What the Heck is GDPR? (and How to Make Sure Your Blog Is Compliant)

What the Heck is GDPR? (and How to Make Sure Your Blog Is Compliant)
Paul Long

Paul Long

112 thoughts on “What the Heck is GDPR? (and How to Make Sure Your Blog Is Compliant)”

  1. Good to know Paul. I store data mainly through blog comments since I build no email list. Meaning this would be my main personal data stored, although you could toss cookies in there too. Thanks for the nudge to be compliant πŸ˜‰

    Ryan

    1. Hey Ryan – no problem, thanks for reading!

      Looks like there are some interesting GDPR enhancements to WordPress in development (including clearer opt-in for commenters and anonymization of commenter data), so if you’re a WP user, it’s worth looking out for updates.

      Cheers,
      Paul

      1. Thanks for this comment about WordPress developments to respond to GDPR. Was wondering throughout this whole post as to what WordPress would have to say in response (my blog is powered by WP).

  2. Great article! The clearest and most understandable one I’ve read so far. Thank you for the effort of writing it.

    1. Thanks Jana πŸ™‚ There’s already a bit of ‘GDPR-fatigue’ taking hold (well, certainly here in the UK) – so I’m glad if the information helps!

      Cheers
      Paul

  3. Thank you for this clear guide to GDPR compliance. I’ve been digging around trying to find guidance that’s both thorough yet easy to understand. This is exactly what I was looking for.

  4. Thank you for a thorough and simple to understand post about a topic that I was definitely avoiding. I checked out your privacy policy. It’s excellent and gave me many good ideas about how to rework mine.

    1. πŸ™‚ a lot of us have been guilty of putting it off! There’s something about a deadline that focuses the mind!

      Glad the PP helped

      cheers
      Paul

  5. Good article, though I wouldn’t necessarily say it’s a new law since it was adopted in 2016. It’s only popular now because the the enforceable date is looming.

    1. Thanks James – absolutely right. A law that is ‘in force’ but not ‘enforced’ is an interesting concept, but that’s technically where we’ve been for the last couple of years.

      Human nature, I guess, for people to get a bit twitchy when the fines start to apply!

      All the best
      Paul

    1. It certainly can affect you – doesn’t matter where in the world you are if you process personal data relating to people in the EU.

      I guess the main point for you will be the ‘territorial scope’ section and the question about whether you ‘offer goods and services’ in the EU, or profile the behaviour of people in the EU.

      If you don’t do either of those things, then it might not apply to you.

      thanks
      Paul

  6. Hi Paul. Thanks so much for providing this information. In trying to understand the GDPR and what I’m supposed to do as the owner of a small blog, I have been asking people in online forums, FB groups for bloggers etc. what they’re doing to prepare for implementation of the new regulations and checking out the bigger blogs in my niche. I was shocked that so many are doing nothing…

    You info is not only thorough, but easy for me to grasp the important details, so that I have some sense of what this means for my blog. Thanks. I greatly appreciate the help.

    1. Hi Kimberly – my pleasure, I’m glad it’s been of some help.

      You’re right, of course – there are a lot of people (and organisations) who have been taken off-guard. I don’t think it’s too controversial to say that the existing (pre-GDPR) rules weren’t very actively enforced, and perhaps some people got a little complacent about it. I think the GDPR is going to change that!

      All the best with your planning!

      cheers
      Paul

  7. FINALLY someone who actually explained GDPR and told us what to do about it in plain English. This post should be required reading for all bloggers. Great job and Thanks!

  8. Thank you! I didn’t know about this, and I’m getting ready to launch the blog side of my website. Now I can set everything up properly. Shared it on Facebook.

  9. This is really a detailed post about GDPR. I am one of those who wrongly assumed that, I may not need to bother myself about GDPR since I no readers from Europe. Thanks for this post.

    1. Thanks Uthman – yes, the trick is to be as clear as possible in your own mind whether the Regulation affects you. A clear, defensible argument that the GDPR does not apply to you is as good a plan as any!

      all the best
      Paul

  10. Really great article – I get the concept of what the Europeans are trying to do but it seems very onerous for small blogs with a few tens to a few hundred subscribers, particularly if there is no financial model associated with the blog to cover any expenses related to becoming “compliant”.

