4 ms·

They have a point, the eu is forcing themselves between service providers and citizens. As a European citizen, I don't want this. It also costs money to imple

They have a point, the eu is forcing themselves between service providers and citizens. As a European citizen, I don't want this. It also costs money to implement GDPR

ccmcarey 6y ago
> the eu is forcing themselves between service providers and citizens Yes, that's what regulations do, and it is for the _benefit_ of the citizens.
- asdfasgasdgasdg 6y ago
  > Yes, that's what regulations do, and it is for the _benefit_ of the citizens. Purportedly for the benefit of citizens. Whether citizens in actual fact benefit from any given regulation is specific to the given regulation and the given citizen's preferences.
IfOnlyYouKnew 6y ago
The law doesn't apply to them.
- pestaa 6y ago
  The law applies to any service provided to any EU citizen, even abroad. (That's why geofencing does not make GDPR 'go away'.)
  - yorwba 6y ago
    The law applies to any service targeted at EU citizens. It does not apply to services that any EU citizen happens to be using even though they're primarily intended for citizens of other countries. A "local" Bavarian news site hosted in the US would be in scope, but a local Nebraskan news site hosted in the US wouldn't. Edit: Recital 23: Applicable to processors not established in the Union if data subjects within the Union are targeted: https://gdpr.eu/Recital-23-Applicable-to-processors-not-established-in-the-Union-if-data-subjects-within-the-Union-are-targeted https://gdpr.eu/Recital-23-Applicable-to-processors-not-esta... In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.
    - pestaa 6y ago
      Thank you, that is an important distinction I did not know about. So after all geofencing is a sufficient signal to avoid falling under GDPR, unless there are other explicit ways to do business with them from the EU. For example, if a web store blocks my IP, but I can place an order with an EU country address through a VPN, they are nonetheless obligated to process my data according to EU regulations. Is this a correct interpretation?
      - Kalium 6y ago
        I have some doubts on several points. First, that sounds like a pretty clear signal that the business is pointedly not targeting EU citizens. Such a business would not be envisaging "offering services to data subjects in one or more Member States in the Union". Second, that business probably does not operate in any meaningful way in the EU, making any obligations under GDPR a matter of legal fiction. With no kind of enforceability, any GDPR rights or obligations are meaningless.
        PeterisP 6y ago
        If some online store is getting payments from EU credit cards and sending goods to EU, then they obviously do offer services in EU. There are also some plausible options for enforceability (e.g. seizing all payments from EU), however, the major obstacle is that no regulator will care enough to try and enforce anything for a small scale foreign site. Their #1 enforcement priority is on EU businesses mishandling private data (e.g. loyalty programs of brick-and-mortar shops, telecommunications providers, lenders, etc), and #2 priority is the major online players that each affect millions of people. Most regulators still have a backlog on #1, they're just starting the first enforcement actions on #2, so any attempt for small foreign sites is years away at best.
    - auganov 6y ago
      > The law applies to any service targeted at EU citizens. It does not apply to services that any EU citizen happens to be using even though they're primarily intended for citizens of other countries. > A "local" Bavarian news site hosted in the US would be in scope, but a local Nebraskan news site hosted in the US wouldn't. That's a pretty optimistic interpretation of this recital. It doesn't talk about who is primarily being targeted, but the mere intent (or possibility) of "offering goods or services to data subjects in the Union". If all local EU news websites are covered because they're offering a service just by being a news website, then it follows that US sites are offering a service too. The only remaining part is to prove intent. Most of these local US sites blocking the EU are operated by big players like MNI targeted media and Chicago Tribune publishing. Even 1% of the traffic being from the EU would be a big number. Conversely, if this would indeed exempt them from GDPR, then are all general purpose US news sites not specifically targeting the EU exempt too? Or let's go further, if I have a social media site and 99% of my users are Americans talking about US-related stuff, am I exempt too even if I let EU citizens register and participate?
pestaa 6y ago
It costs money to build protections for customer data now? Oh I'm sure the service providers took information security very seriously as they proclaimed to. In which case, GDPR is only a legal framework they had no trouble (and serious expenses) to adhere to.
Bayart 6y ago
GDPR is pretty cheap if treating people as merchandise isn't part of your economics.

