4 ms·

The idea that simply having an EU visitor load your site can subject you to a $2M fine is a recurring bit of FUD. Directly from the EU: > Provided your compan

The idea that simply having an EU visitor load your site can subject you to a $2M fine is a recurring bit of FUD. Directly from the EU: > Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR. (https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/enforcement-and-sanctions/sanctions/what-if-my-company-organisation-fails-comply-data-protection-rules_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...)

lucio 8y ago
If there's a complaint, Do you have to provide proof that your site doesn't specifically target its services at individuals in the EU?
niko001 8y ago
How a company "specifically targets its services at individuals in the EU" is not clearly defined within GDPR. Even if you just set your AdWords targeting to 'global', it might be enough to trigger this. GDPR Shield is a clear signal that you're not targeting EU users.
- rhabarba 8y ago
  > How a company "specifically targets its services at individuals in the EU" is not clearly defined within GDPR. Does that mean that (e.g.) German bloggers are not bound to the GDPR when they just add "made for the Swiss" to their header?
  - tscs37 8y ago
    Well, if you're in the EU you have to obviously implement the regulation either way.
  - DanBC 8y ago
    What personal data are German bloggers gathering?
    - rhabarba 8y ago
      IP addresses, e-mail addresses from those who comment...
      - DanBC 8y ago
        IP addresses alone are not personal data. They're only personal data if they can be used to identify a natural person. If someone is gathering and storing email addresses and ip addresses it seems reasonable to ask them to take industry standard measures to protect that data, and to let users know that the data is being collected.
        rhabarba 8y ago
        > IP addresses alone are not personal data. According to the GDPR, they are. https://eugdprcompliant.com/personal-data/ https://eugdprcompliant.com/personal-data/ "The conclusion is that the GDPR does consider it as such."
- Angostura 8y ago
  However specifically putting measures in place to block EU users should be sufficient to show that you are not specifically targeting them.
rayshan 8y ago
This is what you're trying to reference: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
- drtillberg 8y ago
  That explanation is the first one I've seen that makes GDPR sound reasonable. The main problem overall is that the EU appears to consider information about someone as being owned by that person. That is quite foreign from a US individual perspective and having some blogs. I don't see how the learning I have acquired about people places and things, which I acquired without any promise of confidentiality, can be owned by anyone but me. Are libraries and newspapers required to scrub their shelves and archives? And if not, what is the limiting principle?
  - jkaplowitz 8y ago
    There are other interests that get balanced against the individual's right to privacy, including public interests like newsworthiness. But indeed that can go both ways - the website of a newspaper might be required upon request to remove a 20-year-old crime blotter item reporting a single petty theft conviction for an otherwise law-abiding non-celebrity; they wouldn't be required to do that for a 2-year-old murder conviction.
mandelbulb 8y ago
Overall I'm content with the GDPR as it is a long needed corrective action for the path we've been treading in the West as a whole. One requirement, imho, is quite ridiculous, however. That is the need for entities which need to abide by the GDPR but do not have a presence in the EU to assign a representative in the EU. This part definitely needs some relaxation. Just complying with the regulation ought to be enough as the first step, especially for start-ups.
- tchock23 8y ago
  Yes! That was the part of the regulation to me that felt like a shake down. I get the need to be more careful with user data. Make me hire a rep in the EU? Now you're just trying to drum up fees for your lawyers...
- dingaling 8y ago
  > Just complying with the regulation ought to be enough as the first step, especially for start-ups. It is enough; most start-ups won't need a representative. That requirement only applies to large-scale processing of special categories ( i.e. sensitive ) of data or that relating to criminal convictions and offences. Article 27 applies: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e3106-1-1 http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE... It's basically to prevent big data processors from claiming 'we don't have an EU presence so you can't fine us'.

lucio 8y ago

If there's a complaint, Do you have to provide proof that your site doesn't specifically target its services at individuals in the EU?

niko001 8y ago

How a company "specifically targets its services at individuals in the EU" is not clearly defined within GDPR. Even if you just set your AdWords targeting to 'global', it might be enough to trigger this. GDPR Shield is a clear signal that you're not targeting EU users.

rhabarba 8y ago
> How a company "specifically targets its services at individuals in the EU" is not clearly defined within GDPR. Does that mean that (e.g.) German bloggers are not bound to the GDPR when they just add "made for the Swiss" to their header?
- tscs37 8y ago
  Well, if you're in the EU you have to obviously implement the regulation either way.
- DanBC 8y ago
  What personal data are German bloggers gathering?
  - rhabarba 8y ago
    IP addresses, e-mail addresses from those who comment...
    - DanBC 8y ago
      IP addresses alone are not personal data. They're only personal data if they can be used to identify a natural person. If someone is gathering and storing email addresses and ip addresses it seems reasonable to ask them to take industry standard measures to protect that data, and to let users know that the data is being collected.
      - rhabarba 8y ago
        > IP addresses alone are not personal data. According to the GDPR, they are. https://eugdprcompliant.com/personal-data/ https://eugdprcompliant.com/personal-data/ "The conclusion is that the GDPR does consider it as such."
Angostura 8y ago
However specifically putting measures in place to block EU users should be sufficient to show that you are not specifically targeting them.

rayshan 8y ago

This is what you're trying to reference: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...

drtillberg 8y ago
That explanation is the first one I've seen that makes GDPR sound reasonable. The main problem overall is that the EU appears to consider information about someone as being owned by that person. That is quite foreign from a US individual perspective and having some blogs. I don't see how the learning I have acquired about people places and things, which I acquired without any promise of confidentiality, can be owned by anyone but me. Are libraries and newspapers required to scrub their shelves and archives? And if not, what is the limiting principle?
- jkaplowitz 8y ago
  There are other interests that get balanced against the individual's right to privacy, including public interests like newsworthiness. But indeed that can go both ways - the website of a newspaper might be required upon request to remove a 20-year-old crime blotter item reporting a single petty theft conviction for an otherwise law-abiding non-celebrity; they wouldn't be required to do that for a 2-year-old murder conviction.

mandelbulb 8y ago

Overall I'm content with the GDPR as it is a long needed corrective action for the path we've been treading in the West as a whole. One requirement, imho, is quite ridiculous, however. That is the need for entities which need to abide by the GDPR but do not have a presence in the EU to assign a representative in the EU. This part definitely needs some relaxation. Just complying with the regulation ought to be enough as the first step, especially for start-ups.

tchock23 8y ago
Yes! That was the part of the regulation to me that felt like a shake down. I get the need to be more careful with user data. Make me hire a rep in the EU? Now you're just trying to drum up fees for your lawyers...
dingaling 8y ago
> Just complying with the regulation ought to be enough as the first step, especially for start-ups. It is enough; most start-ups won't need a representative. That requirement only applies to large-scale processing of special categories ( i.e. sensitive ) of data or that relating to criminal convictions and offences. Article 27 applies: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e3106-1-1 http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE... It's basically to prevent big data processors from claiming 'we don't have an EU presence so you can't fine us'.