Related point: if you're intending to get out of GDPR, blocking the EU doesn't really help, because the law applies on the basis of citizenship, not territory. If an EU citizen accesses your website in America, that's still within GDPR scope. If you have EU business assets, ship things to the EU, or have any other ties to the EU, then they still have jurisdiction and you certainly still have to comply with GDPR.
And the GDPR is a way way more sensible law than whatever the UK is trying to do here, nobody will comply and no body will care, its only going to Hurt UK citizens and The UK's economy.
I care about privacy and really like what the EU has passed with the GDPR and DSA, but unfortunately we will have countries that does stupid things like this. Hopefully they aren't that important so no one complies.
No, that's not correct. You have to be clearly intending to (not just incidentally happening to) offer goods or services to an EU data subject.
> ship things to the EU
This wouldn't be enough to make the GDPR applicable. You'd have to be specifically targeting EU customers in some way, such as allowing users to pay in euros - not just incidentally selling some stuff to folks who live in the EU. Your other examples (such as having EU business assets) hold because they would make you an EU entity.
The other is when you are processing personal data of EU data subjects that is related to "the monitoring of their behaviour as far as their behaviour takes place within the Union".
There's a recital that adds:
> In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.
Unlike the recital that explains the goods and services case, which talks about it only applying if you envisage offering goods and services in the Union as opposed to your site merely being accessible from the Union, the monitoring case doesn't seem to have any requirement that you are intending to monitor EU data subjects.
That's pretty broad as written. From what the recital says it even applies if you are gathering data the could be used for profiling even if you are not actually currently profiling.
As noted in the article at gdpr.eu that a parallel commenter cited:
> If your organization uses web tools that allow you to track cookies or the IP addresses of people who visit your website from EU countries, then you fall under the scope of the GDPR. Practically speaking, it’s unclear how strictly this provision will be interpreted or how brazenly it will be enforced. Suppose you run a golf course in Manitoba focused exclusively on your local area, but sometimes people in France stumble across your site. Would you find yourself in the crosshairs of European regulators? It’s not likely. But technically you could be held accountable for tracking these data.
I'm not aware of legal cases that have specifically hinged on this issue, but Soriano v Forensic News LLC (from 2021) touched on this clause, and seemed to doubt that merely collecting information (e.g., using cookies) without further processing it with the intent to profile would make you subject to the GDPR.
I didn't specifically mention Article 3(2)(b) - the clause you're citing - because the post I was responding to didn't really mention profiling in any way. Still, it's good to note that the legal landscape on this particular point isn't totally clear as far as I'm aware.
Argh, why won't this misinformation die? You are completely, utterly, 100% wrong.
The GDPR applies if either the data controller is established in the EU or the data subject is physically in the EU.
Article 3 (territorial scope) is incredibly short, read it: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:...
No it doesn't. depends on location only. A US, or any other, citizen is protected by GDPR when they access the web from within the EU
Wow, does that suck. I see about 20% of the "cookie track consent" popups Stateside that I saw browsing from the EU.
Well, except the big, commonly-used ones where you've already consented (or not). Facebook, for instance. It's like this law was hand-tuned to consolidate users into only visiting a few commonly-accessed sites to save themselves the UX annoyance at the cost of the broader Internet's discoverability.
Especially given that what constituted "tracking" was so broad that a lot of sites took the "better safe than sorry" approach because it was cheaper than a full audit of their tracking and a lawyer to interpret whether, say, Apache logs that show IP address constitute "tracking."
Its clearly not a sensible law, and blocking users will send a clear message to them that they should complains about it.
Also the EU is a way bigger user base than the UK, and being complaint with the GDPR is actually possible without needing to pay anyone anything.
I think the affect of this law is going to be way bigger than the GDPR.
Also your example of ignoring Afghan laws on women doesn't work. If you tried to setup a business in Afghanistan that was say an online tutoring programme tailored for Aghan women. How quickly do you think your DNS will get pointed to 0.0.0.0 on the Afghan internet? And how quickly will they seek to prosecute you as a director of that business? As a foreigner living abroad, you'll probably be fine but you won't be making money from your target market. So you're finished. The law worked and you didn't ignore it.
Posting to say you live somewhere else and don't care about the article doesn't contribute to any intelligent conversation, and usually means you do care about something involved, strongly, but aren't willing to say so.
So as a person, I of course do care. The UK used to be fairly good concerning human rights, privacy, cooperation, ... This represents another step back. So the best thing to do is ignore this insanity as good as possible.
Laws like this tend to spill over to other countrys, unless the politicians in question have to tiptoe away from the mess
Pick a lane.
You can ignore its laws by blocking users, and clearly saying you won't comply with such stupid laws.
Being concerned that this can spread to other countries is a big reason why you have to be clear about not playing along.
But yeah believe what makes you happy. Just don't let the hate get to you to much.
https://fra.europa.eu/sites/default/files/fra_uploads/fra-20...
Umm yeah no. Perhaps regulation wise but no, the uk is not a “small” country in the “computer world”.
1. https://www.statista.com/topics/7208/digital-economy-in-the-...
With this legalization I would IP ban the UK, then grow the service and look into opening up for the UK when my service was big and the lawyers didn't matter.
Suggesting that the market size of the UK might not be big enough to make up for the costs of complying with a law like this is not at all the same as saying that people from the UK are not capable of making using industry contributions.
The term small used by op can also be read as a pejorative term meant to describe uk’s would be weakness post brexit - often used by a small but vocal number of eu citizens that like myself (a uk person as well) have been against brexit. And i’ve it read as such.
The uk market may be small in size in comparison with the whole of the eu, but the uk is by no means a small player in the “computer world”, whatever that means.
Indeed due to its size it may not hold much legal clout over the eu, and the eu being protectionist as it is it might even seek to punish british isps or web companies by the excuse of having different laws. Thats not in anyone’s interest and it reflects poorly on the eu and on those people here proposing a ban on uk ips because of some silly laws. I despise the mindset of those who only seek “sanctions” and “punishment” instead of actual solutions and are constantly spewing nationalist nonsense as if, say, germany isnt full of crap and a root cause of quite some major issues on the continent right now.
So yeah I am pretty much bored by all this nonsense. How can we fix the issues that such legislation is causing? Before the righteous ban our ips - not that we’d lose much.
That isn’t righteousness, it’s simply taking the most logical step to protect myself and my company.
The GDPR has teeth only because the EU is big enough to make companies care. It is a watered down version from some privacy rights compared to the old laws in my country. But the old laws were ignorde by US tech because why wouldn't they.
So as the UK left the EU, they are now a small country in the computer world. I'll ignore its laws just as I ignore Afghan laws requiring women to stay at home or whatever country's laws to forbif gays from existing.