4 ms·

You probably don't have to do anything. I am of the opinion that blocking EU traffic potentially increases your exposure to GDPR, but this is not settled law.

by lmkg 5y ago

You probably don't have to do anything. I am of the opinion that blocking EU traffic potentially increases your exposure to GDPR, but this is not settled law. GDPR's territorial scope applies to international Controllers who are "targeting" EU residents. According to Recital 23, merely having a website doesn't qualify. There needs to be additional evidence that you are attempting to attract an EU audience. E.g. when selling goods, offering Euro as a currency. Blocking EU traffic means that you are specifically envision EU residents visiting your site. And blocking traffic from them is a type of data processing. IANAL, don't take advice from randos on the Internet, but if you're just some website then blocking EU visitors might be more trouble than it's worth. In either case, no DPA is going to give a shit about you. https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/

FredPret 5y ago
That's brilliant, thank you!!
tzs 5y ago
Recital 23 elaborates on Article 3 2(a), which covers the offering of goods or services to people in the Union as a bases for applying GDPR. There's also 2(b), which covers the monitoring of behavior as far as their behavior takes place within the Union. Recital 24 at https://gdpr-info.eu/recitals/no-24/ https://gdpr-info.eu/recitals/no-24/ elaborates on that: > The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. > In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. (line break added between sentences to make it easier to read). Unlike 2(a), 2(b) doesn't require any attempt to attract an EU audience so is more easy to accidentally fall under.

by lmkg 5y ago

FredPret 5y ago

That's brilliant, thank you!!

tzs 5y ago

Recital 23 elaborates on Article 3 2(a), which covers the offering of goods or services to people in the Union as a bases for applying GDPR. There's also 2(b), which covers the monitoring of behavior as far as their behavior takes place within the Union. Recital 24 at https://gdpr-info.eu/recitals/no-24/ https://gdpr-info.eu/recitals/no-24/ elaborates on that: > The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. > In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. (line break added between sentences to make it easier to read). Unlike 2(a), 2(b) doesn't require any attempt to attract an EU audience so is more easy to accidentally fall under.