4 ms·

I think it's quite funny he's complaining about someone else's knowledge of GDPR but links to GDPR UK and not GDPR EU which is he is really referring to. WordPr

I think it's quite funny he's complaining about someone else's knowledge of GDPR but links to GDPR UK and not GDPR EU which is he is really referring to. WordPress not being a UK entity in any way, would mean it's outside of GDPR UK. And him being a UK citizen and resident would mean he is not covered under GDPR EU.

jeroenhd 2y ago
The author lives in the UK, so the UK GDPR is relevant, not the EU one. It doesn't matter that WordPress isn't a UK entity. WordPress does do business in the UK so they need to comply with the UK GDPR as well as the EU one. If they don't want to comply with UK laws, they need to stop doing business with UK customers (or provide free services to UK citizens, but enforcing decisions against companies outside of the country's borders is rather difficult).
- that_guy_iain 2y ago
  > It doesn't matter that WordPress isn't a UK entity. WordPress does do business in the UK so they need to comply with the UK GDPR as well as the EU one. If they don't want to comply with UK laws, they need to stop doing business with UK customers (or provide free services to UK citizens, but enforcing decisions against companies outside of the country's borders is rather difficult). WordPress.org does not do business in the UK. It doesn't do business at all. It has no UK entity. The courts would have no recourse to enforce anything upon WordPress.org. UK Law does not just apply to everyone. UK law applies to businesses operating within the UK. If you want to test this, go complain to the ICO and they'll tell you that they have no power.
  - graemep 2y ago
    > WordPress.org does not do business in the UK. Wordpress.org is run by Automattic, and the owned by Matt Mullenweg personally: https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-wordpress-org-wp-engine https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-w... Automattic does do business in the UK.
    - that_guy_iain 2y ago
      Read the actual court documents instead of linking to a news report, which actually disagrees with your point. Automattic are being very clear about them not operating WordPress.org. And have submitted to the court that WordPress.org is operated by Audery Captial another one of Matt's companies. A company used to help to blur lines and deal with personal matters.
graemep 2y ago
UK GDPR applies to anyone processing UK residents' data. EU GDPR applies similarly to EU residents' data. That is why American companies that deal with people in those countries comply with both. Some American websites block traffic from both. Wordpress.org is IIRC run by Automattic, which receives payments from the UK so there is even a way to enforce fines.
- that_guy_iain 2y ago
  >Wordpress.org is IIRC run by Automattic, which receives payments from the UK so there is even a way to enforce fines. No. WordPress.org is owned and operated by a private American citizen who receives no payments. Automattic is a separate for-profit organization which does fall under GDPR. WordPress foundation would also fall under GDPR. WordPress.org does not. Yea, we were all pretty surprised to hear that WordPress.org is a privately owned and operated site.
  - btasker 2y ago
    dotorg being run by a private citizen who receives no payments does not exempt it from GDPR, because GDPR doesn't make that distinction. There _is_ an exemption for household processing (recital 18) - which means that I don't need to worry about taking a neighbour's contact number etc - but wordpress.org wouldn't fall under that. Given Matt's actions (and statements made by his own team so far in the case), I think he'd struggle to claim that wordpress.org is not linked to "professional or commercial activity". It might be quite difficult to enforce against a private citizen, but that's not the same as it not applying.
    - that_guy_iain 2y ago
      > dotorg being run by a private citizen who receives no payments does not exempt it from GDPR, because GDPR doesn't make that distinction. The dot org being run by an American citizen who does not operate within the UK that country 100% means UK courts do not having standing. Remember GDPR UK is not GDPR. It's based on it but case law is different and other stuff. Remember, just because one country does not allow something or requires something does not mean everyone whose website is accessible within that country has to follow that law. But for UK law to apply to someone there has to be a connection. Not just "I can connect to that website" or they're processing my data. Furthermore, GDPR UK does make a distinction or at least the ICO does - https://ico.org.uk/for-organisations/data-protection-and-the-eu/data-protection-and-the-eu-in-detail/the-uk-gdpr/ https://ico.org.uk/for-organisations/data-protection-and-the.... Under UK law providing goods and services requires taking payment. Legal opinion has also been shared from lots of sources that small businesses operating out with the EU aren't covered by GDPR. I believe there is EU law that says EU law only applies to companies with a significant number of customers who are EU citizens. > There _is_ an exemption for household processing (recital 18) - which means that I don't need to worry about taking a neighbour's contact number etc - but wordpress.org wouldn't fall under that. Fun fact, in the UK data protection laws will still cover cameras and whatnot taken from a household. That is UK case law. But again, there is no standing for even the Data Protection Act to apply because there is no connection. > Given Matt's actions (and statements made by his own team so far in the case), I think he'd struggle to claim that wordpress.org is not linked to "professional or commercial activity". Yea, but there is no standing for the UK to apply its laws on Matt. The EU may have a better claim since he has servers in the EU. However, as pointed out GDPR does not apply for that person because he is neither an EU citizen or a resident as far as I can tell. Their entire claim would be to apply UK law to someone not operating within the country. The entire point of commercial activity is that there would be a connection and would give UK courts standing is silly. It's basic law 101. Hence, why I said in my first comment that OP didn't understand the law.

