Hacker News Reader

Naive question: If there are no such laws in the US, can one just simply store ALL personal data in Iceland?

How would that fix the problem you still can't save data from users from the EU.

That's exactly it. GDPR doesn't particularly care where you're storing the data, nor whether you have a "European presence". If you're storing data on people from the EU, from the EU's perspective, you're required to follow GDPR.

From an enforcement point of view... if you have no EU presence, it'll probably be pretty hard for them to actually collect on the fines they levy, but as a director, travelling to Europe could be problematic. It's not entirely clear here, but it looks like there's a possibility of directors being held personally liable.

In fact, the EU considers all citizens of the world to fall under their legal protections. That is, you don't have to be a EU citizen to have the same legal rights.

Technically this is true for the US as well. We just like to pretend there is a distinction.

It’s a terrifying overreach. The law is so vague many can be considered to be in violation without even realizing it.

Far too many to even prosecute. But a politically active EU bureaucrat can just pick out key offenders to squeeze for publicity, piliticsl contributions, or even bribes.

Reply on news.ycombinator.com