5 ms·

Under the GDPR, by not clicking Accept it means you're not agreeing to those terms.

perl4ever 8y ago
Perhaps, perhaps, but (a) I think I've seen this sort of thing before, and (b) your interpretation nonetheless contradicts the statement that using the site is agreeing, and (c) I'm not in the EU.
- bad_user 8y ago
  GDPR doesn't work like that, the user has to explicitly opt-in. So the website has to block users that don't explicitly agree, a simple statement won't do. There are exceptions, GDPR having the notion of "legitimate interest", which many services will try to abuse, however it has a precise definition and user tracking, ads targeting, marketing, or other interests like that that don't cut it, even if by not doing so results in less revenue for the service. The GDPR has teeth, which is why companies that have been violating user privacy are freaking out ;-)
  - JumpCrisscross 8y ago
    > GDPR doesn't work like that We don't know how GDPR works. Its structure grants immense discretion to political bodies. Given the EU is undergoing another cycle of political weakness, it would not be safe to assume anything about interpretation or enforcement.
    - Moter8 8y ago
      GDPR is formulated in this way, because good laws are not special and well-"explained", they have to be general so you can apply them to almost everything.
      - JumpCrisscross 8y ago
        > good laws are not special and well-"explained", they have to be general so you can apply them to almost everything This is a good principle for Constitutional law. It's a bad principle for general law, as it introduces political uncertainty and authoritarian risks into everything.
        setquk 8y ago
        That is the idea. Increase the risk and arbitrary non viability of loopholes. No one will touch it so the only way to move forwards is minimal risk.
        csomar 8y ago
        In my experience this just opens or expands corruption. You pay your way to be able to be "approved" by the authority. For example, the legitimate interest. Who determines that? The authoritaa. But then the authoritaa might approve Google and disapproves small-naughty-trackor. Both are doing the same privacy invasion. So why one gets a free pass and another is reprimanded. Even if the current regulator (persons) are honest, they are not irreplaceable. Maybe the guy after them will be corrupt. And since there is a lot of money here, money corrupts.
        icebraining 8y ago
        Which is why the authority can be appealed.
        Mirioron 8y ago
        "Minimal risk" in business means not actually doing business or doing business in a way that doesn't make you liable, eg blocking EU users.
- Entalpi 8y ago
  There seems to be common misconception that GDPR only applies to the geographical region that is the EU, this is false. GDPR applies to all Europeans, independent of location.
  - TheForumTroll 8y ago
    No it does not. It covers data in the EU. Being from the EU but using for example a US service while you are in the US means you are not covered. EU law doesn't cover people not inside the EUs borders.
    - kokx 8y ago
      With one exception, when your business targets EU markets, EU citizens abroad are still covered. For example, when you are a EU citizen using a US social network that operates world wide (and thus also targets EU markets), you are still covered when in the US.
      - icebraining 8y ago
        Where is that defined? The word "citizen" doesn't even appear in the law.
  - hk__2 8y ago
    I thought this, too. But it does depend on location: * If your company is EU-based, you must comply with GDPR, whatever the location of your users/clients * If your users/clients are EU-based, idem * If your users/clients are EU citizens located abroad, it applies *only* if you target EU as a market. If you operate a website dedicated to sell t-shirts to Californian people, and an EU citizen living in California buys from your website, you aren’t expected to comply with GDPR.
  - azernik 8y ago
    This is false. See Article 3 (Territorial Scope): """ 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. [i.e. EU companies, or EU subsidiaries of foreign companies, have to obey GDPR with all data they deal with] 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: [foreign companies dealing with the data of people physically inside the territory of the EU have to follow the GDPR if...] (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union [they're offering services to those people]; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. [they're tracking what those people do in the EU - but tracking what they do abroad doesn't trigger GDPR!] 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law. [it applies to businesses in places with weird legal status, like some overseas possessions, or maybe the Channel Islands] """
- freeflight 8y ago
  > (b) your interpretation nonetheless contradicts the statement that using the site is agreeing IANAL but implied consent, by visiting the site, is not enough anymore. Consent must be explicit and informed, afaik there are a few exceptions there for stuff that's "vital to the sites function".

