Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Indeed, my answer would be no. But IANAL, IANYL and TINLA.

There's https://gdpr.eu/companies-outside-of-europe/ :

> Article 3.2 goes even further and applies the law to organizations that are not in the EU if two conditions are met: the organization offers goods or services to people in the EU, or the organization monitors their online behavior.

Recital 23 clarifies what is meant by the organization offers goods or services to people in the EU: https://gdpr.eu/Recital-23-Applicable-to-processors-not-esta...

> In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, [..] the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

Profiling is clarified in recital 24: https://gdpr.eu/Recital-24-Applicable-to-processors-not-esta...

> it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.

So, I'd say no. The mere fact that HN is accessible to people in the EU does not show intent. HN is an English forum, which is the native language of the country where it is established, and does not offer its services in additional European languages, and does not advertise products in the Euro currency. I'm unable to know for sure, but I don't believe HN is using my posts here to predict or analyse my personal preferences either.



I'm inclined to say that's a wrong interpretation. You don't have to sell anything to be required to be compliant with GDPR. My understanding is any entity (not necessarily a company, mind you) collecting personal or behavioral data of EU citizens needs to comply to the GDPR. Were HN to collect such data, EU laws would apply. But take that with a pinch of salt, I'm no lawyer or anything.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: