Hacker News Reader

Comment by breakingcups | Hacker News Reader

It's quite simple. If you want to do business in the EU or with people who reside in the EU, you need to comply with the EU's regulations.

Don't like it? Don't do business in/with the EU. Then you're free to ignore their frameworks, rules and regulations.

They are not trying to "impose their regulations on the rest of the world", they're trying to protect the privacy of their inhabitants. That this leads to measures that need to be taken by companies doing business with (the data of) their inhabitants is a side-effect and only logical.

View on HN

If a business decides to opt-out of doing business with the EU as a result, what measures do they need to take? Would a banner asking "Are you an EU citizen? Yes/No" suffice? Or would we have to use some kind of Geo IP tool? How would that defend against EU citizens using a VPN or Tor, and what would a business's liability be in that case?

What kind of business exists where it would be cheaper to drop European revenue than comply with GDPR?

The major tech companies impacted by the law are already likely taking steps to comply. Is anyone seriously saying they’d rather just wave goodbye to an entire continent?

Not all organisations will need to be compliant with GDPR. By that I mean, if your organisation only do marketing in, for example, the US and Canada, only accepts USD/CAD and they are no legitimate appearance that you do/want to do business in Europe, you are not required to be GDPR compliant, even if an european customer goes on your website and purchases a product/service.

If your website accepts Euros, has multiple european languages (e.g. spanish, german, etc.), you do marketing in Europe, then we can conclude that you legitimely do business in Europe, you are then required to be GDPR compliant. This is indicated in one of the GDPR article (can't remember which one)

Edit: fix typos

This are all limitation/qualification upon whether you qualify as providing goods/services.

Yet, that is only one of two reasons why you would be subject to GDPR, the other is "the monitoring of their behaviour as far as their behaviour takes place within the Union".

As far as I can tell, logging a european IP address together with urls (i.e. an access log like every server has) would qualify you even if you aren't doing business there.

Is that interpretation or is there actually language to this effect in the regulations?

I found this (which is not official or legal advice but does quote the regulation): https://www.gdpreu.org/the-regulation/who-must-comply/

Not quite. GDPR applies to you, a US entity, if you do business with an EU citizen trading in dollars living in the US.

"[...]Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union."

Quote from GDPR, page 5, recital 23 (http://www.privacy-regulation.eu/en/recital-23-GDPR.htm). I'm no lawyer, but that's the way I'm understanding it.

So what, English and French? Those are the two major languages of the union, but are also the two official languages of canada. Seems like you can easily get hamstrung on a technicality.

Those are factors, not hard and fast rules. If you are a Canadian company and you provide services in English and French, that alone wouldn't indicate that you are targeting EU users. There would need to be other factors indicating your intent to target EU users.

GDPR may state that it applies. Good luck to the EU in enforcing it, though.

You might need to add something to your terms asking the lines of users certifying that they are not EU residents or citizens and agree to not move to any EU country, and if they do any of those things they agree to indemnify you for any legal expenses or fines resulting from that.

Completely unenforceable though.

Deny access to EU citizens. If EU citizens then lie about their identity its out of your hands.

Simply stop accepting European credit cards. Just like many EU online shops do not accept non-EU (or what blacklist do they have) cards. At least I haven't been able to buy an ebook without a proper European card and/or billing address.

GDPR is not about money, you may not accept payments at all.

ok, but maybe combined with the notice that if you're from EU, you should leave, that would be an effective measure to show you mean it when you say 'no business with EU'.

Users in the EU are not legally required to follow such notices until you make some form of contract with them. Which requires consent.

There's a big difference between "in the EU" and "with people who reside in the EU". When I come to the EU to do business, sure, I'll comply with their laws.

But it's very different to expect people who live outside the EU to respect EU laws, just because someone from the EU happens to choose to visit their website. I don't see this as any different than if someone in the EU was to visit a convenience store in the US - should the convenience store owner be bound by EU regulations in that case?

The comparison to the convenience store fails because in the digital realm, the customer does not need to physically travel outside the EU to do business with somebody outside the EU.

Or, to look at it another way: If it weren't extraterritorial, ad providers (for example) could simply close their local branches, and EU citizens would not be protected from consent-less data gathering. To realistically be able to fulfill its mission, the GDPR _has_ to be global in scope.

