14 ms·

As someone from the EU, with no money or anuthing coming in from the UK, why would I even care about this? The GDPR has teeth only because the EU is big enough

As someone from the EU, with no money or anuthing coming in from the UK, why would I even care about this? The GDPR has teeth only because the EU is big enough to make companies care. It is a watered down version from some privacy rights compared to the old laws in my country. But the old laws were ignorde by US tech because why wouldn't they. So as the UK left the EU, they are now a small country in the computer world. I'll ignore its laws just as I ignore Afghan laws requiring women to stay at home or whatever country's laws to forbif gays from existing.

xdfgh1112 4y ago
Yeah, this already happens to some extent with American and Asian sites blocking Europe and the UK because they don't want to deal with GPDR.
- sterlind 4y ago
  If this UK bill passes, I'd simply return HTTP 451 with a note that although the UK is blocked from my site, VPNs are not.
  - kmeisthax 4y ago
    Promoting VPN usage could be construed by the UK courts as an attempt to commit subterfuge or dodge jurisdiction. They will not take kindly to this. You really want to make it perfectly clear that you want nothing to do with Britain as long as they have crazy laws on the books. Related point: if you're intending to get out of GDPR, blocking the EU doesn't really help, because the law applies on the basis of citizenship, not territory. If an EU citizen accesses your website in America, that's still within GDPR scope. If you have EU business assets, ship things to the EU, or have any other ties to the EU, then they still have jurisdiction and you certainly still have to comply with GDPR.
    - kwhitefoot 4y ago
      > because the law applies on the basis of citizenship, No it doesn't. depends on location only. A US, or any other, citizen is protected by GDPR when they access the web from within the EU
    - jacooper 4y ago
      However, the GDPR doesn't really apply if you don't intend to target Europeans(2) And the GDPR is a way way more sensible law than whatever the UK is trying to do here, nobody will comply and no body will care, its only going to Hurt UK citizens and The UK's economy. I care about privacy and really like what the EU has passed with the GDPR and DSA, but unfortunately we will have countries that does stupid things like this. Hopefully they aren't that important so no one complies. 2. https://gdpr.eu/companies-outside-of-europe/ https://gdpr.eu/companies-outside-of-europe/
    - whakim 4y ago
      > If an EU citizen accesses your website in America, that's still within GDPR scope. No, that's not correct. You have to be clearly intending to (not just incidentally happening to) offer goods or services to an EU data subject. > ship things to the EU This wouldn't be enough to make the GDPR applicable. You'd have to be specifically targeting EU customers in some way, such as allowing users to pay in euros - not just incidentally selling some stuff to folks who live in the EU. Your other examples (such as having EU business assets) hold because they would make you an EU entity.
      - tzs 4y ago
        Targeting EU data subjects with goods and services is just one of two ways GDPR asserts extraterritorial jurisdiction. The other is when you are processing personal data of EU data subjects that is related to "the monitoring of their behaviour as far as their behaviour takes place within the Union". There's a recital that adds: > In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. Unlike the recital that explains the goods and services case, which talks about it only applying if you envisage offering goods and services in the Union as opposed to your site merely being accessible from the Union, the monitoring case doesn't seem to have any requirement that you are intending to monitor EU data subjects. That's pretty broad as written. From what the recital says it even applies if you are gathering data the could be used for profiling even if you are not actually currently profiling. As noted in the article at gdpr.eu that a parallel commenter cited: > If your organization uses web tools that allow you to track cookies or the IP addresses of people who visit your website from EU countries, then you fall under the scope of the GDPR. Practically speaking, it’s unclear how strictly this provision will be interpreted or how brazenly it will be enforced. Suppose you run a golf course in Manitoba focused exclusively on your local area, but sometimes people in France stumble across your site. Would you find yourself in the crosshairs of European regulators? It’s not likely. But technically you could be held accountable for tracking these data.
