When the regulation does not apply
Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.Could this effectively a work around?
It could only for non-EU members, but do you really want to start checking people's nationality now? And it would give an unfair advantage to non-EU members.
"Your company is service provider based outside the EU."
Couldn't we use a host provider outside of the EU?The host is in the US.
That changes some things doesn't it?
"Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR."
You don't specifically target EU individuals, they just happen to be members among other populations as well.I do not think it means that I go and only provide service only to the EU. I think they meant it in the way I showed with the US bank. Here is another site that I had read many months ago:
https://gdpr.eu/companies-outside-of-europe/
The site offers services to EU citizens.
We should look further into how this applies.
How long do you figure it'd take a lawyer to look over these policies and advise us on this website's options? If it'd only take like an hour it might be worth it to finally settle years of varied confusion.
It is questionable if they can only revoke it for one piece of data, not for all, but if we assume they have to revoke all of it, then they must not use the forum, as thats the only way, they give consent by using the forum.
Maybe they can only request their doxes to be removed legally if they leave the forum. I am ok with that. We can have the vote for the people that chose to use the forum anyway. I may have to reread my TOS for this.We ought to look further into what goes into revoking.
I can write in the TOS that any information that is not requested to be taken down is implied consent. I already have a part that says it if they post it themselves it is not considered confidential.
This however means, they can request it to be taken down.
I do not think it is a good idea to force people to leave to have their info removed, it can be abused.
How do you see it playing out?
TOS can't overwrite the law though, keep that in mind.
Which is why it's worth looking into what clauses do and don't exist around them.
For instance is this even a case of "specific targeted service" is worth looking into.