I run a Web site. I am a natural-born US citizen. I own no property outside the US. Why does my Web site have to be GDPR compliant? Even if a European court convicts me of a crime, does it really affect me?
15
-
4Who says your website has to be compliant? Just cut your EU audience off (by both Geo IP and by terms explicitly excluding anyone in the EU using non-EU VPNs).– GreendrakeJun 30, 2022 at 9:05
-
1@Greendrake - depends who you ask, I suppose, but no harm in considering every possibility. But if you only consider "the EU" you will definitely miss at least three places that are likely to bite you for Data Protection legislation.– ItWasLikeThatWhenIGotHereJun 30, 2022 at 10:13
-
6And then there are the other countries that have similar to (often based on) GDPR: 17 Countries with GDPR-like Data Privacy Laws: Australia, Brazil, Canada, Chile, China, Egypt, India, Israel, Japan, New Zealand, Nigeria, South Africa, South Korea, Switzerland, Thailand, Turkey and some US states such as California.– Mark JohnsonJun 30, 2022 at 10:41
-
2Interesting read, though copyright-related, not GDPR related: American project Gutenberg had to geoblock Germany from access because they hosted several books in German, which were out of copyright in the US but still copyrighted in Germany, which a German court ruled as targeting a German audience. teleread.org/2018/03/03/… So yes, EU laws and court rulings can and do affect American web sites as long as those websites target EU citizens.– Guntram BlohmJun 30, 2022 at 14:48
-
1@JonathanReez Unless the people involved in said project decided to take a vacation in Europe and found themselves in prison for violating a court order.– reirabJun 30, 2022 at 22:19
|
Show 10 more comments
2 Answers
As of 2022, there are no legal precedents where:
- A website was operating outside the EU, with no EU legal entity established and no payments accepted from EU users
- An EU court ruled that they must still comply with GDPR because they happen to have visitors living in the EU
- Said website ignored the EU court ruling entirely, refusing to comply
- The EU managed to convince the authorities of the country where the website is located to enforce the judgement on their behalf
See As of 2020, have any GDPR-related court judgements been successfully enforced on companies without presence in the EU? for a prior discussion of this question.
So as of today, you're likely fine not complying with GDPR as long as you don't take any payments from users in the EU and don't have a legal entity there. Things might change in the future if a successful foreign enforcement occurs, but until then it's highly likely you'll be just fine. While EU authorities would love to force the whole world to comply with their laws, in reality its unclear if this is possible, as otherwise every single website would face a huge headache trying to comply with laws from Turkmenistan or Iran despite not taking any payments from these nations.
answered Jun 30, 2022 at 18:37
-
5Are you suggesting that you wouldn't want to abide by Iran's Global Data Extraction Resolution requiring that all personal data from everyone on your server be handed over for personal review by the Grand Ayatollah unless you've specifically geofenced Iranians from accessing your website? :)– reirabJun 30, 2022 at 19:12
-
4@reirab or the Turkmenistani law requiring you to pay 10 manat to the government for every 1000 visitors that you get :-) Jun 30, 2022 at 19:24
-
2@Someone I don't know but it shows the absurdity of expecting websites to comply with the laws of 200+ nations just because they happen to be accessible from those countries via the Internet. If you're taking payments from the EU, then sure, it makes sense to follow their laws, but otherwise you shouldn't bother. Jun 30, 2022 at 21:21
-
3@Someone No, it was a parody (and reductio ad absurdum argument) poking fun at the idea of claiming extraterritorial jurisdiction over websites that aren't even conducting actual business in the legitimate jurisdiction of the government body in question. It's a terrible precedent to set, even if it were to get upheld, with extreme potential for abuse. Clearly, MEPs didn't think that one through very well.– reirabJun 30, 2022 at 22:07
-
1Yeah, if countries had to enforce each other's court rulings, I would just find some deserted island, start a micronation, put myself on the Supreme Court of Iwanttofinemegacorporationsland, rule that Amazon violated my (ex post facto, but that doesn't matter because I don't have a constitution forbidding it) privacy laws, and fine them for $1,000,000,000.– SomeoneJun 30, 2022 at 22:19
As stated by GDPR article 3 you are required to follow it under the following circumstance:
This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
- the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
- the monitoring of their behaviour as far as their behaviour takes place within the Union.
You can read the recourse better at What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?, but in short the US will allow the EU court to press it's rulings due to wanting to keep its trades, treaties and other similar things in place.
-
-
3The reality is, unless you're Google or Amazon, just ignore the GDPR and nothing will happen. The EU will have a difficult time trying to enforce their laws against your small time ecommerce website or whatever.– SnakeDocJun 30, 2022 at 23:54
-
@SnakeDoc and especially given the risk of failing to enforce the GDPR on a foreign entity, resulting in humiliation for the EU. Jul 1, 2022 at 20:22