If we process personal data ( country information ) for following :

  1. Blocking users from countries we do not have patent or copyright in .
  2. Removing content where the authority has asked .
    Is this legitimate interest or something else? Can anyone object to this processing ?

If you are a non-EU data controller, and process personal data such as IP addresses for the purpose of preventing any offering of goods or services to people in the EU or UK, there would be a good argument that this would fall outside of the scope of the GDPR. However, this would be easy to mess up:

  • If this processing is carried out in the context of an EU establishment of the data controller, the GDPR definitely applies (regardless of where the data subjects are).

  • If you do offer goods or services to data subjects in one EU country, then GDPR might apply.

If you have a legal obligation by an EU member state to block some content, that legal obligation is a sufficient legal basis to perform the necessary processing such as geolocating IP addresses on a per-country level.

Note that there are various EU regulations against offering different goods or services (or possibly at different prices) to consumers in different EU member states. E.g. if you only have copyright or patent licenses to only offer services in France but not in Sweden, you may be required to re-negotiate these licenses. But this depends very much on the precise services at question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.