Hacker News Reader

Comment by peanut_worm | Hacker News Reader

Question to anyone who knows; I am assuming if you don’t live in the EU they can’t make you pay a fine. What do they actually do to stop you from doing business in the EU then? Do they outright block your website? I can’t think of how they’d stop you from collecting ad revenue from EU visitors otherwise.

View on HN

Yes if push comes to shove they could obviously just shut down websites or go after companies that continue to use Disqus and they in turn will drop it. There's also plenty of countries outside the EU who have adopted GDPR compatible laws and so the EU could likely pursue them in their national jurisdictions. Also EU and US regulatory agencies tend to cooperate routinely because it's in either case to keep market access so if the case is large enough I wouldn't bet on being sheltered from enforcement.

There was for example one case of Canadian firm 'AggregateIQ' being pursued by the UK's ICO over privacy violations, and Canadian regulators agreed.

https://www.theguardian.com/world/2019/nov/26/brexit-data-fi...

The article does not contain the string "ICO". The article describes enforcement of Canadian privacy law against a Canadian company.

The ICO's GDPR enforcement action is what set this in motion, (which to be honest is the first result on Google if you want the entire saga)

https://iapp.org/news/a/ico-serves-aggregateiq-with-first-ev...

The article contains no reference to the Canadian enforcement action. It is about a European enforcement action against the Canadian company in question for work it did in Europe.

Dude are you intentionally trying to be obtuse. The British data watchdog noticed that a Canadian company, AggregateIQ, was mistreating data relating to the Brexit campaign. It then talked to the Canadian data watchdog, which pursued a privacy inquiry against said company because of its mistreatment of British user data. This is one of the first examples of the sort of extrajudicial enforcement of GDPR that OP wanted to know about, Jesus.

There might of been some sort of extrajudicial enforcement of the GDPR in this case, but the second article presented only showed that intrajudicial enforcement of the GDPR occurred based on actions that took place inside the EU with respect to the data of people living in the EU.

The first article actually doesn't mention any enforcement at all in Canada, just comments by a provincial and the federal privacy commissioner. Those comments were entirely based on Canadian law, not the GDPR.

I'm curious about this, too. I once commented that, say, my hobby website isn't subject to the GDPR because I love, work, and play in the US and that's where my blog is, too. Turns out some people have very strong opinions about this and insisted that I am subject to the GDPR. But as a practical matter, how? I don't have a presence outside the US. Even if I violated a EU law, is there a reason I'd ever need to care? For instance, I know I've violated some Chinese laws by criticizing their government, but I'm OK with that because, really, what are they going to do about it?

As an aside, I'm completely behind GDPR, CCPA, and related privacy laws. I think they're great. I definitely comply with the spirit of the laws in my hobby projects by doing things like not tracking anonymous users, not retaining identifiable logs, etc. This isn't me trying to get away with something nefarious. More like, I don't (and won't) bother with things like cookie banners even if GDPR would want me to.

GDPR doesn't actually require cookie banners. If all the tracking and data protection you do is justified, justifiable and obviously necessary for the lowest-common-denominator service you provide, you don't even need to ask for consent (though do let your users know what's up, anyway, with at minimum a Privacy Notice in the footer, because that's just common decency).

If a company asks for GDPR consent, either:

• They have cool, optional features of their site / service / system (though they could just ask at run-time, when you try to use those features, in most cases); or

• They're doing something dodgy and want to wave a magic wand and remove the dodginess by getting you to “consent”.

Worst case they could block your site, but that's not going to happen.

Note that if it is a personal website you are not subject to GDPR. GDPR only applies to companies and organizations.

Also note that most stuff that a layperson would say is reasonable for a website to function isn't a problem in GDPR.

> most stuff that a layperson would say is reasonable for a website to function isn't a problem in GDPR.

Except revenue of course.

You can advertise perfectly fine, just not track users to show personalized ads.

These were the norm in advertising until like 2005.

If you're not doing business in or with any EU entities there's not much they can do

Reply on news.ycombinator.com