4 ms·

Does this entity have dealings in Europe? If so it might be possible for GDPR to apply, and I can see this getting ugly if it does (as I believe it should, they

Does this entity have dealings in Europe? If so it might be possible for GDPR to apply, and I can see this getting ugly if it does (as I believe it should, they should get massive fines for this).

johnchristopher 7y ago
GDPR would apply if the entity had personal information of European citizens.
- Rafert 7y ago
  They have.
  - johnchristopher 7y ago
    How do you know that (not in the article) and are European citizens on the list ?
    - Rafert 7y ago
      With 2000+ people on that list the chances are pretty high there's at least one European included. At least this Dutch video game journalist complained on Twitter about his data being out there: https://twitter.com/tweakjur/status/1157609578143649792 https://twitter.com/tweakjur/status/1157609578143649792
      - johnchristopher 7y ago
        Ah, thanks for that follow-up ^^.
- dahart 7y ago
  > GDPR would apply if the entity had personal information of European citizens. Not quite, merely having data on an EU citizen is not sufficient to invoke GDPR. To clarify, article 3 of GDPR specifies that it applies to companies that market specifically to EU citizens or specifically monitor EU behavior of their customers. https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ This is taken by many to broadly mean that when an EU citizen purchases something by (for example) a US company where the product is marketed only to US citizens, GDPR does not apply. For example: https://www.gdpreu.org/the-regulation/who-must-comply/ https://www.gdpreu.org/the-regulation/who-must-comply/ “May be insufficient evidence [if] The firm’s website is accessible to EU residents”
  - jolmg 7y ago
    > GDPR specifies that it applies to companies that market specifically to EU citizens or specifically monitor EU behavior of their customers Does that mean that if you market to the world (i.e. anyone who might hit the site, making no mention of world nationalities) but not specifically to the EU (i.e. You make no mention of anything specific to the EU in any part of a site and you don't differentiate them in any way from non-EU users) then the GDPR doesn't apply?
    - acollins1331 7y ago
      Market doesn't mean advertise, it means to bring products to market, so yes, bringing products to market for the world is also bringing them to market for the EU.
      - dahart 7y ago
        > Market doesn't mean advertise Broadly speaking, the verb "to market" does mean "to advertise or promote" (try Googling "define market", and see the verb definition). > so yes, bringing products to market for the world is also bringing them to market for the EU. While that's true in a sort of technical sense, the GDPR text explicitly contradicts the notion that failing to restrict EU citizens from buying something amounts to requiring GDPR compliance.
    - dahart 7y ago
      The best advice if you intend to market something globally, and either comply with or avoid GDPR regulation -- either way -- is to hire a lawyer or a firm who has actual GDPR expertise. My understanding from reading the GDPR text and multiple law firm and FAQ summaries is that GDPR applies to marketing specifically to the EU. The text of Article 3 is clearly stating that GDPR doesn't apply to everyone in the world, and doesn't apply for the sole reason that EU residents purchase something globally. But, the wording is also vague, GDPR has been widely criticized for it's lack of lack of specifics. Personally, I currently believe that if you do not mention EU, do not market to the EU specifically in any way, and do not track or separate EU related data from global data, then GDPR may not apply. Marketing globally may not be sufficient to require GDPR compliance. But, it might also be easy to cross that line by doing something as simple as using Google Analytics, where it shows you behavior per region, so might be considered tracking EU activities. I don't know where the line is, so hire a GDPR lawyer.

Does this entity have dealings in Europe? If so it might be possible for GDPR to apply, and I can see this getting ugly if it does (as I believe it should, they should get massive fines for this).

johnchristopher 7y ago

GDPR would apply if the entity had personal information of European citizens.

Rafert 7y ago
They have.
- johnchristopher 7y ago
  How do you know that (not in the article) and are European citizens on the list ?
  - Rafert 7y ago
    With 2000+ people on that list the chances are pretty high there's at least one European included. At least this Dutch video game journalist complained on Twitter about his data being out there: https://twitter.com/tweakjur/status/1157609578143649792 https://twitter.com/tweakjur/status/1157609578143649792
    - johnchristopher 7y ago
      Ah, thanks for that follow-up ^^.
dahart 7y ago
> GDPR would apply if the entity had personal information of European citizens. Not quite, merely having data on an EU citizen is not sufficient to invoke GDPR. To clarify, article 3 of GDPR specifies that it applies to companies that market specifically to EU citizens or specifically monitor EU behavior of their customers. https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ This is taken by many to broadly mean that when an EU citizen purchases something by (for example) a US company where the product is marketed only to US citizens, GDPR does not apply. For example: https://www.gdpreu.org/the-regulation/who-must-comply/ https://www.gdpreu.org/the-regulation/who-must-comply/ “May be insufficient evidence [if] The firm’s website is accessible to EU residents”
- jolmg 7y ago
  > GDPR specifies that it applies to companies that market specifically to EU citizens or specifically monitor EU behavior of their customers Does that mean that if you market to the world (i.e. anyone who might hit the site, making no mention of world nationalities) but not specifically to the EU (i.e. You make no mention of anything specific to the EU in any part of a site and you don't differentiate them in any way from non-EU users) then the GDPR doesn't apply?
  - acollins1331 7y ago
    Market doesn't mean advertise, it means to bring products to market, so yes, bringing products to market for the world is also bringing them to market for the EU.
    - dahart 7y ago
      > Market doesn't mean advertise Broadly speaking, the verb "to market" does mean "to advertise or promote" (try Googling "define market", and see the verb definition). > so yes, bringing products to market for the world is also bringing them to market for the EU. While that's true in a sort of technical sense, the GDPR text explicitly contradicts the notion that failing to restrict EU citizens from buying something amounts to requiring GDPR compliance.
  - dahart 7y ago
    The best advice if you intend to market something globally, and either comply with or avoid GDPR regulation -- either way -- is to hire a lawyer or a firm who has actual GDPR expertise. My understanding from reading the GDPR text and multiple law firm and FAQ summaries is that GDPR applies to marketing specifically to the EU. The text of Article 3 is clearly stating that GDPR doesn't apply to everyone in the world, and doesn't apply for the sole reason that EU residents purchase something globally. But, the wording is also vague, GDPR has been widely criticized for it's lack of lack of specifics. Personally, I currently believe that if you do not mention EU, do not market to the EU specifically in any way, and do not track or separate EU related data from global data, then GDPR may not apply. Marketing globally may not be sufficient to require GDPR compliance. But, it might also be easy to cross that line by doing something as simple as using Google Analytics, where it shows you behavior per region, so might be considered tracking EU activities. I don't know where the line is, so hire a GDPR lawyer.