8 ms·
Does the GDPR apply to companies outside of the EU?
- Zenst 5y agoIn the UK - Yes currently, though that may well diverge as it was incorporated into UK Data Protection laws. Better explained here: https://ico.org.uk/for-organisations/dp-at-the-end-of-the-transition-period/transition-period-faqs/#gdpr https://ico.org.uk/for-organisations/dp-at-the-end-of-the-tr...
- djoldman 5y agocache if it gets hugged to death: http://webcache.googleusercontent.com/search?q=cache:AerXIhX4VtwJ:https://gdpr.eu/companies-outside-of-europe/&hl=en&gl=us&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:AerXIhX...
- djoldman 5y agoI think one of the relevant passages is: > Suppose you run a golf course in Manitoba focused exclusively on your local area, but sometimes people in France stumble across your site. Would you find yourself in the crosshairs of European regulators? It’s not likely. But technically you could be held accountable for tracking these data. This, combined with the <250 employees = lower obligations, seems to indicate one should worry about the GDPR but in proportion to the size of your company (outside the EU). The bigger you are, the more seriously you should take it, I guess?
- iso1631 5y agoI don't understand how that meshes with the previous paragraph > The Internet makes goods and services in far-flung places accessible anywhere in the world. A teenager in Cyprus could easily order a pizza online from a local pizza shop in Miami and have it delivered to a friend’s house there. But the GDPR does not apply to occasional instances. Rather, regulators look for other clues to determine whether the organization set out to offer goods and services to people in the EU.
- tchock23 5y agoThe lower employee cap is only for some record keeping. The provisions still apply otherwise. See this article on the 30.5 section for details: https://www.scl.org/articles/10114-article-30-gdpr-what-does-the-paragraph-5-exemption-really-mean-for-smaller-organisations https://www.scl.org/articles/10114-article-30-gdpr-what-does...
- hak8or 5y agoIf it applies or not us irrelevant, what only matters is to what degree is it able to be enforced (and in practice) against companies that have no assets under EU jurisdiction. From what I gather, it's very little, so most smaller companies simply don't care.
- LatteLazy 5y agoCareful. That's what they say about US laws, then your CFO gets arrested in Canada and extradited to the US...
- iso1631 5y agoOr New Zealand police raid your house at the behest of the US department of justice
- andi999 5y agothis could turn out mega-embarrassing for NZ.
- sabalaba 5y agoPretty sure that both instances you're talking about (Huawei/Megaupload) are perfect examples of parent's point --- the US is capable of enforcing laws outside of its territory, the EU is not.
- SimeVidas 5y agoFWIW, I can’t access some US news sites from Europe because they “value my privacy and haven’t implemented GDPR yet.”
- marban 5y agoI wish there were more news sites with a light-weight EU equivalent. https://eu.usatoday.com https://eu.usatoday.com comes to mind.
- cerved 5y agoIt's pity we're excluded from Freedom Tracking
- raverbashing 5y agoYeah, it's a bit funny how (Small Regional News Site) thinks they'll be the main targets of GDPR regulators. While it's good they try to respect it, the fact that's there's an fundamental "local" nature to them, makes it very unlikely. Very very unlikely.
- vidarh 5y agoA lot of the blocks are down to "Small Regional News Site" really being "small regional front for a large news organisation running a single platform" that seems to have just made a blanket assessment. I don't think many genuinely small independent regional sites have bothered. E.g. Lee Enterprises is one of the publishers who still blocks European users, and they own 75+ newspapers. If you're in the EU and get "451: Unavailable due to legal reasons", it's a good chance it's a Lee Enterprises paper.
- anoncake 5y agoUnderstandable, it has been passed only five years ago and been applicable for three.
- waynesonfire 5y agosometimes maintaining two systems is more trouble. also, CCPA closes this gap, as it's not only EU customers you have to worry about.
- jaywalk 5y agoI think the pragmatic answer to this question is another question: do you have any operations that fall under EU jurisdiction? If yes, then they have the ability to punish you and you need to follow the GDPR. If no, then the GDPR is just as irrelevant as any other EU regulation and can safely be ignored.
- lbarrow 5y agoI love how even gdpr.eu has a cookie acceptance banner. Man, they really screwed the cookie law up.
- lmkg 5y agoThe website has no relation with the law, and is not an authoritative source of information. It's not even a particularly good one. It's just a website run by some guys.
- lbarrow 5y agoAh, that makes more sense then.
