What experts? I found the law to be pretty clear and there are plenty of summarized versions out there. What some companies find confusing is that the law has made their core business model illegal and no consent form can save them. You cannot get your users to opt out via a consent form, how many times do people have to repeat this? This is nothing like the cookie law.

The only vague part of the law is the fining system which was done on purpose. If you have explicit fines then companies will have to make more money from your private data to cover the explicitly priced fine leading to a worse situation.

1. HN discussions themselves. Literally EVERY TIME this comes up, you see a massive back and forth from various crowds of GDPR; some of whom swear that it's perfectly comprehensible even as significant portions of the conversation are interpreting the same points in a variety of ways. (Are IPs PII? What exceptions can be allowed? What falls under "security requirement"? What forms of data are associated PII? What sort of deanonymization is sufficient? IS it sufficient? are some common questions I saw in the past, not even getting into the wonderful world of third party data processors.) This seems like enough pragmatic evidence that a (to give the benefit of the doubt) educated and professional community hasn't reached consensus, so to say there's a variety of interpretation seems very fair.

2. I implemented GDPR for a small corner of a notable BigCo. I do not consider myself an expert, but I certainly got my marching orders from experts, (The legal teams who interpreted the document and evaluated the implementation methods) and the sheer amount of horsepower put behind finding an interpretation we believed and were confident in was staggering. Granted this is something where we _really wanted to get it right_ but if it were really trivial to interpret I question if the process would have been as intensive as it was. (To preempt the inevitable; our (my team's) business model has _literally nothing_ to do with your data, but we had many of the same confusions/questions that I saw from companies who did, so I'd be hesitant to say that the burden isn't somewhat widespread.)

You shouldn't be getting down voted. I just went through a GDPR compliance review. We have a service model which is incredibly serious about customer confidentiality. We don't sell ads and, to my recollection, have never even bought them. Still required an army of lawyers. Two top London law firms ended up agreeing to disagree on major points, ultimately concluding the Polish data regulator would probably rule one way and the French the other.

Complying with the spirit of a law doesn't mean complying with the statue of it. With GDPR, it's the latter that's a pain in the ass.

Wait, this is being handled on the national level??? I thought you guys had some singular EU court thing for this, not a clusterF of the different countries' justice systems.

Yup, each of the EU's twenty-eight member states have a national data regular who is responsible for interpreting the law. One can appeal to EU courts. But the local context must be considered.

in the end the gdpr is more about opening new jobs.

also sites like: http://www.spiegel.de/ or https://www.bild.de/ do not care about the gdpr/dsvgo... so it won't happen that there will be many groundbreaking changes on how the governments will see privacy issues. at the end they just wanted to scare of the silicion valley.

The point if EU is/was to achieve an "ever closer union" so that war between European states would never happen again. It's not just an economic bloc.

Btw the immigration is the main issue which has nothing to do with trading.

What the poster above is lamenting over is that each member state is in charge of their own investigatory authority, and this makes a lot of sense, if you have a data leak that affects only Spanish citizens you wouldn't want the investigation being carried out by a country like Sweden or even by the EU itself. However if a data leak affects multiple member state citizens each of those member states are invited to and can enter a joint investigation. The issue they believe is that France may have a stricter interpretation of the law than a country like Poland which may make cooperating with the law more difficult as you don't know how strict to be, and while this certainly is going to be the case it's not so different from any other facet of life - In the US you may favour a certain state to be prosecuted in, you may prefer to have a different prosecutor or judge, etc.

I've never understood why people try to comply with the text of a new law that doesn't have case-law under it yet, rather than the spirit.

Surely, the first time anyone gets sued for noncompliance of the text of GDPR, when they are compliant with the spirit under which GDPR was issued, case-law will be created that "bends" the interpretation of the text more toward the spirit?

Continental Europe uses civil law [1]. Case law is less relevant than it is in the U.K. or United States.

More broadly, people try to "comply with the text of a new law" to avoid becoming the precedent. (Even if you prevail, it's distracting and expensive.)

> Surely, the first time anyone gets sued for noncompliance of the text of GDPR, when they are compliant with the spirit under which GDPR was issued, case-law will be created that "bends" the interpretation of the text more toward the spirit?

Surely? Based on what? For anyone with material revenue, that basis will be legal advice.

[1] https://en.wikipedia.org/wiki/Civil_law_(legal_system)

We're all over Europe and the U.S. It was pretty painless. Our business does not rely on the ignorance of users or the abuse of their privacy. What "army of lawyers" did you have and why was the spirit of the law not enough? We had several different business units get through compliance without any problems.

This isn't a hard thing to address at the end of the day (so long as your entire business doesn't depend on it). I just can't help but feel a few ways A) You didn't understand what the law says B) what your lawyers were actually worried about or C) this story is just made up.