    One thing I do not understand is – if this is a European law – how they (whoever “they” are) intend to enforce and fine blog owners in the USA or for that matter in any other country outside of Europe.

    1. Thanks Simon – that’s a really interesting point actually.

      The principle is of course concerned with protecting individuals’ personal data, regardless of the purpose of processing that data. For example, even a charity, or a completely non-commercial and benevolent organization is just as capable of a data breach as anyone else – and the impact of such a breach would be no different.

      Each EU member state will have their own ‘supervisory authority’ (i.e. regulatory body). Here in the UK, it is the Information Commissioner’s Office (ICO), and they will actually have a lot of discretion.

      There is clear guidance that the supervisory authorities must take account of what is reasonable and proportionate, given the size of the Controller’s organization, the nature of the data being processed and the cost/complexity of implementing solutions.

      So, in my opinion, they absolutely will take a different approach for individuals and small organizations that process small amounts of low-risk data.

      And yes, whether they could actually track down a non-EU blogger in order to apply a penalty is a completely different matter!

      cheers
      Paul

  11. Thanks for the post.

    But what about affiliate marketing? I’m an affiliate of several products and I don’t know how to address this.

    Any ideas? πŸ˜‰

    1. Thanks John,

      Affiliate marketing does involve a number of the GDPR concepts.

      Primarily, there’s the question of what personal data you (as opposed to the affiliate network) are actually processing.

      Chances are that by using any form of affiliate link, some sort of web cookies will be used to identify (and subsequently track) the individual – and cookies are potentially ‘personal data’. So (assuming that the GDPR applies to you at all), you would be obliged as a minimum to explain this in your Privacy Policy – including the fact that the cookie data is effectively shared with the affiliate network.

      But are you actually collecting/processing any personal data other than this? I guess it will depend on what specific approach you use.

      If you’re using affiliate links within emails to your mailing list, then there’s also the broader question the scope of the consent that you have from people on that list.

      I think the principle must be this: if you publish an affiliate link, then you should be clearly signposting the fact that it IS an affiliate link (there’s nothing new in that). If, by clicking on the link, the individual will be tracked in some way, then you should be transparent about that so that people can make an educated decision about whether to click it.

      All of that said, I think that the affiliate networks themselves have got some significant work to do to make sure that they are compliant.

      cheers
      Paul

      1. Thanks for the information! I’m impressed by your reply.

        I’ll update my privacy policy for starters and then wait and see what happens on other sites. I run a little website and for now consider it almost impossible to comply 100%.

        Guess I am going for the Quick Wins strategy.

  12. Wow. This is fantastic. Best GDPR explanation and help that I have come across. Thank you so much for your extensive work on this. You are awesome!

  13. Thank you Paul for this very clear explanation.

    While my personalised product is not sold outside Australia, I do have a dot com domain name, and blog within the site.

    You have given me some distinct threads to follow on compliance.

    My CRM definitely is not Australian and I understand your point on “data processor”.

    Thank you and Jon for this invaluable advice.

    1. Thanks Lesley,

      That’s a good point actually – if you sell a specific product, but you do not ship that product outside Australia, then that is a solid indication that you do not ‘envisage offering goods and services to individuals within the EU’.

      Of course, that isn’t the only factor, but it is an important one that might suggest that you are outside the ‘territorial scope’ of the GDPR.

      thanks
      Paul

    1. Hi Andreea,

      Almost certainly not – a specific Data Protection Officer is not required unless you are a public body, or your processing constitutes ‘regular and systematic monitoring of data subjects on a large scale’ (especially if you are dealing in certain ‘special categories’ of data such as health, religion, ethnic origin etc).

      If you are unsure, Article 37 of the GDPR contains the details.

      I would think it highly unlikely that you would need to appoint a DPO.

      thanks
      Paul

  14. One thing I don’t see here (and haven’t seen in any of the other posts I’ve read on the subject), how can the EU enforce this on people in other countries? In other words, how can a country that I don’t live or do business in, and am not visiting, enforce a law I or those elected to represent me didn’t vote for?

