Comment by vore | Hacker News Reader

Comment by vore | Hacker News Reader

Parent Full thread

https://gdpr.eu/article-3-requirements-of-handling-personal-...

  2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

    a. the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

    b. the monitoring of their behaviour as far as their behaviour takes place within the Union.

  3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

How this is enforced this is a different question, but the GDPR explicitly spells out that the controller or processor, even if not established in the EU, is subject to GDPR if they are interacting with EU citizens.

> ”but the GDPR explicitly spells out that the controller or processor, even if not established in the EU, is subject to GDPR”

It may be in the GDPR’s text but they have no jurisdiction. Put simply, the EU has no authority whatsoever to create law outside of its own borders.

To instrument with which to extend the reach of such laws as the GDPR would be international treaties.

Sure they can – if any subsidiary of the controller or processor is domiciled in the EU, they can penalize the subsidiary.

> is subject to GDPR if they are interacting with EU citizens.

Only with regarding to item a and b. Item b is irrelevant since it's for monitoring EU citizens within EU. Item a is questionable since it's for goods and services offered, i.e. marketed to, EU citizens. For non-EU companies and websites that don't market to or offer goods/services to EU citizens, I don't see how GDPR applies.

Right, I would argue that if the OP is not complying or attempting to comply with GDPR and believe that the laws don't apply to them at all, then they are not making an effort either to actively avoid offering goods or services to EU citizens.

Reply on news.ycombinator.com