4 ms·

Even if the California law doesn't apply, if you operate a website with EU citizens as users, you're subject to the GDPR (and unless your website is extremely s

Even if the California law doesn't apply, if you operate a website with EU citizens as users, you're subject to the GDPR (and unless your website is extremely small or you explicitly block them, you've probably got some users from the EU). The GDPR has similar provisions to the CCPA, and some people do exercise their GDPR rights by sending emails like the ones the researchers sent. Which isn't to say that what the researchers did was acceptable -- just that it can still be a valuable educational experience for anyone unprepared to handle such a request.

matkoniecz 5y ago
> some people do exercise their GDPR rights by sending emails like the ones the researchers sent. Legitimate mails are OK. Mass send spam with illegitimate threats is still not. I am in large part irritated because it gives arguments to people who would want to get rid of such laws, makes harder to handle legitimate requests and spreads false info about such laws. > it can still be a valuable educational experience for anyone unprepared to handle such a request. And being robbed or having your country invaded also can be valuable lesson, which is not making it in any way acceptable or welcome.
joecool1029 5y ago
If they aren't an EU website, GDPR effectively doesn't apply. EU can word the law however they want but at least in the US without a treaty to enforce such a law, it lacks the force of law here. Europeans have an extremely hard time understanding this and I'm not quite sure why. I see this assertion again and again across the web.
- kstrauser 5y ago
  I've seen that too. I'm in the US, and not subject to the GDPR. I like the GDPR and totally approve of its goals. As a Californian, I'm glad we have the CCPA which is similar to it. I say this, then, as someone who supports the GDPR and appreciates it: I'm still not subject to it because I'm not inside its jurisdiction. Similarly, I'm certain I've broken laws in other jurisdictions, such as by criticizing fragile-egoed governments who make that illegal. Doesn't matter, they don't apply to me either.
  - Beldin 5y ago
    Slightly more nuanced: you do not foresee (and have no intention of) being anywhere where the laws you broke hold sway. There are laws that apply to anyone anywhere*; if you never have to worry about the consequences of breaking a law, you could choose to ignore it. * Belgium has one on warcrimes if memory serves; the GDPR might also apply to anyone handling an EU citizen's data (but IANAL).
  - tremon 5y ago
    This is a bit pedantic, but I'll make my point anyway: whether a law can apply to you is orthogonal to whether it can be enforced on you. The GDPR is very clear about its application, and it is explicitly extraterritorial [1]. Of course, it does have secondary provisions about company size and non-commercial activity (mainly recitals [13] and [18]) which limits its applicability, but from a legal definition point of view, "I don't live in the EU so the GDPR does not apply to me" is too simplistic. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ [13] https://gdpr-info.eu/recitals/no-13/ https://gdpr-info.eu/recitals/no-13/ [18] https://gdpr-info.eu/recitals/no-18/ https://gdpr-info.eu/recitals/no-18/
    - sergiotapia 5y ago
      Trinidad and Tobago might as well threaten the world as well with some weird clause. Fact is that EU GDPR has zero application here in the states.
michaelmrose 5y ago
Nobody in America is going to know about or expect to be bound to the laws of 100 different jurisdictions because in theory someone could visit from that country. Kind of like visitors from Spain don't bring with them Spanish laws when they visit Nevada.

matkoniecz 5y ago

> some people do exercise their GDPR rights by sending emails like the ones the researchers sent. Legitimate mails are OK. Mass send spam with illegitimate threats is still not. I am in large part irritated because it gives arguments to people who would want to get rid of such laws, makes harder to handle legitimate requests and spreads false info about such laws. > it can still be a valuable educational experience for anyone unprepared to handle such a request. And being robbed or having your country invaded also can be valuable lesson, which is not making it in any way acceptable or welcome.

joecool1029 5y ago

If they aren't an EU website, GDPR effectively doesn't apply. EU can word the law however they want but at least in the US without a treaty to enforce such a law, it lacks the force of law here. Europeans have an extremely hard time understanding this and I'm not quite sure why. I see this assertion again and again across the web.

kstrauser 5y ago
I've seen that too. I'm in the US, and not subject to the GDPR. I like the GDPR and totally approve of its goals. As a Californian, I'm glad we have the CCPA which is similar to it. I say this, then, as someone who supports the GDPR and appreciates it: I'm still not subject to it because I'm not inside its jurisdiction. Similarly, I'm certain I've broken laws in other jurisdictions, such as by criticizing fragile-egoed governments who make that illegal. Doesn't matter, they don't apply to me either.
- Beldin 5y ago
  Slightly more nuanced: you do not foresee (and have no intention of) being anywhere where the laws you broke hold sway. There are laws that apply to anyone anywhere*; if you never have to worry about the consequences of breaking a law, you could choose to ignore it. * Belgium has one on warcrimes if memory serves; the GDPR might also apply to anyone handling an EU citizen's data (but IANAL).
- tremon 5y ago
  This is a bit pedantic, but I'll make my point anyway: whether a law can apply to you is orthogonal to whether it can be enforced on you. The GDPR is very clear about its application, and it is explicitly extraterritorial [1]. Of course, it does have secondary provisions about company size and non-commercial activity (mainly recitals [13] and [18]) which limits its applicability, but from a legal definition point of view, "I don't live in the EU so the GDPR does not apply to me" is too simplistic. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ [13] https://gdpr-info.eu/recitals/no-13/ https://gdpr-info.eu/recitals/no-13/ [18] https://gdpr-info.eu/recitals/no-18/ https://gdpr-info.eu/recitals/no-18/
  - sergiotapia 5y ago
    Trinidad and Tobago might as well threaten the world as well with some weird clause. Fact is that EU GDPR has zero application here in the states.

michaelmrose 5y ago

Nobody in America is going to know about or expect to be bound to the laws of 100 different jurisdictions because in theory someone could visit from that country. Kind of like visitors from Spain don't bring with them Spanish laws when they visit Nevada.