Can&#39;t GDPR compliance be trivially bypassed? For large tech firms such as Facebook, at least, wouldn't it be a trivial matter for these companies to avoid EU GDPR compliance altogether? Many big companies don't actually "sell" any tangible property directly to users, and may only sell digital subscriptions instead. These subscriptions could be paid for with a credit card, for example, regardless of what country the card is issued in. I don't understand why any sort of EU presence would even be necessary in these cases. For example, why couldn't Facebook just dissolve all of its EU-based subsidiaries? Since it doesn't charge anything to its users, couldn't it just carry on allowing people to sign up from EU nations since it would have no legal presence there? What exactly could the EU do short of blocking the site from being accessed? (Please note I'm not advocating for or against GDPR, I'm just wondering how it even has any real applicability to multinationals)
Facebook isn't a charity. It operates in the EU on order to make money there. And yes, it makes money from advertisers, but those include EU advertisers. Facebook would be seriously hurt if it would lose those. A second effect is the winner-takes-all effect. That is why Facebook became so big in the first place. Google+ is folding, possibly its only competitor is WeChat (due to China's protected internal market)/ Giving up the EU means giving up the biggest market. A GDPR-compliant competitor will arise in the EU if Facebook would do that. That competitor will have a larger potential market by not excluding the EU. This is an existential threat to Facebook. There is nothing inherently unique to Facebook except its size, so it cannot afford to waste that advantage. They don't want to become the next Google+. Complying with the GDPR is a small price.
The European Convention on Human Rights has an article about privacy (article 8). Note that this is from the Council of Europe, which is not the same as the European Union: non-EU member states such as Russia, Turkey, and Azerbaijan are also part of the Council of Europe and therefore the ECHR. I'm not sure if you first have to go to a lower court, but the European Court of Human Rights is the authority on this (commonly mistaken for the European Court of Justice, but they are distinct entities). According to this ruling of the ECtHR, it is not illegal to monitor your employees' communications per se. However, the monitoring has to be: for legitimate purposes ("the employer had only accessed the account in the sincere belief that it contained only messages of a professional, not personal, nature"), proportionate ("it was the only possible way available"), and communicated to the employee (or, if the monitoring is not announced, at least the restriction on personal use should be communicated, for example through company policy). In the European Union, there is also the GDPR, but this does not change much. It applies to your employer the same as any other organisation and basically says that they have to be reasonable about it: collect only what they need, for a legitimate purpose, and tell you about it. I think you should be able to request a copy of any data they collected about you, ask a human to review an automated decision, and your other usual rights. They don't need your consent to start collecting data, as Esa Jokinen already commented: "GDPR doesn't even require consent to handle PII data, but the consent is just the last option when there's no other legitimate reason to process the data." In fact, your employer probably cannot ask you for consent: because of the employer–employee imbalance of power, the consent would probably not be considered to be freely given (where this article mentions "The GDPR states", I think they are referring to recital 43).
It is not possible for someone to forfeit their rights because the GDPR is compulsory law. In the EU, laws can be regulatory or compulsory. In case of an agreement, regulatory laws can be set aside, if both parties agree on that. But compulsory laws cannot be set aside. Of course laws can also be partly compulsory. For example provisions which cannot be changed in disadvantage of a consumer. So there is freedom of contract, but it's freedom is reduced by law for the common good or for example to avoid misuse of bargaining power. In particular consumer related laws are often compulsory because it has little power against the other parties. Companies can have their negotiations done by lawyers, so they can make a well informed an well negotiated decision. As an extreme example, you cannot kill someone, even if that person has given you written permission. See also "Peremptory norm" on wikipedia for international law examples.
