Hacker News Reader

Hacker News

Comment by pmontra | Hacker News Reader

Parent Full thread

pmontra

Yes, even if he lives outside the EU

https://gdpr.eu/companies-outside-of-europe/

It applies even to non EU citizens resident in the EU.

View on HN

> Yes, even if he lives outside the EU

No. And your link doesn't support this assertion.

> It applies even to non EU citizens resident in the EU.

Yes.

Some of the examples in that article are perplexing to me. Take the example of the Colorado company they say is subject to the GDPR. What motivation does that company have not to just ignore it? Since the EU doesn't have legal authority in Colorado, does the EU block European citizens from accessing violating websites? Do they send an angry letter?

A small Colorado company collecting data on EU residents, and mistreating it, would fall foul of GDPR. Yes, the EU doesn't really have much recourse outside of the EU, so there's not much they'll do. Theoretically, if you step foot in the EU they might come after you, but I'm sure you could understand why that would be exceptional circumstances.

Google, however, does have entities within the EU, so they can enforce penalties or what not.

What stops Google or other evil corp from doing the dirty business through small companies in Denver and other places in the US? Can they purchase data from uncountable small actors without any legal repercussion?

Because the EU will be like "oh, I see what you're doing. Pay up Google EU"

Wait so, an an EU resident, processing my data outside of the EU is illegal under GDPR? I have a right to have it processed within the EU?

Incorrect. It is legal to process data outside the EU. They have to be compliant with GDPR. GDPR does not require the data to processed within the EU borders.

Exactly. Perhaps I worded my question wrong, but this is my assumption. The entire premise of the article seems incorrect.

My understanding is that they can "process" it outside, but the "Data Controller" should be a European legal entity. After all, they are not saying "we are moving everyone data to US", they say "we are moving UK customers to US". I don't doubt they can do it, but I'm not a UK customer, that's the point.

Reply on news.ycombinator.com