Hacker News Reader

I don't believe that's true. For processors outside of the Union, it applies to "data subjects in the Union" or "monitoring [...] within the Union".

https://gdpr-info.eu/art-3-gdpr/

View on HN

Does this mean that if a US citizen goes on holiday to a country in the European Union, that they are a data subject in the European Union?

Yes, as I understand it, that is correct. When you are in a country that is a member of the EU, your data held by companies is subject to the GDPR.

If I go on holiday to an EU country, which (Google) emails, chats, searches become subject to GDPR? All those sent/received only during that holiday? Is Google (or whoever) really going to attach some metadata just to that time frame saying data collected on that date range is subject to GDPR?

Doesn't this mean that even a US company which explicitly verifies it only works with US citizens must still IP block all of Europe to comply?

EDIT: A nasty surprise that might be, too, if it turns out there was important data via that service that you wanted to access abroad but couldn't.

Only if they actually have a legal presence in the EU. If they are a US company that has no legal entity established in the EU, the laws of the EU have no effect on them.

Thanks for the info.

> must still IP block all of Europe to comply

It could comply the normal way.

Reply on news.ycombinator.com