    I also see this backfiring big time in two ways. One, if I’m a small-time blogger that doesn’t directly do business with anyone in Europe and doesn’t have a lawyer on retainer, I might as well say to hell with this law and block all European IP addresses from my blog. That way I don’t have to bother with complying. And second, what’s to stop other countries from making up their own laws to impose on residents of other countries?

    1. Hey Matt,

      Yep, the geographic scope of the GDPR is one of its more surprising elements. Whether it’s right or wrong is another story altogether.

      I guess the point is that the GDPR only affects people in non-EU countries to the extent that they are impacting EU citizens.

      I think some people will do exactly what you suggest: block visitors from the EU. But that’s a shame (and arguably unnecessary) if you have a readership or revenue coming from the EU.

      And yes, there’s probably nothing stopping (for example) the US creating a law that puts exactly the same obligations on people in the EU, in so far as they target US citizens.

      That gives us something to look forward to πŸ™‚

  15. Hey Alex,

    Firstly, I’m glad my ‘IANAL’ (I Am Not A Lawyer) disclaimer is doing its job πŸ˜‰

    On that (non-lawyerly) basis, and if we assume that GDPR does apply to you:

    – Good job with your double-opt-in, that’s obviously very important;
    – But there’s more to GDPR consent than the visitor just saying that they consent. What are they actually consenting to? This is where the Privacy Policy comes in – by offering the visitor a link to the PP that they can read BEFORE they consent, you are effectively incorporating the rest of the privacy details within that consent.
    – By doing that, not only are your subscribers agreeing to be placed on your email list, they’re also consenting to who you share the data with, the methods you use to protect the data, and so on. This is central to the idea of ‘informed’ consent;
    – Should you have a link to the PP on your landing page? Absolutely. That’s part of being open and transparent. But to be effective, the CHECKBOX really should be included at the point at which they subscribe – because you want their consent to cover 1) delivering the goodie to them and 2) adding them to your mailing list. The double-opt-in will only affect whether or not they end up on the mailing list, not whether they get the goodie or not (I assume)
    – If we’re being really technical, you should probably have 2 consent boxes (sorry!) – one for the goodie and one for the mailing list. Because if they HAVE to sign up for the list in order to get the goodie, then this is arguably not ‘freely given’ consent. If they actually want to be on your mailing list, they’ll check the box.

    This last point, in itself, makes an ‘interesting’ point – we all know that we offer freebies to get people to subscribe. But what if they don’t want to subscribe, they just want the freebie?

    Discuss πŸ™‚

    1. Hey Alex,

      Ok, that arguably changes things slightly. If the intention is (understandably) to keep your landing page simple and free from barriers to subscribing, and we look at this from a theoretical perspective of ‘how can I legitimately NOT put a consent checkbox on my landing page’, then an approach might be this:

      – you technically need a lawful basis for collecting the email address that allows you to send your confirmation email. Simplest answer is consent. But if we don’t want an annoying consent checkbox, you could argue that collecting the email address is clearly essential to allow you to deliver the thing that the user is asking you for. The ‘contractual’ lawful basis might help you here – i.e it is lawful to process personal data if it is ‘necessary … in order to take steps at the request of a data subject prior to entering into a contract’. If we read ‘contract’ as ‘agreement’, then it is clearly necessary for you to collect an email address from the individual so that you can do what they’ve asked you do to;
      – Re your point 5 – I completely agree: you are providing valuable information, and it would be reasonable to expect that there would be some ‘quid pro quo’. I personally think that it would be a valid argument to say that you have a ‘legitimate interest’ in adding the individual to your mailing list, as that is in part what allows you to give away valuable goodies in the first place. Your Legitimate Interest is a separate legal basis and can, in theory, justify adding the individual to the list without their specific consent;
      – However, using the legitimate interest lawful basis comes with other responsibilities – you are expected to consider and document your legitimate interest in a way that demonstrates that you can 1) show that it is legitimate, 2) show that the processing is necessary to achieve that interest and 3) have balanced your interest against the individual’s right to privacy.

      in my opinion, I don’t think it would be too hard to establish that what you’ve described is a valid, legitimate interest – especially if 1) you are crystal clear in your privacy policy that the user will be added to a mailing list and 2) the user can unsubscribe at any time.

