Hacker News Reader

Comment by nemoniac | Hacker News Reader

The GDPR also holds for European Tesla drivers outside the EU.

I don't believe that's true. For processors outside of the Union, it applies to "data subjects in the Union" or "monitoring [...] within the Union".

https://gdpr-info.eu/art-3-gdpr/

Does this mean that if a US citizen goes on holiday to a country in the European Union, that they are a data subject in the European Union?

Yes, as I understand it, that is correct. When you are in a country that is a member of the EU, your data held by companies is subject to the GDPR.

If I go on holiday to an EU country, which (Google) emails, chats, searches become subject to GDPR? All those sent/received only during that holiday? Is Google (or whoever) really going to attach some metadata just to that time frame saying data collected on that date range is subject to GDPR?

Doesn't this mean that even a US company which explicitly verifies it only works with US citizens must still IP block all of Europe to comply?

EDIT: A nasty surprise that might be, too, if it turns out there was important data via that service that you wanted to access abroad but couldn't.

Only if they actually have a legal presence in the EU. If they are a US company that has no legal entity established in the EU, the laws of the EU have no effect on them.

Thanks for the info.

> must still IP block all of Europe to comply

It could comply the normal way.

Is this true? Doesn't the GDPR only applied to those within the EU (i.e., resident or not), or anyone, anywhere, if the company handling the data is in the EU?

No, GDPR only applies if (i) you're in the EU or (ii) the org with the personal data is in the EU.

(i) might be enforible against a US corp if they have something in the EU to do business

Reply on news.ycombinator.com