It's not over stepping. Don't like the laws? Don't do business there. States in the US have different laws that affect operating businesses in them, too.

Funnily enough I operate a service to download copyright-expired content.. Only most of the content is still under copyright in the US. Early Elvis works seem to be very popular.

I've banned all non-local IP addresses from the website with a splash page which tells them why they're unable to access content.

This also doesn't stop my local ISP's and hosts eventually giving up on hosting my content as they're sick of reviewing DMCA's from US-based copyright-holders. Many of the smaller ones simply give me 24 hours notice or no notice at all, nobody wants to risk a lawsuit from the big-bad US media companies.

I get several hundred letters and emails a year with copyright holders threatening lawsuits and legal action. I suspect similar issues will arise for non-GDPR compliant services in the form of user support tickets.

Isn't "webhosts that cheerfully ignore DMCA complaints" a large, well-established industry?

Not in my country, and I have no intention of hosting this outside these borders which could get me in legal hot water.

For curiosity, where are you? Are you unable to find a DMCA-proof server in a country where your content would also be legal, or is there a different problem?

It's a different problem - I'm part of the Commonwealth.

I could host it in a country that would ignore requests, but the point of the website is to do everything correctly. If I hosted my content in a country that doesn't care about copyright or DMCA, I'm putting myself at risk if I was brought into court as I've purposefully skirted around laws.

My country has proven we are held to US copyright law - see the Kim DotCom case. What would usually be considered a matter for civil court was brought into criminal court because it crossed borders and unfounded claims were made against the accused (namely money laundering) who's now being extradited.

I simply want to provide a free, legal media service to those in my country. There's no money in it - I don't even run AdSense, I simply pay for hosting. So far, so good.

If I do get dragged into court, I expect a precedence to be set for future cases. This will also open up a lot of free historical media for government-run TV and streaming services, and local media producers.

It's kind of like a weird tech protest against goofy copyright laws.

But does US law actually require you to respond to the DMCA notice? Like, the provider loses its safe harbor, but if there's no violation of US copyright law then why does that matter? That's perhaps a different test case from the one that you intend, of course...

US law shouldn't matter to us at all. We shouldn't need to know what a DMCA notice is. A copyright claim should be made in the host country's format applicable to their laws, that doesn't seem to be a reality to any of the claims I've received.

Where I am, you should receive an IP rights notice and an interim injunction to remove the works. I've never received anything like that.

> What would usually be considered a matter for civil court was brought into criminal court because it crossed borders

Wasn't it criminal because he was doing it as a business and earning money from it?

That's still a civil case in New Zealand. It's copyright infringement, you don't go to jail - you get sued and bankrupted. The fact he was making money from it doesn't change the court, he just gets sued for more (in this case, it would have been everything he owned).

This bothers me a lot as well. The EU shouldn't have domain over American companies. There's a reason that there isn't a ton of Tech companies in places like Germany.

Well internet is a connected place. Same things happen when US changes their policy. Foe example new net neutrality laws will probably somehow affect the whole world.

Also i think there are lot of tech companies in Germany they just target german audience.

They don't have domain over American companies.

Just don't accept European customer's data and you're fine.

I'm not a citizen of Pakistan.

I don't live in Pakistan.

My servers aren't in Pakistan.

Pakistan can't force me to comply with their laws just because a Pakistani national uses my site.

Same thing with EU laws.

If you want to do business in Pakistan you do.

I'm not doing business in Pakistan or in the EU.

The mere fact that a Pakistani or European uses my site doesn't subject me to the laws of Pakistan or the European Union.

The fact that they are using your site means you are doing business with them.

You know, same could be said for the US, but look how that turned out for Kim Dotcom. Extradition and humongous expenses for him - all because people in a country that was unrelated to the site decided to break their copyright rules and use it :).

They don't have domain over American companies if they're not doing business in the EU.

> It seems overstepping and heavy handed that the EU can enact laws that affect American's and American companies.

Unlike eg Kinder Eggs? https://www.cbp.gov/newsroom/national-media-release/dont-be-...

This also bothers me a lot. I've always wondered how the EU intends to enforce its laws upon my little side projects here in the US.

>I've always wondered how the EU intends to enforce its laws upon my little side projects here in the US.

It doesn't.

It's made to force you to comply when you become bigger.

So it has clauses about project/service/product size/popularity?

In fact, yes. For example, the record-keeping requirements don't apply to most businesses with less than 250 employees. The DPO requirements don't apply to most businesses with less than 250 employees. The entire regulation doesn't apply if you don't target people in the EU and don't offer goods or services to people in the EU. Some of the requirements only apply if you process data on large numbers of people regularly, rather than occasionally. And there's a recital calling on member states that enact and enforce the regulation to pay special attention to the unique needs of micro, small and medium sized businesses.

DPO?

Data Protection Officer. There are a few situations where you MUST assign a DPO (large company, or systemic monitoring or processing of data, or processing of protected data). If you're talking about a tiny side project with basic data protection and you're not doing social scraping, GDPR will likely ignore you.

Demanding privacy is not overstepping it is consumer protection. The consumer need to rely that you treat their data responsibly and the GDPR is a rule book what you need to do. And yes, this rule book knows sanctions.