Hacker News new | ask | show | jobs
by GlitchMr 1057 days ago
GDPR doesn't apply for entities outside EU if they aren't specifically targetting services at individuals in the EU (which can be indicated by using EU domains, supporting EU currencies, supporting EU languages or mentioning EU customers in promotional materials).
2 comments
mitjam 1057 days ago
this is not completely correct. GDPR applies to (among others) „ a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU.“ - if you have an accidental EU customer it applies to you. Also if you have an US customer who is temporarily in the EU. https://commission.europa.eu/law/law-topic/data-protection/r...
link
ekidd 1057 days ago
I'm pretty sure I've provided French localization for some of my software at some point, just on a whim. Which is an EU language. And I know that some of my non-EU users of free, online tools have travelled to Europe occasionally. So I guess I was subject to the GDPR, until I took all my web tools offline?

Sure, I never tracked any information except what was absolutely necessary. No email address, no IPs, just logins, passwords, and data saved by the user. But that still means:

- I needed to respond to several kinds of emails within 30 days, even if I was on vacation.

- I needed to understand the frustratingly vague and abstract language of the GPDR.

- I was subject to 27 different data regulators, not all of whom provided information in languages I could read, I don't think?

As a non-EU resident, I have zero vote in any of this. I make zero money off of anyone in the EU. I would happily ignore the EU entirely, or allow EU users to download my stuff and to figure out their own laws.

But the EU claims jurisdiction over foreign nationals, even though we have no vote, no representation, and no commercial presence. There is precisely zero upside for me here.

And with the Product Liability Directive, it looks like the EU might impose personal liability on me as an open source author who occasionally consults for US companies. Which, since nobody in the EU is paying me a cent, I have no interest in assuming. If the final PLD is bad enough, I guess I can try to block downloads from European IPs or something.

If these laws were limited to real companies with an actual presence in Europe, I'd feel very differently. But extraterritorial laws for private citizens are gross.

link