4 ms·

I understand that GDPR is based on where the data [edit reflecting comments below:] originates. The law doesn't make reference to citizenship or residency. If

I understand that GDPR is based on where the data [edit reflecting comments below:] originates. The law doesn't make reference to citizenship or residency. If you're physically in an EU country then EU GDPR applies to you there; if you're physically in the UK then UK GDPR applies to you there.

munchbunny 6y ago
GDPR is generally based on where the data is located That is not correct. Specifically, the counterexample is if you are a EU citizen living in an EU country and the actual bits are stored in a datacenter in Texas. GDPR still applies in this case, as long as the website owner accepts EU users. If the website specifically doesn't do business in the EU, things are different.
- throwaway2245 6y ago
  Ah, apologies, you're right to pick that up, it's not quite what I meant. Maybe "where the data originates" is better? Since the data originates where you are, the data has crossed a border to get to Texas and is therefore subject to GDPR (extra-territorially), I agree. If you were in Texas when that data was collected from you, and you returned to the EU, I doubt that GDPR would apply to that data.
  - PHGamer 6y ago
    gpdr on the other hand is tough to enforce on companies who wholly are in the US. from a sovereign perspective the EU can pound sand when telling Americans how to treat people in their own land. The only reason the EU is able to get away with this to a degree is the american governments wish cooperation to a point and our treaties. However, I suspect america will only tolerate so much push from the EU.
    - tpxl 6y ago
      > gpdr on the other hand is tough to enforce on companies who wholly are in the US. If you do actual business in the EU they can block financial transactions, and if you don't do business in the EU, there isn't really any incentive to (ab)use the data GDPR covers?
      - munchbunny 6y ago
        Yup that's the idea, the EU is a big market and GDPR is the cost of doing business there. As a startup though, it's absolutely part of your calculus. If you are worried about GDPR compliance, you can choose to just not launch in the EU (actually that might not be enough, I believe you may need to actively refuse EU users) until after you've proven the concept. Although with California's CCPA, depending on the specifics of your situation, you may as well just carve out some time to deal with compliance.
  - tpxl 6y ago
    >If you were in Texas when that data was collected from you, and you returned to the EU, I doubt that GDPR would apply to that data. Afaik GDPR covers EU citizens traveling abroad, as well as non-EU citizens in the EU. Edit: It does not cover EU citizens traveling abroad, see thread below.
    - throwaway2245 6y ago
      Afaik GDPR does not cover EU citizens (or residents) travelling outside the EU, but of course there is no harm for companies acting like it does.
      - tpxl 6y ago
        I have looked around a bit, and apparently GDPR applies to: - People in the EU - Any data being processed in the EU, regardless of where the person is located
      - jnxx 6y ago
        But as far as I understand, it applies to UK citizens which are traveling in the EU, because they are located in the EU: https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1528874672298&uri=CELEX:02016R0679-20160504 https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15288746...
  - munchbunny 6y ago
    If you were in Texas when that data was collected from you, and you returned to the EU, I doubt that GDPR would apply to that data. I believe that is still covered by GDPR, but I'll openly admit that I specifically chose the counterexample in order to stay within my factual memory of the law.

munchbunny 6y ago

GDPR is generally based on where the data is located That is not correct. Specifically, the counterexample is if you are a EU citizen living in an EU country and the actual bits are stored in a datacenter in Texas. GDPR still applies in this case, as long as the website owner accepts EU users. If the website specifically doesn't do business in the EU, things are different.

throwaway2245 6y ago
Ah, apologies, you're right to pick that up, it's not quite what I meant. Maybe "where the data originates" is better? Since the data originates where you are, the data has crossed a border to get to Texas and is therefore subject to GDPR (extra-territorially), I agree. If you were in Texas when that data was collected from you, and you returned to the EU, I doubt that GDPR would apply to that data.
- PHGamer 6y ago
  gpdr on the other hand is tough to enforce on companies who wholly are in the US. from a sovereign perspective the EU can pound sand when telling Americans how to treat people in their own land. The only reason the EU is able to get away with this to a degree is the american governments wish cooperation to a point and our treaties. However, I suspect america will only tolerate so much push from the EU.
  - tpxl 6y ago
    > gpdr on the other hand is tough to enforce on companies who wholly are in the US. If you do actual business in the EU they can block financial transactions, and if you don't do business in the EU, there isn't really any incentive to (ab)use the data GDPR covers?
    - munchbunny 6y ago
      Yup that's the idea, the EU is a big market and GDPR is the cost of doing business there. As a startup though, it's absolutely part of your calculus. If you are worried about GDPR compliance, you can choose to just not launch in the EU (actually that might not be enough, I believe you may need to actively refuse EU users) until after you've proven the concept. Although with California's CCPA, depending on the specifics of your situation, you may as well just carve out some time to deal with compliance.
- tpxl 6y ago
  >If you were in Texas when that data was collected from you, and you returned to the EU, I doubt that GDPR would apply to that data. Afaik GDPR covers EU citizens traveling abroad, as well as non-EU citizens in the EU. Edit: It does not cover EU citizens traveling abroad, see thread below.
  - throwaway2245 6y ago
    Afaik GDPR does not cover EU citizens (or residents) travelling outside the EU, but of course there is no harm for companies acting like it does.
    - tpxl 6y ago
      I have looked around a bit, and apparently GDPR applies to: - People in the EU - Any data being processed in the EU, regardless of where the person is located
    - jnxx 6y ago
      But as far as I understand, it applies to UK citizens which are traveling in the EU, because they are located in the EU: https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1528874672298&uri=CELEX:02016R0679-20160504 https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15288746...
- munchbunny 6y ago
  If you were in Texas when that data was collected from you, and you returned to the EU, I doubt that GDPR would apply to that data. I believe that is still covered by GDPR, but I'll openly admit that I specifically chose the counterexample in order to stay within my factual memory of the law.