3 ms·

But the inverse seemingly works with regards to GDPR? If a Belgian citizen in Belgium hacks my US server they are not protected by this Belgian law. Yet if a

But the inverse seemingly works with regards to GDPR? If a Belgian citizen in Belgium hacks my US server they are not protected by this Belgian law. Yet if a Belgian citizen in Belgium visits my US server they are protected by GDPR? How does that work then?

derefr 3y ago
If a Belgian citizen in Belgium visits your US server for commercial purposes then international trade treaties apply, and those treaties model your business (which might just be a sole proprietorship) as having a Belgian subsidiary that is doing the actual commerce with them. Same reason that if a country Y has a law against selling thing X, but no law against buying thing X, then you, outside of country Y, are still not allowed to sell+ship X to people in country Y. For purposes of commercial interactions with people in country Y, you're acting as a local subsidiary subject to those laws. (In fact, for tax reasons, you may not even be able to sell into many countries without having a real established domestic incorporated business in those countries.) Note that this doesn't apply if there's a (multinational) import/export business involved — in which case, you have no obligation to avoid selling X into the country, because you're selling X to your own domestic country-Z arm of the importer/exporter. It's then the import/export business's duty to comply with laws about what can be sold in country Y (and to pay any import tariffs, etc.)
rascul 3y ago
> Yet if a Belgian citizen in Belgium visits my US server they are protected by GDPR? No, not if you and your server have no EU presence. There might be other reasons to comply, though.
- andruby 3y ago
  Yes they are. If a US company provides a service to a EU citizen, they must comply with EU regulations. If an EU company provides a service to a US citizen they must comply with US regulations (eg Sales Tax, etc)
  - rascul 3y ago
    What you describe would be one of the "other reasons to comply" that I mentioned, where the EU can affect you and/or your business if you don't comply. Additional context was not provided so I made no assumptions. An example: I don't have any legal obligation to the GDPR for my (hypothetical) US based blog as a US citizen, regardless of who visits it. But if I want to sell a t-shirt from the site, potentially to people in EU, failure to comply may result in the EU taking action to prevent me from doing business in the EU.

derefr 3y ago

If a Belgian citizen in Belgium visits your US server for commercial purposes then international trade treaties apply, and those treaties model your business (which might just be a sole proprietorship) as having a Belgian subsidiary that is doing the actual commerce with them. Same reason that if a country Y has a law against selling thing X, but no law against buying thing X, then you, outside of country Y, are still not allowed to sell+ship X to people in country Y. For purposes of commercial interactions with people in country Y, you're acting as a local subsidiary subject to those laws. (In fact, for tax reasons, you may not even be able to sell into many countries without having a real established domestic incorporated business in those countries.) Note that this doesn't apply if there's a (multinational) import/export business involved — in which case, you have no obligation to avoid selling X into the country, because you're selling X to your own domestic country-Z arm of the importer/exporter. It's then the import/export business's duty to comply with laws about what can be sold in country Y (and to pay any import tariffs, etc.)

rascul 3y ago

> Yet if a Belgian citizen in Belgium visits my US server they are protected by GDPR? No, not if you and your server have no EU presence. There might be other reasons to comply, though.

andruby 3y ago
Yes they are. If a US company provides a service to a EU citizen, they must comply with EU regulations. If an EU company provides a service to a US citizen they must comply with US regulations (eg Sales Tax, etc)
- rascul 3y ago
  What you describe would be one of the "other reasons to comply" that I mentioned, where the EU can affect you and/or your business if you don't comply. Additional context was not provided so I made no assumptions. An example: I don't have any legal obligation to the GDPR for my (hypothetical) US based blog as a US citizen, regardless of who visits it. But if I want to sell a t-shirt from the site, potentially to people in EU, failure to comply may result in the EU taking action to prevent me from doing business in the EU.