4 ms·

The page it self might be compliant (not recording IPs/session cookies/etc) but the law still applies on any data collected on EU citizens that might be visitin

The page it self might be compliant (not recording IPs/session cookies/etc) but the law still applies on any data collected on EU citizens that might be visiting abroad. That's why a GeoIP block is not a real fix.

bryanrasmussen 8y ago
unfortunately the data collected on eu citizens abroad does not seem to actually be the case, it was a common misunderstanding of the law that I fell prey to as well.
paulcole 8y ago
AFAIK this is not true: > When an individual leaves an EU country and travels to a non-EU country, they are no longer protected by GDPR. https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-living-in-the-us/ https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-...
volkl48 8y ago
They're a US entity operating under US law. If you are in the US, US law is what applies, not EU law. They also don't have European operations, so it's not like the EU has any means to compel them to act even if it wanted to. You'd certainly be laughed out of a US courtroom (rightfully) if you are trying to force a domestic business to comply with arbitrary foreign regulations in a country they have no involvement with.
- tzs 8y ago
  It's worth noting that the important part here is the "have no involvement with" part, which the geographical blocking helps establish. A US entity operating under US law with no physical presence in a foreign jurisdiction but actively courting business with citizens in that foreign jurisdiction has to be a lot more careful. For example, if one of their foreign customers sues them in a foreign court, wins, and gets a damages award there is a decent chance in many states that the US court would recognize and enforce that judgement.
tzs 8y ago
For controllers or processors not established in the Union, GDPR only applies to the processing of personal data of data subjects who are in the Union. See Article 3 [1]. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/

bryanrasmussen 8y ago

unfortunately the data collected on eu citizens abroad does not seem to actually be the case, it was a common misunderstanding of the law that I fell prey to as well.

paulcole 8y ago

AFAIK this is not true: > When an individual leaves an EU country and travels to a non-EU country, they are no longer protected by GDPR. https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-living-in-the-us/ https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-...

volkl48 8y ago

They're a US entity operating under US law. If you are in the US, US law is what applies, not EU law. They also don't have European operations, so it's not like the EU has any means to compel them to act even if it wanted to. You'd certainly be laughed out of a US courtroom (rightfully) if you are trying to force a domestic business to comply with arbitrary foreign regulations in a country they have no involvement with.

tzs 8y ago
It's worth noting that the important part here is the "have no involvement with" part, which the geographical blocking helps establish. A US entity operating under US law with no physical presence in a foreign jurisdiction but actively courting business with citizens in that foreign jurisdiction has to be a lot more careful. For example, if one of their foreign customers sues them in a foreign court, wins, and gets a damages award there is a decent chance in many states that the US court would recognize and enforce that judgement.

tzs 8y ago

For controllers or processors not established in the Union, GDPR only applies to the processing of personal data of data subjects who are in the Union. See Article 3 [1]. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/