      So yes, I think it’s possible, but you’ve got to get your ducks in a row …

  16. Great article, Paul. Very informative and easily understood. Even though I’m not in the EU zone, it is a good idea to embrace the GDPR principles and go along with it. And the fact that you suggested that the is GDPR enhancements to WordPress in development, including clearer opt-in for commenters is great as my site is on a WP platform. I will have to edit my Privacy Policy accordingly.

    Thanks for sharing, Paul.

    1. Thanks Moss!

      Yes, keep an eye out for WP version 4.9.6 – it looks like the release is due in a matter of days, and there appears to be new functionality for Privacy Policies and the ability to erase/export personal data in comments. It also looks like more privacy enhancements are being lined up for v4.9.7 too.

      cheers
      Paul

  17. Thank you, Paul. I have been to workshops, attended Webinars and read the ICO information but this is the first time I actually feel I know what I should be doing to comply with the GDPR. I have passed this on to other business owners, even those without a blog, directing them to the 7 steps towards compliance.

  18. What is the recommendation about cookies and consent for those? Do we need a popup on the site that says there are cookies that might collect data? If we do, what exactly does that consent need to look like? I am seeing lots of different interpretations of this!

    1. Hi Lisa, good question

      Firstly, it’s worth pointing out that there is a reason why you’re seeing different interpretations of the rules on cookies:

      The GDPR does not (and was never intended to) give any detailed requirements in relation to cookies. GDPR sets out the general privacy principles which, as we have seen, apply to a broad range of situations.

      The detailed cookie requirements actually come from a SEPARATE regulation, commonly referred to as the Privacy and Electronic Communications Regulation (PECR). The existing PECR was due to be replaced with a new version at the same time as GDPR came into force.

      Unfortunately, the new PECR has been delayed and is unlikely to happen until 2019.

      So we have a frustrating ‘limbo’ situation where the OLD PECR will still apply when the GDPR comes into force – and there are some areas of inconsistency between the two sets of rules.

      For example:
      – GDPR says that cookies can be personal data, and if your legal basis for using cookies is consent, then that consent must be ‘explicit’ consent, indicated by an affirmative action on behalf of the individual;

      But:

      – PECR says that you need consent to place cookies, but that consent can be ‘implied’ (i.e. ‘by continuing to use this site, we assume that you are ok with our use of cookies’).

      These rules are obviously inconsistent with each other.

      So, this is a complex area, but my best summary of the situation is this:

      – From an EU perspective, we should all have been using some form of cookie notification before now, under the PECR. So yes, technically, you should have a notification of some form, with a link to your privacy/cookie policy. But the requirement to do this comes from PECR, and not GDPR;
      – Going by the letter of the GDPR law, if you need consent for ANYTHING, you need EXPLICIT consent, and you’d need to get that consent BEFORE the cookies are set. This is going to provide a real technical challenge for some folk, because it’s not always easy to wait for consent before setting a cookie;
      – But realistically, I cannot imagine any regulator giving a Data Controller a penalty for using IMPLIED consent, while the PECR still says that that is ok. In fact, the UK regulator (the ICO) still uses implied consent on their own website;
      – The current DRAFT of the new version of the PECR shows a softening of attitudes towards ‘non-privacy-intrusive’ cookies, such as analytics cookies – the implication is that no consent will be required to set that type of cookie. But as I say, this is only an indication of what the new rules might say.

      So:

      – If you want to be ultra-safe, you should use a cookie notification, and develop your website in such a way as to only set cookies when you have the explicit consent of the individual;
      – But I personally think there is a good justification for NOT going to this extreme, and that justification boils down to this:
      a) the existing PECR regulations allow implied consent for cookies;
      b) under GDPR, there is a separate legal basis that you might rely upon for the use of many types of cookies, i.e. the ‘legitimate interest of the controller’. But please note the words of caution I gave in the article about using ‘legitimate interest’.

      So this is a bit of risk-based decision. If your site uses cookies, I would suggest that you SHOULD have at least a notification message/banner. But I also know that a lot of site owners will make a conscious decision not to, because of the inevitable impact it has on user experience.

      Personally, I have a cookie notification banner. I set non-privacy-intrusive cookies (analytics and some security cookies) without consent because I believe it is in my legitimate interest to do so, and I’m prepared to justify that position. I will only set marketing (FB) cookies after the user has seen the cookie warning and continued to use the site.

