4 ms·

Question to anyone who knows; I am assuming if you don’t live in the EU they can’t make you pay a fine. What do they actually do to stop you from doing business

Question to anyone who knows; I am assuming if you don’t live in the EU they can’t make you pay a fine. What do they actually do to stop you from doing business in the EU then? Do they outright block your website? I can’t think of how they’d stop you from collecting ad revenue from EU visitors otherwise.

kstrauser 5y ago
I'm curious about this, too. I once commented that, say, my hobby website isn't subject to the GDPR because I love, work, and play in the US and that's where my blog is, too. Turns out some people have very strong opinions about this and insisted that I am subject to the GDPR. But as a practical matter, how? I don't have a presence outside the US. Even if I violated a EU law, is there a reason I'd ever need to care? For instance, I know I've violated some Chinese laws by criticizing their government, but I'm OK with that because, really, what are they going to do about it? As an aside, I'm completely behind GDPR, CCPA, and related privacy laws. I think they're great. I definitely comply with the spirit of the laws in my hobby projects by doing things like not tracking anonymous users, not retaining identifiable logs, etc. This isn't me trying to get away with something nefarious. More like, I don't (and won't) bother with things like cookie banners even if GDPR would want me to.
- wizzwizz4 5y ago
  GDPR doesn't actually require cookie banners. If all the tracking and data protection you do is justified, justifiable and obviously necessary for the lowest-common-denominator service you provide, you don't even need to ask for consent (though do let your users know what's up, anyway, with at minimum a Privacy Notice in the footer, because that's just common decency). If a company asks for GDPR consent, either: • They have cool, optional features of their site / service / system (though they could just ask at run-time, when you try to use those features, in most cases); or • They're doing something dodgy and want to wave a magic wand and remove the dodginess by getting you to “consent”.
- dtech 5y ago
  Worst case they could block your site, but that's not going to happen. Note that if it is a personal website you are not subject to GDPR. GDPR only applies to companies and organizations. Also note that most stuff that a layperson would say is reasonable for a website to function isn't a problem in GDPR.
  - jimmaswell 5y ago
    > most stuff that a layperson would say is reasonable for a website to function isn't a problem in GDPR. Except revenue of course.
    - dtech 5y ago
      You can advertise perfectly fine, just not track users to show personalized ads. These were the norm in advertising until like 2005.
- prima_cookie 5y ago
  If you're not doing business in or with any EU entities there's not much they can do
Barrin92 5y ago
Yes if push comes to shove they could obviously just shut down websites or go after companies that continue to use Disqus and they in turn will drop it. There's also plenty of countries outside the EU who have adopted GDPR compatible laws and so the EU could likely pursue them in their national jurisdictions. Also EU and US regulatory agencies tend to cooperate routinely because it's in either case to keep market access so if the case is large enough I wouldn't bet on being sheltered from enforcement. There was for example one case of Canadian firm 'AggregateIQ' being pursued by the UK's ICO over privacy violations, and Canadian regulators agreed. https://www.theguardian.com/world/2019/nov/26/brexit-data-firm-aggregateiq-broke-canadian-privacy-laws-watchdog-finds https://www.theguardian.com/world/2019/nov/26/brexit-data-fi...
- upofadown 5y ago
  The article does not contain the string "ICO". The article describes enforcement of Canadian privacy law against a Canadian company.
  - Barrin92 5y ago
    The ICO's GDPR enforcement action is what set this in motion, (which to be honest is the first result on Google if you want the entire saga) https://iapp.org/news/a/ico-serves-aggregateiq-with-first-ever-gdpr-formal-notice/ https://iapp.org/news/a/ico-serves-aggregateiq-with-first-ev...
    - upofadown 5y ago
      The article contains no reference to the Canadian enforcement action. It is about a European enforcement action against the Canadian company in question for work it did in Europe.
      - Barrin92 5y ago
        Dude are you intentionally trying to be obtuse. The British data watchdog noticed that a Canadian company, AggregateIQ, was mistreating data relating to the Brexit campaign. It then talked to the Canadian data watchdog, which pursued a privacy inquiry against said company because of its mistreatment of British user data. This is one of the first examples of the sort of extrajudicial enforcement of GDPR that OP wanted to know about, Jesus.