Yes, there would still be an obligation to comply with erasure requests – if the data subject can be identified, and if the GDPR applies. This is a case for Art 11 GDPR: processing which does not require identification. The pastebin site is not required to collect identifying info just in order to facilitate later deletion. If the site is unable to identify the data subjects, then the data subject rights (like access, rectification, erasure, restriction, or data portability) do not apply. Other rights like the right to be informed and the right to object do remain, though. But if the data subject provides sufficient additional information that makes it possible to identify their records, then the data subject rights apply again. In practice, this is likely going to mean that anyone with access to a paste will be able to request deletion, since the site would have no ability to verify the identity of the data subject beyond the information in the paste. None of this absolves the site from implementing appropriate technical and organizational measures to ensure the security of this data. Even though the pastes might not be directly identifying, they are personal data and are far from anonymous. Common practices like numbering pastes with a sequential ID or showing recent pastes on a homepage have to be viewed critically. My go-to recommendation is to assign a cryptographically random UUIDv4 ID to the post, so that it is practically impossible for anyone to find the paste unless they were given a link by the uploader. Your idea to delete pastes after a fairly short retention period is also good. This helps with security, and it is in line with the GDPR's data minimization and storage limitation principles: data may only be kept as long as necessary for its purpose. On the other hand, quick deletion might not be in line with the purpose of these pastes – it all depends on context. You mention that this is an US-based site. If so, there's a question whether GDPR would even apply. GDPR will apply per Art 3(2) if the data controller is offering its services to people who are in Europe. Here, “offering” does not mean mere availability of the website, but that the data controller intends the service to be used by such people, in particular if the service is somehow targeted or marketed to such people.
The consent presented in the question is a text-book example on how to not secure consent under the GDPR. The GDPR requires concent to be explicit, specific, freely given, and informed. This particular privacy policy does not measure up to any of these requirements. The GDPR goes to great lengths to regulate consent. For instance, in Article 7 (2) is says: Any part of such a declaration [of consent] which constitutes an infringement of this Regulation shall not be binding. So if the consent obtained is not explicit, specific, freely given, and informed, and the company relies on consent to ensure lawfulness of processing, it is breaking the law (and may be fined under the GDPR). The big problem with this privacy policy is this sentence: Your continued access to or use of any of the Services shall be deemed your acceptance of the Privacy Policy. As you've noted, the GDPR requires consent to be explicit. What "explicit" means is spelled out in Recital 32, which (among other things) says: Silence, pre-ticked boxes or inactivity should not therefore constitute consent. And Recital 32 goes on state that consent must be specific: When the processing has multiple purposes, consent should be given for all of them. The full privacy policy lists 16 different purposes for which personal data is collected, but do not seek specific consent for any of them. Consent under GDPR must also be freely given. Recital 42 says (among other things): Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. Here the company states that continued use of the service "shall be deemed your acceptance". The only way the data subject can refuse consent is to not use the service, which is to the detriment of the data subject. This also makes the consent invalid. Finally, the GDPR also requires consent to be informed. What this means is spelled out in Recital 42, which (among other things say): For consent to be informed, the data subject should be aware at least [...] the purposes of the processing for which the personal data are intended. Here the data subject is supposed to consent to some unknown, future change which may be to allow different purposes of the processing. This also invalidates the consent.
It is not different. But one company can decide to approach compliance differently from another. Here, TomTom has chosen a fairly safe/conservative interpretation, whereas Google and Apple decided that more data collection is appropriate. A “find my device” style functionality appears to be entirely unproblematic if the user books that particular service (regardless of whether the service is paid or gratis) and provides consent for the location data collection. The legal basis for such a service could then be Art 6(1)(a) consent or Art 6(1)(b) necessity for performance of a contract to which the data subject is party. Personally, I believe that Google is not sufficiently transparent about how Find My Device works, but that TomTom could provide a compliant service if they wanted to. That TomTom doesn't offer this service primarily shows that they don't think developing this service is worth it. Wiping a remote device is unrelated to this issue and doesn't seem to provide GDPR challenges. At least in a business context, remote wiping may be an appropriate security measure and may then even be mandated by the GDPR (e.g. see Art 24 or Art 32).
