4 ms·
Thank you, that is an important distinction I did not know about. So after all geofencing is a sufficient signal to avoid falling under GDPR, unless there are
by pestaa 6y ago
Thank you, that is an important distinction I did not know about.
So after all geofencing is a sufficient signal to avoid falling under GDPR, unless there are other explicit ways to do business with them from the EU.
For example, if a web store blocks my IP, but I can place an order with an EU country address through a VPN, they are nonetheless obligated to process my data according to EU regulations.
Is this a correct interpretation?
- Kalium 6y agoI have some doubts on several points. First, that sounds like a pretty clear signal that the business is pointedly not targeting EU citizens. Such a business would not be envisaging "offering services to data subjects in one or more Member States in the Union". Second, that business probably does not operate in any meaningful way in the EU, making any obligations under GDPR a matter of legal fiction. With no kind of enforceability, any GDPR rights or obligations are meaningless.
- PeterisP 6y agoIf some online store is getting payments from EU credit cards and sending goods to EU, then they obviously do offer services in EU. There are also some plausible options for enforceability (e.g. seizing all payments from EU), however, the major obstacle is that no regulator will care enough to try and enforce anything for a small scale foreign site. Their #1 enforcement priority is on EU businesses mishandling private data (e.g. loyalty programs of brick-and-mortar shops, telecommunications providers, lenders, etc), and #2 priority is the major online players that each affect millions of people. Most regulators still have a backlog on #1, they're just starting the first enforcement actions on #2, so any attempt for small foreign sites is years away at best.