Hacker News Reader

Comment by Hamuko | Hacker News Reader

Sorry, but GDPR came into force in 2016.

That's when they passed the bill I think, but as the article says:

> [...] is to stop serving users in Europe ahead of a new data protection enforcement regime incoming under GDPR, which applies from May 25.

Nope, GDPR was adopted in 2016. It just hasn't been enforced for the last two years in order to give companies time to transition.

It hasn't been enforced because the law itself says it shall apply from the 25th of may 2018 (art.99 par. 2).

So no, the GDPR is not in force yet.

Oh right, I see what you mean now. Yeah, pure technically the law came in to force in 2016.

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:...

> This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

"This Regulation" referring to the General Data Protection Regulation. The date on the journal is 4 May 2016, so GDPR entered into force on 20 May 2016.

To quote the whole thing:

  Article 99

  Entry into force and application

  1.   This Regulation shall enter into force on the twentieth day following that 
  of its publication in the Official Journal of the European Union.

  2.   It shall apply from 25 May 2018.

  This Regulation shall be binding in its entirety and directly 
  applicable in all Member States.

  Done at Brussels, 27 April 2016.

I guess you're arguing about a fine point and being downvoted for pedantry, then?

So to say it "came into force" before its being enforced is at best a poor choice of words.

It was enacted at the EU (err: thingie) level in 2016 and required that all EU member states enact local legislation within two years, deadline 25 May 2018.

The EU is pretty complicated. Oh and by the way, the UK will 99.99999% maintain GDPR related statutes on the books, post Brexit. Either that or we are madder than I thought.

GDPR is a Regulation (the clue is in the name), not a Directive and doesn't require member states to transpose it in to domestic law.

Who mentioned Directive?

You did, because what you described is a directive. GDPR is not a directive. It does not require EU member states to do anything. Only country that needs to do something is the UK, since they're leaving the EU and want to convince the other member states that they're not naughty and they want to play in the same digital ballpark as the rest.

OK, silly me: https://www.eugdpr.org/gdpr-faqs.html

https://services.parliament.uk/bills/2017-19/dataprotection....

Hasn't received royal assent yet?

GDPR isn't a directive. It came into force in 2016 in all of the EU member states.

That's not the GDPR.

It's the UK's effective implementation of it.

Reply on news.ycombinator.com