    - M2Ys4U 4y ago
      >Related point: if you're intending to get out of GDPR, blocking the EU doesn't really help, because the law applies on the basis of citizenship, not territory. Argh, why won't this misinformation die? You are completely, utterly, 100% wrong. The GDPR applies if either the data controller is established in the EU or the data subject is physically in the EU. Article 3 (territorial scope) is incredibly short, read it: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.ENG#d1e1455-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:...
      - mitjam 4y ago
        Yes and this may be a UK citizen on a trip to Paris
- shadowgovt 4y ago
  As an American visiting the UK and the EU, I got to see what the GDPR has done to the online experience over there for the first time. Wow, does that suck. I see about 20% of the "cookie track consent" popups Stateside that I saw browsing from the EU.
  - pasc1878 4y ago
    So you prefer being tracked without you knowing rather than being asked and easily opt out?
    - shadowgovt 4y ago
      Personally, yes. I think most of what the GDPR intended to accomplish could have been accomplished more easily by public education campaigns and broad cultural adoption of no-track plugins. That would have done a lot less damage to the user experience than naively assuming that if one pushed the educational burden onto sites, the sites would cease to do the tracking that triggered the educational burden rather than just bother their users forever with government-mandated information placards. Especially given that what constituted "tracking" was so broad that a lot of sites took the "better safe than sorry" approach because it was cheaper than a full audit of their tracking and a lawyer to interpret whether, say, Apache logs that show IP address constitute "tracking."
  - jacooper 4y ago
    Well that's the websites problem, no body told them to include 50 trackers. And there are many filters to kill cookies banners. Also AFAIK now there is an enforced Reject All button.
    - shadowgovt 4y ago
      It's also the user's problem because there aren't websites to go to that aren't showing those banners. Well, except the big, commonly-used ones where you've already consented (or not). Facebook, for instance. It's like this law was hand-tuned to consolidate users into only visiting a few commonly-accessed sites to save themselves the UX annoyance at the cost of the broader Internet's discoverability.
LegitShady 4y ago
the louder someone tells me in advance they don't care, the more they care about something going on here, and in your case its to talk about the EU and the UK. This was an article about the UK, if you didn't care you didn't need to post here at all, just as people from the US don't need to post to say "I'm from the US, why do I need to care about EU laws?" you don't, but you also don't say anything intelligent about it by saying you live somewhere else. Posting to say you live somewhere else and don't care about the article doesn't contribute to any intelligent conversation, and usually means you do care about something involved, strongly, but aren't willing to say so.
- noduerme 4y ago
  Here's something novel, then: I've lived all over the world, but I wouldn't step foot in post-Brexit, xenophobic Britain if you paid me. I'm reading this gleefully thinking of ways to flout whatever implementation is settled upon, while homegrown British companies rot. I am, in fact, rooting for your economy to utterly collapse.
  - LegitShady 4y ago
    As I said, its not that you don't care, its that you care very very strongly, but wanted to pretend you didn't care, which was why you posted to say 'but I don't live in the UK' as if it was relevant to anyone but you.
