'target the EU market' is vague.

These are independent operators, NGOs etc, services being 'used by EU citizens' not really 'targeting Europeans'.

From a liability perspective, to the author's point these services I suppose would have to just filter out European sources?

Why would they publish a regulation so obviously vague, full well knowing the reality on the ground?

Why wouldn't they use language that unambiguously places NASA etc. firmly 'in our out' of the regulations or, some criteria which they would be one way or another?

Seems odd.

That is exactly how gdpr is set up. Which is good.

Regards NGOs: just because you do not make money does not make you a saint.

Regards vagueness: if you want to survive in an agile environment without rewriting every second day, vagueness is the way to go.

>That is exactly how gdpr is set up. Which is good.

So if the US comes out with "GDPR- The Next Generation" with similar mandates towards the EU would that also be "good"?

Asking for a friend.

FISA courts and the law they are based on? The US is explicitly or implicitly doing this all the time.

Or the Hague invasion act which is pretty much that case (US soldier are protected abroad against international treaties).

Yes, it most certainly would be good.

The text in question does define more closely what it means to offer services in the EU. To lawyers (and to anyone who has experience with GDPR compliance) this is not a particularly vague statement. Admittedly, there's no unambiguous bright line definition, but there's a lot of jurisprudence on the matter.

In reality, the question is not whether EU citizens will use these services, but whether the operator of the service is targeting people in the EU, i.e. whether the operator intends or reasonably expects for EU people to use their service. A US service will most likely be fine if their reasoning goes something like this: (1) We primarily intend to serve connections from the US. (2) This expectation is reasonable based on our network topology. (3) But we don't care if someone else connects.

It would not be appropriate to exempt specific organizations since those organizations may change their targeting in the future. It already exempts most non-EU organizations, due to the criterion that they don't target the EU.

We had the same panicking in 2018 when the GDPR came into force and – quelle surprise – there are no fines for random international websites. The EU doesn't insert itself into your affairs if you don't insert yourself into the EU market.

I'm not sure where you got the word "target" from. In the context of GDPR what the EU does is they believe European people are their data subjects, they claim that personal data is things like IP addresses, and if you record information about these data subjects, like RIPE IPs in NGINX logs, then the EU feels that you are governed by them regardless of where you live or where your server is hosted. Which to me sounds like basically everyone who's plugged into the internet who hasn't configured their firewall to drop traffic from ips starting with 2, 5, 25, 31, 37, 46, 51, 53, 57, 62, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 109, 141, 145, 151, 176, 178, 185, 188, 193, 194, 195, 212, 213, or 217. In practice, the EU has explicitly exempted most of the operators who wouldn't be economical to fine, but it's pretty clear that the regulatory model is intended to operate like a whitelist, i.e. you're under their dominion unless they say you're not. What I found particularly amusing in the context of the DNS topic at hand. Is when people voiced concerns about normal people running DNS on a Linux router or something being impacted by the legislation, the EU's response in the document was like, no no trust us if you're doing something like running a DNS server on your "laptop" (yes they said laptop) then you're not going to be impacted. How reassuring!

I got the word "target" from the referenced section (65):

> In order to determine whether such an entity is offering services within the Union, it should be ascertained whether it is apparent that the entity is planning to offer services to persons in one or more Member States. The mere accessibility in the Union of the entity’s or an intermediary's website or of an emailaddress and of other contact details, or the use of a language generally used in the third country where the entity is established, is as such insufficient to ascertain such an intention. However, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the entity is planning to offer services within the Union.