3 ms·

'target the EU market' is vague. These are independent operators, NGOs etc, services being 'used by EU citizens' not really 'targeting Europeans'. From a liab

'target the EU market' is vague. These are independent operators, NGOs etc, services being 'used by EU citizens' not really 'targeting Europeans'. From a liability perspective, to the author's point these services I suppose would have to just filter out European sources? Why would they publish a regulation so obviously vague, full well knowing the reality on the ground? Why wouldn't they use language that unambiguously places NASA etc. firmly 'in our out' of the regulations or, some criteria which they would be one way or another? Seems odd.

oaiey 6y ago
That is exactly how gdpr is set up. Which is good. Regards NGOs: just because you do not make money does not make you a saint. Regards vagueness: if you want to survive in an agile environment without rewriting every second day, vagueness is the way to go.
- EricE 6y ago
  >That is exactly how gdpr is set up. Which is good. So if the US comes out with "GDPR- The Next Generation" with similar mandates towards the EU would that also be "good"? Asking for a friend.
  - oaiey 6y ago
    FISA courts and the law they are based on? The US is explicitly or implicitly doing this all the time. Or the Hague invasion act which is pretty much that case (US soldier are protected abroad against international treaties).
  - yxhuvud 6y ago
    Yes, it most certainly would be good.
latk 6y ago
The text in question does define more closely what it means to offer services in the EU. To lawyers (and to anyone who has experience with GDPR compliance) this is not a particularly vague statement. Admittedly, there's no unambiguous bright line definition, but there's a lot of jurisprudence on the matter. In reality, the question is not whether EU citizens will use these services, but whether the operator of the service is targeting people in the EU, i.e. whether the operator intends or reasonably expects for EU people to use their service. A US service will most likely be fine if their reasoning goes something like this: (1) We primarily intend to serve connections from the US. (2) This expectation is reasonable based on our network topology. (3) But we don't care if someone else connects. It would not be appropriate to exempt specific organizations since those organizations may change their targeting in the future. It already exempts most non-EU organizations, due to the criterion that they don't target the EU. We had the same panicking in 2018 when the GDPR came into force and – quelle surprise – there are no fines for random international websites. The EU doesn't insert itself into your affairs if you don't insert yourself into the EU market.

oaiey 6y ago

That is exactly how gdpr is set up. Which is good. Regards NGOs: just because you do not make money does not make you a saint. Regards vagueness: if you want to survive in an agile environment without rewriting every second day, vagueness is the way to go.

EricE 6y ago
>That is exactly how gdpr is set up. Which is good. So if the US comes out with "GDPR- The Next Generation" with similar mandates towards the EU would that also be "good"? Asking for a friend.
- oaiey 6y ago
  FISA courts and the law they are based on? The US is explicitly or implicitly doing this all the time. Or the Hague invasion act which is pretty much that case (US soldier are protected abroad against international treaties).
- yxhuvud 6y ago
  Yes, it most certainly would be good.

latk 6y ago

The text in question does define more closely what it means to offer services in the EU. To lawyers (and to anyone who has experience with GDPR compliance) this is not a particularly vague statement. Admittedly, there's no unambiguous bright line definition, but there's a lot of jurisprudence on the matter. In reality, the question is not whether EU citizens will use these services, but whether the operator of the service is targeting people in the EU, i.e. whether the operator intends or reasonably expects for EU people to use their service. A US service will most likely be fine if their reasoning goes something like this: (1) We primarily intend to serve connections from the US. (2) This expectation is reasonable based on our network topology. (3) But we don't care if someone else connects. It would not be appropriate to exempt specific organizations since those organizations may change their targeting in the future. It already exempts most non-EU organizations, due to the criterion that they don't target the EU. We had the same panicking in 2018 when the GDPR came into force and – quelle surprise – there are no fines for random international websites. The EU doesn't insert itself into your affairs if you don't insert yourself into the EU market.