Hacker News new | ask | show | jobs
by ensignavenger 374 days ago
Doesn't GDPR have an explicit exemption for legal compliance?
2 comments

Yes, but somehow I feel like "a foreign court told us to save absolutely everything" will not hold up in the EU indefinitely.

At least in sensitive contexts (healthcare etc.) I could imagine this resulting in further restrictions, assuming the order is upheld even for European user's data.

Legal compliance with European laws that they are subject of. Not any random law around the world.
Do you have a refference for where the GDPR limits it to only EU law compliance?
Quoting wikipedia: The regulation does not purport to apply to the processing of personal data for national security activities or law enforcement of the EU; however, industry groups concerned about facing a potential conflict of laws have questioned whether Article 48 could be invoked to seek to prevent a data controller subject to a third country's laws from complying with a legal order from that country's law enforcement, judicial, or national security authorities to disclose to such authorities the personal data of an EU person, regardless of whether the data resides in or out of the EU. Article 48 states that any judgement of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may not be recognised or enforceable in any manner unless based on an international agreement, like a mutual legal assistance treaty in force between the requesting third (non-EU) country and the EU or a member state. The data protection reform package also includes a separate Data Protection Directive for the police and criminal justice sector that provides rules on personal data exchanges at State level, Union level, and international levels.[8]

https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

Thank you, that helps understand the wider picture. However, article 48 only to deal with transfers and disclosures, not with storage and retention.