Hacker News Reader

Comment by jamespetercook | Hacker News Reader

"Unfortunately, our website is currently unavailable in most European countries. We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market. We continue to identify technical compliance solutions that will provide all readers with our award-winning journalism."

Is this their attempt at GDPR compliance?

View on HN

http://webcache.googleusercontent.com/search?q=cache:HyG0Ev7...

https://outline.com/x63TLD

It’s not an attempt– it is GDPR compliance. What about the page you’re seeing is not in compliance?

I'm sure that what he's saying is that this is a feeble way of complying, not that it's non-complying. The site has apparently chosen to simply block European users, and then to display the insultingly evasive and insincere corporatese message that GP quoted. If the site doesn't wish to take on the burden of complying with the GDPR in a meaningful way that allows access, they should say so honestly.

The page it self might be compliant (not recording IPs/session cookies/etc) but the law still applies on any data collected on EU citizens that might be visiting abroad.

That's why a GeoIP block is not a real fix.

unfortunately the data collected on eu citizens abroad does not seem to actually be the case, it was a common misunderstanding of the law that I fell prey to as well.

AFAIK this is not true:

> When an individual leaves an EU country and travels to a non-EU country, they are no longer protected by GDPR.

https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-...

They're a US entity operating under US law. If you are in the US, US law is what applies, not EU law.

They also don't have European operations, so it's not like the EU has any means to compel them to act even if it wanted to.

You'd certainly be laughed out of a US courtroom (rightfully) if you are trying to force a domestic business to comply with arbitrary foreign regulations in a country they have no involvement with.

It's worth noting that the important part here is the "have no involvement with" part, which the geographical blocking helps establish.

A US entity operating under US law with no physical presence in a foreign jurisdiction but actively courting business with citizens in that foreign jurisdiction has to be a lot more careful. For example, if one of their foreign customers sues them in a foreign court, wins, and gets a damages award there is a decent chance in many states that the US court would recognize and enforce that judgement.

For controllers or processors not established in the Union, GDPR only applies to the processing of personal data of data subjects who are in the Union. See Article 3 [1].

[1] https://gdpr-info.eu/art-3-gdpr/

Reply on news.ycombinator.com