6 ms·

The law applies to any service provided to any EU citizen, even abroad. (That's why geofencing does not make GDPR 'go away'.)

by pestaa 6y ago

yorwba 6y ago
The law applies to any service targeted at EU citizens. It does not apply to services that any EU citizen happens to be using even though they're primarily intended for citizens of other countries. A "local" Bavarian news site hosted in the US would be in scope, but a local Nebraskan news site hosted in the US wouldn't. Edit: Recital 23: Applicable to processors not established in the Union if data subjects within the Union are targeted: https://gdpr.eu/Recital-23-Applicable-to-processors-not-established-in-the-Union-if-data-subjects-within-the-Union-are-targeted https://gdpr.eu/Recital-23-Applicable-to-processors-not-esta... In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.
- pestaa 6y ago
  Thank you, that is an important distinction I did not know about. So after all geofencing is a sufficient signal to avoid falling under GDPR, unless there are other explicit ways to do business with them from the EU. For example, if a web store blocks my IP, but I can place an order with an EU country address through a VPN, they are nonetheless obligated to process my data according to EU regulations. Is this a correct interpretation?
  - Kalium 6y ago
    I have some doubts on several points. First, that sounds like a pretty clear signal that the business is pointedly not targeting EU citizens. Such a business would not be envisaging "offering services to data subjects in one or more Member States in the Union". Second, that business probably does not operate in any meaningful way in the EU, making any obligations under GDPR a matter of legal fiction. With no kind of enforceability, any GDPR rights or obligations are meaningless.
    - PeterisP 6y ago
      If some online store is getting payments from EU credit cards and sending goods to EU, then they obviously do offer services in EU. There are also some plausible options for enforceability (e.g. seizing all payments from EU), however, the major obstacle is that no regulator will care enough to try and enforce anything for a small scale foreign site. Their #1 enforcement priority is on EU businesses mishandling private data (e.g. loyalty programs of brick-and-mortar shops, telecommunications providers, lenders, etc), and #2 priority is the major online players that each affect millions of people. Most regulators still have a backlog on #1, they're just starting the first enforcement actions on #2, so any attempt for small foreign sites is years away at best.
- auganov 6y ago
  > The law applies to any service targeted at EU citizens. It does not apply to services that any EU citizen happens to be using even though they're primarily intended for citizens of other countries. > A "local" Bavarian news site hosted in the US would be in scope, but a local Nebraskan news site hosted in the US wouldn't. That's a pretty optimistic interpretation of this recital. It doesn't talk about who is primarily being targeted, but the mere intent (or possibility) of "offering goods or services to data subjects in the Union". If all local EU news websites are covered because they're offering a service just by being a news website, then it follows that US sites are offering a service too. The only remaining part is to prove intent. Most of these local US sites blocking the EU are operated by big players like MNI targeted media and Chicago Tribune publishing. Even 1% of the traffic being from the EU would be a big number. Conversely, if this would indeed exempt them from GDPR, then are all general purpose US news sites not specifically targeting the EU exempt too? Or let's go further, if I have a social media site and 99% of my users are Americans talking about US-related stuff, am I exempt too even if I let EU citizens register and participate?
  - yorwba 6y ago
    > If all local EU news websites are covered because they're offering a service just by being a news website, then it follows that US sites are offering a service too. The only remaining part is to prove intent. They aren't because ... the mere accessibility of the ... website in the Union ... is insufficient to ascertain such intention Local EU websites are covered by virtue of being EU websites, not because they're accessible in the EU. > Conversely, if this would indeed exempt them from GDPR, then are all general purpose US news sites not specifically targeting the EU exempt too? Yes. > if I have a social media site and 99% of my users are Americans talking about US-related stuff, am I exempt too even if I let EU citizens register and participate? Yes, unless you're targeting EU citizens by e.g. offering interface localization in EU languages or setting growth targets for the European market in statements to your investors etc.
    - auganov 6y ago
      > ... the mere accessibility of the ... website in the Union ... is insufficient to ascertain such intention > Local EU websites are covered by virtue of being EU websites, not because they're accessible in the EU. None of this talks about nature of the content. None of this talks about how few EU users you have. It clearly talks about providing goods or services to EU citizens with some degree of intent[0]. If providing news to people isn't providing a service then any news site should be exempt regardless of content and userbase. The "mere accessibility" part says it wouldn't be enough to prove your intention to provide goods or services to EU citizens. If you're a local bakery that only sells locally it's pretty clearly you're safe. The information on your website is not the service you're providing. And it would be very hard to argue you're somehow benefiting from or expecting EU visitors. [0] and the "envisages offering" language is arguably an even lesser standard than the also mentioned "intention"

