7 ms·

How does CloudFlare know if someone is a citizen of the EU and traveling abroad? In haproxy, I redirect a few accept-language headers, but even this has its fa

How does CloudFlare know if someone is a citizen of the EU and traveling abroad? In haproxy, I redirect a few accept-language headers, but even this has its faults.

sp332 8y ago
You're the third person to ask this and I'd like to ask you: is this idea coming from a specific source? The law, like any other EU law, obviously does not apply outside the EU. It applies to companies that do business in the EU (even if they are based outside), but it can't apply to companies that don't do business there. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
- LyndsySimon 8y ago
  It actually isn't clear that it doesn't, as best I can tell. I don't have the text in question in front of me, but one of the questions I've asked and haven't gotten a solid answer on is - who is covered by GDPR? Is it only EU citizens residing in the EU, or EU citizens generally? If it's the latter, then someone with both US and German citizenship could be covered even if they've never been to the EU.
  - Kalium 8y ago
    GDPR is written in terms of rights people in the EU have against companies operating in the EU. Which is to say your hypothetical dual citizen would have zero rights under GDPR in their dealings with purely US entities.
  - outside1234 8y ago
    This is a very dangerous interpretation. Let me tell you why: this opens the door for someone, let's say China, to say that their laws apply to Chinese nationals outside of China. You know, censorship and the rest. While GDPR is a good idea, its legal impact can only be for business conducted within EU boundaries, or we are going to open up a Pandora's Box like this.
    - olivierduval 8y ago
      You mean: like giving fines to ANY company doing business with Iran just because some US President decided to cancel its own part of an international treaty...? ;-) Come on: you're whining but you're doing that kind of extra-territorial stuff for decades!!!
  - eckesicle 8y ago
    Anyone who is in the EU (citizens and not) at the time of using the service. EU citizens living abroad are not covered (unless they are visiting Europe, of course). Geoblocking is not enough. A user in Europe that bypasses an EU block with a VPN is still covered (this has been explicitly stated). https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ Art 3 (2b)
  - azernik 8y ago
    "data subjects in one or more Member States in the Union." People (regardless of EU citizenship status) who are physically in the EU. This isn't so hard.
- nrdgrl 8y ago
  GDPR applies to all EU citizens. It doesn't matter if the citizen is accessing the web site from the eu or another country. Blocking people in the EU doesn't block all eu citizens from accessing your product/service.
  - itake 8y ago
    Do you have a source? It is my understanding that the world operates on the idea that the laws of where you are located only apply to you. An expat living in the EU is protected because they reside in the EU. If you are living in the USA, you must follow American laws.
  - outside1234 8y ago
    People keep saying this but its not true. The EU has no jurisdiction outside of the EU. If both the user and site are outside of the EU at the time of the transaction, they can not make claims, regardless of citizenship.
    - JBReefer 8y ago
      No, it is true, If you don't the EU Army will come and get you. /s It's a basic idea, and HN prides itself on being smart, but there aren't global laws. No one gets to enforce civil penalties outside of their jurisdictions, without exceptional circumstances. If they fine you and you don't have offices there just ... don't pay? The EU might not exist in 10 years anyway.
