I've noticed that this is something the EU has tried to do lately, to just sort of push their regulations on the rest of the world. I don't see what sort of authority they'd have to impose this on citizens of other countries.
I wonder if Europe pushes the issue, if this will be treated like libel tourism, where US citizens and companies without a Eurpoean nexus will be explicitly protected from judgements against them.
Don't like it? Don't do business in/with the EU. Then you're free to ignore their frameworks, rules and regulations.
They are not trying to "impose their regulations on the rest of the world", they're trying to protect the privacy of their inhabitants. That this leads to measures that need to be taken by companies doing business with (the data of) their inhabitants is a side-effect and only logical.
So, should you just start blocking IPs from EU-based citizens?
OTOH it just shows your remaining customers that you're willing to do shitty things to them, as long as America is trailing in privacy legislation.
The major tech companies impacted by the law are already likely taking steps to comply. Is anyone seriously saying they’d rather just wave goodbye to an entire continent?
If your website accepts Euros, has multiple european languages (e.g. spanish, german, etc.), you do marketing in Europe, then we can conclude that you legitimely do business in Europe, you are then required to be GDPR compliant. This is indicated in one of the GDPR article (can't remember which one)
Edit: fix typos
Quote from GDPR, page 5, recital 23 (http://www.privacy-regulation.eu/en/recital-23-GDPR.htm). I'm no lawyer, but that's the way I'm understanding it.
Yet, that is only one of two reasons why you would be subject to GDPR, the other is "the monitoring of their behaviour as far as their behaviour takes place within the Union".
As far as I can tell, logging a european IP address together with urls (i.e. an access log like every server has) would qualify you even if you aren't doing business there.
Completely unenforceable though.
But it's very different to expect people who live outside the EU to respect EU laws, just because someone from the EU happens to choose to visit their website. I don't see this as any different than if someone in the EU was to visit a convenience store in the US - should the convenience store owner be bound by EU regulations in that case?
You aren't doing business unless you're accepting payments/selling/shipping things to people in the EU. And as with any law, if you're sufficiently small fry the EU isn't going to care about you until you actually screw up. Don't accept euros as currency. Don't offer to ship to EU nations. Done. If you do accept payments/ship/etc, unless you're a multinational, the EU probably won't care anyway, as you'll fly under the radar, unless you leak customer information. Do that in a sufficiently extravagant way, and they -will- care, but unless you have assets in the EU they can't/won't do anything about it anyway.
I see multiple comments mentioning this. Do American banks restrict which currencies your credit card can be charged in? As far as I've been able to tell, my bank lets me pay in any currency I'd like, and they will convert the amount to SEK before charging my account.
If dealing with digital products, allow people to purchase without creating an account, or require them to select a country as part of account creation (and prevent those selecting the EU, or don't make it an option). If the bank processes the payment, but you've collected no information, you can't run afoul of the law (since you have no information).
Don't have server logs with IP addresses? Don't collect an email for the user to use to log in? Don't receive customer support recieve from these users?
I wonder how ads play into all this. E.g. are people who watch an ad on YouTube considered YouTube customers? Are they considered customers of the ad company?
My concern is that we will see more (non-EU) companies implement something where users "pay" for services/features by watching ads. I do also wonder how it then affects the ad companies if they collect personal information about the user. Does the user count as a "customer" if the ad company is the one paying?
The advertising networks are clearly doing business in EU as they're getting paid by these advertisers - so all the major advertising networks will have to be GDPR compliant. So in this regard, the ads (and user info used for these ads) shown to EU users will (in practice) have to be GDPR compliant even if your site doesn't care about it, because everyone who'd want to pay for these ads has to be compliant.
This is the part I'm not sure is true.
Sure, if the ad agency's company motto is "delivering ads to EU users since XXXX", they obviously have to be compliant, but what if they are a US-based ad agency and none of the companies selling them ad space are in the EU? How many layers does one need to circumvent this?
Almost every ad I see is from some company that is actually eager to sell stuff to me, so they're doing business in EU, and have to be compliant.
All advertisers who care about me won't be allowed to buy my data from US-based ad agencies, so even if such US-based agencies can gather the data, it's worthless, since noone would buy that.
This is false.
If you offer a free product and one of the companies you publicly list as a user has a presence in the EU, then you need to be compliant.
If your signup page has been localized to Estonian, you also probably need to be compliant.
"Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union."
Or, to look at it another way: If it weren't extraterritorial, ad providers (for example) could simply close their local branches, and EU citizens would not be protected from consent-less data gathering. To realistically be able to fulfill its mission, the GDPR _has_ to be global in scope.
this is a very good point actually, GDPR will probably also be used in trade agreements as a requirement, in which the EU has a lot of leverage compared to most other nations/trading blocks across the world.
In the end, the reason the EU can do it is simply because it has enough political leverage to make this happen.
edit: To add to this, I think these kind of things will be good in the long run, especially when the EU starts more trading talks with smaller nations, which are usually very eager to get into a trade agreement with the EU, especially for african nations as it usually allows more ways for legal migration and includes foreign aid a lot of the times.
The authority they have is that delegated by the sovereign members of the EU, and the fact that the authority of a sovereign power is limited only by its own decisions and it's practical capabilities.
(The US also imposes it's ruled extraterritorially when it feels like it.)
The US has given lots of precedent cases for that. The usual approach the US takes is to force the banks the foreign site is operating with to seize all assets. The EU likely would do the same.
depending on the levels enforcement I suspect the same will be true of many popular online services for GDPR: you check the "EU citizen" checkbox and you're banned