5 ms·

Both.

by 101404 7y ago

Both.

bhickey 7y ago
This simply isn't true. The GDPR cares about where you are and where you reside, not who you are. I live in the United States and hold Irish citizenship. The GDPR does not apply to me (unless I were to visit the EU.) https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-living-in-the-us/ https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-... https://www.dyspatch.io/blog/gdpr-location-or-citizenship/ https://www.dyspatch.io/blog/gdpr-location-or-citizenship/
- scoot 7y ago
  It applies to EU residents regardless of where the data processor is located, and anyone anywhere whose data is processed by an EU based company (or the EU subsidiary of a multinational): https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
  - scarejunba 7y ago
    That entire domain is an "Under Construction" page (which I didn't think I'd ever see again this century).
    - scoot 7y ago
      Upvoting because this was my mistake. My comment was copied verbatim from and older discussion on the same topic (it's a common cause for confusion), including a URL that I didn't check was still valid. I subsequently changed it to another one with the same info, but didn't call out the edit. Apologies scarejunba for the collateral damage!
      - scarejunba 7y ago
        Haha, all good.
  - manigandham 7y ago
    This is incorrect. "In the EU" refers to the physical location, not your citizenship. Otherwise there would be no way to know who you are without having your data in the first place which means the law is a catch 22. The only working interpretation is based on physical location.
    - squiggleblaz 7y ago
      Was the parent post edited? Otherwise it agrees with you. They don't mention citizenship. Surely my physical location is no less part of my data than my citizenships? I guess if it's being processed immediately when it's collected it's possible to gdpr it or not, but if it's an offline process, then how can you do that?
      - manigandham 7y ago
        Yes it was edited, the part I quoted came from that comment. Anyways it's based on physical location. There are lots of specifics around what PII is but in this case: 1) your location alone cannot identify you individually, and 2) nothing specific is stored and IP/network to region lookup for applying GDPR rules is acceptable.
        scoot 7y ago
        Yes, it was edited, but only to update the linked URL, not the comment. Also, hat part of my comment do you believe that you quoted? The only quote I see if from the article I linked to in the revised comment. Incidentally, when it comes to the GDPR, the term is "personal data", not "personally identifiable information" which is a US term.
        squiggleblaz 7y ago
        My citizenship can't identify me individually. If I use a VPN that makes me appear like I'm in China, I'm still in Europe so I think my data should still be treated as if I'm in Europe. My location/residency is a matter of fact.
  - marcus_holmes 7y ago
    Exactly what the GP said - if you're an Irish citizen residing in the USA, then the GDPR does not apply to you, because you're not an EU resident.
Carpetsmoker 7y ago
How would that be workable? I am a Dutch EU citizen living in Indonesia; does that mean that all Indonesian businesses I interact with should follow the EU GDPR law?
- tick_tock_tick 7y ago
  Not "should" but required by the EU. Any company anywhere in the world is subject to it and may face fines if any violations are brought to light. Now the question is if any random corner store in Indonesia is going to respect the EU decision.....
  - Carpetsmoker 7y ago
    I'm not a lawyer, but I don't think this is how it works unless Indonesia has signed an agreement with the EU or Netherlands regarding this. Otherwise countries could just unilaterally declare laws for all its citizens abroad? I also looked at the text in Article 3, "Territorial scope"[1], and that says it only applies to EU-based organisations and "data subjects who are in the Union". It seems to me that "in the Union" means "residing in", and not "citizen of"? The third clause says it applies to "a place where Member State law applies by virtue of public international law", but I don't think this applies to Indonesia? [1]: https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
    - skissane 7y ago
      > The third clause says it applies to "a place where Member State law applies by virtue of public international law", but I don't think this applies to Indonesia? IANAL, but I think that is primarily a reference to member state embassies, consulates, overseas military bases, ships having member state flag in international waters, aircraft registered in a member state, and spacecraft operated by a member state. So GDPR would apply to data kept in a member state embassy/consulate in Indonesia. In practice, a lot of the work embassies/consulates do may fall into one of the exemptions from the GDPR – national security, etc. But embassies/consulates often also do other stuff, like host conferences, workshops, dinner parties, etc. GDPR may well apply to data collected for those purposes.
manigandham 7y ago
That's incorrect. Only physical location matters, not your citizenship (which would be unknown without accessing your data in the first place).

