Hacker News Reader

Comment by madeofpalk | Hacker News Reader

> I'm an Italian citizen, living in Italy [...] and I'm fully entitled to GDPR protection and to have my data owned by a European data controller.

I don't think the latter part is true. AFAIK GDPR does not give you the right do have your data owned or processed by an EU entity. GDPR does not say that.

It doesn't matter where your data is stored or processed, Google must still follow GDPR rules for data about EU residents. The first part of the comment is correct.

I'm not actually completely sure why some companies do this whole EU data controller seperate company thing. I guess for organisational or legal simplicity?

(Edit: I reworded to hopefully remove ambiguity)

View on HN

No, this is not true.

Companies need to be up front with you about what data they keep, and why, and they have to comply with the regs - but nowhere does it say your data has to be kept in the EU.

Why changing the data controller to Google LLC for UK users only then? (ignore the fact that they misunderstood me for a UK resident)

I'm also a UK resident. I can't answer your question, but at a guess, they are segregating data than falls under the GDPR, keeping it isolated from data that does not; you wouldn't have to place it in the EU to do that of course, but it might make sense for some reason.

I'm curious as to where you have got the belief that your data must be stored in the EU. Perhaps you could point towards where in the GDPR you got this from?

Yes, even if he lives outside the EU

https://gdpr.eu/companies-outside-of-europe/

It applies even to non EU citizens resident in the EU.

Wait so, an an EU resident, processing my data outside of the EU is illegal under GDPR? I have a right to have it processed within the EU?

Incorrect. It is legal to process data outside the EU. They have to be compliant with GDPR. GDPR does not require the data to processed within the EU borders.

Exactly. Perhaps I worded my question wrong, but this is my assumption. The entire premise of the article seems incorrect.

My understanding is that they can "process" it outside, but the "Data Controller" should be a European legal entity. After all, they are not saying "we are moving everyone data to US", they say "we are moving UK customers to US". I don't doubt they can do it, but I'm not a UK customer, that's the point.

Some of the examples in that article are perplexing to me. Take the example of the Colorado company they say is subject to the GDPR. What motivation does that company have not to just ignore it? Since the EU doesn't have legal authority in Colorado, does the EU block European citizens from accessing violating websites? Do they send an angry letter?

A small Colorado company collecting data on EU residents, and mistreating it, would fall foul of GDPR. Yes, the EU doesn't really have much recourse outside of the EU, so there's not much they'll do. Theoretically, if you step foot in the EU they might come after you, but I'm sure you could understand why that would be exceptional circumstances.

Google, however, does have entities within the EU, so they can enforce penalties or what not.

What stops Google or other evil corp from doing the dirty business through small companies in Denver and other places in the US? Can they purchase data from uncountable small actors without any legal repercussion?

Because the EU will be like "oh, I see what you're doing. Pay up Google EU"

> Yes, even if he lives outside the EU

No. And your link doesn't support this assertion.

> It applies even to non EU citizens resident in the EU.

Yes.

I think it is the reverse, although I may have misunderstood your statement. GDPR applies to the entity controlling the data, not the resident. So Google LLC is subject to GDPR. Further, an EU citizen is entitled to use Google LLC and by providing services to an EU citizen, Google LLC has to abide by GDPR. So, my understanding is that Google may move an EU citizen's data to a US company as long as the US entity abides by GDPR.

So, is it legal? I'm happy to amend the article if this is the case, but my understanding (when I initially read that UK citizens were loosing some rights being moved to US) is that moving to Google LLC I will have less privacy rights.

According to their email, they think I'm a UK user:

"because the United Kingdom (UK) is leaving the European Union (EU), Google LLC will now be the service provider and the data controller responsible for your information and for complying with applicable privacy laws for UK consumer users"

But I'm not.

I can't say they are doing this intentionally, but it's surely a mistake and there is no way to reach them for a complain.

> moving to Google LLC I will have less privacy rights.

My understanding is that you always have the same rights. Whether Google follows them is another question.

It doesn't matter where the company stores and processes your data, as an EU resident, they still must follow GDPR rules.

That is if Google LLC is able to comply with GDPR in the USA, i.e. if there is no US law contradicting GDPR. I think I have heard there is a law which falls under this category ...

EDIT: also if they believe you are a UK citizen they won't act GDPR compliant.

Reply on news.ycombinator.com