Re:GDPR: Removing Monal from the EU
by ThePhysicist on Thursday May 17, 2018 @05:12PM
(#17095887)
This was in one of the earlier drafts of the GDPR but was removed, so you can be required to appoint a DPO if you are a small startup as well, but only if one of the conditions mentioned in article 37 applies to you (which I think doesn't to the OP).
I'm not sure this is always true. If you were collecting "sensitive" data (like race) or profiling people you may need a DPO
This sounds like absolute bullshit.
Re:GDPR: Removing Monal from the EU
by BillinghamJ on Thursday May 17, 2018 @05:11PM
(#17095886)
Yes it is bollocks, but the fact that Monal wouldn't need a DPO if they were based in the EU is true.
https://ico.org.uk/for-organisations/guide-to-the-general-da...
Recording IP addresses in a web server log does not qualify as "regular and systematic monitoring of data subjects on a large scale" by any stretch of any definition.
And that's besides the fact that they don't have any presence in the EU. GDPR's scope only includes companies with at least some presence in the EU. That's not just because it'd be unenforceable - the laws make no attempt to include a wider scope than that.
Edit: Art 30 "The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10."