Both.

by 101404 7y ago

Both.

This simply isn't true. The GDPR cares about where you are and where you reside, not who you are. I live in the United States and hold Irish citizenship. The GDPR does not apply to me (unless I were to visit the EU.) https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-living-in-the-us/ https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-... https://www.dyspatch.io/blog/gdpr-location-or-citizenship/ https://www.dyspatch.io/blog/gdpr-location-or-citizenship/

scoot 7y ago
It applies to EU residents regardless of where the data processor is located, and anyone anywhere whose data is processed by an EU based company (or the EU subsidiary of a multinational): https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
- scarejunba 7y ago
  That entire domain is an "Under Construction" page (which I didn't think I'd ever see again this century).
  - scoot 7y ago
    Upvoting because this was my mistake. My comment was copied verbatim from and older discussion on the same topic (it's a common cause for confusion), including a URL that I didn't check was still valid. I subsequently changed it to another one with the same info, but didn't call out the edit. Apologies scarejunba for the collateral damage!
    - scarejunba 7y ago
      Haha, all good.
- manigandham 7y ago
  This is incorrect. "In the EU" refers to the physical location, not your citizenship. Otherwise there would be no way to know who you are without having your data in the first place which means the law is a catch 22. The only working interpretation is based on physical location.
  - squiggleblaz 7y ago
    Was the parent post edited? Otherwise it agrees with you. They don't mention citizenship. Surely my physical location is no less part of my data than my citizenships? I guess if it's being processed immediately when it's collected it's possible to gdpr it or not, but if it's an offline process, then how can you do that?
    - manigandham 7y ago
      Yes it was edited, the part I quoted came from that comment. Anyways it's based on physical location. There are lots of specifics around what PII is but in this case: 1) your location alone cannot identify you individually, and 2) nothing specific is stored and IP/network to region lookup for applying GDPR rules is acceptable.
      - scoot 7y ago
        Yes, it was edited, but only to update the linked URL, not the comment. Also, hat part of my comment do you believe that you quoted? The only quote I see if from the article I linked to in the revised comment. Incidentally, when it comes to the GDPR, the term is "personal data", not "personally identifiable information" which is a US term.
      - squiggleblaz 7y ago
        My citizenship can't identify me individually. If I use a VPN that makes me appear like I'm in China, I'm still in Europe so I think my data should still be treated as if I'm in Europe. My location/residency is a matter of fact.
- marcus_holmes 7y ago
  Exactly what the GP said - if you're an Irish citizen residing in the USA, then the GDPR does not apply to you, because you're not an EU resident.

Carpetsmoker 7y ago

How would that be workable? I am a Dutch EU citizen living in Indonesia; does that mean that all Indonesian businesses I interact with should follow the EU GDPR law?

tick_tock_tick 7y ago
Not "should" but required by the EU. Any company anywhere in the world is subject to it and may face fines if any violations are brought to light. Now the question is if any random corner store in Indonesia is going to respect the EU decision.....
- Carpetsmoker 7y ago
  I'm not a lawyer, but I don't think this is how it works unless Indonesia has signed an agreement with the EU or Netherlands regarding this. Otherwise countries could just unilaterally declare laws for all its citizens abroad? I also looked at the text in Article 3, "Territorial scope"[1], and that says it only applies to EU-based organisations and "data subjects who are in the Union". It seems to me that "in the Union" means "residing in", and not "citizen of"? The third clause says it applies to "a place where Member State law applies by virtue of public international law", but I don't think this applies to Indonesia? [1]: https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
  - skissane 7y ago
    > The third clause says it applies to "a place where Member State law applies by virtue of public international law", but I don't think this applies to Indonesia? IANAL, but I think that is primarily a reference to member state embassies, consulates, overseas military bases, ships having member state flag in international waters, aircraft registered in a member state, and spacecraft operated by a member state. So GDPR would apply to data kept in a member state embassy/consulate in Indonesia. In practice, a lot of the work embassies/consulates do may fall into one of the exemptions from the GDPR – national security, etc. But embassies/consulates often also do other stuff, like host conferences, workshops, dinner parties, etc. GDPR may well apply to data collected for those purposes.

manigandham 7y ago

That's incorrect. Only physical location matters, not your citizenship (which would be unknown without accessing your data in the first place).