When you make a reasonable effort to block access to EU users, EU citizens aren't covered under GDPR if they happen to access your site from a non-EU country temporarily:
"This won't apply to every U.S. business — just the ones that are knowingly, and actively, conducting business in the EU. In this vein, EU courts have the discretionary ability to determine if a U.S. company was purposely collecting EU resident data and subverting GDPR compliance. So, in some cases, the inadvertent collection of personal data will be forgiven if it is found to have been occasional and "unlikely to result in a risk to the rights and freedoms of natural persons."
(from https://community.spiceworks.com/topic/2007530-how-the-eu-ca... )
That is an interpretation of the law and is not in accord with what the ICO (the regulator) is saying. If you have a site called "UK Expats" and you block EU IPs you will still be liable since your site is offering a service to EU citizens.
A less extreme use case but equally applicable, you have a shoe store in the US and your style is liked by french citizens living in the US, since a considerable amount of traffic is coming from EU citizens you are under GDPR. even if it is only 20%, even if they are in the US, even if you blocked all European IPs
Re:GDPR compliance as a service
by RcouF1uZ4gsC on Thursday May 03, 2018 @09:15PM
(#16991460)
The easy way to deal with EU persons coming from non-EU IP addresses is to mention in your terms of service that EU users are prohibited from using your website. Then if they use a VPN or otherwise access your website, they will be in violation of the CFAA https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
Re:GDPR compliance as a service
by friedButter on Friday May 04, 2018 @04:34AM
(#16993086)
Why doesnt EU instead implement a continent wide firewall and allow access to only GDPR compliant sites
Yes. VPNs are definitely an issue.
The only foolproof solution is just to block all IP addresses.
Re:GDPR compliance as a service
by nostrademons on Thursday May 03, 2018 @08:47PM
(#16991316)
Or take over Europe.
Edit: I don't want anyone to think I believe it's a good start but it is a kind of solution. I wonder if lots of US companies, once they begin to realize GDPR is a problem for them, won't decide to try one of two things:
1. This: block access from IP addresses believed to belong in Europe.
2. Lobby Congress for a law (or a quick Executive Order) saying that US companies don't have to comply with GDPR.
A few weeks ago on Twitter [1], I speculated about #2. It was too early, I guess. Few people in USA seem to be aware of GDPR at the present time. That'll change in a couple of weeks.
[1] https://twitter.com/CnAdoctor/status/978849723808301057