Hacker News Reader

Comment by dgellow | Hacker News Reader

That’s not correct, if your service deals with PII from European then you are subject to GDPR. It doesn’t matter where the company is located.

View on HN

yeah... but jurisdiction. i'm publishing a new law, in my own jurisdiction: the following usernames are prohibited:

dgellow

...so what now?

Now you impose sanctions in your jurisdiction to violators and nobody cares because you're not the EU and your sanctions have no weight.

Well, I don't know, is your country part of different international organizations? You know the one that allows your country to exist.

As much as they would like you to believe there is no licensing authority that allows you to be a country. It's maintained through will and force.

You mean the clown institute that pretends Taiwan isn't a country because the big bully would get mad? Pretty sure they don't actually have a say on whether countries exist.

Go ahead and sanction us… oh wait

Ok so Europe can ban me from operating in Europe, why would that stop me from serving data archives to the rest of the world?

Nobody is banning you. You are risking to be fined if people in the EU complain their PII are being shared or processed without their consent.

While in theory GDPR claims global jurisdiction, in practice (pre-Brexit) UK ICO conceded they can't do much about US companies (Washington Post to be precise) as there's no EU presence, so there's that.

I guess it's a bit like if South Korea tried to enforce their North Korean songs ban in the US.

…and what happens when the fine is unpaid?

You are subject to the GDPR if you want to provide services to EU users. While on paper you’re subject to GDPR anyway, what kind of leverage EU can exert on you otherwise?

In theory at least the EU could arrest company representatives should they ever visit the EU and they can confiscate funds or equipment destined for your company if it should transit trought the EU. Whether they would go that far for the GDPR is another question. Usually its a lot easier to just comply which is why most companies consider GDPR to some extend or at least pretend to.

As for the original question, I don't see how deleting your reddit account would require an external archive based on publicly available data to follow that deletion. If there is personal data then you might have a basis for requesting it be removed but surely you'd need to make that request to whoever hosts the archive directly.

It’s really not that simple.

GDPR requires that there be a lawful basis for processing personal data (e.g explicit consent). If the archiving service is releasing the data without the explicit consent of the individuals involved and doesn't have another lawful basis for processing, it could potentially be in violation of GDPR.

Under GDPR, data subjects have certain rights, including the right to access their personal data, the right to rectification if the data is inaccurate, the right to erasure (also known as the "right to be forgotten"), the right to restrict processing, the right to data portability, and the right to object to processing. By releasing a torrent of the dataset, the archiving service is very likely to be infringing on these rights.

Reply on news.ycombinator.com