4 ms·

Have we seen any actual enforcement of the "cookie law" on non-EU entities (or even on EU entities?) If you're not physically in the EU and run a service platf

Have we seen any actual enforcement of the "cookie law" on non-EU entities (or even on EU entities?) If you're not physically in the EU and run a service platform, could you just ignore it until you get hit with a notice? I'm really puzzled at how the EU realistically thinks they can enforce these types of restrictions on an international scale.

pmiller2 9y ago
I'm interested to know this from the non-EU perspective, as well as the best way to comply with the GDPR that's feasible for a small business.
DanBC 9y ago
> enforce People keep saying "enforce". That's the wrong word. Enforcement is a last resort. What actually happens is that the regulator writes you a letter asking you to come back into compliance, and points you to latest best practice. At that point you decide what you want to do. If you have a European presence it's easier for them to impose fines. If you don't I guess they can declare you non-compliant which makes it harder for EU businesses to send you data. Here's a case where a large firm was handling sensitive personal details and didn't bother with their legal duty to register with the Information Commissioner. If the fear-mongering about fines is correct they'd get hit with a huge fine. https://www.bloomberg.com/news/articles/2018-04-26/u-k-healthcare-startup-cera-is-said-to-have-posted-fake-reviews https://www.bloomberg.com/news/articles/2018-04-26/u-k-healt... > The U.K.’s Data Protection Act requires all organizations processing personal information to register with the U.K. data regulator. Although handling sensitive data on recent patients and those needing regular health care, Cera also failed to register with the Information Commissioner’s Office until February this year. The ICO said in a statement that it would only consider “enforcement action” if a company failed to register despite ICO advice.
qwerty456127 9y ago
The entire cookie law seems pointless, by the way. It does nothing but annoys people with useless pop-ups. Every website uses cookies (and more) and everybody knows this. Concerned users just install extensions that remove them automatically.

pmiller2 9y ago

I'm interested to know this from the non-EU perspective, as well as the best way to comply with the GDPR that's feasible for a small business.

DanBC 9y ago

> enforce People keep saying "enforce". That's the wrong word. Enforcement is a last resort. What actually happens is that the regulator writes you a letter asking you to come back into compliance, and points you to latest best practice. At that point you decide what you want to do. If you have a European presence it's easier for them to impose fines. If you don't I guess they can declare you non-compliant which makes it harder for EU businesses to send you data. Here's a case where a large firm was handling sensitive personal details and didn't bother with their legal duty to register with the Information Commissioner. If the fear-mongering about fines is correct they'd get hit with a huge fine. https://www.bloomberg.com/news/articles/2018-04-26/u-k-healthcare-startup-cera-is-said-to-have-posted-fake-reviews https://www.bloomberg.com/news/articles/2018-04-26/u-k-healt... > The U.K.’s Data Protection Act requires all organizations processing personal information to register with the U.K. data regulator. Although handling sensitive data on recent patients and those needing regular health care, Cera also failed to register with the Information Commissioner’s Office until February this year. The ICO said in a statement that it would only consider “enforcement action” if a company failed to register despite ICO advice.

qwerty456127 9y ago

The entire cookie law seems pointless, by the way. It does nothing but annoys people with useless pop-ups. Every website uses cookies (and more) and everybody knows this. Concerned users just install extensions that remove them automatically.