Hacker News new | ask | show | jobs
by mjewtoo 2844 days ago
The page it self might be compliant (not recording IPs/session cookies/etc) but the law still applies on any data collected on EU citizens that might be visiting abroad.

That's why a GeoIP block is not a real fix.

4 comments

They're a US entity operating under US law. If you are in the US, US law is what applies, not EU law.

They also don't have European operations, so it's not like the EU has any means to compel them to act even if it wanted to.

You'd certainly be laughed out of a US courtroom (rightfully) if you are trying to force a domestic business to comply with arbitrary foreign regulations in a country they have no involvement with.

It's worth noting that the important part here is the "have no involvement with" part, which the geographical blocking helps establish.

A US entity operating under US law with no physical presence in a foreign jurisdiction but actively courting business with citizens in that foreign jurisdiction has to be a lot more careful. For example, if one of their foreign customers sues them in a foreign court, wins, and gets a damages award there is a decent chance in many states that the US court would recognize and enforce that judgement.

AFAIK this is not true:

> When an individual leaves an EU country and travels to a non-EU country, they are no longer protected by GDPR.

https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-...

For controllers or processors not established in the Union, GDPR only applies to the processing of personal data of data subjects who are in the Union. See Article 3 [1].

[1] https://gdpr-info.eu/art-3-gdpr/

unfortunately the data collected on eu citizens abroad does not seem to actually be the case, it was a common misunderstanding of the law that I fell prey to as well.