    - anigbrowl 4y ago
      You're responding to two different people as if they were the same person.
      - LegitShady 4y ago
        didn't notice, but again, same thing with both of them. "Here are some laws in the UK" - they respond with "let me tell you about the UK, I don't care about it but here are the reasons why I care..."
  - 4y ago
yrgulation 4y ago
> So as the UK left the EU, they are now a small country in the computer world. Umm yeah no. Perhaps regulation wise but no, the uk is not a “small” country in the “computer world”.
- 9dev 4y ago
  What else would it be? There's about 67 million people living in the UK, compared to the 447 million in the EU - depends on your definition of "small", but our company will likewise ignore any specific UK regulations. The handful of customers there isn't worth any additional overhead compared to the EU+US.
  - nsteel 4y ago
    Perhaps we should be counting computers, rather than people, in the "computer world". Although I am not saying you'd come to a different conclusion.
  - theptip 4y ago
    Of the countries in the world, the UK ranks sixth in GDP.
    - cge 4y ago
      The problem with that measurement is that top GDPs fall off quickly. While the UK is the sixth, it's only around 3-4% of the global GDP, and while I can't find values from the same year at the moment, likely has a lower GDP than California. The EU is around 18% of the global GDP; the US, China, and EU together make up around 65% of global GDP, and each of them has at least triple the GDP of any other individual country.
    - 9dev 4y ago
      Most of that money is bound in the financial industry, though. Unless you're in the sector, the GDP rank doesn't matter much for doing business with the UK.
      - 4y ago
nbevans 4y ago
Doesn't matter if they ignore the laws as then they have to pay fines which bolsters the Treasury anyway. It's win-win. That's why the EU itself loves to regulate in this way because dishing out tickets to American big-tech is a big money spinner for a superstate that is fast running out of money. The real problems start when these fines are being seen in the halls of power as disruptive to trade; as then it becomes a bilateral political issue which can of course blow up in a full blown trade spat very quickly. Also your example of ignoring Afghan laws on women doesn't work. If you tried to setup a business in Afghanistan that was say an online tutoring programme tailored for Aghan women. How quickly do you think your DNS will get pointed to 0.0.0.0 on the Afghan internet? And how quickly will they seek to prosecute you as a director of that business? As a foreigner living abroad, you'll probably be fine but you won't be making money from your target market. So you're finished. The law worked and you didn't ignore it.
hedora 4y ago
If the article is to be believed, then simply ignoring this law would open your company's leadership up to criminal liability in the UK. This probably doesn't matter too much, assuming they never fly through Heathrow or something.
- jacooper 4y ago
  I mean you can just ban all UK IPs and be done with it. Its clearly not a sensible law, and blocking users will send a clear message to them that they should complains about it.
  - connorgurney 4y ago
    Realistically, are they going to complain? I don’t ever remember a mass revolt over US websites blocking EU users because of GDPR.
    - jacooper 4y ago
      The GDPR is a way way more realistic law, there is no comparison here. Also the EU is a way bigger user base than the UK, and being complaint with the GDPR is actually possible without needing to pay anyone anything. I think the affect of this law is going to be way bigger than the GDPR.
  - hedora 4y ago
    According to the article, you'd still need to document the technical process you use to ban the IPs, and also the business processes you haven in place to govern the technical process. That all has to be sent in to the British government with a filing fee, and it's unclear whether even that is enough to appease their regulators or not.
- odiroot 4y ago
  Imagine if they fly through Stansted. That's a punishment in itself!

