4 ms·

No, it applies to every resident in EU and EU citizens all over the world. Edit: https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ ("where Memb

No, it applies to every resident in EU and EU citizens all over the world. Edit: https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ ("where Member State law applies" and "subjects who are in the Union" [...] "regardless of whether the processing takes place in the Union or not" respectively) Edit 2: https://gdpr.eu/companies-outside-of-europe/ https://gdpr.eu/companies-outside-of-europe/ for more info: "The whole point of the GDPR is to protect data belonging to EU citizens and residents. The law, therefore, applies to organizations that handle such data whether they are EU-based organizations or not, known as “extra-territorial effect.”"

yohannparis 6y ago
Yes it apply to residents in the EU, but not EU citizens outside of the EU. Unless I misread the link.
beardbound 6y ago
I read that and it said that it applies to data not processed in the EU. I always interpreted that as applying to data centers and such in something like an was availability zone in the US. It said “ the monitoring of their behaviour as far as their behaviour takes place within the Union.” I never thought that applied to EU citizens all over the world. EU citizens living in another jurisdiction would be subject to that jurisdictions laws right? For instance GDPR wouldn’t apply to a Spanish expat that lives in Thailand, as far as I understand it.
- dathinab 6y ago
  Yes, but if you reside in Spain and use a VPN with Thai exit node to access a site in Thailand you are stil residing in the EU and in turn the Thai website needs to comply with GDPR. Through non compliance can only be enforced if the entity behind the website/app or similar does enter the EU or does business with the EU.
outside1234 6y ago
They can't apply EU law to citizens residing outside of the union.
- smarx007 6y ago
  Well, somehow we in EU have to comply with DMCA, which is not an EU law. Every company that _does business in_ EU can get in trouble for not following EU law irrespective where it violated that law.
  - anticensor 6y ago
    EU has DOCDSM instead.
- rndgermandude 6y ago
  Sure they can, at least in theory. US citizens have to pay taxes no matter where they reside. Most countries will prosecute certain crimes abroad if those crimes were committed by their citizens or against their citizens or against the state. The practical question is just if they can get hold of the people acting unlawfully.
dathinab 6y ago
And as far as I know there is no ruling that using a VPN or other kind of proxy does make you count as "being in the country of the exit node wrt. actions done through the VPN". Which means that you can't say a user is not residing in the EU (without a popup asking the user if they are residing there... ;=) ). On the other hand if there would be such a law it would have kinda interesting consequences.
caminocorner 6y ago
What about former EU residents? (such as the Brits; or foreign residents)
- type0 6y ago
  Brits are being bunched up with Californians in FB terms https://www.independent.co.uk/life-style/gadgets-and-tech/facebook-uk-brexit-us-california-gdpr-privacy-protections-b1774918.html https://www.independent.co.uk/life-style/gadgets-and-tech/fa...
- deleted 6y ago
  [deleted]
- jeroenhd 6y ago
  The GDPR is implemented in British law, that's how these directives work. Once the UK leaves the EU, they're no longer obliged to keep their implementation of the GDPR. The government can choose to keep their implementation, and in practice keep the same regulations as the GDPR, or they could reduce or remove their privacy protection laws as they see fit. With London being famous for their camera surveillance, I expect the UK to reduce some if not all of the privacy protections the GDPR brought to the world.
  - M2Ys4U 6y ago
    The GDPR is a regulation (hence the R at the end) not a directive. It became UK law as soon as it was passed by the EU, and it didn't need to be implemented in to UK law. The UK has already passed their amendments to the GDPR,[0] which will effectively fork it into the "UK GDPR". These will come in to force on the 1st of January. There's a "Keeling Schedule" available[1], which is effectively a diff between the EU GDPR and the UK GDPR. [0] https://www.legislation.gov.uk/uksi/2019/419/introduction/made https://www.legislation.gov.uk/uksi/2019/419/introduction/ma... [1] https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/779335/Keeling_Schedule_for_GDPR.pdf https://assets.publishing.service.gov.uk/government/uploads/...
lmkg 6y ago
The cookie banner is NOT regulated by the GDPR. It's related to the ePrivacy Directive, which is deeply intertwined with GDPR but a separate piece of legislation. It's not clear whether the GDPR's territorial applicability also holds for ePD. France in particular is drawing a divide between GDPR and ePD, because ePD lets them fine Google directly but GDPR require they mediate through the Irish DPA.
- rndgermandude 6y ago
  The "cookie law" as part of the ePD is indeed older than the GDPR, but the GDPR kinda supersedes it by including all tracking/data collection not just cookie data collection. It's also not entirely correct that the GDPR would require going through the Irish DPA or wherever a company in violation has their primary EU presence for tax purposes. True, the GDPR says the nation where a company has the primary presence of business within the EU take lead within the EU should take lead, but the French courts figured out that Google's Irish subsidy is actually not making any decisions, the US parent is, and therefore it's fine for the French watchdog to issue fines skipping Ireland [1]. [1] https://techcrunch.com/2020/06/19/french-court-slaps-down-googles-appeal-against-57m-gdpr-fine/ https://techcrunch.com/2020/06/19/french-court-slaps-down-go...
  - lmkg 6y ago
    Alright, so this gets in the weeds. GDPR does not supercede the ePD. The ePD is, according to its own text, a law that extends the general privacy regulations to certain aspects of internet technology. So in many cases it defers out to the general privacy law in effect. When ePD was passed, that law was the DPD, Data Privacy Directive. When GDPR was passed, all ePD references to the DPD became references to GDPR instead (this is Article 94 of GDPR). But ePD remains entirely in effect, just with updated references. Most importantly, ePD requires Consent in certain cases, but defers to DPD/GDPR for what is the definition of consent. GDPR's definition of consent is much more stringent. In cases where the ePD did not refer out to DPD, it remains unchanged by the passage of GDPR. So, according to CNIL, it does not include the one-stop-shop mechanism. See section "The competence of the CNIL" in the link below: https://www.cnil.fr/en/cookies-financial-penalties-60-million-euros-against-company-google-llc-and-40-million-euros-google-ireland https://www.cnil.fr/en/cookies-financial-penalties-60-millio...

