13 ms·

Asked a lawyer: If Instapaper doesn't delete the data from its EU users tomorrow, all the rules of the GDPR might still fall on their head. Most likely, they ar

Asked a lawyer: If Instapaper doesn't delete the data from its EU users tomorrow, all the rules of the GDPR might still fall on their head. Most likely, they are then storing EU user data without given consent and have to follow all the requests about data storage, use, deletion and so on. Denying service without data deletion is not an option.

dejv 8y ago
Also: how they are going to decide who is EU user. GDPR apply to all EU citizens living abroad.
- bthdonohue 8y ago
  The ban that goes into effect tomorrow will be IP-based for IPs in EU countries.
  - deleted 8y ago
    [deleted]
- BlackFly 8y ago
  GDPR applies to data processors in the EU or for data subjects in the EU. Citizenship is irrelevant.
  - dejv 8y ago
    It might be not. But those falls into weird space and we will see how things are going to be played out in practice. I still think they have to conform GDPR, especially having prior data on EU users and involvement of parent company.
    - jkaplowitz 8y ago
      There are many unclear things in the GDPR, but the relevance of citizenship is not among them: Nothing in the text of the GDPR or any official guidance mentions citizenship or nationality. The only sources which do mention those are informal and imprecise third-party summaries. But yes, this mistake has been spread widely. The more precise compliance guides from, say, European law firms don't mention citizenship or nationality either.
BlackFly 8y ago
Indeed, it is not service to EU users which is governed by GDPR, it is data processing of data subjects in the EU. Obviously the data processing as defined by the GDPR doesn't stop simply because the service stops since storage is considered processing. Seems to me Instapaper painted a big target on their chest: "We're not compliant, and we're going to give EU users the middle finger in the meanwhile." Whereas, their size and business model may have staved off the data protection authorities attention, now a bunch of angry users may well be issuing complaints.
- fiter 8y ago
  So if someone traveling in the EU gets GDPR protections, does someone traveling in the US lose GDPR protections? Are the GDPR protections only for the data that was collected while someone was in the EU or for all data once they've traveled to the EU once?
  - guitarbill 8y ago
    > So if someone traveling in the EU gets GDPR protections, does someone traveling in the US lose GDPR protections? Are the GDPR protections only for the data that was collected while someone was in the EU [...]? Roughly speaking, yes. E.g. a Brazilian business not specifically targeting transactions within the EU or EU nationals doesn't come under the GDPR. Conversely, an EU business basically has to apply the GDPR to any data collected inside the Union, regardless of the individual's nationality. (Obviously, this gets messier online, but if the currency was e.g. Euros and the company is in Belgium, probably covered.) Having said that, you might have trouble as a non-EU resident to get the data protection agencies to care for trivial, individual cases. (My opinion as a European, not a fact.)
  - BlackFly 8y ago
    It seems that once you are in the EU, the GDPR applies to you. So you could move to Europe for a year and demand that Facebook provide you with all the benefits of the GDPR. Residency is probably a practical requirement but is not a written legal requirement since you will need to complain to the data authorities, and if you leave after complaining they will likely not follow up on your complaint. Travel is probably one of the hairier issues. For companies which are big enough and do have an EU legal presence, they might get pushed to comply. Obviously, while someone is in the EU, EU laws regarding the treatment of that person apply. If you (as a data controller) are in the EU, of course you should comply, even if the basis of your legal relationship was formed outside of the EU.
wastedhours 8y ago
They probably won't be using consent as their legal basis for most of their work, but all of the rest of it will still be on their heads by the sounds of it.
deleted 8y ago
[deleted]
LoSboccacc 8y ago
do you have to have an account to receive service on instapaper? personal data can be used without the consent if falls under article 6 comma b) or c) as long as the user signed up willingly and the personal data is necessary to erogate the service itself - say you need to store the user email to confirm his identity to avoid fraud associated with using multiple anonymous accounts to work around trial limitations.
bsder 8y ago
It would be MUCH easier to legally argue against the retroactiveness of the GDPR while coming into compliance than to risk being active during the actual deadline while coming into compliance. I strongly suspect that the GDPR applying retroactively will get litigated and will have a very difficult time legally.
- guitarbill 8y ago
  If only it hasn't come into law two years ago, then this argument might have a change.