      Usual disclaimer – this is just my opinion and not legal advice – but I hope the context helps in some way to make your decision about your own site.

      thanks
      Paul

  19. So you mean to tell me that the European Union can put fines on a blogger or content marketer in the United States and get the money from them if the EU feels the site owner is in violation of GDPR?

  20. Russell McLaughlin

    HI Paul, today l was sent an email from a US based company tell me that they will no longer be able to sell goods to me in Australia (including EU countries) because of the GDPR, is this because they do not wish to comply with this or is there another reason ?
    Thanks
    Russell

    1. Hi Russell,

      Difficult to say for sure – because there’s nothing in the GDPR that would affect US/Australian sales specifically (i.e. because it’s nothing to do with the EU) – but I have heard of some companies that have decided to simply stop doing business with EU consumers.

      I’m assuming that a company would only do that if their EU sales were low, and the cost of complying with the GDPR wouldn’t be justified based on those sales. Basically, it is a clear way of them demonstrating that they do not ‘envisage offering products or services in the Union’.

      It’s a shame if that’s what’s happening, but I guess it could be a logical response in some circumstances.

      I hope you can get whatever you buy from them from somewhere else πŸ˜‰

  21. Hi Paul: Where it says that one must only hold data for as long as required to achieve the stated objective — supposing someone signs up for something and it says on our site that by signing up they will also receive an ezine and occasional emails, do we need to go in and actually remove people who haven’t been opening our emails? I mean, do we need to be culling our list of people who signed up before GDPR goes into effect and are not active?

    1. Hi Jill,

      I think there are two different separate issues there:

      1) From a consent perspective, I wouldn’t say there was any direct obligation for you to remove people from a mailing list simply because they don’t open your emails. There is a school of thought, however, that you should periodically review your mailing list and potentially invite people to ‘re-consent’ if they are not engaging with your content. After all, what you really want is a list full of people who are actually interested in what you’re offering. You should certainly use this periodic review to remove addresses that regularly bounce, because this is indicative of old/inaccurate data;

      2) In terms of people who signed up before GDPR goes into effect, you need to ask yourself the question whether the consent you have from them is still valid under GDPR at all. If the consent does not meet GDPR standards, then you wouldn’t technically be able to send emails to them after May 25 unless you had some other lawful basis for doing so. That’s why so many people are sending ‘reconsent’ emails to their list before the 25th.

      hope that helps
      thanks
      Paul

  22. This is a fantastic summary, and I have been watching what others are doing to their privacy policies so that I can change mine to be GDPR-compliant.

    Thanks for this! I’m sharing it everywhere!

    1. Thanks Lorraine – writing (or amending) your privacy policy can actually be a strangely positive experience – because it forces you to think about what you’re doing with people’s data, how you protect it etc. It might seem like a chore, but it can only make us all better prepared in the end.

      All the best
      Paul

  23. Wow. This is fantastic. Best GDPR explanation and help that I have come across. Thank you so much for your extensive work on this. You are awesome!

  24. Ryan Mcdonald

    Great points throughout this article Paul! Staying compliant is so important especially to those who are looking to make blogging a career. There are a ton of compliance issues with many passive income methods that have been popping up lately including dropshipping and affiliate marketing. Companies like AliExpress often don’t abide by the regulations put in place by US lawmakers. Using a website like SaleHoo.com is your best bet.

    1. Thanks Ryan – absolutely, it’s only when you really sit down and think about it that you realise how easy it is (too easy maybe?) for information to be passed around and shared. Doing your ‘due diligence’ on any company that you plan to use is a great idea (although I can’t comment on the specific ones you mention).

      cheers
      Paul

  25. Hey Paul,
    Thank you so much for this vital information. I am just starting out and being a
    “Newbie” is very scary. This new requirement probably has seasoned veterans
    quaking in their boots. With me being such a novice, it scares me to death. However, I feel more comfortable now that I have read your detailed report
    about how to proceed and the reasons stated. I cannot thank you enough for this
    submission. It is much appreciated.

    1. Hey Kenneth – thanks very much, I’m glad it helped. Actually, being a newbie is not a bad place to be right now – it’s almost more difficult for people with established businesses and blogs because changing the way you’ve always done things is arguably more complicated than doing it right in the first place.