What specifically were the discrepancies in the interpretation of the law between various countries that caused two "top" tier law firms to be unable to come to a clean consensus?

My personal guess was they wouldn't need consent, as it was a clear-cut case where all requested data was clearly needed to provide the service. And asking for consent to use the data a customer just typed in the site for requesting the service seems a sure-fire way to annoy them without any upside.

Then the GDPR lawyers came.

It turns out, if you interpret the company charter in a very nasty but still legal way, there might be a very rare edge cases where a service was provided to someone who was not strictly 100% a customer. Yeah, I'm a bit vague here, sorry about that.

To be clear: No real-life example was found now or in the 10+ year history records of the service, both the almost-but-not-quite customer and the company would have to do insane things, and service delivered in the case was almost non-existant, but theoretically, on paper, it was possible. I'm pretty sure nobody would care if it happened, either.

So boom goes our legal base. Consent it is,then.

> Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

and the ICO guidance is

> Consent should be separate from other terms and conditions and should not generally be a precondition of signing up to a service.

Even when consent is given, the users interests still have to be considered during processing, so it's not like it's a do-whatever-you-like card. Just because a user says they consent to you doing something with their data, doesn't necessarily mean you can if that thing is obviously not in their interests.

I wish the fact that consent is only a weak basis under GDPR were made more clear, since if we just end up with an internet that requires consent on every site then the law has just made things worse and made nothing better.

And it is even more insane blindly accepting this sort of advice with GDPR, worrying about getting sued for for theoretical edge cases when the first round of warnings haven't even gone out to the worst offenders yet.

https://gdpr-info.eu/art-6-gdpr/

There are 6 options. Option a is the consent you are talking about. I am talking about option b.

Basically, having multiple legale bases can't hurt, so our lawyers said: Get both option a and b.

Defining what those simple statements like "customer data is secure" means in the context of hundreds or thousands of use cases throughout a complex organization.

But if you're not, or you're not sure what the boundaries of "personal" are (is a first name only personal?) it's harder.

https://www.eugdpr.org/the-regulation.html

Hands up. Who has actually read all of it?

Speaking as somebody who actually has - was teaching computer security last term - I found it relatively easy to read (as legal documents go) - but it still took a weekend. I will guarantee you, that not all of the high powered lawyers whose job it is to read it, have done that.

True story: back in the days when libraries still stamped your book with the date it was due back, I took out a copy of Keynes General Theory from the main library where I lived. It's not that thick of a book, and according to the date stamps it had been borrowed at least 20 or so times. About half way through the pages hadn't been cut.

It was a few years before the significance of that finally dawned on me. As in many things in life, HN discussions on the GDPR are a wonderful example of nobody actually reading it, and everybody having an opinion of it.

Well now I read that link, but I don't think that's the actual law...

Regarding your point about consensus, that's fair - however this has not been my experience. Most parties that you would ask for advice on the matter have a pretty good handle on what the different terms mean.

Your second point is mostly evidence (to my mind) of large corporations trying to get away with as much malicious compliance as they can possibly manage. You really do have to put a lot of effort in that, as you cannot assume the agency checking you will see good faith (which is, as far as I understand it, one of the requirements for not being slapped with fines very quickly).

The law is pretty clear (not 100% clear, obviously, there is going to be loophole and unclear things), and it's easy to decide about unclear spots by following the spirit of the law, and by understanding that any unclear technical requirements really means "what a sane engineer would do, that you could defend against a jury of your peer".

To answer a few of your questions (obvisouly IANAL):

- are IPs PII? Yes, there are legal case about that, your lawyer should have a more detailed answer.

- what exceptions can be allowed? When you have a case you could defend that doesn't go against the spirit of the law

- what falls under "security requirements"? You should be able to defend your choices securiy-wise against a jury of your peer, using your internal documentation. If you have unsalted passwords hashs for example, you are in trouble

- what sort of deanonymization is sufficient? Best practices at the current date.

Technical details aren't going to be in the law, because the goal of a law is to not be outdated every year.

Laws are enforced by humans, not by computers. Your company should be prepared to defend its interpretation of the law (that's your lawyer job) and your technical choices (that's your job).

Edit: obviously, that's a simplified vision, and you should always consult your lawyer. The biggest your company is, the more important it is to try your best to be compliant.

Have you yourself read the regulation? You are wrong.

The regulation makes a single reference (by name) to IP addresses. In recital 30. In that recital, it specifically declares IP address to be PD (GDPR doesn't use the term PII at all).

Not to confuse the matter, but if you stopped there, and decided IP addresses were PD, you would have stopped short. It requires deeper analysis. Here are two good ones:

https://gdpr-info.eu/issues/personal-data/ https://www.whitecase.com/publications/alert/court-confirms-...

The soundbite-sized answer is: it depends.

The tricky thing about GDPR is choosing the correct lawful basis. I think people reach for the legitimate interest card too quickly because they see it as a "get out of jail free" card. But then it ends up complicating things enormously -- especially since legitimate interest can be objected to. I've seen people agonising in public about what to do because the personally identifying information is necessary to provide the service they are offering. If you're in the situation where if someone objects to the use of their data, then it breaks the whole service -- well you're in contract lawful basis territory.

IP addresses are potentially complicated, though. I'm not sure what's supposed to happen when you receive personally identifying information from someone that you don't have a contract with. The law does seem to be vague on what constitutes a "contract", because in some cases it seems to imply something different than what contract law says (i.e. if there is no consideration, it seems I can still use contract lawful basis). In this situation, if I have a P2P network and I need your IP address to fulfil my side of the protocol, then I should be able to use it under contract basis. However, I'm unclear about the actual legality of it -- especially when the information is sent to you by an intermediate node.

To me, that's what needs to be cleared up. I expect it will be over a period of time. I don't think the law was written with that kind of stuff in mind. It's kind of interesting, though. I imagine it is a violation of the GDPR to track what individuals are downloading in bittorrent without giving them a legitimate interest notice, though (and allowing them to object! and be forgotten!). It will be interesting to see if anybody complains about that kind of thing.

Check Patrick Breyer v. Bundesrepublik Deutschland.

Literally a website just logging IP addresses of visitors.

You’re making it sound incredibly cut and dry when it’s clearly not and there’s case law on record confirming it’s not so simple.

https://curia.europa.eu/jcms/upload/docs/application/pdf/201...

I also looked up some additional explanations.

That case literally does not support the claim you make. The court decided that:

* dynamic IPs can be considered personal info if the entity collecting them has legals means to get additional information related to that IP (these legal means exist in Germany, if the entity believes they are being cyberattacked)

* furthermore, the court noted that this particular law is more restrictive than general EU law (which eventually becomes GDPR, as far as I understand: http://germanitlaw.com/patrick-breyer-v-federal-republic-of-...)

* according to the less restrictive law though, "The operator of a website may have a legitimate interest in storing certain personal data relating to visitors to that website in order to protect itself against cyberattacks"

* and this opened up the question as to which law should be followed in Germany, at least until GDPR comes into play (again, see explanation in http://germanitlaw.com/patrick-breyer-v-federal-republic-of-...)

* note then that: this issue is no longer an issue (since GDPR is in play now) and that GDPR actually allows the collection of dynamic IPs if the entity needs to do this to protect from cyberattack

I was responding to a person that was claiming that essentially IP addresses are only personal data for ISPs or ISP like businesses. Which is simply not the case.

I didn't say IP addresses were always considered personal data, I simply said it can be personal data, which you also stated in your post. That it's not cut and dry. The person I was responding to was posting that IP addresses are definitively NOT personal data.

The point is, context for IPs matters. The person I was replying to was way over simplifying.

I'm not entirely sure what claim you think I made that the case doesn't back up as you essentially stated what I did just with more specificity. In any case I totally agree with your post since it's the same point I was making :)

I'm guessing not. People who are willing to put their reputation on the line, who are paid four figures per hour to understand this stuff, disagree with eachother on interpretations of GDPR.

Forget about violations. Even if you're in perfect compliance, any EU resident can complain to their data authorities if they think you're non-compliant. That then prompts a regulatory inquiry, which requires lawyers to competently respond to, which is distracting and expensive.

The flurry of activities is only driven by companies who keep data about their users. Of course "legitimate" will be defined by the courts. That's the price you have to pay now for all the abuses that have been going on for the past two or three decades. History has shown that to define "legitimate" the text of the law is to open the doors to avoidance. Sorry mate, we can't trust you to be honest. It's too late now.

The burden for filing a lawsuit is significantly higher than the burden for making a regulatory complaint.

Of course, just as you mentioned above, responding to complaints is distracting and expensive, which is why all insurance companies folded up the business up here, and there's no more insurance to be bought in Washington.

(I'm kidding of course, insurance companies work here just fine.)

I'm a huge fan of complain-and-respond frameworks. I have complained to my state Attorney General when my cable company change pricing on me mid-contract. I complained to my state Department of Financial Services when a rebate issuer sent me a card instead of a cheque. I complained, the other night, when a construction company decided to run jackhammers on 26th Street at 1:30 in the morning.

Complain-and-respond regimes work. They're also expensive, and cause known incumbency biases. Deploying them should be carefully considered. For insurance and financial services, the tradeoff makes sense. For literally every business that might ever touch a European's data, it's a bit overblown.

GDPR should have had a minimum revenue threshold for the bulk of its requirements. Enforcement should have also been centralized in a single EU enforcer. A simple process for obtaining non-compulsory affirmative compliance certificates, for businesses at or below the revenue threshold, would have also been nice.

> I find it hard to believe that it's going to get much worse than that with GDPR

I see Facebook and Google gaining market share and failing to change their behavior. In addition, Europe is no longer a market one launches in simultaneously with the U.S. and Asia for most foreign businesses.

This whole episode is deeply frustrating as I'm strongly anti-Facebook and pro-privacy rights. The degree to which the EU turned an opportunity to lead into a wholesale boondoggle is jaw-dropping.

Yeah, but in this case that "anyone" is not spending a dime of his own, instead the limitless resources of EU will be coming after you. By the time the court decides, virtually any small company will bankrupt.

Most companies would--and do--retain lawyers to answer regulators' questions. Particularly when in respect of a new law, and doubly so given the political uncertainty currently present across the Continent. Naturally, one is free to self represent with regulators as one is in a court.

This is not America. We do not regularly put people/companies into bankruptcy just because we can.

You have much, much bigger things to worry about as a small company. You could have your bank cut you off because you’re suddenly deemed too risky - happens every day. You could run into a contractual dispute that drags out for years and costs you tens of thousands of euros. You could violate a patent you never knew about. Your supplier goes bust just after you’ve spent weeks negotiating a large order, and now you don’t have enough inventory. You could perform some action or inaction that results in injury to someone, and your insurance could refuse to pay out. It turns out that one of the products you sell kills people, and the Government decides to take you to court over it. Your customers might fail to make good on any credit you give them. One of your key employees could develop a chronic, life-changing illness. You didn’t realise that some tax or other applied to you, and now you’re not making enough money to stay afloat. As a business owner, have you worried about any of these things as much as the GDPR?

> If a country in the EU choose to make an example of my company for whatever reason would would be preventing them from doing that?

GDPR states all fines need to be proportionate.

Isn't that a little vague? It seems to imply that if a business can show that collecting your personal information will grow their business, they do not need to provide a way for you to 'opt out'.

[1] https://ico.org.uk/for-organisations/guide-to-the-general-da...

It's totally fine for it to be vague. I very much doubt we'll see any cases where the general public disagrees with a DPA ruling of LI applicability. As a business owner, it means you need to strongly justify it and consider if a "reasonable person" would consider your use of LI to be justified. If you have doubt, you should seek consent instead.

Do keep in mind, that growing your business by using PD for marketing purposes is explicitly excepted from LI.

Consent may not apply:

> Consent is presumed not to be freely given if... the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

And that is exactly what sites are doing now. And there is noone on earth that will ever believe it isn't deliberate.

While others say the opposite, any data derived from a single individual is still considered personal data.

I could fit a planet into that "reasonable means" caveat.

The regulator interprets the gap. "Planet-sized gap" means the regulator can choose to be lenient or capricious based on their own preferences. That kind of uncertainty is anathema for modern businesses. (It's also beneficial to those who pay to build relationships with said regulators.)

This is classic anti-regulation BS. I would like to see a regulation which did not have this issue brought up against it. Heck, isn't this the core of the anti-regulation camp? Clearly though, regulations have not destroyed the world...

Technically, it will be the courts who (ultimately) interpret the gap, and it's worked so far for other standards like 'beyond reasonable doubt'. Courts have a tendency to be less capricious than a regulator.

I'd even go so far as to argue that "reason" is one of those things where specific examples can illustrate, but no more. Especially with regards to technology -- what is reasonable today, can be unreasonable tomorrow (eg: SHA1).

In the meantime, I'm positive that as of right now, 99% of the interpretation is performed by the data processors, and in most cases to their own benefit.

Dynamic IPs were considered as possibly being personal info, since a law existed which could allow an entity to connect dynamic IPs they have connected to other information (from an ISP), if they believe that connections from the dynamic IP are undertaking cyberattacks against them. Proto-GDPR actually considered collecting dynamic IPs in this case reasonable, and it was a specific German law that was more restrictive. The main question thus became: should proto-GDPR be used, or the existing more restrictive German law? Going off topic though. Point is that "reasonable" is used not as a mathematically precise definition, but in a human language sense of "reasonable". If you don't get what reasonable means, then I am sorry to say that in the case of law, you will generally have to suffer what most people consider to be reasonable in spirit.

In other words, you have a problem with all laws in general, since they are not nearly precise enough for you.

Use of magic moves it from reasonable to improbable.

Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun.

Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers!

It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...)

Processing of data is legitimate so long as you still have a reason to process that data, as well as if you have a contractual obligation with the subject to process that data. If that contract involves keeping an account registered indefinitely, until deletion is requested, then so be it. State it clearly and plainly when the user registers an account, and if you're that concerned about the ambiguity of the situation then the solution seems a simple one, no? Allow the user to choose to have their account deleted after a certain period of inactivity, or email users that their accounts will be deleted after lengthy periods of inactivity. It should be noted that 'inactivity' is industry specific, for something like free services online it could be industry standard to keep accounts for years, it's hard to imagine that a user would be upset about having an account they haven't used in 4 years be deleted, and really, do you need to keep that account after 1 year of inactivity? 3 Years? 5 Years?

I realise the law is purposely ambiguous here especially when applied to things like user accounts, but it helps to understand that storage limitations and retention plans apply less to things like accounts and more to things like metadata that you may be collecting. It's perfectly reasonable to keep user accounts registered for years even after inactivity for example, it's less reasonable to collect data for marketing campaigns and keep that data for years. Retention limits are also far more relevant to processors of data rather than for controllers of data, if you're a third party service you shouldn't need to keep data for longer than your contract with the controller specifies, however controllers have far more of a legitimate need to process data for longer. The push to have retention limits may as well be seen as a push to anonymise data that no longer needs to be tied to an identified person rather than a need to delete everything that hasn't been touched in 90 days.

>Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun.

IP addresses become problematic when you can tie them to an identified person, i.e., you're linking user accounts and IP addresses. As far as generic logs go, if the only personal information you're collecting is IP addresses then you shouldn't need to worry too much, treat the logs with some care as they still do contain personal information but don't sweat it too much. Make sure that if your logs are leaked that you inform users (i.e., through a blog post) that logs were leaked and the only personal information contained is IP addresses. IP addresses are one of the easiest things to justify needing to keep as a legitimate interest as well as needing keeping indefinitely, and if only IP addresses are leaked it's not really a big deal. If you have other personal information in your logs, especially if it's linked with more information, i.e., 'ip address 1.2.3.4 who has username asdf searched for jkl; [etc]', you should take steps to justify why you need to keep that extra information and maybe look at implementing a retention limit, or better yet, anonymise some of the extra data after you are finished processing it. If the metadata you're collecting is kept to a minimum and/or anonymised as much as possible, the need for a retention limit drops almost entirely, not that retention limits are entirely needed.

>Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers!

In every other industry you are responsible for when you choose a shoddy third party vendor who makes a mistake, I fail to see why the tech industry should be any different. I realise there is going to be a lot of teething issues on this particular issue, but part of the reason GDPR has as much scope as it does is because of these clueless third party vendors who misuse and abuse data. Maybe look into using European third party vendors in the future, as they would be just as culpable for their mistakes as you would be and they would be liable for fines too. :-)

>It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...)

For what it's worth, the GDPR makes explicit exemptions allowing for processing data where you have a legal obligation to do so. There is absolutely no conflict between financial laws and the GDPR in this respect.

You're totally right about the 3rd party vendor thing, and this will get better with time, but it doesn't change much that right now, it's a problem. Even vendors who take security seriously and have awesome engineering teams might have garbage lawyers and you have to deal with them. At the end of the day, no amount of security is perfect and you need DPAs. Getting rid of a vendor over this might be hard.

Basically, the whole point is: no, this isn't easy: large companies can have insanely complex problems. Small companies may not have access to the proper lawyer (or even have an IT department!). It's painful. What's worse is having to deal with European laws when you don't have a European presence (foreign lawyers can be tricky or expensive!). And companies who just decide to just avoid dealing with EU customers as a workaround (even small ones who might simply no longer be able to deal with this) get burnt at the stake.

In another comment you posted:

>I'm still not sure that recording everyone who walks past your store 24/7 is legitimate interest.

Stores and businesses need to display signs for when they are recording in the areas they're recording, inside a store it may be obvious that the store is recording, so a sign may only be needed on a door. Outside of a store you may need more prominent signs. If it's not obvious that the area area is being recorded then even more signs need to be posted still. The degree to which stores and businesses can record outside of their businesses will vary by country, but for the UK the ICO provides information for consumers [0], and businesses [1].

[0] https://ico.org.uk/your-data-matters/cctv/

[1] https://ico.org.uk/for-organisations/police-justice/

As a matter of fact: If you operate secutrity cameras in a public -, or semi public place you need a written procedure why something is captured, what is captured, how long it's kept, who can see the footage and under which conditions the footage is retained.

"If not, why?"

Because this is not a reasonable request if the footage is anyway deleted after, say, 72 hours.

If you think this, you've misinterpreted it. I don't think even the biggest GDPR advocates would claim that it is "pretty clear".

What about Article 27? It's unclear, and you don't have to have a shady business model in order to have no idea how you are supposed to deal with it. All it takes is that your business is not established in the Union.

This is the article that requires companies who are not in the Union but are subject to GDPR due to Article 3(2) to appoint a representative in the Union. The representative serves as a contact point that regulators and persons can communicate with instead of the company on all GDPR matters concerning the company. The representative is also required to keep a bunch of metadata about the company's data processing, according t Article 30.

According to the recital for this article, "The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor".

What does that mean?

Some people claim it means that your representative in the Union will be liable for any fines you incur from EU regulators or any damages a plaintiff wins in a private lawsuit over GDPR if the regulator or plaintiff is not able to force you to pay up.

Others think it just means that if regulators or plaintiffs serve notice on the representative, that legally counts as if you were served, meaning that if you do not show up at the hearing or trial and lose by default, you cannot try to weasel out by claiming you had no notice of the hearing or trial. In other words, these people think that the representative is very similar to the "registered agent" that many jurisdictions require foreign businesses to have in order to do business in that jurisdiction.

Personally, I was leaning toward the latter, as the idea of making the representative liable seemed pretty absurd...but it has been pointed out that in earlier drafts of Article 27 and the recitals, it did in fact actually clearly do so. That language was taken out before the final draft, but was that change because they wanted to remove that aspect, or because they decided "subject to enforcement proceedings" already implied it and they were just tightening the language?

This is important because if representatives are actually liable for fines and damages, it is going to be a lot more expensive to hire people to be representatives than it will be if all they have to do is be a contact point and a repository of metadata.

For small businesses outside the Union this could be a major expense if they must have a representative, perhaps a big enough expense that it will be worthwhile to just stop doing business in the EU.

So we must ask, "Who needs a representative?". The answer, it turns out, involves still more vagueness.

Basically, you are excused from needing a representative if you meet three conditions. Two of them most small businesses easily meet as long as they are not doing high volumes of certain particularly sensitive data, and their processing does not result in a risk to "the rights and freedoms of natural persons" (more vagueness!).

The third condition is that your processing "is occasional". What is "occasional"? No one seems to know.

I very much doubt this for a few reasons, the first being that it would be completely out of scope for the GDPR to have any say on what happens or who should be sued in a private lawsuit. The recital itself would also be contradictory, immediately before it says that the representative 'should be subject to enforcement proceedings' it says,

>Recital 80(4), The designation of such a representative does not affect the responsibility or liability of the controller or of the processor under this Regulation.

Additionally,

>Article 27(5), The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.

The wording of these two alone make it clear, to me, that the responsibility or liability lies solely on the controller/processor. The term prejudice also has a very specific meaning in Civil Law, and while it may have different meanings in Common Law (UK) I'm sure the more specific Civil Law version is intended and relevant. The wording of recital 80(6) as well as (5) '[the representative should cooperate] with the competent supervisory authorities with regard to any action taken to ensure compliance with this Regulation.' also tie in with other areas of the GDPR, particularly article 31 and 58(1)(a) which essentially state that supervisory authorities have the power to order the controller/processor as well as the representative to provide information that is required for the authority to perform its tasks. I think recital 80(6) with this context is basically just confirming that representatives need to to be present when supervisory authorities undergo enforcement of legislation.

If it were such a legal headache for representatives, it is concerning that no law firm has put forward an analysis of the situation. As far as I can tell from a brief search it is only amateurs interpreting the GDPR that have come to the conclusion that representatives may be liable for fines. With DPOs, who have many more responsibilities and requirements, there was much analysis by the legal community on what those responsibilities would include and whether DPOs could share liability. The WP29 even put out guidelines for DPOs[0] stating plainly that DPOs are not responsible for non-complaince, only the controllers/processors are responsible for non-complaince. It just seems odd to me that representatives who receive almost no mention in the legislation may be responsible for non-complaince where DPOs aren't responsible.

[0] http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_... [very bottom of page 24]

/s

Exactly this. Even the big reputable publishers (who wouldn't <em>dream</em> of breaking the law, oh no) accept money from companies directly targeted by the GDPR, who collect copious amounts of data on visitors across multiple sites.

Do users on site A consent to company B collecting data through ads, even if they tick a box? Probably not.

https://sheep.horse/2018/6/the_eu_general_data_protection_re...

Searches for my real name now vs prior to GDPR enforcement are like day/night. Prior, it was all topped by aggressive (SEO wise) companies who clone public registries and republish them en-masse without adding any value whatsoever. They just use this as a trick to drive people searching for various people's names to their online magazines and whatever. They basically parasite on other people's names to prop up their revenue at those people's expense.

Now the searches are actually starting to return relevant things near the top, like my past OSS contributions, etc.

For me, this side of GDPR compliance is working fine, and almost all comapnies are pretty good at responding to requests. That is a law working pretty well from the side of the data subject.

How were the prior top search results not relevant before? Either google and others are lousy or relevance means something different to you than most other people when searching for your name.

It was the result of name squatting, as I described earlier.

I know of no search engine which has always shown what I'm trying to find.

- Australia has laws that about child sex tourism aimed at those that go to Asian countries with lax laws or enforcement. These crimes are committed in other countries [1]

- Foreign financial institutions are subject to FATCA when serving US customers, an issue that has made it difficult for US expats to even open bank accounts in some jurisdictions [2]

- Australia has some pretty strict insider trading laws such that two foreigners who trade in inside information about an ASX listed company while they're on foreign soil (may) have commited a crime in Australia

- Sanctions on the likes of Iran and North Korea prevent US companies or persons from trading with entities from sanctioned states even if such transactions take place entirely on foreign soil.

- US citizens living in other countries are required to file taxes with the IRS even though during the tax year the citizen may never have stepped foot on US soil and any income is earned and paid entirely in foreign jurisdictions.

So I'm not saying GDPR applies or doesn't. I honestly don't know. I'm just saying not being in Europe and being small aren't the automatic defenses you seem to think they are.

[1]: http://www.thejakartapost.com/news/2017/12/13/australia-intr...

[2]: https://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance...

that's part of being a us citizen, and complying with your own law. you can renounce citizenship if you prefer to not comply with IRS.

> Australia has laws that about child sex tourism aimed at those that go to Asian countries with lax laws or enforcement. These crimes are committed in other countries

So if a US citizen violates Australian laws in Thailand, are they guilty and punishable by Australia? The example above is still against Australians, even if the crime is committed overseas. But... it's only against people who've been convicted, and it's basically just shutting down their ability to leave the country.

The customer in question was stating that simply someone being a citizen of a European country, then visiting my client's shop somehow subjected my client to European law. I don't find any examples you've cited above to be remotely comparable to this situation.

No, I take it back, your banking situation is sort of similar, except the banks in question are likely directly or indirectly connected with US banks. If they want to continue to enjoy whatever status that gives them, they're probably going to comply with those regulations. I also suspect that it's really their own government's financial regulators which have an agreement with US regulators (the wikipedia page seems to jive with that). Those FFIs are voluntarily(?) agreeing to the terms of FACTA because they enjoy some level of benefit (not being shut down by their own govt regulators, perhaps).

There are laws about heresy and apostasy in middle eastern regions - I'm probably violating their laws on a regular basis. Beyond a highly unlikely fatwa that may get issues against me, I'm not sure what they can really do (or indeed, that I would really be 'liable' in any real sense of the word)

Blocking EU users is a smart business choice to avoid any possible legal issues and far easier than compliance.

https://en.wikipedia.org/wiki/Online_Privacy_Protection_Act

Edit: Apprently, there is a new one on its way: https://eu.usatoday.com/story/tech/talkingtech/2018/06/28/ho...

People like me are the sort who think about Stalin and sigh: "oh, things were so good back then!". That's why we love regulation.

I expect it's more or less the same thing that the US can do to you: Depends on what assets you have now (or may have later) in the EU, whether you ever plan to visit the EU, and what treaties are ratified now (or later, been bitten by this one) by the US and EU countries.

Ignoring the laws of foreign countries is possible if you're willing to put in the resources, it's much cheaper and less risky just to comply. The general idea of being forced (literally or practically) to comply with the regulations of other governments is completely fucked up in my personal opinion[1], but until your government decides to do something about it, there's not much you can do. At least, you get the option to expand in a foreign county market as a consolation prize.

In the end, this is just a comment on some internet board. I'd recommend asking a lawyer that specializes in these matters if you really want to know about the risks involved.

1: I'll state that I'm not against the GDPR in general and think it's introduction is long, long overdue. What I object to is having some foreign entity I have no connection to forcing me to comply to their will. That's a can of worms governments will regret opening.

[1] http://www.privacy-regulation.eu/en/recital-23-GDPR.htm

As for legislation and jurisdiction, doing business internationally has always been complicated. Many big corporations have legal entities across the world and funneling revenue via the eu is a popular way to dodge taxes in the us. If you do business with such companies, that makes gdpr relevant for you even if you have no direct eu ties as these companies may be forced to reconsider their relationship with you otherwise. Think anything involving ad based revenue, e-commerce, and other sectors involving non trivial revenue from the EU.

Anyway, read the law text. It's surprisingly easy to find and digest and it puts all the idiots interpreting each other's interpretations a bit in perspective. Good summaries are available.

Edit: replied to an out of date tab, another poster commented the same idea.

For example, switches opting in by default or popups saying “by using the site you agree to x”.

They're doing the minimum necessary to claim they tried to comply while changing absolutely nothing about the way they do business. They're waiting to see how serious enforcement of the law is before making changes that negatively impact their business. It's not about whether they'd lose in court or have a regulatory judgment against them, it's about the likelihood that non-compliance will get them in trouble.

If EU regulators show a willingness to do the legwork to fine smaller companies, you'll start to see a lot of these site become much more compliant. But those companies are not going to spend all that time and money proactively only to see that the EU doesn't have the teeth to enforce the rules, so they need practical precedents of companies being hit with huge non-compliance fines to scare them into making the necessary changes.

I think one of the problems is that too many of those people are MEPs.

What does the GDPR mean for these people? The europeans will still believe you have broken their laws and try to use whatever international agreements they have to go after you? Or if you enter europe they will hold you to account?

Google / Facebook have operations in Europe, so I can understand why they are concerned, but what does it mean if you don't operate in Europe but have Europeans using your site?

My limited understanding is that generally, it doesn't mean much. However, if you are actively targeting/marketing to Europeans, then you might fall afoul of this, but probably won't be affected legally without hitting some sort of moderate commercial size.

In the EU, if everyone is breaking the law then the foreign tech companies are.

https://www.nytimes.com/interactive/2015/04/13/technology/ho...

In e.g. Belgium, privacy law is very strict and enforced for local corporation. When I read on hacker news how e.g. USA Healthcare providers dig up the old history of their clients to find a reason not to pay, I am horrified. Any West-European privacy regulator would have ended that kind of behavior long before things got this far. Probably just sending a strong 'We dont like this' message without actually starting a lawsuit would do the job.

Don't forget how history hammered into the population how people died and suffered because powerful groups managed to built lists of facts. Think WWII and the jews. Or the Napoleonitic conscription lists.

So if people with this background get confronted with the American Way, they don't like this. Here is a wrong that should be righted is the opinion.

For now, there are no lawsuits I am aware of. If both the large tech companies and the USA government behave reasonably well, I don't expect a big one either. The governmental regulators are simply not ready for them yet, as the GDPR had a big impact on them as well. And they never like having to pay for a drawn-out legal battle.

And it's not as if EU companies go without scrutiny. Due to the still-fractured market, most are small enough so their antitrust matters are localized to one country, but if you check the EU website there are still plenty of cases, they're just not sexy enough to make the news - like the a recent case "Commission fines maritime car carriers and car parts suppliers a total of €546 million".

In for instance the "state aid" tax preference cases cited in your link, the EU has also launched investivations into European companies like IKEA and Fiat cars.

So what does that tell you about dramatic changes?

Then sites only need to serve up the annoying dialogs if they need a permission you haven't set, otherwise clearing cookies periodically means being plagued by the dreaded things. >;-(

Instead we had people running around like headless chickens rushing to put in place some extra tick-box on their website.

The funny thing was how people sent out those emails to their newsletter subscribers and I do wonder how decimated those lists became. People got GDPR fatigue and could not be bothered with the emails after a while. This particularly affected smaller businesses who had legitimate reasons to email customers.

Does anyone here have any anecdotal data on how badly some of these email lists were purged?

Email is control. You get someone's email once, you get to control how often you contact them. You can send them hundreds of messages for next to no cost - as long as they don't hit 'unsubscribe'

But if you can't rely on email, what do you turn to? Ads, of course!

I get that there are some nasty actors that abuse your privacy. But as a consumer, I've never felt that spam was that big an issue to begin with, at least not big enough to warrant small businesses ceding control and having to rely on Google and Facebook to reach their audiences.

We've had data protection laws for 20 years. Those companies were already breaking the law if they didn't have permission to send email, and if they had a legitimate need to send email they don't need consent under GDPR.

I’m being ironic, a decent chunk of Europeans want this (I’d say a majority but I don’t have hard numbers).

It's never been portrayed as "anti-US", and it isn't. It's pro-privacy, and that's an entirely different thing. While I think certain US companies have aggressively persued certain business strategies which are very much anti-privacy, so have many companies around the world, and this legislation is long overdue pushback against some very dubious business practices many people are very, very uncomfortable with.

Complying with government regulation is not really in the same class of issues.

I am referring mainly to the media hype and how it becomes the issue de jure and then ceases to matter. The media jumps on it and amplifies anyone who chimes or confirms the fear. Why? So they can run a 'if it bleeds it leads' type headline. While there could have been stories after the fact of problems for unpatched systems I don't remember any of those stories. And it is not because everyone patched their systems either.

I mean there were posts online about GDPR where some small insignificant company just folded up for fear of what would happen as if the EU was really going to go after that type of target. Anyone who has been in business for a long time knows that is not what is ever done.

To your point you are right because this isn't even (for US companies) a US regulation and if they have no customers in the EU then it is a stretch to be concerned about it (at least relative which is my point to the attention given to it by the media).

A job well done!

Seriously, that is my impression of all conversations here, US companies trying to understand a law written in EU. I imagine this to be very hard.

Exactly. And that is part of my point. Everyone acting as if something dreadful would happen if the timeline was not met RIGHT AWAY!!!. It would not. The EU might bring an action after initial outreach to the companies legal department. The legal dept would do a dance and explain why they need more time. The EU would then agree to the time line. Any any case would go to some court and would also involve appeals and some form of due process. During that time lawyers would work back and forth. Any fine would almost certainty not approach the worse case scenario. Not going to happen. And certainly not to a small fish or anything close to that.