4 ms·

> If you're an American company and a single European citizen uses your services you are bound by the GDPR's regulations. This is false. I blogged about this t

> If you're an American company and a single European citizen uses your services you are bound by the GDPR's regulations. This is false. I blogged about this topic a while ago: https://www.joyfulbikeshedding.com/blog/2018-04-17-should-non-eu-websites-ban-eu-visitors-under-the-gdpr.html https://www.joyfulbikeshedding.com/blog/2018-04-17-should-no... The criterium for whether a non-EU company needs to comply to GDPR is: does the company intent to seriously service EU citizen? This is determined based on multiple factors, such as the website's language (do they have e.g. German translations?), providing pricing in euros, testimonials from EU customers, or having a contract with a parcel company with the specific intention of delivering to EU customers. The mere fact that the website can be used by an EU citizen is not enough to have it fall under the GDPR. Source: the book "Handbook GDPR, Compliance in practice" (page 11) by Arnoud Engelfriet & co, a Dutch IT lawyer. https://ictrecht.nl/boeken/handboek-avg-compliance-in-de-praktijk/ https://ictrecht.nl/boeken/handboek-avg-compliance-in-de-pra...

fwdpropaganda 8y ago
> The criterium for whether a non-EU company needs to comply to GDPR is: does the company intent to seriously service EU citizen? This is determined based on multiple factors, such as the website's language (do they have e.g. German translations?), providing pricing in euros, testimonials from EU customers, or having a contract with a parcel company with the specific intention of delivering to EU customers. The mere fact that the website can be used by an EU citizen is not enough to have it fall under the GDPR. Hey, thanks a lot for this. It seems these days the noise is larger than the signal. Hard to find anyone putting careful thought into this. Thank you.
- cdjk 8y ago
  The blog post references a secondary source in Dutch. I’d be careful before relying on that for legal advice.
  - FooBarWidget 8y ago
    Said secondary source however is written by a lawyer. A lawyer specialized in IT even.
    - cdjk 8y ago
      I would be careful relying on legal advice from a lawyer who is not your lawyer.
      - FooBarWidget 8y ago
        That is not under dispute. Of course you should be careful with legal advice that isn't tailored for your specific situation. My comment does not contradict that notion. The content of the book also does not contradict that notion. The book explains the general situation and gives generic advice. But even generic advice is useful to a degree. It does not replace seeking specific advice from a lawyer, but it does complement it. Specific and generic advice are not mutually exclusive.
wtfstatists 8y ago
There is nothing you have said that a business who can potentially be fined to death, rely upon. The fact that every response to the criticism of GDPR being too ambiguous, is ambiguous, only proves critics right. EU lawmakers picked worst combination: huge fine + huge ambiguity. This all could have been done with more certainity. So sad.
- raverbashing 8y ago
  Ambiguity is the way to deal with a changing landscape and changing technologies. And I agree it sucks, but it sucks less than the alternative (which is to be rigid and say something that becomes meaningless one year after the law is published)
fyfy18 8y ago
So if as an EU citizen, I sign up for a SaaS product priced in USD, say GitHub, they can do what they like with my data?
- FooBarWidget 8y ago
  It's not as easy as that. As I stated, the criterium for GDPR compliance for non-EU businesses is "does said business intent to seriously do business with EU citizen?". Pricing in EUR is merely one of the multiple possible factors that a judge would use to determine whether this is the case. I'm not a lawyer so I'm not in a good position to evaluate Github. But I do know that Github has an office in Amsterdam, The Netherlands, so there is at least the possibility that they have to be GDPR compliant. But let's say you're buying from a random small business web shop in the US, and everything about that web shop clearly screams that their main business intention is work with US customers, it's just that their delivery service happens to ship world wide even though they clearly don't care about non-US customers. Then yes in theory they can "what they like with my data". In practice they probably have to define what "what they like" means in a contract, like a privacy policy, so it's not as if you can't know about what they will do. You are still able to make an informed decision of whether you want to do business with them.
cdjk 8y ago
Can you provide a reference in the text of GDPR itself or an official government source such as the UK ICO that supports that criterion for determining if a company needs to comply with GDPR? Your description does not match with what I have seen about GDPR applying to European data subjects which is the language the regulation uses.
- FooBarWidget 8y ago
  I am not a lawyer myself, it is not very useful to ask me to reference a text in the GDPR. It is far more useful to consult a lawyer. The information I posted is from a lawyer's book, translated almost literally from Dutch to English.

fwdpropaganda 8y ago

> The criterium for whether a non-EU company needs to comply to GDPR is: does the company intent to seriously service EU citizen? This is determined based on multiple factors, such as the website's language (do they have e.g. German translations?), providing pricing in euros, testimonials from EU customers, or having a contract with a parcel company with the specific intention of delivering to EU customers. The mere fact that the website can be used by an EU citizen is not enough to have it fall under the GDPR. Hey, thanks a lot for this. It seems these days the noise is larger than the signal. Hard to find anyone putting careful thought into this. Thank you.

cdjk 8y ago
The blog post references a secondary source in Dutch. I’d be careful before relying on that for legal advice.
- FooBarWidget 8y ago
  Said secondary source however is written by a lawyer. A lawyer specialized in IT even.
  - cdjk 8y ago
    I would be careful relying on legal advice from a lawyer who is not your lawyer.
    - FooBarWidget 8y ago
      That is not under dispute. Of course you should be careful with legal advice that isn't tailored for your specific situation. My comment does not contradict that notion. The content of the book also does not contradict that notion. The book explains the general situation and gives generic advice. But even generic advice is useful to a degree. It does not replace seeking specific advice from a lawyer, but it does complement it. Specific and generic advice are not mutually exclusive.

wtfstatists 8y ago

There is nothing you have said that a business who can potentially be fined to death, rely upon. The fact that every response to the criticism of GDPR being too ambiguous, is ambiguous, only proves critics right. EU lawmakers picked worst combination: huge fine + huge ambiguity. This all could have been done with more certainity. So sad.

raverbashing 8y ago
Ambiguity is the way to deal with a changing landscape and changing technologies. And I agree it sucks, but it sucks less than the alternative (which is to be rigid and say something that becomes meaningless one year after the law is published)

fyfy18 8y ago

So if as an EU citizen, I sign up for a SaaS product priced in USD, say GitHub, they can do what they like with my data?

FooBarWidget 8y ago
It's not as easy as that. As I stated, the criterium for GDPR compliance for non-EU businesses is "does said business intent to seriously do business with EU citizen?". Pricing in EUR is merely one of the multiple possible factors that a judge would use to determine whether this is the case. I'm not a lawyer so I'm not in a good position to evaluate Github. But I do know that Github has an office in Amsterdam, The Netherlands, so there is at least the possibility that they have to be GDPR compliant. But let's say you're buying from a random small business web shop in the US, and everything about that web shop clearly screams that their main business intention is work with US customers, it's just that their delivery service happens to ship world wide even though they clearly don't care about non-US customers. Then yes in theory they can "what they like with my data". In practice they probably have to define what "what they like" means in a contract, like a privacy policy, so it's not as if you can't know about what they will do. You are still able to make an informed decision of whether you want to do business with them.

cdjk 8y ago

Can you provide a reference in the text of GDPR itself or an official government source such as the UK ICO that supports that criterion for determining if a company needs to comply with GDPR? Your description does not match with what I have seen about GDPR applying to European data subjects which is the language the regulation uses.

FooBarWidget 8y ago
I am not a lawyer myself, it is not very useful to ask me to reference a text in the GDPR. It is far more useful to consult a lawyer. The information I posted is from a lawyer's book, translated almost literally from Dutch to English.