dejv 8y ago

Also: how they are going to decide who is EU user. GDPR apply to all EU citizens living abroad.

bthdonohue 8y ago
The ban that goes into effect tomorrow will be IP-based for IPs in EU countries.
- deleted 8y ago
  [deleted]
BlackFly 8y ago
GDPR applies to data processors in the EU or for data subjects in the EU. Citizenship is irrelevant.
- dejv 8y ago
  It might be not. But those falls into weird space and we will see how things are going to be played out in practice. I still think they have to conform GDPR, especially having prior data on EU users and involvement of parent company.
  - jkaplowitz 8y ago
    There are many unclear things in the GDPR, but the relevance of citizenship is not among them: Nothing in the text of the GDPR or any official guidance mentions citizenship or nationality. The only sources which do mention those are informal and imprecise third-party summaries. But yes, this mistake has been spread widely. The more precise compliance guides from, say, European law firms don't mention citizenship or nationality either.

BlackFly 8y ago

Indeed, it is not service to EU users which is governed by GDPR, it is data processing of data subjects in the EU. Obviously the data processing as defined by the GDPR doesn't stop simply because the service stops since storage is considered processing. Seems to me Instapaper painted a big target on their chest: "We're not compliant, and we're going to give EU users the middle finger in the meanwhile." Whereas, their size and business model may have staved off the data protection authorities attention, now a bunch of angry users may well be issuing complaints.

fiter 8y ago
So if someone traveling in the EU gets GDPR protections, does someone traveling in the US lose GDPR protections? Are the GDPR protections only for the data that was collected while someone was in the EU or for all data once they've traveled to the EU once?
- guitarbill 8y ago
  > So if someone traveling in the EU gets GDPR protections, does someone traveling in the US lose GDPR protections? Are the GDPR protections only for the data that was collected while someone was in the EU [...]? Roughly speaking, yes. E.g. a Brazilian business not specifically targeting transactions within the EU or EU nationals doesn't come under the GDPR. Conversely, an EU business basically has to apply the GDPR to any data collected inside the Union, regardless of the individual's nationality. (Obviously, this gets messier online, but if the currency was e.g. Euros and the company is in Belgium, probably covered.) Having said that, you might have trouble as a non-EU resident to get the data protection agencies to care for trivial, individual cases. (My opinion as a European, not a fact.)
- BlackFly 8y ago
  It seems that once you are in the EU, the GDPR applies to you. So you could move to Europe for a year and demand that Facebook provide you with all the benefits of the GDPR. Residency is probably a practical requirement but is not a written legal requirement since you will need to complain to the data authorities, and if you leave after complaining they will likely not follow up on your complaint. Travel is probably one of the hairier issues. For companies which are big enough and do have an EU legal presence, they might get pushed to comply. Obviously, while someone is in the EU, EU laws regarding the treatment of that person apply. If you (as a data controller) are in the EU, of course you should comply, even if the basis of your legal relationship was formed outside of the EU.

wastedhours 8y ago

They probably won't be using consent as their legal basis for most of their work, but all of the rest of it will still be on their heads by the sounds of it.

deleted 8y ago

[deleted]

LoSboccacc 8y ago

do you have to have an account to receive service on instapaper? personal data can be used without the consent if falls under article 6 comma b) or c) as long as the user signed up willingly and the personal data is necessary to erogate the service itself - say you need to store the user email to confirm his identity to avoid fraud associated with using multiple anonymous accounts to work around trial limitations.

bsder 8y ago

It would be MUCH easier to legally argue against the retroactiveness of the GDPR while coming into compliance than to risk being active during the actual deadline while coming into compliance. I strongly suspect that the GDPR applying retroactively will get litigated and will have a very difficult time legally.

guitarbill 8y ago
If only it hasn't come into law two years ago, then this argument might have a change.