Why can&#39;t I add a governing law to my terms of service to avoid GDPR? I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European users, it must obey that law. However, if a website is based in the US and the terms of service say that the law governing the terms is US law, how can GDPR have any affect? I'm not a lawyer, but I've signed many contracts in my life and nearly all of them have some form of "governing law" clause.
However, if a website is based in the US and the terms of service say that the law governing the terms is US law, how can GDPR have any affect? It is unlikely that the EU will be able to enforce financial penalties against a company with no presence in the EU. But they could for example block your website in the EU, depriving you of your EU user base. The actual measures that they could or would take against such a company are still unclear, since the GDPR is quite new, and there has been no action under the GDPR against foreign companies. I'm not a lawyer, but I've signed many contracts in my life and nearly all of them have some form of "governing law" clause. The governing law clause in a contract identifies the law that will be used to interpret the contract and to resolve any disputes arising from the contract. The law identified in the clause does not become the sole law governing every aspect of the relationship between the parties, however. For example, a business in New Jersey could have a contract with a client in New York with a clause specifying New Jersey law as the governing law of the contract. But that does not mean that New York's consumer protection law doesn't apply to the transaction.
Keeping logs of chats would not necessarily be against the GDPR as you have suggested. For the IRC service provider/operator: these chats/logs would be within scope if EU-based users are involved and this means the data controller/processors would have legal obligations to comply with GDPR. The IRC service provider/operator would be the data controller and would be held ultimately responsible for the data stored/processed through the IRC service, including backups and logs kept etc, and this would mean any sub-processors they select (such as hosting provider) would also have to be GDPR compliant. Due to the nature of IRC chats being entirely public in the same way forum board posts and comments are public, the contract terms between the IRC service provider and the IRC users would need to be very clear that this is the case, and the IRC users would need to give consent for this processing (this is more complicated for children, see Article 8 regarding consent from the holder of parental responsibility). For IRC users (personal use): If you wish to keep the chat records for personal use only (i.e. not in connection with a business or your employment at a business), then an exemption applies: This Regulation does not apply to the processing of personal data: ... (c) by a natural person in the course of a purely personal or household activity; ... (GDPR, Article 2: Material Scope, Paragraph 2(c), p.32) For IRC users (commercial/business use): In this case I don't think you would have any legal basis to store/process these chats/logs if they contain personal data without a legal agreement with the data controller which would require you to put in place the same protections they have to under GDPR but then allow your business to access the data for specific purposes. While the information may be published or considered to be in the 'public domain', for you to take a copy of it without permission and use it for a purpose they haven't consented to would not be allowed under GDPR. Additionally, to go through the process of removing personal data from the chats/logs would in itself be considered 'processing' under GDPR and therefore would be unauthorised without a legal agreement with the data controller. Practically therefore, your best options under this circumstance would be if: The IRC service provider implemented a 'favourites' feature to save within their own system the chat conversations you wish to retain and refer back to in future. Since they hold the data and you already have a user agreement with them there is no further complications (this is probably the best option); The IRC service provider implemented a feature to download an anonymized copy of a chat conversation (not ideal as there are no guaruntees a user will not include personal data in their messages, though the user agreement could state that message content will be considered to exclude personal data, in a similar way to how StackExchange do for this website, see the paragraph titled "Information You Choose to Display Publicly on the Network" on the StackExchange Privacy Policy). Your business considered an alternative communications solution, such as hosting its own real-time chat system or forum boards system, in which case your business would be the data controller, and while subject to GDPR you could then define the purposes for which the data will be used in your own user agreement.
