Hacker News Reader

Comment by pdimitar | Hacker News Reader

In the spirit of my original comment I'd answer "yes" to your last question. If I wanted a legal career I'd pursue that -- but I don't. So I'll cut my loses. That doesn't mean I am a shady operator, it means I don't want to risk being sued for money I don't have and likely end up in jail; in EU you can't just declare bankruptcy and run free afterwards.

Hobby or goodwill projects (==not turning a profit) just aren't worth that risk.

View on HN

> in EU you can't just declare bankruptcy and run free afterwards.

Incorporate in the US?

Well, that's yet another legal black hole I don't want to fall into, but yours is still an excellent point.

I thought the gdpr applied to all EU citizens, even if they're not in the EU. If so filtering IP addresses isn't enough.

It cares about the location where you're targeting your goods or services, the location where the data processor or controller is established, or the location where the data is processed. Not anyone's citizenship. Much reporting has been sloppy about this, but the more precise info is consistent.

That's fairly contrary to how I've understood things. Can you provide a resource on that?

Here's one:

https://www.wileyrein.com/newsroom-newsletters-item-May_2017...

I got a couple of small details wrong, but not the main point: citizenship of the data subject is irrelevant.

Ok, that does seem to be the consensus and a good reading of the law.

However, IP blocks are still useless for the reverse reason: someone "in the Union" could be vpned through another country. (For example, I'm on vacation somewhere in the EU and VPN through my home computer to purchase something and have it delivered to my house in the US. By virtue of being in the EU at the time, at the least that specific information collected during my stay would be subject to the gdpr. How would said company ever know?

If you're making a purchase for delivery to the US and using a VPN to hide your EU location, that wouldn't bring the website under the scope of the GDPR regardless of your physical location: the EU guidance talks about signs of targeting the EU for the offering of goods or services.

Examples they list: use of EU languages or currencies not used in the host country, use of EU domain names, specific wording addressing an EU audience.

This kind of nuance is where it's good that humans are the ones enforcing the GDPR, instead of needing a programmable rule.

> 2. Article 3(2): "This regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

a. The offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

b. The monitoring of their behavior as far as their behavior takes place within the Union."

This doesn't seem to discuss intent at all? I mean, we could mince words about what offering a service means, but that doesn't seem productive and unless there is some other part of the law redefining this, won't make me comfortable.

The official EU guidance (not in the text of the GDPR) clarifies what offering means - it requires some evidence of intent to target the EU, rather than merely not blocking the EU.

While that point of guidance won't have region-wide binding force of law unless the European Court of Justice rules that way, I'd be extremely surprised if any national supervising authority or court system would contradict such a document, since the official guidance's reading is clearly among the possibilities consistent with the text (admittedly not the only one) and predictability of this kind of law is key to achieving its goals. Even if they do, they wouldn't likely penalize people with more than a warning if they haven't announced their weird interpretation in advance.

This is an excellent example of the problems people are worried about though.

Q: is it possible to be in violation of the gdpr in a situation where you could never know you needed to be compliant and have taken steps to avoid serving EU countries?

A, official: Yes.

A, unofficial: Most likely not if no one's having a bad day or has a bone to pick or is just being uppity.

The official answer isn't necessarily yes, though. The official answer is more ambiguous than that - "offering" can mean what you think it means, but it can also mean what the official guidance says.

Also, both answers are official and from the EU institutions. One is the law, and the other is meant to help interpret and apply the law. I'm not talking about third party compliance guides (except for the link I shared), of which there are many.

With all of that said... If you have both taken steps to avoid serving EU countries AND have also done things which they view as targeting EU countries, the answer would be murkier. For example, if you block European IP addresses but also use .de and .fr IP addresses and accept Euros, they might consider it to apply despite the IP block.

I'm also not sure what would happen if you took no explicit steps to target, but saw 80% of your customers coming from Europe on a sustained basis and did nothing to stop that.

Overall, the law will be interpreted with its own intent in mind: it should apply if you're engaging with Europe, but not automatically globally.

I understand if you want more certainty, but that's how computer programs operate, not laws.

It's the other way around: it applies to people within the eu, regardless of citizenship so for example a non-eu national that resides within the eu would be covered but data provided by a eu national while living in the us wouldn't be covered.

Yes, I realize that now, but since I can't wait to say I've been told so, I'll keep getting downvotes :)

The recitals do sound as if it applies to citizens, however the actual definition of a data subject for a company outside the EU is someone "in the Union".

Reply on news.ycombinator.com