jeroenhd 2y ago

The author lives in the UK, so the UK GDPR is relevant, not the EU one. It doesn't matter that WordPress isn't a UK entity. WordPress does do business in the UK so they need to comply with the UK GDPR as well as the EU one. If they don't want to comply with UK laws, they need to stop doing business with UK customers (or provide free services to UK citizens, but enforcing decisions against companies outside of the country's borders is rather difficult).

that_guy_iain 2y ago
> It doesn't matter that WordPress isn't a UK entity. WordPress does do business in the UK so they need to comply with the UK GDPR as well as the EU one. If they don't want to comply with UK laws, they need to stop doing business with UK customers (or provide free services to UK citizens, but enforcing decisions against companies outside of the country's borders is rather difficult). WordPress.org does not do business in the UK. It doesn't do business at all. It has no UK entity. The courts would have no recourse to enforce anything upon WordPress.org. UK Law does not just apply to everyone. UK law applies to businesses operating within the UK. If you want to test this, go complain to the ICO and they'll tell you that they have no power.
- graemep 2y ago
  > WordPress.org does not do business in the UK. Wordpress.org is run by Automattic, and the owned by Matt Mullenweg personally: https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-wordpress-org-wp-engine https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-w... Automattic does do business in the UK.
  - that_guy_iain 2y ago
    Read the actual court documents instead of linking to a news report, which actually disagrees with your point. Automattic are being very clear about them not operating WordPress.org. And have submitted to the court that WordPress.org is operated by Audery Captial another one of Matt's companies. A company used to help to blur lines and deal with personal matters.

graemep 2y ago

UK GDPR applies to anyone processing UK residents' data. EU GDPR applies similarly to EU residents' data. That is why American companies that deal with people in those countries comply with both. Some American websites block traffic from both. Wordpress.org is IIRC run by Automattic, which receives payments from the UK so there is even a way to enforce fines.

that_guy_iain 2y ago
>Wordpress.org is IIRC run by Automattic, which receives payments from the UK so there is even a way to enforce fines. No. WordPress.org is owned and operated by a private American citizen who receives no payments. Automattic is a separate for-profit organization which does fall under GDPR. WordPress foundation would also fall under GDPR. WordPress.org does not. Yea, we were all pretty surprised to hear that WordPress.org is a privately owned and operated site.
- btasker 2y ago
  dotorg being run by a private citizen who receives no payments does not exempt it from GDPR, because GDPR doesn't make that distinction. There _is_ an exemption for household processing (recital 18) - which means that I don't need to worry about taking a neighbour's contact number etc - but wordpress.org wouldn't fall under that. Given Matt's actions (and statements made by his own team so far in the case), I think he'd struggle to claim that wordpress.org is not linked to "professional or commercial activity". It might be quite difficult to enforce against a private citizen, but that's not the same as it not applying.
  - that_guy_iain 2y ago
    > dotorg being run by a private citizen who receives no payments does not exempt it from GDPR, because GDPR doesn't make that distinction. The dot org being run by an American citizen who does not operate within the UK that country 100% means UK courts do not having standing. Remember GDPR UK is not GDPR. It's based on it but case law is different and other stuff. Remember, just because one country does not allow something or requires something does not mean everyone whose website is accessible within that country has to follow that law. But for UK law to apply to someone there has to be a connection. Not just "I can connect to that website" or they're processing my data. Furthermore, GDPR UK does make a distinction or at least the ICO does - https://ico.org.uk/for-organisations/data-protection-and-the-eu/data-protection-and-the-eu-in-detail/the-uk-gdpr/ https://ico.org.uk/for-organisations/data-protection-and-the.... Under UK law providing goods and services requires taking payment. Legal opinion has also been shared from lots of sources that small businesses operating out with the EU aren't covered by GDPR. I believe there is EU law that says EU law only applies to companies with a significant number of customers who are EU citizens. > There _is_ an exemption for household processing (recital 18) - which means that I don't need to worry about taking a neighbour's contact number etc - but wordpress.org wouldn't fall under that. Fun fact, in the UK data protection laws will still cover cameras and whatnot taken from a household. That is UK case law. But again, there is no standing for even the Data Protection Act to apply because there is no connection. > Given Matt's actions (and statements made by his own team so far in the case), I think he'd struggle to claim that wordpress.org is not linked to "professional or commercial activity". Yea, but there is no standing for the UK to apply its laws on Matt. The EU may have a better claim since he has servers in the EU. However, as pointed out GDPR does not apply for that person because he is neither an EU citizen or a resident as far as I can tell. Their entire claim would be to apply UK law to someone not operating within the country. The entire point of commercial activity is that there would be a connection and would give UK courts standing is silly. It's basic law 101. Hence, why I said in my first comment that OP didn't understand the law.