I'm in the U.S. with my websites. I'm not under European Union jurisdiction unless my use of one or another Google product puts me under EU jurisdiction. I need to find out if any Google product gives me that nexus. I've asked Google several ways but no answer has appeared. Google's online information is vague. Google likely wants us to continue using its products and I'd rather do so, but I don't want the burdens of EU law. I know how to research U.S. law but hardly at all how to research foreign law. Reading the new privacy regulation doesn't help me understand how EU law applies it. We're not required to know and comply with the laws of about 190 nations and it's not possible. How do I find out if the Google product nexus is present here if Google doesn't say?
-
If you and your business are not located in the EU, the EU will find it difficult to exert jurisdiction over you. I wonder if your question/assumptions are unclear which is why you are not getting the answers you need? Why do you think you need to apply with EU law?– davidgoMay 24, 2018 at 2:01
-
Google seems to say compliance is needed & I use Google products. My query may be complex but is clear & Google has not said it's unclear. Whether enforcement is hard is irrelevant to EU's legal right to enforce.– NickMay 25, 2018 at 2:03
1 Answer
It obviously depends on what the Google products you use does.
For instance, if one of the products is Google Analytics, and you are not filtering this data, your site (controller) will send personal data about Europeans to Google (processor).
GDPR Article 3 (2) b, says that if you are not located in the EU but are involved in processing of PPI about European residents
where the processing activities are related to [...] monitoring of their behaviour as far as their behaviour takes place within the Union
your processing falls under European Union jurisdiction.
My understanding is that the profiling of individuals that is done by GA is the type of monitoring or profiling this refers to.
Now, I do not think the EU is going to dispatch its stormtroopers to strike you down if you do this, but technically, using GA and not taking any additional steps (such as filtering the data to exclude data from Europeans) will put your processing under EU jurisdiction.
-
EU may be overclaiming authority outside EU, although it has some (I answered the other thread). Showing ads from/through Google that Europeans click on is itself not enough of a nexus unless Google's presence in EU provides a nexus, thus my opening query. There's more than one Analytics product and I think one needs compliance but I don't use that one, but that's why I'm trying to figure out how to get more clarity from Google about a nexus.– NickMay 25, 2018 at 2:09