Glen —
From what I’ve been reading lately, I think Nik’s observation about location is
the critical piece. Here’s what I’m understanding at the moment:
1. Is the transaction happening with someone physically located in the EU?
If no, you’re all done. GDPR does not apply.
If yes, proceed to step 2.
(Article 3 of the GDPR is the relevant bit here)
2. Are you collecting uniquely identifiable data (ie, name, address, phone
number, DOB, picture, etc) or behavioral data of someone in the EU?
If no, you’re all done, GDPR no longer applies.
If yes, proceed to step 3.
3. Is the material (marketing or products) targeted or localized to a member of
the EU? (I admit that the *product* part seems iffy to me)
If no, you’re all done, GDPR no longer applies.
If yes, you need to be in compliance with GDPR
In particular, if a german user comes across your english-only website with
marketing or content geared to a US consumers (or B2B), then that german user
doesn’t have GDPR protections, they weren’t part of the target audience. I do
think this is a bit of a grey zone and when in doubt, it’s probably better to
be opting for GDPR compliance.
-bw.
> On Feb 7, 2018, at 6:32 PM, Glen Barnes <g...@mytoursapp.com
> <mailto:g...@mytoursapp.com>> wrote:
>
> "The GDPR not only applies to organisations located within the EU but it
> will also apply to organisations located outside of the EU if they offer
> goods or services to, or monitor the behaviour of, EU data subjects. It
> applies to all companies processing and holding the personal data of data
> subjects residing in the European Union, regardless of the company’s
> location.”
>
> If you collect data on an EU resident it counts. We have had to abide by
> rules the US has pushed on the rest of the world in relation to money
> laundering, travel and other areas for years. Our bank is making small
> businesses in NZ who have no business outside of the local community fill
> out forms declaring US based income, etc. (See FACTA:
> https://www.stuff.co.nz/business/79049481/thousands-of-bank-customers-called-on-to-reveal-us-connections
>
> <https://www.stuff.co.nz/business/79049481/thousands-of-bank-customers-called-on-to-reveal-us-connections>
> )
>
> The US is about to get a taste of its own medicine ;-) So yeah, welcome to
> the club!
>
> Cheers
> Glen Barnes
> CEO/Founder
> Authentic - Home of My Tours, Curtis, STQRY and 7scenes
> p: +64 (21) 0429 471
> e: g...@getauthentic.io
> w: www.getauthentic.io
>
>>
>>
>> Message: 1
>> Date: Wed, 7 Feb 2018 11:33:45 -0800
>> From: Nik Honeysett <nhoneys...@bpoc.org>
>> To: "mcn-l@mcn.edu" <mcn-l@mcn.edu>
>> Subject: Re: [MCN-L] Preparing for quickly approaching GDPR deadline
>> Message-ID: <af36e10c-d903-4ce2-9b03-a13ecabbb...@bpoc.org>
>> Content-Type: text/plain; charset=utf-8
>>
>> James - I don?t think that is right otherwise every business in the U.S.
>> would be potentially liable.
>> -nik
>>
>> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>
>> Nik Honeysett | Chief Executive Officer | BPOC | www.bpoc.org
>>
>>
>> M (805) 402-3326 P (619) 331-1974 E nhoneys...@bpoc.org <mailto:
>> nhoneys...@bpoc.org>
>> 1549 El Prado, Suite 8, San Diego, CA 92101
>>
>> A non-profit technology collaboration connecting audiences to art, culture
>> & science.
>>
>> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Bruce Wyman | Principal
bwy...@usd-mach.com <mailto:bwy...@usd-mach.com> | 720.208.6586
USD Design | MACH Consulting | www.usd-mach.com
Strategy • Design • Concept • Implementation
_______________________________________________
You are currently subscribed to mcn-l, the listserv of the Museum Computer
Network (http://www.mcn.edu)
To post to this list, send messages to: mcn-l@mcn.edu
To unsubscribe or change mcn-l delivery options visit:
http://mcn.edu/mailman/listinfo/mcn-l
The MCN-L archives can be found at:
http://www.mail-archive.com/mcn-l@mcn.edu/
