4 ms·

It’s questionable as to whether or not judgements under the GDPR can be enforced in the US. There are existing treaties that generally enable this, but those a

It’s questionable as to whether or not judgements under the GDPR can be enforced in the US. There are existing treaties that generally enable this, but those also allow for a large number of exceptions. One of those exceptions is usually where something is illegal in one country and not illegal in the other, but we’ve been told there may be exceptions to that as well. It’s a big mess, but generally it would be up to a US judge in each individual case to decide whether the judgment can be domesticated. However, recital 23 makes it clear that you do not need to comply with GDPR unless ”it is apparent that [you] envisage offering services to data subjects in one or more Member States in the Union”. In other words, it’s not your fault if you are a US-based site and it goes viral in the EU unless it was targeted to them. Don’t translate to EU only languages, mention EU users or customers, or use an EU-based domain extension. You can also announce your intention to not serve EU customers by blocking EU visitors. Even though some EU traffic may get to your site through VPNs etc, merely trying to block them is more than enough to show that you do not “envisage” serving EU customers, which makes you not subject to GDPR. Those EU users that evade your block through technical means are not subject to the protections of the GDPR. Finally, one law firm suggested that we put a checkbox similar to this on our registration forms: ”This website was designed to comply with US privacy laws. By checking this box, you attest that you are NOT subject to any law or regulation that conflicts with or is more restrictive than US privacy laws, including but not limited to the GDPR.”

_o_ 8y ago
Hm, that seems like a good advice, I was thinking about that too, and came to quite tricky problem, hypothetical situation: EU user uses technical measures (or just click the checkbox) to circumvent your blocking and then sues your ads provider which is US based and does operate in EU, due to personal data collection without consent. And they figure out they are having legal/operational costs due to you, as operator, serving them poisoned data. Can they (ads provider) sue you? And if they do, even if you are not guilty, how much money would it cost to win at the court?
- downandout 8y ago
  Talk to any proponent of the GDPR, and they’ll tell you that it’s all about principles and intentions. But that’s a double-edged sword. Sites can’t lure EU users in and ignore GDPR, but at the same time, users cannot lie to you, and then go file a complaint with a regulator or demand rights that they told you they don’t have (either by using a VPN, which means they are lying about their location, or checking the box attesting to something they know to be false). When looking at whether an action can proceed under the GDPR (either against you or an ad network whose code you have on your site), their regulators will review your site and see that the checkbox was required to register. That, combined with not having content or services targeted to EU users, should stop any GDPR action in its tracks before it is filed. This of course all depends on the GDPR being enforced in good faith. They have every incentive to be abusive with it, and no incentive not to be. But we just have to hope that newly self-declared privacy overlords in the EU are kind and benevolent.
  - scruple 8y ago
    > Talk to any proponent of the GDPR, and they’ll tell you that it’s all about principles and intentions. Here's a random and perhaps unfounded thought that I've had a couple of times regarding this line of thought re: GDPR. What to stop some foreign bad actors from abusing the hell out of this legislation and burning up more useful time and energy on it? Moving beyond that, it would very likely serve to further divide and erode the trust between the EU and the US. For example, if we're to assume that Russia is seriously meddling in everything that they currently stand accused of meddling in, essentially engaging in some loose, and seemingly effective (depending on who you ask), forms of cyber warfare, then what is to stop them from turning this regulation in to a complete nightmare for US/EU relations and further driving us away from our common goals? It just seems to me that these sorts of good faith and intentions based laws don't work as effectively in the modern era as they maybe once did. edit/ It honestly doesn't even need to be so malicious. I could imagine trolls causing more than enough trouble for small businesses just for the lulz.
    - downandout 8y ago

_o_ 8y ago

Hm, that seems like a good advice, I was thinking about that too, and came to quite tricky problem, hypothetical situation: EU user uses technical measures (or just click the checkbox) to circumvent your blocking and then sues your ads provider which is US based and does operate in EU, due to personal data collection without consent. And they figure out they are having legal/operational costs due to you, as operator, serving them poisoned data. Can they (ads provider) sue you? And if they do, even if you are not guilty, how much money would it cost to win at the court?

downandout 8y ago
Talk to any proponent of the GDPR, and they’ll tell you that it’s all about principles and intentions. But that’s a double-edged sword. Sites can’t lure EU users in and ignore GDPR, but at the same time, users cannot lie to you, and then go file a complaint with a regulator or demand rights that they told you they don’t have (either by using a VPN, which means they are lying about their location, or checking the box attesting to something they know to be false). When looking at whether an action can proceed under the GDPR (either against you or an ad network whose code you have on your site), their regulators will review your site and see that the checkbox was required to register. That, combined with not having content or services targeted to EU users, should stop any GDPR action in its tracks before it is filed. This of course all depends on the GDPR being enforced in good faith. They have every incentive to be abusive with it, and no incentive not to be. But we just have to hope that newly self-declared privacy overlords in the EU are kind and benevolent.
- scruple 8y ago
  > Talk to any proponent of the GDPR, and they’ll tell you that it’s all about principles and intentions. Here's a random and perhaps unfounded thought that I've had a couple of times regarding this line of thought re: GDPR. What to stop some foreign bad actors from abusing the hell out of this legislation and burning up more useful time and energy on it? Moving beyond that, it would very likely serve to further divide and erode the trust between the EU and the US. For example, if we're to assume that Russia is seriously meddling in everything that they currently stand accused of meddling in, essentially engaging in some loose, and seemingly effective (depending on who you ask), forms of cyber warfare, then what is to stop them from turning this regulation in to a complete nightmare for US/EU relations and further driving us away from our common goals? It just seems to me that these sorts of good faith and intentions based laws don't work as effectively in the modern era as they maybe once did. edit/ It honestly doesn't even need to be so malicious. I could imagine trolls causing more than enough trouble for small businesses just for the lulz.
  - downandout 8y ago