Hacker News Reader

Comment by guitarbill | Hacker News Reader

no, we've literally been over this a hundred times in other threads about the GDPR. if your business is outside the EU, and you don't target EU data subjects specifically, then how are you subject to the GDPR? there's no legal basis. even the GDPR legislation acknowledges this, for example in section 23:

> In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union.

it's far more likely they aren't "local" news stations, but owned by a multi-national, or selling data to multi-national corporations subject to GDPR.

View on HN

You're getting downvoted despite being factually and legally correct.

You do not have to comply with GDPR if you are fully outside of the EU's jurisdiction and do no business in the EU.

Every site that gets created does not have to try to comply with every privacy law from every place on earth. At this point it's just belligerent propaganda to try to claim otherwise. It serves no good purpose to lie and pretend that every site on earth with EU visitors must comply with GDPR. That's a non-functioning future: all sites will not be able to comply with all privacy laws from all jurisdictions around the world. It's also legally unenforceable hogwash.

It goes even further however. As an EU citizen not only does GDPR not grant you any new protections in the US jurisdiction, you have very few privacy protections (none?) in the US. Sites with no business in the EU, those that aren't covered by the EU in any manner jurisdiction wise, can do nearly anything they want to with EU citizen data. Lawsuits can be filed against such sites, and they'll be promptly dismissed because the US isn't governed by EU law.

The fact that it’s a “non functioning future” is exactly why people are concerned. It’s entirely possible to regulate a set of activities out of existence if you make the cost of compliance too high. In this case the per user margins are low (FB ARPU is about $25 before expenses).

A website that serves people who connect from the EU can easily be argued to be "offering services to data subjects within the Union".

That paragraph really doesn't say what you think it says. But like all such EU legislation it's really so vague that people who support the EU's political aims will read something anodyne into it, and people who are more suspicious will read something more dangerous, and they can both be right depending on the whims of the commission and ECJ.

However I will note that the EU does have an established track record of making surprising and totally unintuitive judgements about laws that appear to be much clearer and more definitive than what you just cited. The wording of the law is really not as reliable as you might hope with the ECJ.

I stand corrected! Not sure why you're being down-voted for it.

Another point is that the organisation would need some kind of legal presence in the EU, otherwise it would be impossible to prosecute them even if they did violate EU law.

Reply on news.ycombinator.com