4 ms·

> [...] GDPR doesn’t apply to someone living in the US and running a web server there. Only if they ensure that they have no EU-based users [0]. So yeah, unles

by Topfi 3y ago

> [...] GDPR doesn’t apply to someone living in the US and running a web server there. Only if they ensure that they have no EU-based users [0]. So yeah, unless you actively block "data subjects who are in the Union", it does apply to someone living in and running a server in the US. It's part of what makes GDPR so great for us citizens, the beauty that is the Brussels effect. [0] Article 3(2) of the GDPR

xoa 3y ago
Absolutely and utterly wrong. The EU has zero jurisdiction in the US and no treaty covering GDPR. The US is not extraditing Americans to the EU for violating the GDPR, anymore than it is for violating EU, Chinese or Russian censorship laws. If the EU wants to setup their own Great Firewall and block off America that's their right, but absent a treaty and domestic implementation their laws are not our problem. No different from anywhere else. If the EU wanted to prosecute an American for it then sure said American should not travel to the EU ever but that's easy.
kstrauser 3y ago
See? That’s the kind of thing I’m talking about. Imagine me saying a US law applies to someone in Prague because the US law said it did. I’d be rightfully laughed at.
- _djo_ 3y ago
  Why? That's already the case: US law applies to US citizens and there are already some laws that are extraterritorial and impose burdens that companies in other countries must comply with. For instance, financial institutions in Europe have special reporting and KYC requirements for the accounts of American citizens, even if they're long-term residents in European countries and dual-citizens, because of FATCA. Extraterritoriality is not unique to the GDPR and the EU, nor is it new.
  - realusername 3y ago
    > financial institutions in Europe have special reporting and KYC requirements for the accounts of American citizens, Usually they just straight up ban americans from registering banking services. That shift happened after the huge fine they got because of that.
- jcranmer 3y ago
  > Imagine me saying a US law applies to someone in Prague because the US law said it did. I’d be rightfully laughed at. That happens all the time. E.g., US tax laws.
- Topfi 3y ago
  For any of the US laws that are drafted in such a manner that they apply to US citizens outside the states, DC and the territories? At least not by me or anyone else who understand extraterritoriality. No, you wouldn't be laughed at for stating that fact, nor would that be "rightful".
  - kstrauser 3y ago
    Those laws apply to US citizens. GDPR purports to apply to everyone around the globe. That's a substantial increase in scope. I like the GDPR. For the most part, I think it's a good law. It has problems, like it's impossible to comply fully with GDPR and HIPAA at the same time, but I'm glad a major government is pushing so hard for something I support. And yet I still give it the side-eye for claiming jurisdiction over non-EU citizens living and working in non-EU countries without having a realworld presence in the EU.
    - Topfi 3y ago
      > Those laws apply to US citizens. GDPR purports to apply to everyone around the globe. No, not to "everyone", only processors handling data that is covered as part of GDPR, which again, you are free to exclude if you desire. So, to stay with US laws, what about, as one of a few examples, FATCA [0] in the case of US citizens being served by, e.g., EU financial institutions? Very much comparable to GDPR and non-EU processors handling data covered by GDPR. Both apply outside their government of origin for processors handling something connected to the government's citizenry, and both do not "apply to everyone around the globe"; simply don't handle US financials/EU data. Again, GDPR is not unique in regard to extraterritoriality, nor is this something only the EU engages in. It is accepted, established and has been part of US legislation for an extended period prior to GDPR. And, just like with GDPR, FATCA applying beyond US based institutions is a positive attribute of that legislation, neither would work if only applicable within their respective territory. [0] https://www.law.cornell.edu/uscode/text/26/1471 https://www.law.cornell.edu/uscode/text/26/1471 https://www.law.cornell.edu/uscode/text/26/1472 https://www.law.cornell.edu/uscode/text/26/1472 https://www.law.cornell.edu/uscode/text/26/1473 https://www.law.cornell.edu/uscode/text/26/1473 https://www.law.cornell.edu/uscode/text/26/1474 https://www.law.cornell.edu/uscode/text/26/1474

by Topfi 3y ago

xoa 3y ago

Absolutely and utterly wrong. The EU has zero jurisdiction in the US and no treaty covering GDPR. The US is not extraditing Americans to the EU for violating the GDPR, anymore than it is for violating EU, Chinese or Russian censorship laws. If the EU wants to setup their own Great Firewall and block off America that's their right, but absent a treaty and domestic implementation their laws are not our problem. No different from anywhere else. If the EU wanted to prosecute an American for it then sure said American should not travel to the EU ever but that's easy.

kstrauser 3y ago

See? That’s the kind of thing I’m talking about. Imagine me saying a US law applies to someone in Prague because the US law said it did. I’d be rightfully laughed at.

_djo_ 3y ago
Why? That's already the case: US law applies to US citizens and there are already some laws that are extraterritorial and impose burdens that companies in other countries must comply with. For instance, financial institutions in Europe have special reporting and KYC requirements for the accounts of American citizens, even if they're long-term residents in European countries and dual-citizens, because of FATCA. Extraterritoriality is not unique to the GDPR and the EU, nor is it new.
- realusername 3y ago
  > financial institutions in Europe have special reporting and KYC requirements for the accounts of American citizens, Usually they just straight up ban americans from registering banking services. That shift happened after the huge fine they got because of that.
jcranmer 3y ago
> Imagine me saying a US law applies to someone in Prague because the US law said it did. I’d be rightfully laughed at. That happens all the time. E.g., US tax laws.
Topfi 3y ago
For any of the US laws that are drafted in such a manner that they apply to US citizens outside the states, DC and the territories? At least not by me or anyone else who understand extraterritoriality. No, you wouldn't be laughed at for stating that fact, nor would that be "rightful".
- kstrauser 3y ago
  Those laws apply to US citizens. GDPR purports to apply to everyone around the globe. That's a substantial increase in scope. I like the GDPR. For the most part, I think it's a good law. It has problems, like it's impossible to comply fully with GDPR and HIPAA at the same time, but I'm glad a major government is pushing so hard for something I support. And yet I still give it the side-eye for claiming jurisdiction over non-EU citizens living and working in non-EU countries without having a realworld presence in the EU.
  - Topfi 3y ago
    > Those laws apply to US citizens. GDPR purports to apply to everyone around the globe. No, not to "everyone", only processors handling data that is covered as part of GDPR, which again, you are free to exclude if you desire. So, to stay with US laws, what about, as one of a few examples, FATCA [0] in the case of US citizens being served by, e.g., EU financial institutions? Very much comparable to GDPR and non-EU processors handling data covered by GDPR. Both apply outside their government of origin for processors handling something connected to the government's citizenry, and both do not "apply to everyone around the globe"; simply don't handle US financials/EU data. Again, GDPR is not unique in regard to extraterritoriality, nor is this something only the EU engages in. It is accepted, established and has been part of US legislation for an extended period prior to GDPR. And, just like with GDPR, FATCA applying beyond US based institutions is a positive attribute of that legislation, neither would work if only applicable within their respective territory. [0] https://www.law.cornell.edu/uscode/text/26/1471 https://www.law.cornell.edu/uscode/text/26/1471 https://www.law.cornell.edu/uscode/text/26/1472 https://www.law.cornell.edu/uscode/text/26/1472 https://www.law.cornell.edu/uscode/text/26/1473 https://www.law.cornell.edu/uscode/text/26/1473 https://www.law.cornell.edu/uscode/text/26/1474 https://www.law.cornell.edu/uscode/text/26/1474