- choeger 5y agoCookies per se have nothing to do with the GDPR. In fact, if your cookie is not tied to a natural person, the GDPR does not even apply. Also, cookies are under your control. You can alter and delete them whenever you want. As an example: If your site allows different styles or languages and you want to store the setting in a cookie, you do not have to care about the GDPR. Only when you track your user's behavior with a cookie, the cookie banner thing becomes relevant.
- lbarrow 5y agoI meant the cookie law. I'll update my comment to clarify.
- iso1631 5y agoNote: "This is not an official EU Commission or Government resource" Which explains idiocy like > We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it. Is simply not on. You can't assume acceptance.
- miav 5y agoThis and the fact that uBlock detects 9 trackers on the site is quite puzzling given that its basically an ad/pr stunt by protonmail which itself generally doesn't have any trackers/cookie pop-ups
- dred_prte_rbrts 5y agoThis is a violation of the regulator guidance for the ePrivacy Directive. So I wouldn't trust anything on this site when they themselves aren't compliant with EU directives and regulations.
- sabjut 5y agoTo be fair the content is probably produced by a separate team which is not maintaining the actual website. Law experts don't code webpages. But this is embarrassing nevertheless.
- tokai 5y agoIts produced by protonmail.
- matsemann 5y agoNot true. You don't have to consent to set a cookie. It depends on what the cookie does. Gdpr actually doesn't care about technicalities like cookies, but about privacy. So if you achieve the same tracking using other techniques (like Etag) that needs consent as well.
- deleted 5y ago[deleted]
- slownews45 5y agoYou can do a block for GDPR countries and avoid the issue entirely. We did that and its worked out fine. This also helps avoid the cookie notice hell that you get if you design for the EU market - if you go to an EU page you can get a full page of cookie notices. Cloudfront has a geo restrictions option that works well for this.
- CrLf 5y agoYou don't need cookie notices for functional cookies (user preferences, load-balancing, session).
- slownews45 5y agoYou don't know what you do and don't need to do. Literally the page linked here has lots of comments that they are doing cookie notices wrong / should be in jail etc. Some people don't have time for all this lawyering just to post a few things online.
- hef19898 5y agoYou could also just put in one pop-up, accept all, reject all, customize. No big deal, is it?
- tjoff 5y agoBecause not exploiting your users is too much of a hassle for you?
- erik_seaberg 5y agoDon’t be evil is only the first step. You also have to hire specialists and delay launches to continually prove to many bureaucrats’ satisfaction that you are still not evil. Opting out is much cheaper, and maybe safer since the “doesn’t target serving individuals in the EU” language is relatively clear.
- slownews45 5y ago
- mbesto 5y agoNote - IANAL I deal with the question all of the time. My general, non legal view, is the following: - If your economics operate outside of the EU (e.g. you accept money from non EU, have offices outside of EU, etc.) then you don't need to comply, however the process to comply isn't entirely all that hard to do (see point #2). - GDPR is easy to comply with because you're either (1) at a scale where you have global operations so you're already or (2) you're at a scale where you don't really matter to the regulation, even if you have EU citizens in your DB. - If you get acquired by another biz that has operations in EU (but you don't), then the overall entity likely becomes susceptible to GDPR This is based on not a legal review, but rather a logistical one. In other words, if you don't have operations in the EU how on earth is the EU going to penalize you. Are EU cops (which don't exist?) going to show up at your door to collect money?
- preinheimer 5y agoFor me, the weirdest part about gdpr.eu is that it's run by the ProtonMail/ProtonVPN folks. Not like some EU agency. Which is why their sample data processing agreement is literally the ProntonMail one - https://gdpr.eu/data-processing-agreement/ https://gdpr.eu/data-processing-agreement/
- vmception 5y agoBrowsing the internet in Monaco is a disaster as it is not EU but physically surrounded
- deleted 5y ago[deleted]
- tokai 5y agoAnyone know anything about that Horizon 2020 project REP-791727-1? I can't find anything about it anywhere. There is a Horizon 2020 project with the ID 791727. But it is marked as closed, and is about funding of ProtonSuite and not disseminating information about GDPR. https://cordis.europa.eu/project/id/791727 https://cordis.europa.eu/project/id/791727
- anamax 5y agoSuppose that there was a crypto-currency exchange with no assets or presence in the EU. Moreover, their TOS says "no EU residents" AND they IP-block EU IP addresses. Some/many EU residents rent servers from AWS to do crypto-trading on this exchange. These servers are physically located outside the EU. These same residents also access the exchange's website using a VPN that says that that they're outside the EU. [1] Is this exchange subject to the GPDR wrt said EU residents? [2] Does this exchange subject to tax-reporting requirements of the various EU countries?
- anoncake 5y agoProbably not, unless pointlessly blocking EU residents is considered "targeting". > Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...