      As long as you keep privacy considerations in mind, and you’re open and transparent about what you’re doing, you shouldn’t hit too many obstacles.

      It frightened the life out of me until I started to understand it a bit better.

      All the best
      Paul

    1. thanks Aboudi – just keep in mind that it can affect you wherever you are based – the important thing is whether you are dealing with the personal data of people in the EU …

  26. I find myself in the “do nothing and wait” camp to see how WordPress is going to address this. It literally makes no sense to accept, let alone try to respond to comments if people aren’t requested to leave their email address. I’m sure Europeans would see it differently (some of them anyway), but if they’re inclined to leave a comment, the cost of an email address is a fair price. Otherwise… don’t leave one!

    Otherwise… I don’t have a newsletter and I don’t have a mailing list, and even though I market a couple of products on my blogs I haven’t had a buyer in years. At this juncture I’ll wait to be penalized 20 million Euros (whatever that comes to) and see if they can extradite me someone so they can try to get it from me.

    1. Hey Mitch. Yes, I can understand your point of view about commenters and their email address. It just depends what you plan to do with those email addresses though. If, hypothetically, somebody planned to send marketing/promotional emails to anyone who commented on their blog, you could argue that it’s only fair to let people know that’s how their data will be used?

      And yes, good luck to anyone trying to get $24million out of me!

  27. GDPR has become a buzzword nowadays. In fact, this is quite beneficial both for our audience and us because we’re the audience of different sites.

    Data protection measures should be taken seriously.

    Thanks for bringing almost all the sides of GDPR.

  28. Hi,
    correct me if I’m wrong, but I am just wondering. How come you don’t have any Privacy policy or Terms and Conditions pages here on Smart blogger?

    I also don’t get a cookies notification/pop-up here. Could you please explain?

    This is strange to me.

    Cheers

  29. Hey Paul,
    Your post was a timely release. The information that it provided was very helpful
    in that I am lost in some of the terminologies and you have made it easy for me to understand what action is required on my part. This document scared me that I
    was upset about it until your Post.
    Thank you so much for posting this extremely valuable information.

  30. So, for the new bloggers that have yet to build a email list, how does GDPR affect marketing products in the future? Is it worth making a freebie/content upgrade? If so, why?

    1. Good question. If you have yet to build an email list, you’re in a pretty good position, because ‘getting it right from the start’ is probably much easier than ‘fixing’ an existing list or changing your existing processes.

      If you’re clear with people that you’re going to use their details to market products to them, then fair enough. They can make an informed decision about whether they want to give you their data on that basis – which is why it’s so important to be open and transparent about what you plan to do.

      The problems arise when data is used in a way that is beyond the consent that was given, and where there is no other legitimate basis for doing it.

      Giving away freebies is definitely not a requirement – but it can be useful to help you reinforce your ‘legitimate interest’ in marketing to people if that is the lawful basis that you are relying on.

      cheers
      Paul

  31. Hi Paul, thanks for the comprehensive info you’ve put together in this article, all really helpful in clarifying the GDPR minefield! Just wanted to mention something that may help other readers.

    You mention consent a lot and it’s a key part of the legislation, but the burden of course is on businesses to be able to prove that consent in future. Part of this, for email lists, is recording the opt-in form that someone has used to opt in.

    The only advice for people at present seems to be to manually record the forms in some way, e.g. screenshots, the underlying code etc. For a lot of businesses though, this becomes fairly impractical very quickly, especially if you have a lot of forms, you’re split testing them, and so on.

    Would you be interested in some brief info on a solution that auto-records the form each time someone opts in? In other words, for each lead you have an automated record of exactly what the form looked like at time of opt in.

  32. Your follow-up comments are almost as good as the article! THANK YOU so much for this! I work with small businesses (dance studio, painter, physical therapist, etc.) whose clientele is strictly local. One other (I hope?) myth is that if you service EU citizens – even if they’re now living in the U.S. – you must comply with GDPR completely for them. Is this true? I certainly see no downside to doing some of the items listed here, but I want to know how nervous I should be and how quickly I need to comply! LOL Thank you again, Paul!

    1. Thank you Stephanie, very kind πŸ™‚

      Yes, that’s a good point, and is the subject of significant debate.