yohannparis 6y ago

Yes it apply to residents in the EU, but not EU citizens outside of the EU. Unless I misread the link.

beardbound 6y ago

I read that and it said that it applies to data not processed in the EU. I always interpreted that as applying to data centers and such in something like an was availability zone in the US. It said “ the monitoring of their behaviour as far as their behaviour takes place within the Union.” I never thought that applied to EU citizens all over the world. EU citizens living in another jurisdiction would be subject to that jurisdictions laws right? For instance GDPR wouldn’t apply to a Spanish expat that lives in Thailand, as far as I understand it.

dathinab 6y ago
Yes, but if you reside in Spain and use a VPN with Thai exit node to access a site in Thailand you are stil residing in the EU and in turn the Thai website needs to comply with GDPR. Through non compliance can only be enforced if the entity behind the website/app or similar does enter the EU or does business with the EU.

outside1234 6y ago

They can't apply EU law to citizens residing outside of the union.

smarx007 6y ago
Well, somehow we in EU have to comply with DMCA, which is not an EU law. Every company that _does business in_ EU can get in trouble for not following EU law irrespective where it violated that law.
- anticensor 6y ago
  EU has DOCDSM instead.
rndgermandude 6y ago
Sure they can, at least in theory. US citizens have to pay taxes no matter where they reside. Most countries will prosecute certain crimes abroad if those crimes were committed by their citizens or against their citizens or against the state. The practical question is just if they can get hold of the people acting unlawfully.

