Comment by donohoe | Hacker News Reader

Comment by donohoe | Hacker News Reader

First, I am not a lawyer. I don't even play one on TV.

The big question I keep hearing is; I'm in the US (or other non-EU country), does GDPR apply to my company or organization?

The shortest possible answer is: Maybe :)

The answer is: YES if your company has a physical or legal presence (like an office, employee, parent-company, subsidiary, etc.) in an EU country. The GDPR applies to you and you need to to start reading up ASAP as you only have a few weeks to figure this all out.

The answer is likley: NO (but be careful here) if you have no physical or legal presence in the EU. Bonus points if your business isn't really aimed at the EU.

The answer is likley still: NO if again, you have no physical or legal presence in the EU but do rely on EU traffic as a direct or significant part of your business. At that point is all about how much risk you're willing to take on as we see how this law is interpreted.

Any country can claim this over any other territory they wish. But that doesn't make it true. For the claim to be effective (except by use of force), it must be agreed either with the legal authority of the country.

Right now there appears to be none. No one is clearly citing any treaty with the EU as giving them this authority.

  Disclaimer: This isn't legal advice. This is my personal view 
  on a complicated issue that I'm trying to discuss in order 
  to learn more myself.

They explicitly contradict you.

https://ec.europa.eu/info/law/law-topic/data-protection/refo...

The law applies to... 2. a company established outside the EU offering goods/services (paid or for free) or monitoring the behaviour of individuals in the EU.

Do you have any evidence? You're doing business with EU citizens. You allow them to connect to your site.

Wouldn't this operate similarly to how extradition by the US of foreign hackers work?

I'm not sure what you're implying here but allowing somebody to connect to your site obviously doesn't qualify as providing goods/services. The actual legal text makes that pretty clear.

"Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, [...], is insufficient to ascertain such intention, [...]" (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...)

It does not matter what EU thinks. What matters if what can EU do and the answer is nothing unless your company operates in Europe

> Wouldn't this operate similarly to how extradition by the US of foreign hackers work?

It would not.

In most countries, extradition requires that you’re being charged with a crime in another country with something for which you could also be charged in your current country, and which carries a one year prison sentence. If you’re not breaking the law in America, you have nothing to worry about. (This is at least the case for the UK-US treaty - I’ve not verified for other treaties, but I’d highly doubt the US would agree to a treaty with anyone which requires them to extradite anyone for something that isn’t a crime in the US.)

Of course, if you ignore the EU repeatedly, you’re going to be stuck if you ever want to expand to the EU, or have any assets there ever. That’s about all they can do.

Extradition is an extreme example and not applicable here.

My whole point is, just because the EU makes a law doesn't mean it can enforce it.

https://en.wikipedia.org/wiki/Extraterritorial_jurisdiction

I think the problem for orgs in non EU and non Third Countries is that a lot of EU based orgs will be (or already done so) moving as much as possible to providers that are GDPR compliant - or offer assurances that satisfy the GDPR (Like the Privacy Shield)

So by not being compliant, or at least offering a way for orgs that are compelled to follow GDPR to be compliant, they will start to miss out on business from B2B or B2C.

Especially after May 25th, there are already radio and TV adverts about it here in the UK, and I imagine that a lot of consumers are going to start questioning this before they use a service

Yes - and I hope they do!

I'm a big fan of this law, but I also see a lot of panic and inaccurate claims being made.

Remember physical presence in the EU can come from something as small as your airplane to Africa having to make an emergency landing in a EU country for some reason. That is you have to not travel at all in the direction of the EU.

Where are you getting the physical or legal presence requirement from? I don't think that's correct.

This is the same EU that turned a blind eye to VW and other companies blatantly lying to regulators. In terms of EU regulation NO is normally a safe bet as long as you are big enough. You think Germany is going to fine an automaker or Lux is going to fine a bank?

Reply on news.ycombinator.com