    - exegete 8y ago
      The EU has jurisdiction over EU citizens, even those outside of the EU (see US citizens and taxes). But I question how the EU would have jurisdiction on anyone who is outside of the EU and does all their business outside of the EU, even with EU citizens. The EU can prohibit EU citizens from visiting websites that violate the law if they want. They can also block EU residents from visiting those sites.
      - outside1234 8y ago
- chatmasta 8y ago
  You’re going to get downvoted for that comment, but you do raise a legitimate question of enforceability. Sure the EU can say any company in the world who has EU residents’ data should comply with GDPR. But... or what exactly? The EU doesn’t have the power to fine companies outside of their jurisdiction. I mean, they can try. But as far as I know there is no enforceability to ensure that the company actually pays the fine. For larger companies with offices in the EU (especially the ones headquartered there for tax purposes), they obviously have no choice to comply. But what about a small startup, with its only domicile and employees in the US? What exactly could the EU do to punish a startup in that case? Unless they have some enforceability treaty with the US, I don’t see how they have any legal ground to extract fines for arbitrary laws defined in their jurisdiction. The worst they could do is ask EU ISPs and/or payment networks to block the offending sites, right?
  - sp332 8y ago
    It applies to companies that do business in the EU. They could at least seize any assets that you have in the EU, including future profits there. If you don't do any business in the EU to disrupt then this doesn't apply to you anyway.
  - tatersolid 8y ago
    Corporate counsel, who actually went to many of the lead-up conferences for GDPR, said the data authorities from many member countries didn’t even hesitate before saying they would file civil lawsuits against non-EU companies. Such a suit could be ignored too, but it would certainly be a PITA for vacationing executives who get locked up in Italy for an outstanding summary judgement.
    - tathougies 8y ago
      > but it would certainly be a PITA for vacationing executives who get locked up in Italy for an outstanding summary judgement. It's a good thing there are a lot of beautiful parts of the world other than Italy.
  - celticninja 8y ago
- cesarb 8y ago
  > The law, like any other EU law, obviously does not apply outside the EU. There are precedents for the opposite. If you have a grandparent born in some EU countries, you have EU citizenship according to the law of that EU country, even if you never set foot on that country and have no contact at all with the EU. There is a (non-EU) country which says that if you're a citizen of that country, you have to pay income taxes to it, even if you never set foot on that country and have no contact at all with it. At least one country says that its law applies to buyers of widgets manufactured in that country, even if they are sold by someone who never set foot on that country and has no contact at all with it, to someone who likewise has no contact with it. And so on.
unstatusthequo 8y ago
You aren't a data subject if you're outside the EU. If you're in the US, data will be happily collected on you irrespective of GDPR.
unstatusthequo 8y ago
Also, GDPR applies to more than just citizens of the EU. The language doesn't even say citizens. Data subject could be someone in the EU on vacation for two week. Even me a heathen US citizen! O_o
- outside1234 8y ago
  And that makes sense. This is about business conducted in the EU while someone is in the EU. The EU does not have jurisdiction outside of the EU.

