3 ms·

Let's say I operate a website where you can sign up with an email address, and I'll send you recipes. The recipes call out specific brands of ingredients. The v

Let's say I operate a website where you can sign up with an email address, and I'll send you recipes. The recipes call out specific brands of ingredients. The vendors who sell those brands pay me for this service. I and my server are in the USA. Additionally: 1. My food vendors operate (a) all only in the EU; or (b) mostly worldwide, but one operates only in the EU; or (c) all worldwide; or (d) all only in the USA, but an independent third party imports many of their products into the EU. 2. My recipes are for (a) only French food; or (b) all kinds of food. 3. My email includes descriptions of the restaurants that originated the recipes. These restaurants are (a) all in France; or (b) about half in France, half in New Orleans; or (c) all in New Orleans. (New Orleans is an American city with strong French influence on its culture, and a francophone minority.) 4. The recipes are distributed in (a) French only; or (b) English and French; or (c) English only. 5. I advertise my site (a) with a run-of-network ad that shows mostly in the USA, but also on a French newspaper; (b) on a small blog whose American operator doesn't track its audience, but that I've heard is popular in France; (c) not at all, relying on word of mouth. So I've set out 4×2×3×3×3 = 216 cases. In which of them am I subject to the GDPR? What factors or combinations of factors are determining? If I asked this question of two lawyers, how closely would you expect their answers to agree? What confidence would they express that their answers would agree with the regulator? I think the people who think GDPR compliance is easy are saying to themselves, "If I behave in accordance with these general principles as I understand them, then the regulator will see me for the good person that I am and I'll be okay". That may be true, but it's not law.

scrollaway 8y ago
You have EU customer emails. You're subject to gdpr in all of them. None of the factors you suggested matter. Store your emails properly, have unsubscribe links, answer data requests. You just gave one of the most straightforward cases...
- tripletao 8y ago
  The post above said: > If you are a solo founder without any business presence in the EU, or clients in the EU, you have nothing to worry about. Blocking EU site visitors is unnecessary, and GDPR covers this in clear language. Do you think this statement is correct or incorrect? If you think it's incorrect, then why are you interpreting the "clear language" of the GDPR differently from its poster? (I personally think the statement is either incorrect or too vague to assess.) If you think the statement is correct--I presume, because you think that as soon as an EU visitor signs up, you have a "client" or "business presence" in the EU--then what meaning does that poster's statement convey? Does it mean anything more than "blocking EU visitors is unnecessary, as long as you have zero EU visitors", a true and entirely meaningless statement? Or are you saying that the email address makes this different from just a visitor? Even if my server is a typical default configuration that logs time and IP for each visit? Even if my ad network logs tracking cookies? Even if a data broker exists somewhere who could map that information to a real name? Even if I buy that data? And, for clarity: What about the case where the website (1) calls out only products with authorized distributors only in the USA, (2) has recipes for all kinds of food, (3) describes restaurants only in the USA, (4) is in English only, and (5) isn't advertised makes it subject to the GDPR? The EU says in an example that: > Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Do you agree with this guidance? If yes, what factor constitutes the specific targeting? Or does the "travel" language mean we exclude only non-EU residents who temporarily visit the EU? Also EU residents who sign up while in the USA, but then return home? But not EU residents who sign up while in the EU? How sure are you that your answer is correct? I get that you're sure that it's morally right, and complying is always the conservative choice; but what probability would you assign that an EU court would reach your same conclusion, that all 216 cases are subject to the GPDR? And since any suggestion that the GDPR is less than perfect attracts angry reactions: I am not asking whether it's a good idea to comply with the general spirit of the GDPR for all visitors worldwide, and I think the answer to that question is yes. I'm asking what the law says. I think the rule of law is important, and I'd venture that most people who have lived in countries with and without it would agree.
  - scrollaway 8y ago
    It is correct and it is clear. If you have customers in the EU, gdpr matters. If you don't, it doesn't. And either way, you should strive to follow it, because GDPR's rules really are a set of common sense things you should have been doing all along: - Store your stuff properly (encrypt sensitive data) - Allow users to download their data - Allow users to delete their data - Have a clear privacy policy - Offer ways to opt out of marketing
    - tripletao 8y ago
      I said explicitly that I'm not trying to debate what's morally right, or good for business (since I agree that good privacy practices are both of those). I'm asking what is the law. > If you have customers in the EU, gdpr matters. If you don't, it doesn't. Either this is false, or you've adopted an unusual definition of the word "customer". The email recipients don't give me money, but even I agree that e.g. if I promote my site with advertisements only on EU sites, and know or should know that most of my recipients are EU residents in the EU, then it's relatively clear that I'm subject to the GDPR. Lawyers care about precision of language, because people's lives are at stake. It's not useful to discuss legal matters without that precision. I guess you're certain enough that all my previous examples are subject to the GDPR that you don't think it's worth discussing why, since you didn't answer any of my questions. How about: I. I run the website that (1) calls out only products with authorized distributors only in the USA, (2) has recipes for all kinds of food, (3) describes restaurants only in the USA, (4) is in English only, and (5) is advertised on American newspaper websites; but I take no specific measures to exclude EU visitors? I think you think I'm subject to the GDPR. II. Same as II., but I block EU IP addresses? III. Same as II., but I ask the remaining people if they're subject to the GDPR, and block them if they say yes? IV. Same as III., but I require a credit card with an American billing address? V. Same as IV., but I require evidence of legal American residence (e.g., a scan of a US passport of visa)? Are you able to answer these questions? Or does it just not bother you that you can't, because compliance with the GDPR serves a purpose you agree with? What do you understand by the phrase "rule of law"? Do you think it's important? Hungary is an EU country. Its prime minister has described George Soros, the founder of the Open Society Foundation, as an "enemy of the state". If you ran an organization publicly associated with the OSF in Hungary, then how would a notice of a GDPR investigation from your government make you feel? Wouldn't you feel better if the rules gave the regulator less room to maneuver?