kstrauser 5y ago

I'm curious about this, too. I once commented that, say, my hobby website isn't subject to the GDPR because I love, work, and play in the US and that's where my blog is, too. Turns out some people have very strong opinions about this and insisted that I am subject to the GDPR. But as a practical matter, how? I don't have a presence outside the US. Even if I violated a EU law, is there a reason I'd ever need to care? For instance, I know I've violated some Chinese laws by criticizing their government, but I'm OK with that because, really, what are they going to do about it? As an aside, I'm completely behind GDPR, CCPA, and related privacy laws. I think they're great. I definitely comply with the spirit of the laws in my hobby projects by doing things like not tracking anonymous users, not retaining identifiable logs, etc. This isn't me trying to get away with something nefarious. More like, I don't (and won't) bother with things like cookie banners even if GDPR would want me to.

wizzwizz4 5y ago
GDPR doesn't actually require cookie banners. If all the tracking and data protection you do is justified, justifiable and obviously necessary for the lowest-common-denominator service you provide, you don't even need to ask for consent (though do let your users know what's up, anyway, with at minimum a Privacy Notice in the footer, because that's just common decency). If a company asks for GDPR consent, either: • They have cool, optional features of their site / service / system (though they could just ask at run-time, when you try to use those features, in most cases); or • They're doing something dodgy and want to wave a magic wand and remove the dodginess by getting you to “consent”.
dtech 5y ago
Worst case they could block your site, but that's not going to happen. Note that if it is a personal website you are not subject to GDPR. GDPR only applies to companies and organizations. Also note that most stuff that a layperson would say is reasonable for a website to function isn't a problem in GDPR.
- jimmaswell 5y ago
  > most stuff that a layperson would say is reasonable for a website to function isn't a problem in GDPR. Except revenue of course.
  - dtech 5y ago
    You can advertise perfectly fine, just not track users to show personalized ads. These were the norm in advertising until like 2005.
prima_cookie 5y ago
If you're not doing business in or with any EU entities there's not much they can do

Barrin92 5y ago

Yes if push comes to shove they could obviously just shut down websites or go after companies that continue to use Disqus and they in turn will drop it. There's also plenty of countries outside the EU who have adopted GDPR compatible laws and so the EU could likely pursue them in their national jurisdictions. Also EU and US regulatory agencies tend to cooperate routinely because it's in either case to keep market access so if the case is large enough I wouldn't bet on being sheltered from enforcement. There was for example one case of Canadian firm 'AggregateIQ' being pursued by the UK's ICO over privacy violations, and Canadian regulators agreed. https://www.theguardian.com/world/2019/nov/26/brexit-data-firm-aggregateiq-broke-canadian-privacy-laws-watchdog-finds https://www.theguardian.com/world/2019/nov/26/brexit-data-fi...

upofadown 5y ago
The article does not contain the string "ICO". The article describes enforcement of Canadian privacy law against a Canadian company.
- Barrin92 5y ago
  The ICO's GDPR enforcement action is what set this in motion, (which to be honest is the first result on Google if you want the entire saga) https://iapp.org/news/a/ico-serves-aggregateiq-with-first-ever-gdpr-formal-notice/ https://iapp.org/news/a/ico-serves-aggregateiq-with-first-ev...
  - upofadown 5y ago
    The article contains no reference to the Canadian enforcement action. It is about a European enforcement action against the Canadian company in question for work it did in Europe.
    - Barrin92 5y ago
      Dude are you intentionally trying to be obtuse. The British data watchdog noticed that a Canadian company, AggregateIQ, was mistreating data relating to the Brexit campaign. It then talked to the Canadian data watchdog, which pursued a privacy inquiry against said company because of its mistreatment of British user data. This is one of the first examples of the sort of extrajudicial enforcement of GDPR that OP wanted to know about, Jesus.