3 ms·

Non-EU companies need to follow GDPR when serving EU customers, yes. There are many websites that geoblock EU visitors because they don't want to comply with GD

Non-EU companies need to follow GDPR when serving EU customers, yes. There are many websites that geoblock EU visitors because they don't want to comply with GDPR. But the EU only enforces that for transactions involving EU citizens. If you want to grab all the data from US visitors, go for it, the EU will not complain (as long as you don't do it to EU visitors). I think the difference here is that the US is enforcing US law on an operation in a foreign country by a company that operates in the US. The equivalent would be the EU enforcing GDPR for all site transactions, regardless of the visitor's nationality. The point of making this distinction is that there are countries that have laws that we don't want to follow (e.g. various Middle East countries having drastic punishments for atheism and apostasy), and that should not be applied to people (or organisations) who don't reside there. If the USA makes the precedent that it can enforce its domestic law on actions happening in other countries, then it's possible that (e.g.) Australia could enforce its ridiculous anti-online-bullying laws on US citizens who have never left the USA.

bryanrasmussen 2y ago
>But the EU only enforces that for transactions involving EU citizens. If you want to grab all the data from US visitors, go for it, the EU will not complain (as long as you don't do it to EU visitors). https://europa.eu/youreurope/business/dealing-with-customers/data-protection/data-protection-gdpr/index_en.htm https://europa.eu/youreurope/business/dealing-with-customers... >The GDPR applies if: >your company processes personal data and is based in the EU, regardless of where the actual data processing takes place >your company is established outside the EU but processes personal data in relation to the offering of goods or services to individuals in the EU, or monitors the behaviour of individuals within the EU Notice how they emphasized EU citizens? Yeah, neither did I.
- atwrk 2y ago
  The don't emphasize citizenship because it is enough to live in the EU for the law to apply, i.e. immigrants etc. are included. If you look into the actual GDPR, you will find the phrase "data subjects who are in the Union", which are "natural persons", for whom the data protection laws apply.
  - bryanrasmussen 2y ago
    >If you look into the actual GDPR, oh good! Cause I've done that. >you will find the phrase "data subjects who are in the Union", which are "natural persons", for whom the data protection laws apply. tourists who are in the union also apply, there is no idea that you can figure out if that person is just traveling through the EU for some months you can do what you want with them. https://www.dataprotectionreport.com/2018/12/edpb-clarifies-territorial-scope-of-the-gdpr/ https://www.dataprotectionreport.com/2018/12/edpb-clarifies-... >Data subjects in the Union means any person in the Union whose information is being collected at that moment, regardless of their nationality or legal status. That means EU citizens and residents are squarely in scope. And someone in the EU, even a US tourist using an app in the EU, is a data subject in the Union for purposes of the GDPR. on edit: if you were just clarifying/backing up my original point, sorry, I thought it seemed you were going with interpretation of the person who I was replying to an EU company can do what they want with any U.S citizen's data.
- bryanrasmussen 2y ago
  Reading over the post I realize they meant that companies in the U.S need to handle EU citizens data properly but they can do what they want with U.S citizens data, which I misunderstood so my apologies on the misunderstanding.
  - bryanrasmussen 2y ago
    which of course is not an exactly correct understanding - no American company without holdings in Europe needs to worry about what they do with their websites accessed by European citizens.
bryanrasmussen 2y ago
>If the USA makes the precedent that it can enforce its domestic law on actions happening in other countries... Again, there is already ample precedent for this https://www.trade.gov/us-foreign-corrupt-practices-act https://www.trade.gov/us-foreign-corrupt-practices-act this applies to any U.S company engaging in business in another country. >I think the difference here is that the US is enforcing US law on an operation in a foreign country by a company that operates in the US. Well, perhaps that Chiquita used to be an American company affects the situation, not sure here, since Chiquita is nowadays a Swiss company.

bryanrasmussen 2y ago

>But the EU only enforces that for transactions involving EU citizens. If you want to grab all the data from US visitors, go for it, the EU will not complain (as long as you don't do it to EU visitors). https://europa.eu/youreurope/business/dealing-with-customers/data-protection/data-protection-gdpr/index_en.htm https://europa.eu/youreurope/business/dealing-with-customers... >The GDPR applies if: >your company processes personal data and is based in the EU, regardless of where the actual data processing takes place >your company is established outside the EU but processes personal data in relation to the offering of goods or services to individuals in the EU, or monitors the behaviour of individuals within the EU Notice how they emphasized EU citizens? Yeah, neither did I.

atwrk 2y ago
The don't emphasize citizenship because it is enough to live in the EU for the law to apply, i.e. immigrants etc. are included. If you look into the actual GDPR, you will find the phrase "data subjects who are in the Union", which are "natural persons", for whom the data protection laws apply.
- bryanrasmussen 2y ago
  >If you look into the actual GDPR, oh good! Cause I've done that. >you will find the phrase "data subjects who are in the Union", which are "natural persons", for whom the data protection laws apply. tourists who are in the union also apply, there is no idea that you can figure out if that person is just traveling through the EU for some months you can do what you want with them. https://www.dataprotectionreport.com/2018/12/edpb-clarifies-territorial-scope-of-the-gdpr/ https://www.dataprotectionreport.com/2018/12/edpb-clarifies-... >Data subjects in the Union means any person in the Union whose information is being collected at that moment, regardless of their nationality or legal status. That means EU citizens and residents are squarely in scope. And someone in the EU, even a US tourist using an app in the EU, is a data subject in the Union for purposes of the GDPR. on edit: if you were just clarifying/backing up my original point, sorry, I thought it seemed you were going with interpretation of the person who I was replying to an EU company can do what they want with any U.S citizen's data.
bryanrasmussen 2y ago
Reading over the post I realize they meant that companies in the U.S need to handle EU citizens data properly but they can do what they want with U.S citizens data, which I misunderstood so my apologies on the misunderstanding.
- bryanrasmussen 2y ago
  which of course is not an exactly correct understanding - no American company without holdings in Europe needs to worry about what they do with their websites accessed by European citizens.

bryanrasmussen 2y ago

>If the USA makes the precedent that it can enforce its domestic law on actions happening in other countries... Again, there is already ample precedent for this https://www.trade.gov/us-foreign-corrupt-practices-act https://www.trade.gov/us-foreign-corrupt-practices-act this applies to any U.S company engaging in business in another country. >I think the difference here is that the US is enforcing US law on an operation in a foreign country by a company that operates in the US. Well, perhaps that Chiquita used to be an American company affects the situation, not sure here, since Chiquita is nowadays a Swiss company.