scrollaway 8y ago

You have EU customer emails. You're subject to gdpr in all of them. None of the factors you suggested matter. Store your emails properly, have unsubscribe links, answer data requests. You just gave one of the most straightforward cases...

tripletao 8y ago
The post above said: > If you are a solo founder without any business presence in the EU, or clients in the EU, you have nothing to worry about. Blocking EU site visitors is unnecessary, and GDPR covers this in clear language. Do you think this statement is correct or incorrect? If you think it's incorrect, then why are you interpreting the "clear language" of the GDPR differently from its poster? (I personally think the statement is either incorrect or too vague to assess.) If you think the statement is correct--I presume, because you think that as soon as an EU visitor signs up, you have a "client" or "business presence" in the EU--then what meaning does that poster's statement convey? Does it mean anything more than "blocking EU visitors is unnecessary, as long as you have zero EU visitors", a true and entirely meaningless statement? Or are you saying that the email address makes this different from just a visitor? Even if my server is a typical default configuration that logs time and IP for each visit? Even if my ad network logs tracking cookies? Even if a data broker exists somewhere who could map that information to a real name? Even if I buy that data? And, for clarity: What about the case where the website (1) calls out only products with authorized distributors only in the USA, (2) has recipes for all kinds of food, (3) describes restaurants only in the USA, (4) is in English only, and (5) isn't advertised makes it subject to the GDPR? The EU says in an example that: > Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Do you agree with this guidance? If yes, what factor constitutes the specific targeting? Or does the "travel" language mean we exclude only non-EU residents who temporarily visit the EU? Also EU residents who sign up while in the USA, but then return home? But not EU residents who sign up while in the EU? How sure are you that your answer is correct? I get that you're sure that it's morally right, and complying is always the conservative choice; but what probability would you assign that an EU court would reach your same conclusion, that all 216 cases are subject to the GPDR? And since any suggestion that the GDPR is less than perfect attracts angry reactions: I am not asking whether it's a good idea to comply with the general spirit of the GDPR for all visitors worldwide, and I think the answer to that question is yes. I'm asking what the law says. I think the rule of law is important, and I'd venture that most people who have lived in countries with and without it would agree.
- scrollaway 8y ago
  It is correct and it is clear. If you have customers in the EU, gdpr matters. If you don't, it doesn't. And either way, you should strive to follow it, because GDPR's rules really are a set of common sense things you should have been doing all along: - Store your stuff properly (encrypt sensitive data) - Allow users to download their data - Allow users to delete their data - Have a clear privacy policy - Offer ways to opt out of marketing
  - tripletao 8y ago
    I said explicitly that I'm not trying to debate what's morally right, or good for business (since I agree that good privacy practices are both of those). I'm asking what is the law. > If you have customers in the EU, gdpr matters. If you don't, it doesn't. Either this is false, or you've adopted an unusual definition of the word "customer". The email recipients don't give me money, but even I agree that e.g. if I promote my site with advertisements only on EU sites, and know or should know that most of my recipients are EU residents in the EU, then it's relatively clear that I'm subject to the GDPR. Lawyers care about precision of language, because people's lives are at stake. It's not useful to discuss legal matters without that precision. I guess you're certain enough that all my previous examples are subject to the GDPR that you don't think it's worth discussing why, since you didn't answer any of my questions. How about: I. I run the website that (1) calls out only products with authorized distributors only in the USA, (2) has recipes for all kinds of food, (3) describes restaurants only in the USA, (4) is in English only, and (5) is advertised on American newspaper websites; but I take no specific measures to exclude EU visitors? I think you think I'm subject to the GDPR. II. Same as II., but I block EU IP addresses? III. Same as II., but I ask the remaining people if they're subject to the GDPR, and block them if they say yes? IV. Same as III., but I require a credit card with an American billing address? V. Same as IV., but I require evidence of legal American residence (e.g., a scan of a US passport of visa)? Are you able to answer these questions? Or does it just not bother you that you can't, because compliance with the GDPR serves a purpose you agree with? What do you understand by the phrase "rule of law"? Do you think it's important? Hungary is an EU country. Its prime minister has described George Soros, the founder of the Open Society Foundation, as an "enemy of the state". If you ran an organization publicly associated with the OSF in Hungary, then how would a notice of a GDPR investigation from your government make you feel? Wouldn't you feel better if the rules gave the regulator less room to maneuver?