Hacker News Reader

Comment by LyndsySimon | Hacker News Reader

It actually isn't clear that it doesn't, as best I can tell. I don't have the text in question in front of me, but one of the questions I've asked and haven't gotten a solid answer on is - who is covered by GDPR? Is it only EU citizens residing in the EU, or EU citizens generally?

If it's the latter, then someone with both US and German citizenship could be covered even if they've never been to the EU.

View on HN

This is a very dangerous interpretation. Let me tell you why: this opens the door for someone, let's say China, to say that their laws apply to Chinese nationals outside of China. You know, censorship and the rest.

While GDPR is a good idea, its legal impact can only be for business conducted within EU boundaries, or we are going to open up a Pandora's Box like this.

You mean: like giving fines to ANY company doing business with Iran just because some US President decided to cancel its own part of an international treaty...? ;-)

Come on: you're whining but you're doing that kind of extra-territorial stuff for decades!!!

GDPR is written in terms of rights people in the EU have against companies operating in the EU.

Which is to say your hypothetical dual citizen would have zero rights under GDPR in their dealings with purely US entities.

"data subjects in one or more Member States in the Union."

People (regardless of EU citizenship status) who are physically in the EU.

This isn't so hard.

Anyone who is in the EU (citizens and not) at the time of using the service. EU citizens living abroad are not covered (unless they are visiting Europe, of course).

Geoblocking is not enough. A user in Europe that bypasses an EU block with a VPN is still covered (this has been explicitly stated).

https://gdpr-info.eu/art-3-gdpr/ Art 3 (2b)

Reply on news.ycombinator.com