xdfgh1112 4y ago

Yeah, this already happens to some extent with American and Asian sites blocking Europe and the UK because they don't want to deal with GPDR.

sterlind 4y ago
If this UK bill passes, I'd simply return HTTP 451 with a note that although the UK is blocked from my site, VPNs are not.
- kmeisthax 4y ago
  Promoting VPN usage could be construed by the UK courts as an attempt to commit subterfuge or dodge jurisdiction. They will not take kindly to this. You really want to make it perfectly clear that you want nothing to do with Britain as long as they have crazy laws on the books. Related point: if you're intending to get out of GDPR, blocking the EU doesn't really help, because the law applies on the basis of citizenship, not territory. If an EU citizen accesses your website in America, that's still within GDPR scope. If you have EU business assets, ship things to the EU, or have any other ties to the EU, then they still have jurisdiction and you certainly still have to comply with GDPR.
  - kwhitefoot 4y ago
    > because the law applies on the basis of citizenship, No it doesn't. depends on location only. A US, or any other, citizen is protected by GDPR when they access the web from within the EU
  - jacooper 4y ago
    However, the GDPR doesn't really apply if you don't intend to target Europeans(2) And the GDPR is a way way more sensible law than whatever the UK is trying to do here, nobody will comply and no body will care, its only going to Hurt UK citizens and The UK's economy. I care about privacy and really like what the EU has passed with the GDPR and DSA, but unfortunately we will have countries that does stupid things like this. Hopefully they aren't that important so no one complies. 2. https://gdpr.eu/companies-outside-of-europe/ https://gdpr.eu/companies-outside-of-europe/
  - whakim 4y ago
    > If an EU citizen accesses your website in America, that's still within GDPR scope. No, that's not correct. You have to be clearly intending to (not just incidentally happening to) offer goods or services to an EU data subject. > ship things to the EU This wouldn't be enough to make the GDPR applicable. You'd have to be specifically targeting EU customers in some way, such as allowing users to pay in euros - not just incidentally selling some stuff to folks who live in the EU. Your other examples (such as having EU business assets) hold because they would make you an EU entity.
    - tzs 4y ago
      Targeting EU data subjects with goods and services is just one of two ways GDPR asserts extraterritorial jurisdiction. The other is when you are processing personal data of EU data subjects that is related to "the monitoring of their behaviour as far as their behaviour takes place within the Union". There's a recital that adds: > In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. Unlike the recital that explains the goods and services case, which talks about it only applying if you envisage offering goods and services in the Union as opposed to your site merely being accessible from the Union, the monitoring case doesn't seem to have any requirement that you are intending to monitor EU data subjects. That's pretty broad as written. From what the recital says it even applies if you are gathering data the could be used for profiling even if you are not actually currently profiling. As noted in the article at gdpr.eu that a parallel commenter cited: > If your organization uses web tools that allow you to track cookies or the IP addresses of people who visit your website from EU countries, then you fall under the scope of the GDPR. Practically speaking, it’s unclear how strictly this provision will be interpreted or how brazenly it will be enforced. Suppose you run a golf course in Manitoba focused exclusively on your local area, but sometimes people in France stumble across your site. Would you find yourself in the crosshairs of European regulators? It’s not likely. But technically you could be held accountable for tracking these data.
  - M2Ys4U 4y ago
    >Related point: if you're intending to get out of GDPR, blocking the EU doesn't really help, because the law applies on the basis of citizenship, not territory. Argh, why won't this misinformation die? You are completely, utterly, 100% wrong. The GDPR applies if either the data controller is established in the EU or the data subject is physically in the EU. Article 3 (territorial scope) is incredibly short, read it: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.ENG#d1e1455-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:...
    - mitjam 4y ago
      Yes and this may be a UK citizen on a trip to Paris
shadowgovt 4y ago
As an American visiting the UK and the EU, I got to see what the GDPR has done to the online experience over there for the first time. Wow, does that suck. I see about 20% of the "cookie track consent" popups Stateside that I saw browsing from the EU.
- pasc1878 4y ago
  So you prefer being tracked without you knowing rather than being asked and easily opt out?
  - shadowgovt 4y ago
    Personally, yes. I think most of what the GDPR intended to accomplish could have been accomplished more easily by public education campaigns and broad cultural adoption of no-track plugins. That would have done a lot less damage to the user experience than naively assuming that if one pushed the educational burden onto sites, the sites would cease to do the tracking that triggered the educational burden rather than just bother their users forever with government-mandated information placards. Especially given that what constituted "tracking" was so broad that a lot of sites took the "better safe than sorry" approach because it was cheaper than a full audit of their tracking and a lawyer to interpret whether, say, Apache logs that show IP address constitute "tracking."
- jacooper 4y ago
  Well that's the websites problem, no body told them to include 50 trackers. And there are many filters to kill cookies banners. Also AFAIK now there is an enforced Reject All button.
  - shadowgovt 4y ago
    It's also the user's problem because there aren't websites to go to that aren't showing those banners. Well, except the big, commonly-used ones where you've already consented (or not). Facebook, for instance. It's like this law was hand-tuned to consolidate users into only visiting a few commonly-accessed sites to save themselves the UX annoyance at the cost of the broader Internet's discoverability.