      The regulation seeks to protect the rights of data subjects who are ‘in the Union’ (i.e. within the EU) – so an EU citizen who has their personal data processed as a result of their activities when they were not in the EU is unlikely to have the protection of the GDPR.

      I’m choosing my words carefully here because this IS complicated – but I would say it boils down to this:

      – For Data Controllers who ARE based in the EU, the GDPR applies and it almost doesn’t matter whether your ‘data subjects’ are within in the EU, resident in the EU or otherwise – you’re caught by the GDPR because YOU, the controller, are in the EU;
      – For Data Controllers OUTSIDE the EU, all of the considerations about Territorial Scope in the article apply – but if you have concluded that the GDPR otherwise does not apply to you, the fact that an EU citizen uses your services while they are outside the EU shouldn’t make any difference – because they are not ‘in the Union’ at the time.

      So your specific example seems reasonably clear:
      1) you provide local services in the US;
      2) you do not in any way provide (or envisage providing) services to people in the EU;
      3) you simply happen to know that some of your local clients are EU citizens, but they now live in the US.

      On the face of it, 1) and 2) imply that you are outside the territorial scope of the GDPR. My opinion is that 3) does not alter that fact because those people are not ‘in the Union’.

      I think it gets more complicated for people passing through the US (vacation etc) because then there’s the question about what’s required when they are back in the EU.

      I hope that helps – it is, as always, subject to my usual caveat that this is not legal advice πŸ˜‰

      all the best
      Paul

  33. Or you could just have stated the obvious; instead of pretending that Americans need to pay attention to this, at all:

    1) The EU has zero jurisdiction over a United States-based blog or site.

    2) The EU has literally no way of seizing a US-based website or enforcing any kind of European civil or criminal judgement against a United States citizens, ever.

    So why would I bother paying attention to their ridiculous rules?

  34. Mentions very good and useful points in the article. Nicely explain everything one need to know about GDPR.
    Thanks for sharing information with us.

  35. Highly informative comprehensive article. Thank you for breaking it down into very thorough albeit complex morsels. Not the most joyful subject but necessary to understand to protect oneself. It’s distressing that our blogging world has come down to this control.

  36. Thank you so much paul for that, that article was exactly what i was looking for. an easy and relatable guide towards understanding of gdpr. finally a big step towards protection of data and reducing data breaches.
    i cam across this website that helps you monitor security controls, policies and can prove that your regulatory compliances are in place. Securing gives you bird eye view of your IT environment, You can detect, investigate and actively respond to cyber attacks in real time.
    It also provides you with Best log management tool for small business

  37. According to GDPR, in general, the consumers and users may have more stated rights regarding the use and erasure of their data and they must have the clear and accountable process and intentions about their data collection. Another important element is compelling companies to notify users of data breaches.

  38. Thanks for sharing wonderful information, But European Union forcing the companies to intensify privacy-specific policies, instead of implementing a separate GDPR-friendly policy for EU countries.

  39. What a great post, I will suggest your blog to my colleagues because here I found very appropriate information.
    It will help my Digital Marketing Institute students to explore more about GDPR.

  40. So what about free WordPress.com blogs? I need help making sure my blog is GDPR compliant as I don’t want to go to prison for it. Please help me. Thanks.

  41. Scary stuff… very thankful I know now though.

    It’s actually a good thing in my opinion to start implementing some stricter regulations on data collection. A lot of the tech giants are collecting what most consider to be completely unnecessary data that’s actually kind of creepy, like your face, current location, all conversations, etc.

  42. I have a question. I use wordpress.com so I am not sure if I am responsible for GDPR compliance or if they are. Also do you go to prison and become a felon for non-compliance? Thanks.

  43. Thanks for the long article, guess I am a bit late to the party but I I was doing research trying to figure out how this affects me if I am not in Europe, but seems that I have a bit of homework to do now.

  44. Thank you for a great article! It really opened my eyes on how the cookie announcement seem to appear in every site I open. I had not think of it before that also blog writers may be responsible to give announcements on what information they collect from the readers. Great to read your simplified explanations about GDPR!

Leave a Comment

Your email address will not be published. Required fields are marked *

Share
Tweet
Pin
Share