4 ms·

Who's gonna sue you? The EU has no power or jurisdiction over you, you're not required to block access to their citizens.

drivingmenuts 8y ago
In the US, pretty much anyone can sue anyone else for any reason. While a judge may eventually throw out the lawsuit (for various reasons including frivolity, etc.), being sued generally requires the services of a lawyer to at least bring up the motion to toss the suit. Lawyers ain't cheap (at least the kind that are effective). Furthermore, there's the whole watchlist thing - if the EU has decided against you, they can make traveling outside the US very inconvenient.
marcoperaza 8y ago
That's not true. The GDPR has an incredibly broad territorial scope: 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: a. the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or b. the monitoring of their behaviour as far as their behaviour takes place within the Union. So offering free services to people in the EU is enough to ensnare you. What does it mean to offer? From the official notes: factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.* As for being able to acquire personal jurisdiction over you or your company to actually punish you for not obeying, that is not much of an obstacle either. Do you envisage potentially serving EU customers at some point in the future? (for basically any online company, the answer is yes) Do you use any services, banks, etc. that are located in the EU? (another likely yes). They may not be able to directly fine you today, but they might be able to in the future, or cut you off from European companies. There is a reason why the doctrine of international comity exists. When followed, it limits the extraterritorial application of laws such as to not infringe on the rights of other nations to decide what behavior is acceptable within their own territory. But the EU has decided to not follow it with the GDPR. In fairness, the internet has made it challenging to find the appropriate balance, but the EU is way out of left field here.
- sparkling 8y ago
  So, a US based firm offering a spanish version of their website has to apply with GDPR because people from Spain could also visit? Whats next? US firms targeting the American-Korean community in the US need to apply with laws made in Northkorea? :)

drivingmenuts 8y ago

In the US, pretty much anyone can sue anyone else for any reason. While a judge may eventually throw out the lawsuit (for various reasons including frivolity, etc.), being sued generally requires the services of a lawyer to at least bring up the motion to toss the suit. Lawyers ain't cheap (at least the kind that are effective). Furthermore, there's the whole watchlist thing - if the EU has decided against you, they can make traveling outside the US very inconvenient.

marcoperaza 8y ago

That's not true. The GDPR has an incredibly broad territorial scope: 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: a. the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or b. the monitoring of their behaviour as far as their behaviour takes place within the Union. So offering free services to people in the EU is enough to ensnare you. What does it mean to offer? From the official notes: factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.* As for being able to acquire personal jurisdiction over you or your company to actually punish you for not obeying, that is not much of an obstacle either. Do you envisage potentially serving EU customers at some point in the future? (for basically any online company, the answer is yes) Do you use any services, banks, etc. that are located in the EU? (another likely yes). They may not be able to directly fine you today, but they might be able to in the future, or cut you off from European companies. There is a reason why the doctrine of international comity exists. When followed, it limits the extraterritorial application of laws such as to not infringe on the rights of other nations to decide what behavior is acceptable within their own territory. But the EU has decided to not follow it with the GDPR. In fairness, the internet has made it challenging to find the appropriate balance, but the EU is way out of left field here.

sparkling 8y ago
So, a US based firm offering a spanish version of their website has to apply with GDPR because people from Spain could also visit? Whats next? US firms targeting the American-Korean community in the US need to apply with laws made in Northkorea? :)