Hacker News Reader

Comment by 77pt77 | Hacker News Reader

How would this be enforceable for companies that have their headquarters only in the USA even if they have european users?

Will this also apply for citizens of a EU country living outside the EU?

View on HN

The EU is going to send over its army and force you to comply.

My understanding is the GDPR applies to residents of the EU, not just citizens, and it also applies when they are outside the EU. In practice this means it is impossible to determine if it applies unless you gather far more information than you really need from your users - “sorry we have to invade your privacy to protect your privacy”.

So a US company providing services to a US naturalized citizen in the US that is also a dual citizen of a country in the EU makes the company liable to follow these regulations?

That makes no sense.

This sounds unenforceable.

Yep. It is worse that it can be a EU resident (non-citizen) visiting the the USA using a USA only service and the law as currently written still applies. Good luck.

The next fun job is working out how to remove the data from all your backups when you get a removal request.

I have taken the approach that I will comply with the general intent of the GDPR (which I did long before it existed), but not try to apply the ridiculous parts.

"Yep. It is worse that it can be a EU resident (non-citizen) visiting the the USA using a USA only service and the law as currently written still applies. Good luck."

You're going to have to provide proof to back up that statement.

The regulations are ridiculously broad [0]. They appear to cover everyone in the world no matter where they are or what their citizenship. The EU seems to be aiming for a universal human right.

"The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data.”

0. http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...

That's the intro statement. That's like saying the Declaration of Independence is overly broad because it says that "all men are created equal."

See my posts down thread for the more detailed clauses.

It is not citizenship, but residency.

Yes the regulations make no sense and they really aren’t enforceable outside of the EU.

> It is not citizenship, but residency.

I think it's both.

There is nothing in the regulations that talk about citizenship, just residency.

It does not apply to people outside of the EU. Article 3[1] is quite clear about that it applies to people in the EU.

[1] https://gdpr-info.eu/art-3-gdpr/

It says it applies to the “...processing of personal data of data subjects who are in the Union…”.

If someone in the EU (say a visitor) asks to have their data removed that was collected while they were outside the EU, then the controller or processor is supposed to comply.

How is any business supposed to know if a user while they were in the USA of a service located in the USA will not later travel to the EU and make a data removal request while there? If the request comes from someone located in the EU then the regulations apply.

The practical result is you can’t just geo ban people from the EU and this is before we get to the problem of proxies.

You're leaving off the end of the sentence. Data collected about someone outside of the EU is not covered by GDPR even if they later enter the EU.

> where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union.

There is an “or” not an “and” between these two clauses. It applies if you offer any goods or service, OR monitor behaviour inside the EU.

It is interesting that the monitoring clause only applied if the subject is inside the EU when the monitoring is done, while the service or goods clause applies if the person is inside the EU with no requirement that the service or good was acquire or used within the EU. I can’t really think of any logical reason for this distinction. The “takes place within the Union” for one and not the other is strange.

Both clauses explicitly limit their scope to the EU.

> the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union

> the monitoring of their behaviour as far as their behaviour takes place within the Union.

No they don't. The first is limited to subjects in the EU while the second is limited to activity in EU. If the first clause was limited to activities that take place within the EU the clause would say this - actually there would be no need for two clauses as you would just have one clause that says sale, service and monitoring.

It clearly says offering goods and services to subjects in the Union. It only applies if they are in the Union when you are offering them goods or services. If you offer them goods or services outside of the Union and they later enter the Union, you didn't offer goods to someone in the Union, so GDPR doesn't apply.

If you offered them a service and they are in the EU then it is covered. There is no location exemption that this clause only applies when the service was offered when they are in the EU unlike the monitoring clause. Why do you think they broke this out into two separate clauses?

If you get a request from someone in the EU to remove their data you have to comply no matter where or when the data about them was acquired. The clause is quite clear on this point and it why it is written differently to the clause about monitoring.

Trade agreements.

Trade agreements don’t enforce laws, they just mean the countries are supposed to draft local laws that cover the action. This assumes that the GDPR is covered by trade agreement.

Reply on news.ycombinator.com