Hacker News Reader

Companies offering services(including websites) in the EU have to follow laws in the EU. Just like you can't open a shop in New York based on Norwegian law. It makes perfect sense to me. And if a website can't work without spying on me then I'm glad they're avoiding it by themselves.

Well of course! The site is already in the USA. And as such, when I try to access it, I would expect American laws to apply. The problem here, is that the EU tries to regulate foreign web sites, hosted outside the EU -- even if they're not "marketing to the EU" -- for which my country isn't even a member! Of course, the company is in their full right to stop me from viewing their site, in fear of reprecussion from the EU and their draconian fines (though I think it's overly cautios to also stop non-EU-citizens from accessing the contents). That's bessides the point. The point is that it shouldn't be necessary to define opening a web site anywhere in the world as "marketing to EU citizens" (which I'm de jure not, though clearly de facto), when it's clearly hosted in another country. It's exactly like you mentioned; to employ Norwegian laws on a New York shop, which is of course ludicrous. But that's obviously the world we live in now, where innocent bystanders are robbed of their freedom for simply being associated with the wrong entity, for my own protection, I guess, even though I neither asked nor voted for it...

> In fact my country voted against the EU, but yet here we are

And here you are, not in the EU.

Or did you mean Norway should have pursued a "winner takes all" course hinging on a tiny margin, disenfranchised about half the population, and probably caused internal political and economic turmoil for years to come?

If so, I have great news for you. There's an EU country who's about to do exactly that.

What's even better, you can up sticks and move there right now, thanks to the EU (even though you're not in the EU), to witness the glory of the aftermath of such a historic decision.

You might want to hurry though.

I'm already not in the EU, thank you! :) Quite happy with that, weren't it for being treated like I am by American companies making catch-all filters in fear of the oh so scary EU fines.

> I think that is dumb.

It would be dumb if that was what the law says, but it doesn't say that at all.

It says a company needs to be compliant if they operate from the EU or they market to the EU.

Is making a web site, hosted in the USA, "marketing to the EU"? I don't think so. I think it's akin to opening a shop in New York. If you choose to go there, out of your own free will, then American laws should apply, not third party laws to a kafkaesque organization I neither voted for, nor want to partake in.

Applying GDPR based on the country hosting the webpage would be a massive loophole, nullifying the law completely. I think it works well as it is. If websites wants to access the EU market they have to comply to GDPR, but they are free not too... To bounce back on your point, as EU resident myself I haven't had any issue with accessing websites that would not want to implement GDPR.

Except they're not "accessing EU markets." I'm a Norwegian, so I'm not in the EU. As such I never voted for EU laws to apply, and I feel they're being forced on me. Also, I'm the one who's technically accessing American markets, offered from the USA. So American laws should apply. Just my opinion. World leaders and companies don't care about individual freedom, so...

If my company doesn't operate in the EU, how can the EU fine me? Does extradition apply?

It's authoritarian that American web sites can't do the bare minimum to comply with privacy laws in the EU? I worked on some GDPR integration, on a publishing site no less (considering most of the time I noticed publishing sites being unable to be visited when I was overseas), and it took us all of one sprint to do so correctly. It's laziness not difficulty.

It's also not the EU's fault that people in the United States (I say this as an American) are ignorant enough to associate Norway with the EU when it's not a member. The effort involved to actively block people from viewing websites could have been pointed towards GDPR integration.

Edit: You know the real reason some American sites aren't complying? Because they looked at their European analytics and decided that it wasn't worth their effort.

For small sites they might not want to deal with Article 27, which can cost hundreds of euros per year.

If they’re not able to pay hundreds of euros per year to access the european market, they’re not likely making much money off the euro market... so what’s the problem?

Barrier to entry for indies.

It doesn't apply if you're only occasionally processing personal data or not doing so on a large scale.

If you're regularly processing personal data of EU citizens on a large scale then you damn better be doing so securely and in compliance with EU law.

Article 27 doesn't apply if the processing satisfies all of these requirements:

• it's only occasional,

• it does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and

• it is unlikely to result in a risk to the rights and freedoms of natural persons.

Most businesses don't have to worry about the second of those.

How about a risk to the rights and freedoms of natural persons? Recital 75 talks about that:

> The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data protected by professional secrecy, unauthorised reversal of pseudonymisation, or any other significant economic or social disadvantage; where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data; where personal data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or criminal convictions and offences or related security measures; where personal aspects are evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, in order to create or use personal profiles; where personal data of vulnerable natural persons, in particular of children, are processed; or where processing involves a large amount of personal data and affects a large number of data subjects.

That's pretty broad. Note that the overall structure is an "or" of six clauses, and most of those clauses are "or"s of several different kinds of data. Unless this is interpreted very narrowly, most businesses that sell to Europeans online, even if only occasionally, will fall under it, and so Article 27 will apply to them.

Dunno. I am bootstrapping as single founder and the investment was basically

- 2 days to change the app code so only data necessary for the actual use case of the app is processed and stored - 1 day to formulate a GDPR privacy policy in my own words (what data is captured, how is it used, how is it stored, etc)

Unless your business is somehow is fundamentally at odds with GDPR (flashlight app to grab IDFAs and sell those) it doesn't really seem terrible. Especially so as it is in my own interest even without GDPR to minimize my risk surface in case I get hacked and user data is leaked.

It is quite likely that you're not fully compliant, esp wrt chapter 3.

The market isn't wealthy or large enough to target for a lot of American companies.