LegitShady 4y ago

the louder someone tells me in advance they don't care, the more they care about something going on here, and in your case its to talk about the EU and the UK. This was an article about the UK, if you didn't care you didn't need to post here at all, just as people from the US don't need to post to say "I'm from the US, why do I need to care about EU laws?" you don't, but you also don't say anything intelligent about it by saying you live somewhere else. Posting to say you live somewhere else and don't care about the article doesn't contribute to any intelligent conversation, and usually means you do care about something involved, strongly, but aren't willing to say so.

noduerme 4y ago
Here's something novel, then: I've lived all over the world, but I wouldn't step foot in post-Brexit, xenophobic Britain if you paid me. I'm reading this gleefully thinking of ways to flout whatever implementation is settled upon, while homegrown British companies rot. I am, in fact, rooting for your economy to utterly collapse.
- LegitShady 4y ago
  As I said, its not that you don't care, its that you care very very strongly, but wanted to pretend you didn't care, which was why you posted to say 'but I don't live in the UK' as if it was relevant to anyone but you.
  - anigbrowl 4y ago
    You're responding to two different people as if they were the same person.
    - LegitShady 4y ago
      didn't notice, but again, same thing with both of them. "Here are some laws in the UK" - they respond with "let me tell you about the UK, I don't care about it but here are the reasons why I care..."
- 4y ago

yrgulation 4y ago

> So as the UK left the EU, they are now a small country in the computer world. Umm yeah no. Perhaps regulation wise but no, the uk is not a “small” country in the “computer world”.

9dev 4y ago
What else would it be? There's about 67 million people living in the UK, compared to the 447 million in the EU - depends on your definition of "small", but our company will likewise ignore any specific UK regulations. The handful of customers there isn't worth any additional overhead compared to the EU+US.
- nsteel 4y ago
  Perhaps we should be counting computers, rather than people, in the "computer world". Although I am not saying you'd come to a different conclusion.
- theptip 4y ago
  Of the countries in the world, the UK ranks sixth in GDP.
  - cge 4y ago
    The problem with that measurement is that top GDPs fall off quickly. While the UK is the sixth, it's only around 3-4% of the global GDP, and while I can't find values from the same year at the moment, likely has a lower GDP than California. The EU is around 18% of the global GDP; the US, China, and EU together make up around 65% of global GDP, and each of them has at least triple the GDP of any other individual country.
  - 9dev 4y ago
    Most of that money is bound in the financial industry, though. Unless you're in the sector, the GDP rank doesn't matter much for doing business with the UK.
    - 4y ago

nbevans 4y ago

Doesn't matter if they ignore the laws as then they have to pay fines which bolsters the Treasury anyway. It's win-win. That's why the EU itself loves to regulate in this way because dishing out tickets to American big-tech is a big money spinner for a superstate that is fast running out of money. The real problems start when these fines are being seen in the halls of power as disruptive to trade; as then it becomes a bilateral political issue which can of course blow up in a full blown trade spat very quickly. Also your example of ignoring Afghan laws on women doesn't work. If you tried to setup a business in Afghanistan that was say an online tutoring programme tailored for Aghan women. How quickly do you think your DNS will get pointed to 0.0.0.0 on the Afghan internet? And how quickly will they seek to prosecute you as a director of that business? As a foreigner living abroad, you'll probably be fine but you won't be making money from your target market. So you're finished. The law worked and you didn't ignore it.

hedora 4y ago

If the article is to be believed, then simply ignoring this law would open your company's leadership up to criminal liability in the UK. This probably doesn't matter too much, assuming they never fly through Heathrow or something.

jacooper 4y ago
I mean you can just ban all UK IPs and be done with it. Its clearly not a sensible law, and blocking users will send a clear message to them that they should complains about it.
- connorgurney 4y ago
  Realistically, are they going to complain? I don’t ever remember a mass revolt over US websites blocking EU users because of GDPR.
  - jacooper 4y ago
    The GDPR is a way way more realistic law, there is no comparison here. Also the EU is a way bigger user base than the UK, and being complaint with the GDPR is actually possible without needing to pay anyone anything. I think the affect of this law is going to be way bigger than the GDPR.
- hedora 4y ago
  According to the article, you'd still need to document the technical process you use to ban the IPs, and also the business processes you haven in place to govern the technical process. That all has to be sent in to the British government with a filing fee, and it's unclear whether even that is enough to appease their regulators or not.
odiroot 4y ago
Imagine if they fly through Stansted. That's a punishment in itself!