3 ms·

Does the GDPR apply to non-European companies? If a YC-funded startup wants to operate in Europe, presumably they'd have to follow those laws. But YC itself? A

Does the GDPR apply to non-European companies? If a YC-funded startup wants to operate in Europe, presumably they'd have to follow those laws. But YC itself? Are they under any obligation?

Olphs 2y ago
It does, if the company has any branch/office/agent or similar in the EU, or if it targets their services/website to EU residents. What "targets" means exactly in this case I'm not sure, but given that YC actively markets to EU based companies too, I would think that GDPR applies to them as well.
- solardev 2y ago
  I see, thank you! Here's a link with more info: https://gdpr.eu/compliance-checklist-us-companies/ https://gdpr.eu/compliance-checklist-us-companies/ > Why US companies must comply with the GDPR > The GDPR applies to companies outside the EU because it is extra-territorial in scope. Specifically, the law is designed not so much to regulate businesses as it is to protect the data subjects’ rights. A “data subject” is any person in the EU, including citizens, residents, and even, perhaps, visitors. > What this means in practice is that if you collect any personal data of people in the EU, you are required to comply with the GDPR. The data could be in the form of email addresses in a marketing list or the IP addresses of those who visit your website. (See our article explaining what is considered personal data under the GDPR.) > You may be wondering how the European Union will enforce a law in territory it does not control. The fact is, foreign governments help other countries enforce their laws through mutual assistance treaties and other mechanisms all the time. GDPR Article 50 addresses this question directly. So far, the EU’s reach has not been tested, but no doubt data protection authorities are exploring their options on a case-by-case basis.
throwawayffffas 2y ago
It applies if you have European users. Companies that want to avoid having to comply will typically block European users. They usually respond with http error code 451 Unavailable For Legal Reasons.
- segmondy 2y ago
  why should anyone have to build extra logic to block EU users? Let EU block themselves.
- wruza 2y ago
  It applies in EU and your site will/may be blocked in EU if you ignore it. So EU is free to block a site, which is both its right and responsibility, since it’s EU’s idea. Sites self-censoring for EU is just a friendly compliment, not a world-wide obligation. There’s no law (of this level) that could force someone around the globe to do something for someone else. You can only make a public contract like “you do X here or we block you in here and that’s all we can do unless you come here”. It doesn’t work like “all of you over there must do X now”.
  - solardev 2y ago
    The EU GDPR website has this to say: https://gdpr.eu/compliance-checklist-us-companies/ https://gdpr.eu/compliance-checklist-us-companies/ > You may be wondering how the European Union will enforce a law in territory it does not control. The fact is, foreign governments help other countries enforce their laws through mutual assistance treaties and other mechanisms all the time. GDPR Article 50 addresses this question directly. So far, the EU’s reach has not been tested, but no doubt data protection authorities are exploring their options on a case-by-case basis. It sounds like a fancy way to say "Yeah, we can't do anything to you NOW, but we're hoping that other countries will listen and help us enforce this via treaty in the future..."
    - bigfatkitten 2y ago
      It's a completely empty threat unless you happen to have a presence in a jurisdiction with equivalent offences to those provided by EU privacy legislation. Otherwise, you have about as much to fear from Europe as you have from the Chinese for hosting pictures of Winnie the Pooh.
- tzs 2y ago
  > It applies if you have European users. That's not quite correct. If you aren't in the union, whether it applies or not is covered by Article 3(2). That gives two situations where it applies. It applies if you are handling the data of people in the Union if the processing activities are related to: (a) "the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union" or (b) "the monitoring of their behaviour as far as their behaviour takes place within the Union" There's a recital (number 23) that provides more detail for (a). It says "In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union". So for example if you ran a forum for fans of your local community theater group in some small US city, and some Europeans found it and joined, that probably wouldn't require you to comply with GDPR unless you were doing behavioral monitoring that fell under 3(2)(b).

Does the GDPR apply to non-European companies? If a YC-funded startup wants to operate in Europe, presumably they'd have to follow those laws. But YC itself? Are they under any obligation?

Olphs 2y ago

It does, if the company has any branch/office/agent or similar in the EU, or if it targets their services/website to EU residents. What "targets" means exactly in this case I'm not sure, but given that YC actively markets to EU based companies too, I would think that GDPR applies to them as well.

solardev 2y ago
I see, thank you! Here's a link with more info: https://gdpr.eu/compliance-checklist-us-companies/ https://gdpr.eu/compliance-checklist-us-companies/ > Why US companies must comply with the GDPR > The GDPR applies to companies outside the EU because it is extra-territorial in scope. Specifically, the law is designed not so much to regulate businesses as it is to protect the data subjects’ rights. A “data subject” is any person in the EU, including citizens, residents, and even, perhaps, visitors. > What this means in practice is that if you collect any personal data of people in the EU, you are required to comply with the GDPR. The data could be in the form of email addresses in a marketing list or the IP addresses of those who visit your website. (See our article explaining what is considered personal data under the GDPR.) > You may be wondering how the European Union will enforce a law in territory it does not control. The fact is, foreign governments help other countries enforce their laws through mutual assistance treaties and other mechanisms all the time. GDPR Article 50 addresses this question directly. So far, the EU’s reach has not been tested, but no doubt data protection authorities are exploring their options on a case-by-case basis.

throwawayffffas 2y ago

It applies if you have European users. Companies that want to avoid having to comply will typically block European users. They usually respond with http error code 451 Unavailable For Legal Reasons.

segmondy 2y ago
why should anyone have to build extra logic to block EU users? Let EU block themselves.
wruza 2y ago
It applies in EU and your site will/may be blocked in EU if you ignore it. So EU is free to block a site, which is both its right and responsibility, since it’s EU’s idea. Sites self-censoring for EU is just a friendly compliment, not a world-wide obligation. There’s no law (of this level) that could force someone around the globe to do something for someone else. You can only make a public contract like “you do X here or we block you in here and that’s all we can do unless you come here”. It doesn’t work like “all of you over there must do X now”.
- solardev 2y ago
  The EU GDPR website has this to say: https://gdpr.eu/compliance-checklist-us-companies/ https://gdpr.eu/compliance-checklist-us-companies/ > You may be wondering how the European Union will enforce a law in territory it does not control. The fact is, foreign governments help other countries enforce their laws through mutual assistance treaties and other mechanisms all the time. GDPR Article 50 addresses this question directly. So far, the EU’s reach has not been tested, but no doubt data protection authorities are exploring their options on a case-by-case basis. It sounds like a fancy way to say "Yeah, we can't do anything to you NOW, but we're hoping that other countries will listen and help us enforce this via treaty in the future..."
  - bigfatkitten 2y ago
    It's a completely empty threat unless you happen to have a presence in a jurisdiction with equivalent offences to those provided by EU privacy legislation. Otherwise, you have about as much to fear from Europe as you have from the Chinese for hosting pictures of Winnie the Pooh.
tzs 2y ago
> It applies if you have European users. That's not quite correct. If you aren't in the union, whether it applies or not is covered by Article 3(2). That gives two situations where it applies. It applies if you are handling the data of people in the Union if the processing activities are related to: (a) "the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union" or (b) "the monitoring of their behaviour as far as their behaviour takes place within the Union" There's a recital (number 23) that provides more detail for (a). It says "In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union". So for example if you ran a forum for fans of your local community theater group in some small US city, and some Europeans found it and joined, that probably wouldn't require you to comply with GDPR unless you were doing behavioral monitoring that fell under 3(2)(b).