What if you are abusing a service? Can I collect it then?

This is quite a leap from unnecessary phone home request to check version, but alas it already has been answered in depth in other comments.

Not a leap. The conversation jumped to the broader conversation of GDPR and PII a few comments up.

Running a service that might serve an EU citizen quickly escalates to involving lawyers and performing risk analysis in relation to being sued in a court across the ocean.

>Running a service that might serve an EU citizen quickly escalates to involving lawyers and performing risk analysis in relation to being sued in a court across the ocean.

Running any service where you are not sure of legal requirements might require consulting a lawyer first, how is it unique to GDPR? And in order to be on the radar for GDPR violations as a small business you REALLY need to do something seriously wrong.

I actually think I may be mistaken.

I've always believed GDPR was a regulation that crossed borders. Meaning it applies to any EU citizen, no matter where they are located, which is what made this unique (being that it's not my countries laws). But:

> The GDPR applies to: > > a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU.

from https://commission.europa.eu/law/law-topic/data-protection/r...

So now I'm wondering if an IP address reverse-geo lookup to block IPs in the EU is the easy way out for many online services, presuming that this doesn't cause compliance issues for EU users using a VPN.

It sure is a good way to communicate that you don't care about my privacy and should not be getting my money ¯\_(ツ)_/¯

GDPR is a headache and makes doing the right thing harder.

No.

Yes.

Yes.

"Processing shall be lawful only if and to the extent that at least one of the following applies: [..] processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data"

Reasonable abuse protection clearly falls under that, as has been fairly clearly stated even in the GDPR itself: https://gdpr-info.eu/recitals/no-49/

But I don't know what counts as PII because the regulations are so vague.

All of the legal definitions of "PII" leave out a ton that is actually personally-identifying information. Just have personal standards that exceed all of the laws. No problem.