5 ms·

What if EU citizens who are visiting US make purchases from your site?

ghaff 8y ago
Almost certainly does not apply. [1] For that matter, the same FAQ suggests that it's probably not necessary to block IP addresses if you're not located in the EU and aren't actively marketing to EU residents. But I can certainly understand small companies taking a better safe than sorry approach if they don't do material EU business. [1] https://www.gdpreu.org/the-regulation/who-must-comply/ https://www.gdpreu.org/the-regulation/who-must-comply/
- merinowool 8y ago
  It wouldn't apply if you explicitly ask user if he/she is an EU resident, preferably by checking ID and route to /dev/null if user is.
merinowool 8y ago
It does apply. All EU residents are covered regardless where they are.
- snowwolf 8y ago
  The misunderstanding of this is widespread. GDPR does not make any mention of EU citizens OR residents. It only says "data subjects who are IN the Union". See my other comment for more detail: https://news.ycombinator.com/item?id=17143923 https://news.ycombinator.com/item?id=17143923
  - merinowool 8y ago
    It is not defined what "who are in the Union" means. The safest bet is that it means a subject is European Union resident. If they mean that person should be physically present in the European Union, the law would have stated that, but it is not.
    - snowwolf 8y ago
      Equally, if they had meant resident, they would have stated that.
      - merinowool 8y ago
        "Resident" has a full scope of protection, whereas your interpretation has limited cover. I wouldn't have thought that GDPR would protect me only if I was physically in the EU territory - as if somehow once I stepped out of the EU my personal information is no longer worth protecting. Your interpretation makes no sense.
        snowwolf 8y ago
        I think you are missing some context here. Firstly if the company is established in the union then they need to be compliant for all their users no matter where they are [1] (so US resident, EU resident, whatever are equally protected). So the relevant section for this is: "This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union." So lets look at Amazon. They are a US company offering goods in the EU. So if you make a purchase from them as an EU resident (living in Germany) from amazon.de to your home address, then any personal data you give them as part of that purchase needs to be handled in a GDPR compliant way. If you now go on holiday to the US and order something from Amazon.com to be delivered to your hotel, even though you are an EU resident, they do not need to handle that personal data in a GDPR compliant way. But just because you are now in the US doesn't mean the data they hold on you about your purchase on amazon.de is suddenly free from GDPR protections. Or to put it another way. Imagine the law did mean EU resident. What does Amazon.com do? How do they ensure they process an order in the US to a US address in a GDPR compliant way for an EU resident? They can't without asking for additional data to establish each persons residency. Which GDPR doesn't allow. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
downandout 8y ago
Recital 23 states that sites based outside the EU are not subject to GDPR unless it is apparent that they “envisage” the offering of their goods or services to EU residents. The test for this is translation to EU-only languages, mentioning of EU users, targeting EU users, using an EU based domain extension, etc. The easiest way to announce to the world that I do not “envisage” servicing EU customers is to block EU customers. If one happens to use a VPN or otherwise evades this block, it doesn’t matter. I’ve met the clear definitions under Recital 23 and you have no legal right to GDPR protections on my site.

Almost certainly does not apply. [1] For that matter, the same FAQ suggests that it's probably not necessary to block IP addresses if you're not located in the EU and aren't actively marketing to EU residents. But I can certainly understand small companies taking a better safe than sorry approach if they don't do material EU business. [1] https://www.gdpreu.org/the-regulation/who-must-comply/ https://www.gdpreu.org/the-regulation/who-must-comply/

merinowool 8y ago
It wouldn't apply if you explicitly ask user if he/she is an EU resident, preferably by checking ID and route to /dev/null if user is.

merinowool 8y ago

It does apply. All EU residents are covered regardless where they are.

snowwolf 8y ago
The misunderstanding of this is widespread. GDPR does not make any mention of EU citizens OR residents. It only says "data subjects who are IN the Union". See my other comment for more detail: https://news.ycombinator.com/item?id=17143923 https://news.ycombinator.com/item?id=17143923
- merinowool 8y ago
  It is not defined what "who are in the Union" means. The safest bet is that it means a subject is European Union resident. If they mean that person should be physically present in the European Union, the law would have stated that, but it is not.
  - snowwolf 8y ago
    Equally, if they had meant resident, they would have stated that.
    - merinowool 8y ago
      "Resident" has a full scope of protection, whereas your interpretation has limited cover. I wouldn't have thought that GDPR would protect me only if I was physically in the EU territory - as if somehow once I stepped out of the EU my personal information is no longer worth protecting. Your interpretation makes no sense.
      - snowwolf 8y ago
        I think you are missing some context here. Firstly if the company is established in the union then they need to be compliant for all their users no matter where they are [1] (so US resident, EU resident, whatever are equally protected). So the relevant section for this is: "This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union." So lets look at Amazon. They are a US company offering goods in the EU. So if you make a purchase from them as an EU resident (living in Germany) from amazon.de to your home address, then any personal data you give them as part of that purchase needs to be handled in a GDPR compliant way. If you now go on holiday to the US and order something from Amazon.com to be delivered to your hotel, even though you are an EU resident, they do not need to handle that personal data in a GDPR compliant way. But just because you are now in the US doesn't mean the data they hold on you about your purchase on amazon.de is suddenly free from GDPR protections. Or to put it another way. Imagine the law did mean EU resident. What does Amazon.com do? How do they ensure they process an order in the US to a US address in a GDPR compliant way for an EU resident? They can't without asking for additional data to establish each persons residency. Which GDPR doesn't allow. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/

downandout 8y ago

Recital 23 states that sites based outside the EU are not subject to GDPR unless it is apparent that they “envisage” the offering of their goods or services to EU residents. The test for this is translation to EU-only languages, mentioning of EU users, targeting EU users, using an EU based domain extension, etc. The easiest way to announce to the world that I do not “envisage” servicing EU customers is to block EU customers. If one happens to use a VPN or otherwise evades this block, it doesn’t matter. I’ve met the clear definitions under Recital 23 and you have no legal right to GDPR protections on my site.