5 ms·
The privacy of EU persons coming in from a non-EU IP address still need to be protected under GDPR. This solution is a start but it's not bulletproof. Edit: I
by jloughry 8y ago
The privacy of EU persons coming in from a non-EU IP address still need to be protected under GDPR. This solution is a start but it's not bulletproof.
Edit: I don't want anyone to think I believe it's a good start but it is a kind of solution. I wonder if lots of US companies, once they begin to realize GDPR is a problem for them, won't decide to try one of two things:
1. This: block access from IP addresses believed to belong in Europe.
2. Lobby Congress for a law (or a quick Executive Order) saying that US companies don't have to comply with GDPR.
A few weeks ago on Twitter [1], I speculated about #2. It was too early, I guess. Few people in USA seem to be aware of GDPR at the present time. That'll change in a couple of weeks.
[1] https://twitter.com/CnAdoctor/status/978849723808301057 https://twitter.com/CnAdoctor/status/978849723808301057
- threeseed 8y agoYes. VPNs are definitely an issue. The only foolproof solution is just to block all IP addresses.
- nostrademons 8y agoOr take over Europe.
- deleted 8y ago[deleted]
- niko001 8y agoWhen you make a reasonable effort to block access to EU users, EU citizens aren't covered under GDPR if they happen to access your site from a non-EU country temporarily: "This won't apply to every U.S. business — just the ones that are knowingly, and actively, conducting business in the EU. In this vein, EU courts have the discretionary ability to determine if a U.S. company was purposely collecting EU resident data and subverting GDPR compliance. So, in some cases, the inadvertent collection of personal data will be forgiven if it is found to have been occasional and "unlikely to result in a risk to the rights and freedoms of natural persons." (from https://community.spiceworks.com/topic/2007530-how-the-eu-can-fine-us-companies-for-violating-gdpr https://community.spiceworks.com/topic/2007530-how-the-eu-ca... )
- saf2002 8y agoThat is an interpretation of the law and is not in accord with what the ICO (the regulator) is saying. If you have a site called "UK Expats" and you block EU IPs you will still be liable since your site is offering a service to EU citizens. A less extreme use case but equally applicable, you have a shoe store in the US and your style is liked by french citizens living in the US, since a considerable amount of traffic is coming from EU citizens you are under GDPR. even if it is only 20%, even if they are in the US, even if you blocked all European IPs
- RcouF1uZ4gsC 8y agoThe easy way to deal with EU persons coming from non-EU IP addresses is to mention in your terms of service that EU users are prohibited from using your website. Then if they use a VPN or otherwise access your website, they will be in violation of the CFAA https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- friedButter 8y agoWhy doesnt EU instead implement a continent wide firewall and allow access to only GDPR compliant sites