2

(I originally asked this question on Server Fault with GDPR tag, but due to minimal response was advised to try asking here)

As I understand it, GDPR is European legislation promoted as protecting EU citizen's privacy and granting EU citizens rights to control how websites use data/whether the websites can store said data.

My initial impression of GDPR is that if an EU citizen wants GDPR rights, they should only use servers residing in the EU which would be subject to GDPR legislation.

However, there apparently is some notion that EU legislation can somehow affect servers outside of the EU? I'm not a lawyer, but I would expect that each nation defines and enforces their own laws -- which may or may not be in alignment with another nation's legislation. How is GDPR even applicable to servers residing in the US (or any other non-EU nation)?

Based on several articles I've read online, it seems somehow the US allows EU's GDPR legislation to be enforced on US soil.

Since I don't want to deal with GDPR headaches, I seemingly have no choice but to block ALL EU citizens (and anyone else accessing my sites/services from within the EU) from using my websites and services. I can firewall the entire EU IP address space to catch the bulk of EU users, but there are EU citizens who could use VPN or otherwise access my site from an non-EU ISP.

Is there a legal approach that can be used to block EU citizens? E.g. "Accessing this site or service as an EU resident is illegal" such that if one violated the legal directive, GDPR expectation would be void? I don't care if they use my websites and services as long as they understand I'm not playing the GDPR game and anything they submit to my servers won't be subject to it.

Improve this question
6
  • 1
    Does this answer your question? Why can't I add a governing law to my terms of service to avoid GDPR? – BlueDogRanch Dec 18 '20 at 19:57
  • This answer may answer another part of your question: Are GDPR walls legal? – Dave Dec 18 '20 at 20:33
  • 1
    European laws generally apply to everyone withing the EU (i.e. not only EU Citizens). (Equality before the law). I don't believe you have to bother about VPN etc. since that is an deliberate attempt to falsify the real source of the request. – Mark Johnson Dec 18 '20 at 20:50
  • 1
    This question could benefit greatly from removing the rant parts and snide remarks. – Polygnome Dec 19 '20 at 1:43
  • The easiest way is to just conform with the GDPR regulations, which your non-EU users will also greatly appreciate. – gnasher729 Dec 28 '20 at 23:29
10

This might be based on a misunderstanding of the GDPR. The GDPR applies under three circumstances:

  • Art 3(1): you (the data controller) are established/live in the EU.
  • Art 3(2)(a): you offer goods or services to people in the EU.
  • Art 3(2)(b): you monitor behaviour of people who are physically in the EU.

What is not a factor:

  • what citizenship your site visitors have (see Recital 14).
  • whether your site can be accessed from the EU (see Recital 23).

The crucial part is what “offering of goods or services” means. The EDPB has issued official guidelines on the interpretation of this targeting criterion (guidelines 03/2018 on the territorial scope of the GDPR). Some important notes:

  • The offer of goods or services does not have to involve any compensation. Gratis access to a website can also be a service.
  • GDPR applies when targeting people currently in the EU. US tourists in the EU are protected, EU tourists in the US are not.
  • The moment of offering the service matters. E.g. a US person using an US service cannot claim GDPR protection against the US service while travelling to the EU.
  • Instead of looking at the users of the service, we should look at the target market of the service: if the service doesn't cater to people in the EU, GDPR doesn't apply.
  • The essential question is whether the provider of the service “envisages” offering services to people in the EU. Does the service provider intend for EU data subjects to use the service?
  • The guidelines assemble a non-exhaustive list of indications from case law, in particular the Pammer and Alpenhof case. An excerpt of indications that GDPR might apply:
    • the EU or member states are mentioned in the offer of services
    • the website has marketing targetted at an EU audience
    • the activity at issue is of international nature, e.g. tourism
    • mentioning special contact details for the EU market
    • using a top-level domain name associated with the EU or member states
    • travel instructions when visiting from the EU
    • mentions of an international clientele including people/companies from the EU
    • use of a language or currency other than yours
    • offering delivery of goods to the EU

So whether GDPR applies would depend on the subject matter of your website, and on whether you intend to participate in the EU market (even if only online, even if your service is gratis).

If GDPR were to apply, then blocking people from the EU would be questionable. It might also be illegal, but not on GDPR grounds.

If GDPR does not apply, then blocking people from the EU is already unnecessary.

However, geoblocking would be a very strong indication that you don't intend to offer your services to people in the EU. There is no good case law on whether geoblocking is necessary or sufficient. I assume that geoblocking is sufficient (even if it can be easily circumvented e.g. with a VPN), but that it's not necessary in the first place.

You could also re-emphasize that you're not targeting the EU market when considering the above indications. E.g. a web shop might clarify that they only ship to North America, but not internationally.

Again: your targeting of your website is the crucial factor, not the origin of your visitors. So even if there is an occasional EU visitor, that doesn't mean you have to comply with GDPR.

Improve this answer
5
  • Thanks to everyone for your comments and insights. – Charles T. Dec 19 '20 at 18:34
  • Thank you for the link to the guidelines-document, this is extremely useful. – UweD Dec 23 '20 at 9:30
  • Great answer . Very useful . However amongst all this confusion it is still unclear how the bussiness will prove tg they were compliant in response in case of fake lawsuits say a long time later or how will the consumer even prove they really sent the request and that they have not conspired with the isp to destroy the bussiness. – ask Dec 28 '20 at 17:55
  • @ask In a lawsuit, the consumer might not have to “prove” anything. The court might apply weaker standards such as the “balance of probabilities”, and having an ISP conspire with their customers is not very probable. Nevertheless, before a court can apply the GDPR it must show that it is competent, i.e. the supervisory authority or plaintiff would write an argument that the territorial scope conditions in Art 3(2) are fulfilled. If GDPR applies, the controller has the obligation to “demonstrate” their compliance per Art 5(2), e.g. they might supply records about their handling of DSARs. – amon Dec 28 '20 at 18:38
  • Yes that is correct but unfortunately leaf leads to even more collection of data for records. – ask Dec 28 '20 at 20:06
4

You can’t

First, California has a law very similar to the GDPR that applies to its residents no matter where they are. This is different from the GDPR which applies to all people in the EU no matter where they reside. So, a Californian resident in Europe is covered by both laws and a German in Nebraska is covered by neither.

Second, some laws allow parties to agree to abide by different rules, for example, arbitration laws allow parties to give up their right to use the courts. Others don’t, for example, you can’t agree in a contract that it’s ok to drive through red lights. The GDPR (and the California law) are explicit that you can’t contract out, any attempt to do so is simply void (of no effect) and is itself an offence.

Third, even if you could reliably block everyone to whom the laws apply, what do you do when the circumstances of the user’s you have allowed change? I’m an Australian in Australia so I’m covered by neither law (although there are Australian privacy laws that apply to me), if you collect my personal data and, 5 years later I move to Austria, the GDPR now applies to that data.

As you say “technology has vastly improved” - so have legal privacy protections.

Improve this answer
3
  • 3
    "if you collect my personal data and, 5 years later I move to Austria, the GDPR now applies to that data." I am pretty sure this is mistaken. It is where the person is at the time the data is collected that matters, and even more if a provider of goods or services targets the EU. – David Siegel Dec 19 '20 at 0:47
  • 1
    @DavidSiegel not if I now ask you to delete it – Dale M♦ Dec 19 '20 at 1:07
  • I don't see that clearly. I think that would make a good question on its own. – David Siegel Dec 19 '20 at 1:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.