You're probably making an “international transfer” here, but that doesn't mean it is illegal. The GDPR has a very broad concept of “personal data” and of “processing”. Per Art 4(2), ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction Which I would summarize as: pretty much anything you do with the personal data counts as “processing”. So yes, your non-EU servers would be processing the personal data in HTTP requests, even when those servers aren't directly storing the personal data. Chapter V of the GDPR applies to Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country […] Per this definition, the question whether an international transfer occurred is inextricably linked with the question whether the data is being processed in the destination country. The generally accepted interpretation here is that mere transfer through a country does not constitute processing. For example, if your requests happen to take a network route through other countries, that wasn't an international transfer. But your HTTP server is definitely doing processing, even if it doesn't store the data persistently. If the HTTP server is in a non-EU country, then you have to consider how this transfer of data is protected. You're supposed to uphold the high GDPR data protection standards regardless of where the processing occurs. Some countries have been granted an EU adequacy decision, meaning that their data protection laws are sufficiently similar to EU laws and no extra bureaucracy is needed for that transfer. The transfer still needs to be noted in your privacy notice (compare Art 13(1)(f)). In other cases, you may be able to rely on “standard contractual clauses” (SCCs), which are pre-formulated contracts provided by the EU that translate relevant GDPR aspects into a private contract between the data exporter and data importer. However, you as a data controller must make sure that the data importer is legally able to enter into that contract. For example, the terms of these SCCs are incompatible with US national security laws, meaning that US companies might not be able to enter into the SCCs. There are a couple of other ways to authorize international transfers, but they are mostly relevant for multinational groups of companies, or in exceptional situations. In any case, other GPDR requirements like the need to have a suitable contract with your data processors remain unaffected. Also unaffected is the obligation to implement appropriate technical and organizational measures to ensure the compliance and security of your processing activities (e.g. see Art 24 and Art 32 of the GDPR). For example, this may imply the need to implement suitable encryption. In the wake of the Schrems II ruling that struck down the EU–US “Privacy Shield” adequacy decision, the EDPB published recommendations on extra compliance measures that could allow SCCs to remain valid for EU–US data transfers. But it's not easy to defend data processing activities when potential adversaries include literally the NSA, and measures such as end-to-end encryption (E2EE) are incompatible with cloud services that are more interesting than backup storage. Practically speaking, I would reconsider an architecture that would allow failover of EU data processing operations to non-EU locations, unless those target countries are covered by an adequacy decision. If you need a high availability setup for EU activities, it may be more appropriate to maintain multiple deployments within the EU.
It is entirely possible to reach a reasonable level of compliance in a DIY approach, provided that you familiarize yourself with the relevant legal framework. The UK ICO has produced in-depth guidance to help here, which is significantly more digestible than the laws themselves: ICO Guide to the UK General Data Protection Regulation (UK GDPR) For a first reading, it is probably appropriate to focus on the summaries and checklists at the top of each section. You will however notice that GDPR is a lot about principles, and requirements like selecting appropriate compliance measures yourself. On one hand, this means that you have some flexibility in your compliance approach, but it also means also that you can never be sure whether you're actually compliant. But this is also precisely why professional help can be valuable, since compliance professionals probably have a better overview of best practices, state of the art measures, and also potential pitfalls. In some other answers, I have written basic overviews/checklists to get started with a GDPR compliance effort. On to your concrete questions: What is the best strategy to get started with GDPR compliance? This is ultimately a business decision that you have to make. You have to consider how much compliance is worth to you, both in terms of time and money. Maybe you can DIY it, maybe you'll want to get professional help, maybe you'll just hope that no one ever sues you or lodges a complaint. There is no objective optimum, and only you know your particular situation. What are the consequences for unintentional infringement? Not being aware of the rules is not a valid defense (ignorantia juris non excusat). How are fines calculated? The GDPR has two separate enforcement mechanisms: data subjects can sue you for compliance and damages, and the ICO can fine you. Damages are typically small compared to the cost of a lawsuit. When issuing fines, the ICO must consider a variety of factor per Article 83, for example whether the infringement was willful or negligent. The ICO is not required to impose damages, and anecdotally many small problems can be resolved informally before it comes to a full investigation. In particular, the ICO's Regulatory Action Policy 2018 explains that “we will reserve our powers [to issue fines] for the most serious cases, representing the most severe breaches of information rights obligations. These will typically involve wilful, deliberate or negligent acts, or repeated breaches of information rights obligations, causing harm or damage to individuals.” The policy also provides a 5-step process for arriving at fines: removing financial gain, accounting for scale and severity of the breach, considering aggravating factors, ensuring a deterrent for others, and considering mitigating factors. This suggests that a good-faith effort to ensure compliance already goes a long way. When to get professional help? Under some circumstances, the GDPR requires that you appoint a data protection officer, who doesn't have to be an employee. You mention that you do not process sensitive data, so that it is currently unlikely you'd be required to appoint a DPO (compare Art 37, but note that the list of sensitive categories of data in Art 9(1) does not match your examples). The requirement to appoint a DPO depends entirely on the kind and scale of your data processing activities, not on number of employees or revenue thresholds. However, some GDPR compliance obligations like Art 30 Records of Processing Activities can also trigger when you reach 250 employees. Aside from that, it is a business decision whether and when to invest in compliance. Note that if your business offers goods or services to people in the EU/EEA, you may be required to appoint an EU representative. Some law firms offer package deals for DPOs + EU/UK representatives.