Perhaps, perhaps, but (a) I think I've seen this sort of thing before, and (b) your interpretation nonetheless contradicts the statement that using the site is agreeing, and (c) I'm not in the EU.

bad_user 8y ago
GDPR doesn't work like that, the user has to explicitly opt-in. So the website has to block users that don't explicitly agree, a simple statement won't do. There are exceptions, GDPR having the notion of "legitimate interest", which many services will try to abuse, however it has a precise definition and user tracking, ads targeting, marketing, or other interests like that that don't cut it, even if by not doing so results in less revenue for the service. The GDPR has teeth, which is why companies that have been violating user privacy are freaking out ;-)
- JumpCrisscross 8y ago
  > GDPR doesn't work like that We don't know how GDPR works. Its structure grants immense discretion to political bodies. Given the EU is undergoing another cycle of political weakness, it would not be safe to assume anything about interpretation or enforcement.
  - Moter8 8y ago
    GDPR is formulated in this way, because good laws are not special and well-"explained", they have to be general so you can apply them to almost everything.
    - JumpCrisscross 8y ago
      > good laws are not special and well-"explained", they have to be general so you can apply them to almost everything This is a good principle for Constitutional law. It's a bad principle for general law, as it introduces political uncertainty and authoritarian risks into everything.
      - setquk 8y ago
        That is the idea. Increase the risk and arbitrary non viability of loopholes. No one will touch it so the only way to move forwards is minimal risk.
        csomar 8y ago
        In my experience this just opens or expands corruption. You pay your way to be able to be "approved" by the authority. For example, the legitimate interest. Who determines that? The authoritaa. But then the authoritaa might approve Google and disapproves small-naughty-trackor. Both are doing the same privacy invasion. So why one gets a free pass and another is reprimanded. Even if the current regulator (persons) are honest, they are not irreplaceable. Maybe the guy after them will be corrupt. And since there is a lot of money here, money corrupts.
        icebraining 8y ago
        Which is why the authority can be appealed.
        Mirioron 8y ago
        "Minimal risk" in business means not actually doing business or doing business in a way that doesn't make you liable, eg blocking EU users.
Entalpi 8y ago
There seems to be common misconception that GDPR only applies to the geographical region that is the EU, this is false. GDPR applies to all Europeans, independent of location.
- TheForumTroll 8y ago
  No it does not. It covers data in the EU. Being from the EU but using for example a US service while you are in the US means you are not covered. EU law doesn't cover people not inside the EUs borders.
  - kokx 8y ago
    With one exception, when your business targets EU markets, EU citizens abroad are still covered. For example, when you are a EU citizen using a US social network that operates world wide (and thus also targets EU markets), you are still covered when in the US.
    - icebraining 8y ago
      Where is that defined? The word "citizen" doesn't even appear in the law.
- hk__2 8y ago
  I thought this, too. But it does depend on location: * If your company is EU-based, you must comply with GDPR, whatever the location of your users/clients * If your users/clients are EU-based, idem * If your users/clients are EU citizens located abroad, it applies *only* if you target EU as a market. If you operate a website dedicated to sell t-shirts to Californian people, and an EU citizen living in California buys from your website, you aren’t expected to comply with GDPR.
- azernik 8y ago
  This is false. See Article 3 (Territorial Scope): """ 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. [i.e. EU companies, or EU subsidiaries of foreign companies, have to obey GDPR with all data they deal with] 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: [foreign companies dealing with the data of people physically inside the territory of the EU have to follow the GDPR if...] (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union [they're offering services to those people]; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. [they're tracking what those people do in the EU - but tracking what they do abroad doesn't trigger GDPR!] 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law. [it applies to businesses in places with weird legal status, like some overseas possessions, or maybe the Channel Islands] """
freeflight 8y ago
> (b) your interpretation nonetheless contradicts the statement that using the site is agreeing IANAL but implied consent, by visiting the site, is not enough anymore. Consent must be explicit and informed, afaik there are a few exceptions there for stuff that's "vital to the sites function".