The law applies to any service provided to any EU citizen, even abroad. (That's why geofencing does not make GDPR 'go away'.)

by pestaa 6y ago

The law applies to any service provided to any EU citizen, even abroad. (That's why geofencing does not make GDPR 'go away'.)

yorwba 6y ago

The law applies to any service targeted at EU citizens. It does not apply to services that any EU citizen happens to be using even though they're primarily intended for citizens of other countries. A "local" Bavarian news site hosted in the US would be in scope, but a local Nebraskan news site hosted in the US wouldn't. Edit: Recital 23: Applicable to processors not established in the Union if data subjects within the Union are targeted: https://gdpr.eu/Recital-23-Applicable-to-processors-not-established-in-the-Union-if-data-subjects-within-the-Union-are-targeted https://gdpr.eu/Recital-23-Applicable-to-processors-not-esta... In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

pestaa 6y ago
Thank you, that is an important distinction I did not know about. So after all geofencing is a sufficient signal to avoid falling under GDPR, unless there are other explicit ways to do business with them from the EU. For example, if a web store blocks my IP, but I can place an order with an EU country address through a VPN, they are nonetheless obligated to process my data according to EU regulations. Is this a correct interpretation?
- Kalium 6y ago
  I have some doubts on several points. First, that sounds like a pretty clear signal that the business is pointedly not targeting EU citizens. Such a business would not be envisaging "offering services to data subjects in one or more Member States in the Union". Second, that business probably does not operate in any meaningful way in the EU, making any obligations under GDPR a matter of legal fiction. With no kind of enforceability, any GDPR rights or obligations are meaningless.
  - PeterisP 6y ago
    If some online store is getting payments from EU credit cards and sending goods to EU, then they obviously do offer services in EU. There are also some plausible options for enforceability (e.g. seizing all payments from EU), however, the major obstacle is that no regulator will care enough to try and enforce anything for a small scale foreign site. Their #1 enforcement priority is on EU businesses mishandling private data (e.g. loyalty programs of brick-and-mortar shops, telecommunications providers, lenders, etc), and #2 priority is the major online players that each affect millions of people. Most regulators still have a backlog on #1, they're just starting the first enforcement actions on #2, so any attempt for small foreign sites is years away at best.
auganov 6y ago
> The law applies to any service targeted at EU citizens. It does not apply to services that any EU citizen happens to be using even though they're primarily intended for citizens of other countries. > A "local" Bavarian news site hosted in the US would be in scope, but a local Nebraskan news site hosted in the US wouldn't. That's a pretty optimistic interpretation of this recital. It doesn't talk about who is primarily being targeted, but the mere intent (or possibility) of "offering goods or services to data subjects in the Union". If all local EU news websites are covered because they're offering a service just by being a news website, then it follows that US sites are offering a service too. The only remaining part is to prove intent. Most of these local US sites blocking the EU are operated by big players like MNI targeted media and Chicago Tribune publishing. Even 1% of the traffic being from the EU would be a big number. Conversely, if this would indeed exempt them from GDPR, then are all general purpose US news sites not specifically targeting the EU exempt too? Or let's go further, if I have a social media site and 99% of my users are Americans talking about US-related stuff, am I exempt too even if I let EU citizens register and participate?
- yorwba 6y ago
  > If all local EU news websites are covered because they're offering a service just by being a news website, then it follows that US sites are offering a service too. The only remaining part is to prove intent. They aren't because ... the mere accessibility of the ... website in the Union ... is insufficient to ascertain such intention Local EU websites are covered by virtue of being EU websites, not because they're accessible in the EU. > Conversely, if this would indeed exempt them from GDPR, then are all general purpose US news sites not specifically targeting the EU exempt too? Yes. > if I have a social media site and 99% of my users are Americans talking about US-related stuff, am I exempt too even if I let EU citizens register and participate? Yes, unless you're targeting EU citizens by e.g. offering interface localization in EU languages or setting growth targets for the European market in statements to your investors etc.
  - auganov 6y ago
    > ... the mere accessibility of the ... website in the Union ... is insufficient to ascertain such intention > Local EU websites are covered by virtue of being EU websites, not because they're accessible in the EU. None of this talks about nature of the content. None of this talks about how few EU users you have. It clearly talks about providing goods or services to EU citizens with some degree of intent[0]. If providing news to people isn't providing a service then any news site should be exempt regardless of content and userbase. The "mere accessibility" part says it wouldn't be enough to prove your intention to provide goods or services to EU citizens. If you're a local bakery that only sells locally it's pretty clearly you're safe. The information on your website is not the service you're providing. And it would be very hard to argue you're somehow benefiting from or expecting EU visitors. [0] and the "envisages offering" language is arguably an even lesser standard than the also mentioned "intention"