Hacker News Reader

Comment by mgkimsal | Hacker News Reader

I was onsite at a client's retail location and got chatting to a customer. They learned I was in IT and said "I hope you're all set for GDPR!" and I said "it doesn't affect us". "Oh yes it does! There's a lot of people living in this area (in the US) who are European citizens - this affects you right here!" I tried to argue back politely that it didn't affect us, and she started getting a bit... agitated, and the voice started to raise a bit. I tried to de-escalate - other customers in the store would have started paying attention once the raised voice went on. But... man on man... my comeback question I was ready to put back - then stopped short - was "Do you think a 20 person brick and mortar in the middle of Spain is required to abide by US laws? They're not, even when serving customers who happen to be US citizens." I would have hoped it would have made it clear, but... stopped short of getting in to a shouting match with my client's customers. :)

View on HN

I hate to be the one to break it to you but just being in another country and being small doesn't automatically exempt you from other countries' laws. Some examples:

- Australia has laws that about child sex tourism aimed at those that go to Asian countries with lax laws or enforcement. These crimes are committed in other countries [1]

- Foreign financial institutions are subject to FATCA when serving US customers, an issue that has made it difficult for US expats to even open bank accounts in some jurisdictions [2]

- Australia has some pretty strict insider trading laws such that two foreigners who trade in inside information about an ASX listed company while they're on foreign soil (may) have commited a crime in Australia

- Sanctions on the likes of Iran and North Korea prevent US companies or persons from trading with entities from sanctioned states even if such transactions take place entirely on foreign soil.

- US citizens living in other countries are required to file taxes with the IRS even though during the tax year the citizen may never have stepped foot on US soil and any income is earned and paid entirely in foreign jurisdictions.

So I'm not saying GDPR applies or doesn't. I honestly don't know. I'm just saying not being in Europe and being small aren't the automatic defenses you seem to think they are.

[1]: http://www.thejakartapost.com/news/2017/12/13/australia-intr...

[2]: https://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance...

What can EU potentially do to you? I have no plans to comply with my website that gets only 5% traffic from EU. I would rather block access to those users based on trade off.

I hope a Firefox extension comes out to automatically block visiting any website that blocks EU users in general, regardless of whether you are in the EU. I would use it.

If you have negligible EU revenue and no intentions of changing that, it makes no sense to expend any effort on complying with GDPR.

Blocking EU users is a smart business choice to avoid any possible legal issues and far easier than compliance.

fine; but it’s also a red flag for companies that do some pretty terrible things with your data... id prefer not to use a service that gives off those red flags than to chance it. we all have choices, and if a company chooses to represent itself in a shady looking way, i’ll choose to take my business elsewhere.

Or it means... they are a small business with no EU customers.

Those are not in the scope of the GDPR anyway, as per Recital 23.

What if a EU sitizen uses a VPN to use a non GDPR conform service? What's with the California Online Privacy Protection Act? You have to comply to that. And from there it's not such a big step to comply to GDPR. Not?

https://en.wikipedia.org/wiki/Online_Privacy_Protection_Act

Edit: Apprently, there is a new one on its way: https://eu.usatoday.com/story/tech/talkingtech/2018/06/28/ho...

Should they also include any websites that are censored by China?

Yes, as websites are censored in China due to laws meant to protect consumers from the collection of personal information. I want some of that corrupt, totalitarian, and unjust "protection" too!

People like me are the sort who think about Stalin and sigh: "oh, things were so good back then!". That's why we love regulation.

I am unable to see the point of such extension. Why would it matter to you as a user whether the service is available in EU or not ? It is like penalising a website for being complaint with the law. (Not serving EU users is a cheaper alternative for non-EU focused websites).

But I recommend to you that get a list of websites that are censored in China and stop using them. Start with Facebook and Google.

> What can EU potentially do to you?

I expect it's more or less the same thing that the US can do to you: Depends on what assets you have now (or may have later) in the EU, whether you ever plan to visit the EU, and what treaties are ratified now (or later, been bitten by this one) by the US and EU countries.

Ignoring the laws of foreign countries is possible if you're willing to put in the resources, it's much cheaper and less risky just to comply. The general idea of being forced (literally or practically) to comply with the regulations of other governments is completely fucked up in my personal opinion[1], but until your government decides to do something about it, there's not much you can do. At least, you get the option to expand in a foreign county market as a consolation prize.

In the end, this is just a comment on some internet board. I'd recommend asking a lawyer that specializes in these matters if you really want to know about the risks involved.

1: I'll state that I'm not against the GDPR in general and think it's introduction is long, long overdue. What I object to is having some foreign entity I have no connection to forcing me to comply to their will. That's a can of worms governments will regret opening.

Thanks. I operate the business from India and Indian government is unlikely to play with EU rules. Yes, hiring a lawyer is the correct thing to do but given my business does not make enough money from EU users I think it best to ask my EU users to use a VPN.

Recital 23 [1] of the GDPR exempts you from it anyway. Unless you “envisage” serving EU users/customers, it doesn’t apply to you (even if you happen to have some incidental EU users).

[1] http://www.privacy-regulation.eu/en/recital-23-GDPR.htm

> US citizens living in other countries are required to file taxes with the IRS

that's part of being a us citizen, and complying with your own law. you can renounce citizenship if you prefer to not comply with IRS.

> Australia has laws that about child sex tourism aimed at those that go to Asian countries with lax laws or enforcement. These crimes are committed in other countries

So if a US citizen violates Australian laws in Thailand, are they guilty and punishable by Australia? The example above is still against Australians, even if the crime is committed overseas. But... it's only against people who've been convicted, and it's basically just shutting down their ability to leave the country.

The customer in question was stating that simply someone being a citizen of a European country, then visiting my client's shop somehow subjected my client to European law. I don't find any examples you've cited above to be remotely comparable to this situation.

No, I take it back, your banking situation is sort of similar, except the banks in question are likely directly or indirectly connected with US banks. If they want to continue to enjoy whatever status that gives them, they're probably going to comply with those regulations. I also suspect that it's really their own government's financial regulators which have an agreement with US regulators (the wikipedia page seems to jive with that). Those FFIs are voluntarily(?) agreeing to the terms of FACTA because they enjoy some level of benefit (not being shut down by their own govt regulators, perhaps).

There are laws about heresy and apostasy in middle eastern regions - I'm probably violating their laws on a regular basis. Beyond a highly unlikely fatwa that may get issues against me, I'm not sure what they can really do (or indeed, that I would really be 'liable' in any real sense of the word)

A bit of topic, but one cannot simply renounce us citizenship. It is a costly and time consuming process. And if the process of renouncing ones citizenship is not done perfectly, then the us could rejected the request.

Reply on news.ycombinator.com