dathinab 6y ago

And as far as I know there is no ruling that using a VPN or other kind of proxy does make you count as "being in the country of the exit node wrt. actions done through the VPN". Which means that you can't say a user is not residing in the EU (without a popup asking the user if they are residing there... ;=) ). On the other hand if there would be such a law it would have kinda interesting consequences.

caminocorner 6y ago

What about former EU residents? (such as the Brits; or foreign residents)

type0 6y ago
Brits are being bunched up with Californians in FB terms https://www.independent.co.uk/life-style/gadgets-and-tech/facebook-uk-brexit-us-california-gdpr-privacy-protections-b1774918.html https://www.independent.co.uk/life-style/gadgets-and-tech/fa...
deleted 6y ago
[deleted]
jeroenhd 6y ago
The GDPR is implemented in British law, that's how these directives work. Once the UK leaves the EU, they're no longer obliged to keep their implementation of the GDPR. The government can choose to keep their implementation, and in practice keep the same regulations as the GDPR, or they could reduce or remove their privacy protection laws as they see fit. With London being famous for their camera surveillance, I expect the UK to reduce some if not all of the privacy protections the GDPR brought to the world.
- M2Ys4U 6y ago
  The GDPR is a regulation (hence the R at the end) not a directive. It became UK law as soon as it was passed by the EU, and it didn't need to be implemented in to UK law. The UK has already passed their amendments to the GDPR,[0] which will effectively fork it into the "UK GDPR". These will come in to force on the 1st of January. There's a "Keeling Schedule" available[1], which is effectively a diff between the EU GDPR and the UK GDPR. [0] https://www.legislation.gov.uk/uksi/2019/419/introduction/made https://www.legislation.gov.uk/uksi/2019/419/introduction/ma... [1] https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/779335/Keeling_Schedule_for_GDPR.pdf https://assets.publishing.service.gov.uk/government/uploads/...

lmkg 6y ago

The cookie banner is NOT regulated by the GDPR. It's related to the ePrivacy Directive, which is deeply intertwined with GDPR but a separate piece of legislation. It's not clear whether the GDPR's territorial applicability also holds for ePD. France in particular is drawing a divide between GDPR and ePD, because ePD lets them fine Google directly but GDPR require they mediate through the Irish DPA.

rndgermandude 6y ago
The "cookie law" as part of the ePD is indeed older than the GDPR, but the GDPR kinda supersedes it by including all tracking/data collection not just cookie data collection. It's also not entirely correct that the GDPR would require going through the Irish DPA or wherever a company in violation has their primary EU presence for tax purposes. True, the GDPR says the nation where a company has the primary presence of business within the EU take lead within the EU should take lead, but the French courts figured out that Google's Irish subsidy is actually not making any decisions, the US parent is, and therefore it's fine for the French watchdog to issue fines skipping Ireland [1]. [1] https://techcrunch.com/2020/06/19/french-court-slaps-down-googles-appeal-against-57m-gdpr-fine/ https://techcrunch.com/2020/06/19/french-court-slaps-down-go...
- lmkg 6y ago
  Alright, so this gets in the weeds. GDPR does not supercede the ePD. The ePD is, according to its own text, a law that extends the general privacy regulations to certain aspects of internet technology. So in many cases it defers out to the general privacy law in effect. When ePD was passed, that law was the DPD, Data Privacy Directive. When GDPR was passed, all ePD references to the DPD became references to GDPR instead (this is Article 94 of GDPR). But ePD remains entirely in effect, just with updated references. Most importantly, ePD requires Consent in certain cases, but defers to DPD/GDPR for what is the definition of consent. GDPR's definition of consent is much more stringent. In cases where the ePD did not refer out to DPD, it remains unchanged by the passage of GDPR. So, according to CNIL, it does not include the one-stop-shop mechanism. See section "The competence of the CNIL" in the link below: https://www.cnil.fr/en/cookies-financial-penalties-60-million-euros-against-company-google-llc-and-40-million-euros-google-ireland https://www.cnil.fr/en/cookies-financial-penalties-60-millio...