How does CloudFlare know if someone is a citizen of the EU and traveling abroad? In haproxy, I redirect a few accept-language headers, but even this has its faults.

sp332 8y ago

You're the third person to ask this and I'd like to ask you: is this idea coming from a specific source? The law, like any other EU law, obviously does not apply outside the EU. It applies to companies that do business in the EU (even if they are based outside), but it can't apply to companies that don't do business there. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...

LyndsySimon 8y ago
It actually isn't clear that it doesn't, as best I can tell. I don't have the text in question in front of me, but one of the questions I've asked and haven't gotten a solid answer on is - who is covered by GDPR? Is it only EU citizens residing in the EU, or EU citizens generally? If it's the latter, then someone with both US and German citizenship could be covered even if they've never been to the EU.
- Kalium 8y ago
  GDPR is written in terms of rights people in the EU have against companies operating in the EU. Which is to say your hypothetical dual citizen would have zero rights under GDPR in their dealings with purely US entities.
- outside1234 8y ago
  This is a very dangerous interpretation. Let me tell you why: this opens the door for someone, let's say China, to say that their laws apply to Chinese nationals outside of China. You know, censorship and the rest. While GDPR is a good idea, its legal impact can only be for business conducted within EU boundaries, or we are going to open up a Pandora's Box like this.
  - olivierduval 8y ago
    You mean: like giving fines to ANY company doing business with Iran just because some US President decided to cancel its own part of an international treaty...? ;-) Come on: you're whining but you're doing that kind of extra-territorial stuff for decades!!!
- eckesicle 8y ago
  Anyone who is in the EU (citizens and not) at the time of using the service. EU citizens living abroad are not covered (unless they are visiting Europe, of course). Geoblocking is not enough. A user in Europe that bypasses an EU block with a VPN is still covered (this has been explicitly stated). https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ Art 3 (2b)
- azernik 8y ago
  "data subjects in one or more Member States in the Union." People (regardless of EU citizenship status) who are physically in the EU. This isn't so hard.
nrdgrl 8y ago
GDPR applies to all EU citizens. It doesn't matter if the citizen is accessing the web site from the eu or another country. Blocking people in the EU doesn't block all eu citizens from accessing your product/service.
- itake 8y ago
  Do you have a source? It is my understanding that the world operates on the idea that the laws of where you are located only apply to you. An expat living in the EU is protected because they reside in the EU. If you are living in the USA, you must follow American laws.
- outside1234 8y ago
  People keep saying this but its not true. The EU has no jurisdiction outside of the EU. If both the user and site are outside of the EU at the time of the transaction, they can not make claims, regardless of citizenship.
  - JBReefer 8y ago
    No, it is true, If you don't the EU Army will come and get you. /s It's a basic idea, and HN prides itself on being smart, but there aren't global laws. No one gets to enforce civil penalties outside of their jurisdictions, without exceptional circumstances. If they fine you and you don't have offices there just ... don't pay? The EU might not exist in 10 years anyway.
  - exegete 8y ago
    The EU has jurisdiction over EU citizens, even those outside of the EU (see US citizens and taxes). But I question how the EU would have jurisdiction on anyone who is outside of the EU and does all their business outside of the EU, even with EU citizens. The EU can prohibit EU citizens from visiting websites that violate the law if they want. They can also block EU residents from visiting those sites.
    - outside1234 8y ago
chatmasta 8y ago
You’re going to get downvoted for that comment, but you do raise a legitimate question of enforceability. Sure the EU can say any company in the world who has EU residents’ data should comply with GDPR. But... or what exactly? The EU doesn’t have the power to fine companies outside of their jurisdiction. I mean, they can try. But as far as I know there is no enforceability to ensure that the company actually pays the fine. For larger companies with offices in the EU (especially the ones headquartered there for tax purposes), they obviously have no choice to comply. But what about a small startup, with its only domicile and employees in the US? What exactly could the EU do to punish a startup in that case? Unless they have some enforceability treaty with the US, I don’t see how they have any legal ground to extract fines for arbitrary laws defined in their jurisdiction. The worst they could do is ask EU ISPs and/or payment networks to block the offending sites, right?
- sp332 8y ago
  It applies to companies that do business in the EU. They could at least seize any assets that you have in the EU, including future profits there. If you don't do any business in the EU to disrupt then this doesn't apply to you anyway.
- tatersolid 8y ago
  Corporate counsel, who actually went to many of the lead-up conferences for GDPR, said the data authorities from many member countries didn’t even hesitate before saying they would file civil lawsuits against non-EU companies. Such a suit could be ignored too, but it would certainly be a PITA for vacationing executives who get locked up in Italy for an outstanding summary judgement.
  - tathougies 8y ago
    > but it would certainly be a PITA for vacationing executives who get locked up in Italy for an outstanding summary judgement. It's a good thing there are a lot of beautiful parts of the world other than Italy.
- celticninja 8y ago
cesarb 8y ago
> The law, like any other EU law, obviously does not apply outside the EU. There are precedents for the opposite. If you have a grandparent born in some EU countries, you have EU citizenship according to the law of that EU country, even if you never set foot on that country and have no contact at all with the EU. There is a (non-EU) country which says that if you're a citizen of that country, you have to pay income taxes to it, even if you never set foot on that country and have no contact at all with it. At least one country says that its law applies to buyers of widgets manufactured in that country, even if they are sold by someone who never set foot on that country and has no contact at all with it, to someone who likewise has no contact with it. And so on.

unstatusthequo 8y ago

You aren't a data subject if you're outside the EU. If you're in the US, data will be happily collected on you irrespective of GDPR.

unstatusthequo 8y ago

Also, GDPR applies to more than just citizens of the EU. The language doesn't even say citizens. Data subject could be someone in the EU on vacation for two week. Even me a heathen US citizen! O_o

outside1234 8y ago
And that makes sense. This is about business conducted in the EU while someone is in the EU. The EU does not have jurisdiction outside of the EU.