2

I have a client that wants to approach GDPR compliance by simply putting a notice on his subscription forms along the lines of "Don't sign up, Europeans"

From what I gather about GDPR compliance, I'm pretty sure that won't pass muster. Correct?

Improve this question
1

2 Answers 2

Reset to default
3

I'm not aware of any cases on point, but as a rule legal fig-leaves don't play well in court.

If the webmaster simply puts up a banner saying that EU residents are not permitted but takes no other action to exclude them, then that is going to be considered irrelevant. The webmaster is still very likely required to comply with the GDPR.

On the other hand if the webmaster takes other steps to exclude EU residents, such as using a geolocation service to block connections known to be in the EU, validating email addresses and blocking those from EU domains, and ejecting anyone who mentions that their residence is in the EU, then that is more likely to be seen as a good-faith attempt to avoid being subject to the GDPR. It will also have the practical effect of greatly reducing the number of actual EU residents. All these controls can be evaded, but it would be much harder for any data subjects to claim that they acted in good faith or that the webmaster acted in bad faith.

Note that validating an email address or logging an IP is itself processing of personal data, so anyone implementing such a system still can't ignore the GDPR completely, but it would greatly limit the scope and make it easy to delete any such data after a short time.

(Note: the term "EU resident" above is an approximation of the territorial scope).

Improve this answer
1

You can't get qualified legal advice on an anonymous message board. If the client really wants to go ahead with this, he should consult a qualified lawyer.

That being said, the EU maintains that the GDPR applies worldwide as long as the data subject is in the EU. The enforcement of such worldwide jurisdiction might prove difficult, but see e.g. the Iran sanctions regime by the US for an extreme case.

I don't think such a notice can prevent users from becoming GDPR data subjects.

Improve this answer
3
  • But any European client who still signed up would probably breach their terms of service. I don't think one can obtain access to a service by violating terms of service and then make claims based on that violation. The relevant question is if the website is "offering goods or services" to EU citizens, which (even if telling them to eff off suggests that this is not the case) needs indeed to be checked by a lawyer. But that sounds more like an implementation detail, not as if the idea was untenable per se.
    – user9838
    Jul 28, 2018 at 10:14
  • 3
    @EikePierstorff, what if a non-EU client becomes an EU client by moving to the EU? "I'm in Europe now. I don't want to renew the subscription and by they way, what data do you have on me and how are you using it?" Also I doubt that a violation of the terms of service voids GDPR protections, except insofar as data can be preserved for litigation (and the already GDPR allows for that).
    – o.m.
    Jul 28, 2018 at 14:06
  • 5
    Violating the terms of service doesn't allow the site to breach GDPR.
    – gnasher729
    Apr 27, 2019 at 7:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .