<story><title>How to effectively evade the GDPR and the reach of the DPA</title><url>https://blog.zoller.lu/2020/05/how-to-effectively-evade-gdpr-and-reach.html</url></story><parent_chain><item><author>garmaine</author><text>Does RocketReach have servers in the EU? Employees? Subsidiaries?&lt;p&gt;I generally don’t know in this case. But in general my European friends seem to think that merely having someone from the EU access a website makes that website’s owner have a presence in the EU, even if the server that handled it isn’t. That seems like overreach to me. If that were the case, I’d block EU access for any of my domains, and I don’t think we want a future where that becomes the norm. The ideals of the Internet are free exchange of ideas and information, no country-specific walled gardens.</text></item><item><author>josefx</author><text>&amp;gt; The EU doesn&amp;#x27;t have such status or power over US companies.&lt;p&gt;US companies operating in the EU are subject to EU law. Worst case the company itself doesn&amp;#x27;t operate in the EU, however that still leaves its customers (Intel, AirBnB, etc. ) potential targets to apply pressure on.</text></item><item><author>oarsinsync</author><text>I&amp;#x27;m not sure how I feel about the screenshot at the end, showing that various policy makers also have their personal information being sold.&lt;p&gt;I guess the information is out there, and doing so also makes it definitively personal for the policy makers &amp;#x2F; enforcers involved.&lt;p&gt;That said, the policy makers &amp;#x2F; enforcers may be genuinely hamstrung. The US imposes its laws globally because of it&amp;#x27;s status as a global reserve currency (trading in USD requires the transaction to route via the US, thus making the entity subject to US law).&lt;p&gt;The EU doesn&amp;#x27;t have such status or power over US companies. The most it can do is try to prevent them from operating in the region.&lt;p&gt;As a person who almost certainly has his personal information being sold on this platform, I&amp;#x27;m not pleased, and would love to see something done to prevent this kind of activity. Unfortunately, that depends on the US government to take action, and the last 12 years haven&amp;#x27;t been a flying endorsement of the effectiveness of the current government system. (This is not meant as an statement regarding the effectiveness of either President, but rather a regarding the low output from the system as a whole)</text></item></parent_chain><comment><author>tomxor</author><text>&amp;gt; The ideals of the Internet are free exchange of ideas and information, no country-specific walled gardens.&lt;p&gt;Your argument reduces to &amp;quot;freedom of speech&amp;quot; == &amp;quot;freedom to take and distribute personal information&amp;quot; (They are not equal).&lt;p&gt;Your walled gardens cherry on top only highlights the deficiencies that some countries have to protect personal information - Saying this is making the internet into walled gardens is like promoting tax evasion by using Ireland (in this case the US == Ireland, because it is deficient)</text></comment>
<story><title>How to effectively evade the GDPR and the reach of the DPA</title><url>https://blog.zoller.lu/2020/05/how-to-effectively-evade-gdpr-and-reach.html</url></story><parent_chain><item><author>garmaine</author><text>Does RocketReach have servers in the EU? Employees? Subsidiaries?&lt;p&gt;I generally don’t know in this case. But in general my European friends seem to think that merely having someone from the EU access a website makes that website’s owner have a presence in the EU, even if the server that handled it isn’t. That seems like overreach to me. If that were the case, I’d block EU access for any of my domains, and I don’t think we want a future where that becomes the norm. The ideals of the Internet are free exchange of ideas and information, no country-specific walled gardens.</text></item><item><author>josefx</author><text>&amp;gt; The EU doesn&amp;#x27;t have such status or power over US companies.&lt;p&gt;US companies operating in the EU are subject to EU law. Worst case the company itself doesn&amp;#x27;t operate in the EU, however that still leaves its customers (Intel, AirBnB, etc. ) potential targets to apply pressure on.</text></item><item><author>oarsinsync</author><text>I&amp;#x27;m not sure how I feel about the screenshot at the end, showing that various policy makers also have their personal information being sold.&lt;p&gt;I guess the information is out there, and doing so also makes it definitively personal for the policy makers &amp;#x2F; enforcers involved.&lt;p&gt;That said, the policy makers &amp;#x2F; enforcers may be genuinely hamstrung. The US imposes its laws globally because of it&amp;#x27;s status as a global reserve currency (trading in USD requires the transaction to route via the US, thus making the entity subject to US law).&lt;p&gt;The EU doesn&amp;#x27;t have such status or power over US companies. The most it can do is try to prevent them from operating in the region.&lt;p&gt;As a person who almost certainly has his personal information being sold on this platform, I&amp;#x27;m not pleased, and would love to see something done to prevent this kind of activity. Unfortunately, that depends on the US government to take action, and the last 12 years haven&amp;#x27;t been a flying endorsement of the effectiveness of the current government system. (This is not meant as an statement regarding the effectiveness of either President, but rather a regarding the low output from the system as a whole)</text></item></parent_chain><comment><author>himinlomax</author><text>My understanding is that merely having a website that can be accessed from the EU may not by itself be enough to be subject to the GDPR. However collecting or processing data on EU citizens or residents certainly is. And almost all websites track users (even when it&amp;#x27;s not obviously useful to do so), so unless you go the USA Today route and create a site for the EU with no tracking, you have to comply.&lt;p&gt;There&amp;#x27;s also the question of who they sell the data to. It&amp;#x27;s hard to see why they would sell EU citizens&amp;#x2F;residents data to companies who don&amp;#x27;t have any EU presence themselves, so at least some of their customers are bound by the GDPR as far as these are concerned. Informed consent is required at every step, so for example they would need the EU subject&amp;#x27;s consent to buy that data from RocketReach.</text></comment>