Why don't ad providers simply close their local branches, stop accepting these tainted Euros, and collect the data anyway? As mentioned elsewhere in the thread, there's limited mechanism of enforcement.

For the same reason that downloading a song is different than stealing with a CD. Digital stuff is innately different.

You aren't doing business unless you're accepting payments/selling/shipping things to people in the EU. And as with any law, if you're sufficiently small fry the EU isn't going to care about you until you actually screw up. Don't accept euros as currency. Don't offer to ship to EU nations. Done. If you do accept payments/ship/etc, unless you're a multinational, the EU probably won't care anyway, as you'll fly under the radar, unless you leak customer information. Do that in a sufficiently extravagant way, and they -will- care, but unless you have assets in the EU they can't/won't do anything about it anyway.

> You aren't doing business unless you're accepting payments/selling/shipping things to people in the EU.

This is false.

If you offer a free product and one of the companies you publicly list as a user has a presence in the EU, then you need to be compliant.

If your signup page has been localized to Estonian, you also probably need to be compliant.

"Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union."

> Don't accept euros as currency.

I see multiple comments mentioning this. Do American banks restrict which currencies your credit card can be charged in? As far as I've been able to tell, my bank lets me pay in any currency I'd like, and they will convert the amount to SEK before charging my account.

Don't offer shipping options to the EU.

If dealing with digital products, allow people to purchase without creating an account, or require them to select a country as part of account creation (and prevent those selecting the EU, or don't make it an option). If the bank processes the payment, but you've collected no information, you can't run afoul of the law (since you have no information).

> If the bank processes the payment, but you've collected no information, you can't run afoul of the law (since you have no information).

Don't have server logs with IP addresses? Don't collect an email for the user to use to log in? Don't receive customer support recieve from these users?

> You aren't doing business unless you're accepting payments/selling/shipping things to people in the EU.

I wonder how ads play into all this. E.g. are people who watch an ad on YouTube considered YouTube customers? Are they considered customers of the ad company?

My concern is that we will see more (non-EU) companies implement something where users "pay" for services/features by watching ads. I do also wonder how it then affects the ad companies if they collect personal information about the user. Does the user count as a "customer" if the ad company is the one paying?

The simple answer to that is that the advertisers pay you to show ads to EU users because they want to get money from EU users; so these advertisers are/have to be GDPR compliant, especially if they're using user information to target ads, and they'll have to be sure that this user information is legal for them to use.

The advertising networks are clearly doing business in EU as they're getting paid by these advertisers - so all the major advertising networks will have to be GDPR compliant. So in this regard, the ads (and user info used for these ads) shown to EU users will (in practice) have to be GDPR compliant even if your site doesn't care about it, because everyone who'd want to pay for these ads has to be compliant.

> advertisers pay you to show ads to EU users because they want to get money from EU users; so these advertisers are/have to be GDPR compliant

This is the part I'm not sure is true.

Sure, if the ad agency's company motto is "delivering ads to EU users since XXXX", they obviously have to be compliant, but what if they are a US-based ad agency and none of the companies selling them ad space are in the EU? How many layers does one need to circumvent this?

I'm not talking about ad agencies, but about the actual advertisers. Why would a company buy ad impressions if they're not selling to these users?

Almost every ad I see is from some company that is actually eager to sell stuff to me, so they're doing business in EU, and have to be compliant.

All advertisers who care about me won't be allowed to buy my data from US-based ad agencies, so even if such US-based agencies can gather the data, it's worthless, since noone would buy that.

> Don't like it? Don't do business in/with the EU. Then you're free to ignore their frameworks, rules and regulations.

So, should you just start blocking IPs from EU-based citizens?

Yes, if you're not willing to comply, that's exactly what you should do.

OTOH it just shows your remaining customers that you're willing to do shitty things to them, as long as America is trailing in privacy legislation.

Geoblocking IPs is not a solution, unless you're willing to let some people slip through and block people who you don't need to block. Also, not everyone connecting from a EU country is a citizen thereof.

GDPR doesn’t just apply to citizens of EU countries, it also applies to residents and potentially people just passing through (e.g. changing flights at an EU hub).

Given that the average small-to-medium sized business in the US is unlikely to do any business outside of the US, I think we'll be fine. :)

Reply on news.ycombinator.com