They have a point, the eu is forcing themselves between service providers and citizens. As a European citizen, I don't want this. It also costs money to implement GDPR

ccmcarey 6y ago

> the eu is forcing themselves between service providers and citizens Yes, that's what regulations do, and it is for the _benefit_ of the citizens.

asdfasgasdgasdg 6y ago
> Yes, that's what regulations do, and it is for the _benefit_ of the citizens. Purportedly for the benefit of citizens. Whether citizens in actual fact benefit from any given regulation is specific to the given regulation and the given citizen's preferences.

IfOnlyYouKnew 6y ago

The law doesn't apply to them.

pestaa 6y ago
The law applies to any service provided to any EU citizen, even abroad. (That's why geofencing does not make GDPR 'go away'.)
- yorwba 6y ago
  The law applies to any service targeted at EU citizens. It does not apply to services that any EU citizen happens to be using even though they're primarily intended for citizens of other countries. A "local" Bavarian news site hosted in the US would be in scope, but a local Nebraskan news site hosted in the US wouldn't. Edit: Recital 23: Applicable to processors not established in the Union if data subjects within the Union are targeted: https://gdpr.eu/Recital-23-Applicable-to-processors-not-established-in-the-Union-if-data-subjects-within-the-Union-are-targeted https://gdpr.eu/Recital-23-Applicable-to-processors-not-esta... In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.
  - pestaa 6y ago
    Thank you, that is an important distinction I did not know about. So after all geofencing is a sufficient signal to avoid falling under GDPR, unless there are other explicit ways to do business with them from the EU. For example, if a web store blocks my IP, but I can place an order with an EU country address through a VPN, they are nonetheless obligated to process my data according to EU regulations. Is this a correct interpretation?
    - Kalium 6y ago
      I have some doubts on several points. First, that sounds like a pretty clear signal that the business is pointedly not targeting EU citizens. Such a business would not be envisaging "offering services to data subjects in one or more Member States in the Union". Second, that business probably does not operate in any meaningful way in the EU, making any obligations under GDPR a matter of legal fiction. With no kind of enforceability, any GDPR rights or obligations are meaningless.
      - PeterisP 6y ago
        If some online store is getting payments from EU credit cards and sending goods to EU, then they obviously do offer services in EU. There are also some plausible options for enforceability (e.g. seizing all payments from EU), however, the major obstacle is that no regulator will care enough to try and enforce anything for a small scale foreign site. Their #1 enforcement priority is on EU businesses mishandling private data (e.g. loyalty programs of brick-and-mortar shops, telecommunications providers, lenders, etc), and #2 priority is the major online players that each affect millions of people. Most regulators still have a backlog on #1, they're just starting the first enforcement actions on #2, so any attempt for small foreign sites is years away at best.
  - auganov 6y ago
    > The law applies to any service targeted at EU citizens. It does not apply to services that any EU citizen happens to be using even though they're primarily intended for citizens of other countries. > A "local" Bavarian news site hosted in the US would be in scope, but a local Nebraskan news site hosted in the US wouldn't. That's a pretty optimistic interpretation of this recital. It doesn't talk about who is primarily being targeted, but the mere intent (or possibility) of "offering goods or services to data subjects in the Union". If all local EU news websites are covered because they're offering a service just by being a news website, then it follows that US sites are offering a service too. The only remaining part is to prove intent. Most of these local US sites blocking the EU are operated by big players like MNI targeted media and Chicago Tribune publishing. Even 1% of the traffic being from the EU would be a big number. Conversely, if this would indeed exempt them from GDPR, then are all general purpose US news sites not specifically targeting the EU exempt too? Or let's go further, if I have a social media site and 99% of my users are Americans talking about US-related stuff, am I exempt too even if I let EU citizens register and participate?

pestaa 6y ago

It costs money to build protections for customer data now? Oh I'm sure the service providers took information security very seriously as they proclaimed to. In which case, GDPR is only a legal framework they had no trouble (and serious expenses) to adhere to.

Bayart 6y ago

GDPR is pretty cheap if treating people as merchandise isn't part of your economics.