GDPR for US Based Website

[The Moose]

I'm helping a buddy of mine here in the US launch a new online business.

I'm not going to be going into any great detail as to what the site does, but European citizens do not form even a minor portion of the potential customer base. Don't get me wrong, there's no reason why someone living in the EU could not register on the website (or even pay for the service)...but they would get zero value out of it unless they also had a presence in the US.

Last year when GDPR became a thing (well, an enforced thing!), I remember some large US sites blocking access to their website for EU visitors.

To be honest, I struggle to see what prosecution could take place given the company is US based and doesn't transact any business in the EU...however if there's some way to be compliant for little cost (time or money) then it's worth doing...I also suspect the motivation behind it is not a bad idea in theory.

Does anyone know what steps need to be taken to ensure we don't end up in some GDPR-related mess?

[jammy-git]

If they're not interested in EU custom, them probably the easiest thing to do would be to route traffic through Cloud late and block EU traffic.

Or implement some measure to stop EU users from registering?

[The Moose]

jammy-git said:

If they're not interested in EU custom, them probably the easiest thing to do would be to route traffic through Cloud late and block EU traffic.

Or implement some measure to stop EU users from registering?

I was reading about this earlier and saw some article saying that you're not allowed to use an IP block?

[48k]

Can you just not accept user registrations and thus orders from non US-based addresses?

[The Moose]

48k said:

Can you just not accept user registrations and thus orders from non US-based addresses?

We have a free service and a paid service. The free service does not have any need for a credit card so you could, in theory, lie about your location and create an account (and we don't want to stop that). The paid service is more unlikely to be an issue as the service would not be of interest to anyone who isn't in the US.

[MadProfessor]

What aspect of GDPR is a problem as the CDPA will come into force by 2020. Whilst they are obviously different and compliance with one doesn't mean compliance with the other, one would assume that any company should be taking data privacy seriously.

[Australiam]

The Moose said:

I'm helping a buddy of mine here in the US launch a new online business.

I'm not going to be going into any great detail as to what the site does, but European citizens do not form even a minor portion of the potential customer base. Don't get me wrong, there's no reason why someone living in the EU could not register on the website (or even pay for the service)...but they would get zero value out of it unless they also had a presence in the US.

Last year when GDPR became a thing (well, an enforced thing!), I remember some large US sites blocking access to their website for EU visitors.

To be honest, I struggle to see what prosecution could take place given the company is US based and doesn't transact any business in the EU...however if there's some way to be compliant for little cost (time or money) then it's worth doing...I also suspect the motivation behind it is not a bad idea in theory.

Does anyone know what steps need to be taken to ensure we don't end up in some GDPR-related mess?

Your question is a little like asking how long is the proverbial piece of string. However, you need to decide upon a couple of things for us to start to propose a path.

If you collect PI then you are a data controller, and legally bound by the GDPR. If you want them to be a customer, you want a long term relationship with them, or for any reason you want to keep their details on record, there is no 'shortcut' to learning your obligations, and understanding what you can rightfully do or not do with their information.

If you are not interested in them signing up, then as others have said, it may be easier to prevent that in the first place. You could use a technical solution as suggested, or have a compulsory 'country' field in the form they submit, and just not save or delete anything from the EU (you will have to decide you preferred approach).

Anything else is bound by the regulation. However I had a US site, and and I knew EU citizens submit PI, to which I wanted to reply, but not engage in the longer term, then I would at the very least -

- Communicate with them clearly what you will do with their data (including where you will store it and for how long)
- Delete the data as soon as it is no longer needed it for the purpose described above
- give them details of how to get in touch with the data controller.

I would determine and document the lawful basis for collecting the data, and make it clear to the user (assumed to be Legitimate Interest or Consent). If LI I would complete a balance test, if consent, I would offer an easy process for that consent to be retracted, and the data treated accordingly.

I would also create a mechanism to prove these steps in case you ever receive a compliant.

This is by no means exhaustive, and arguably non compliant, but until we see some case law, and therefore some idea of the steps that are likely to be taken, this would reduce my risk to a level I would be happy with.

As you can see, other than 'do not collect the data in the first place' or 'learn the regulation' you have to decide for yourself what approach you are comfortable taking, so this is not advice, but rather the approach I may take if in the position you describe. I am sure others will be along to add more, and give their alternative view of your options.