4 ms·

Currently a US citizen living in Spain, I hit these decently often looking up news articles that look interesting about things in the US, but stopped short by t

Currently a US citizen living in Spain, I hit these decently often looking up news articles that look interesting about things in the US, but stopped short by the notices about GDPR. I'd be curious if some of the newspapers eventually comply after several court cases defining some details on how it is treated-- seems disproportionately higher for newspapers; anyone know why? other than their audiences don't tend to be in Europe?

Mashimo 8y ago
Maybe they relay more on selling data?
guitarbill 8y ago
A lot of these sites are ostensibly local US news or media (e.g. WPTA - Fort Wayne, IN), and it's hard to see how they fall under the GDPR. So either it's a political statement, or they somehow are subject to the GDPR, e.g. they are owned by a multi-national conglomerate, or sell data to them.
- raverbashing 8y ago
  Yeah, they don't fall under GDPR it's mostly a knee-jerk reaction (or, as you mentioned, they are owned by a bigger conglomerate)
  - guitarbill 8y ago
    well, the latter is quite insidious, and something they've likely tried to keep a secret. Weirdly, this could a win for transparency by the GDPR even outside of Europe.
  - chrismeller 8y ago
    IP addresses are specifically considered to be personal data, so even accepting a page view from an EU citizen and writing the IP to an Apache log file could subject them to it. Same with cookies and any kind of analytics or advertising partners (which most local news sites seem oddly heavy on). Even if they somehow figured out that they were already completely compliant (and ignoring the work involved in discovering that), there are policies and procedures you need to write to document who you share their data with and respond to requests from EU citizens about their data and the features to support answering those.
    - josteink 8y ago
      > IP addresses are specifically considered to be personal data Again. Knee jerk internet reactions divorced from reality. Access logs are not illegal under the GDPR. Stop spreading FUD.
    - raverbashing 8y ago
      > so even accepting a page view from an EU citizen and writing the IP to an Apache log file could subject them to it. You better inform yourself before making incorrect assertions But it does get tiring, really
- dmortin 8y ago
  They don't want to devote resources to investigate what should they do to comply. It's a business decision. If only a fraction of their visitors come from the EU then it may not be worth it to deal with the GDPR.
  - DanBC 8y ago
    > If only a fraction of their visitors come from the EU then it may not be worth it to deal with the GDPR. If only a fraction of their users come from the EU they don't need to deal with GDPR, they're exempt from it.
- nicktelford 8y ago
  They'd be subject to the GDPR if someone visited from within the EU and they stored data about that visitor as far as I'm aware. Edit: this is incorrect, see comment by guitarbill below.
  - guitarbill 8y ago
    no, we've literally been over this a hundred times in other threads about the GDPR. if your business is outside the EU, and you don't target EU data subjects specifically, then how are you subject to the GDPR? there's no legal basis. even the GDPR legislation acknowledges this, for example in section 23: > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. it's far more likely they aren't "local" news stations, but owned by a multi-national, or selling data to multi-national corporations subject to GDPR.
    - adventured 8y ago
      You're getting downvoted despite being factually and legally correct. You do not have to comply with GDPR if you are fully outside of the EU's jurisdiction and do no business in the EU. Every site that gets created does not have to try to comply with every privacy law from every place on earth. At this point it's just belligerent propaganda to try to claim otherwise. It serves no good purpose to lie and pretend that every site on earth with EU visitors must comply with GDPR. That's a non-functioning future: all sites will not be able to comply with all privacy laws from all jurisdictions around the world. It's also legally unenforceable hogwash. It goes even further however. As an EU citizen not only does GDPR not grant you any new protections in the US jurisdiction, you have very few privacy protections (none?) in the US. Sites with no business in the EU, those that aren't covered by the EU in any manner jurisdiction wise, can do nearly anything they want to with EU citizen data. Lawsuits can be filed against such sites, and they'll be promptly dismissed because the US isn't governed by EU law.
      - 8y ago

Mashimo 8y ago

Maybe they relay more on selling data?

guitarbill 8y ago

A lot of these sites are ostensibly local US news or media (e.g. WPTA - Fort Wayne, IN), and it's hard to see how they fall under the GDPR. So either it's a political statement, or they somehow are subject to the GDPR, e.g. they are owned by a multi-national conglomerate, or sell data to them.

raverbashing 8y ago
Yeah, they don't fall under GDPR it's mostly a knee-jerk reaction (or, as you mentioned, they are owned by a bigger conglomerate)
- guitarbill 8y ago
  well, the latter is quite insidious, and something they've likely tried to keep a secret. Weirdly, this could a win for transparency by the GDPR even outside of Europe.
- chrismeller 8y ago
  IP addresses are specifically considered to be personal data, so even accepting a page view from an EU citizen and writing the IP to an Apache log file could subject them to it. Same with cookies and any kind of analytics or advertising partners (which most local news sites seem oddly heavy on). Even if they somehow figured out that they were already completely compliant (and ignoring the work involved in discovering that), there are policies and procedures you need to write to document who you share their data with and respond to requests from EU citizens about their data and the features to support answering those.
  - josteink 8y ago
    > IP addresses are specifically considered to be personal data Again. Knee jerk internet reactions divorced from reality. Access logs are not illegal under the GDPR. Stop spreading FUD.
  - raverbashing 8y ago
    > so even accepting a page view from an EU citizen and writing the IP to an Apache log file could subject them to it. You better inform yourself before making incorrect assertions But it does get tiring, really
dmortin 8y ago
They don't want to devote resources to investigate what should they do to comply. It's a business decision. If only a fraction of their visitors come from the EU then it may not be worth it to deal with the GDPR.
- DanBC 8y ago
  > If only a fraction of their visitors come from the EU then it may not be worth it to deal with the GDPR. If only a fraction of their users come from the EU they don't need to deal with GDPR, they're exempt from it.
nicktelford 8y ago
They'd be subject to the GDPR if someone visited from within the EU and they stored data about that visitor as far as I'm aware. Edit: this is incorrect, see comment by guitarbill below.
- guitarbill 8y ago
  no, we've literally been over this a hundred times in other threads about the GDPR. if your business is outside the EU, and you don't target EU data subjects specifically, then how are you subject to the GDPR? there's no legal basis. even the GDPR legislation acknowledges this, for example in section 23: > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. it's far more likely they aren't "local" news stations, but owned by a multi-national, or selling data to multi-national corporations subject to GDPR.
  - adventured 8y ago
    You're getting downvoted despite being factually and legally correct. You do not have to comply with GDPR if you are fully outside of the EU's jurisdiction and do no business in the EU. Every site that gets created does not have to try to comply with every privacy law from every place on earth. At this point it's just belligerent propaganda to try to claim otherwise. It serves no good purpose to lie and pretend that every site on earth with EU visitors must comply with GDPR. That's a non-functioning future: all sites will not be able to comply with all privacy laws from all jurisdictions around the world. It's also legally unenforceable hogwash. It goes even further however. As an EU citizen not only does GDPR not grant you any new protections in the US jurisdiction, you have very few privacy protections (none?) in the US. Sites with no business in the EU, those that aren't covered by the EU in any manner jurisdiction wise, can do nearly anything they want to with EU citizen data. Lawsuits can be filed against such sites, and they'll be promptly dismissed because the US isn't governed by EU law.
    - 8y ago