DEV Community

Discussion on: GDPR vs. CCPA: Data privacy requirements explained

Collapse
 
jayjeckel profile image
Jay Jeckel

Under the GDPR, the rights detailed above are available to all “data subjects,” which refers to any EU citizen or a resident in the EU giving out their data, irrespective of citizenship. Any entity that [...] interacts with EU residents must comply with GDPR, giving it true global reach.

Irrespective of location, data controllers or processors that collect or process personal data from EU residents or citizens are subject to data privacy requirements under the GDPR.

While, yes, that is the language of the GDPR, the idea that the EU has jurisdiction to regulate businesses outside its physical borders is patently rediculous. The fact of the matter is that the GDPR only applies to businesses with a physical presense in the EU or nations that have agreed to GDPR regulation by way of legally enacted treaties.

I understand it is your business to convince people that they need your company to implement GDPR and similar compliance, but that is no excuse to keep propagating these obviously overreaching claims.

Bottom line: Nations and similar organizations can only make laws and regulations that apply within their jurisdictions. Saying that the GDPR applies to businesses outside the EU is as nonsensical as saying Canadian speed limits apply to cars in Germany if the car is carrying a Canadian citizen. That is silly because obviously Canadian speed limits only apply to cars driving in Canada, just as the GDPR only applies to companies in the EU.