As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. That's not exactly true, consent is merely one of six possible legal basis for processing (article 6). For example, processing of personal data can also be lawful if it necessary to perform a contract, legally mandatory, or in the public interest. The court decision acknowledges that but rules out another basis in this case because it considers that it is possible to serve fonts without relying on a third-party ([…] der Einsatz der Schriftarten auch möglich ist, ohne dass eine Verbindung von Besuchern zu externen Servern hergestellt werden muss). Confusingly, it only refers to article 6(1)(f) when it seems to me that (b) would also be plausible but maybe this wasn't raised during the proceedings? If the data controller cannot invoke any other basis for the lawfulness of the processing then yes, the only thing left is asking for consent, i.e. invoking article 6(1)(a). But that doesn't mean that you should expect to be asked for consent each and every time your personal information is being used. The consent form on the site also implicitly assumes consent, which I thought was also a violation. Yes, implying consent doesn't really make sense under the GDPR definition (article 4, see also article 7): ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action European data protection authorities have issued guidelines that detail what that means and clearly reject “bundling” different data processing. The regulation also makes it clear that data subjects should be able to withdraw consent at any time, which does not seem possible with the fonts on golem.de My reading of all this is that assuming consent because you are using a service (or even created an account or checked a box at some point) simply isn't valid consent. Either you don't need consent at all in the first place or what you need is freely given, specific consent and “implying” consent or bundling it with a registration process achieves exactly nothing. But this is still extremely common and it might take some time before enforcement and case law definitively settle this question. Smart data controllers trying to avoid collecting consent (like Meta) have abandoned any claim that signing up to the their services would constitute consent (because that's transparently not the case) and try to bypass the issue entirely using another basis like contractual necessity. This is also being litigated. I know that a EU regulation can be implemented and interpreted differently from country to country, and that a single court ruling in Germany doesn't even mean that the national law was correctly applied. From what I've read, I get the impression that this particular ruling was not unlikely to be overturned by a higher instance, if it came down to it. So my question probably both pertains to German law specifically and the EU regulation itself. That sounds more like the way EU directives work. Regulations are supposed to be immediately applicable (no implementation in national law necessary) with minimal differences between countries (except when they explicitely provide for that). Of course, enforcement would still mostly be in the hands of national court systems and (in Germany) provincial data protection authorities but there are mechanisms to ensure consistency (the European Data Protection Board, prejudicial questions to the CJEU, infringement proceedings from the European Commission…).
By which law I am enforced to share my personal details (such as my full name) on forum publicly to on-line people which I even don't know (when commenting on random posts)? Contract Law. Google have made it a term of the contract that you use your full name. You can: contact Google and negotiate a change to that term, accept that term, choose not to enter the contract. so I can enforce on my privacy rights without removing my Google Plus account? As a person subject to UK law, your privacy rights involve limiting who and in what circumstances Google can divulge personal private information to. Your name is not personal private information; things like your medical history and bank balance are. Aside from that, you do not have a right to privacy. Anything you do or say that is visible or audible from a public place (like the internet) or a private place where the person in control of that place does not insist on your privacy (i.e. almost everywhere that you are not in control of) is public!
EU Member State Data Protection Authorities (&quot;DPAs&quot;) have fined foreign legal entities (pursuant to Articles 58(2)(i) and 83 GDPR and further national provisions), however it is not publicly documented whether the specific situation you described has occured. Even if such situation would arise, I would think that it is unlikely that DPAs imposing administrative fines could enforce their (fine imposing) decisions outside the EU, even if the decision in question was confirmed by a court. For instance, in the Netherlands there is not a strong legal basis for the (mutual) recognition and enforcement of foreign administrative decisions. I could imagine that the same applies to other EU Member States. However, please note (possible) civil liability Your question seems to refer to enforcement of the GDPR under instruments of administrative / public law. Please note however that the GDPR can also be enforced by private individuals and organizations, e.g. through tortious liability claims. See for example Amsterdam District Court 2 september 2019, ECLI:NL:RBAMS:2019:6490 for a situation (albeit purely national), in which the Court awarded damages for a GDPR breach to a data subject. Possibly, a similar case could be brought against an entity outside the EU that processes data of EU data subjects, contingent upon the outcome of certain questions of International Private Law. With regard to civil damages, there is an extensive international legal framework that covers the cross-border enforcement of rewards for civil damages. Likely, such rewards for damages could more easily be enforced outside the EU. However, I must note that such (private) cross-border enforcement of the GDPR has not happened in practice (yet) either (as far as I know). (Please note that this answer assumes (per the question) that the GDPR is applicable and only deals with the question of the territorial aspects of subsequent enforcement. See about the territorial scope of the GDPR: What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?).
Art. 15(4) GDPR says: (4) The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. If I was the controller in this situation, and I believed that this would endanger the students that have criticised the professor, I would base my argument for not complying on this. In addition, Art. 85 GDPR requires member states to: [...] reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information [...] So you may be able to argue that the students posting messages are engaging in "processing for journalistic purposes and the purposes of academic, artistic or literary expression", depending on the laws of the particular member state. (edit: this could be difficult since you mention it is a private database). The second case seems just like the first in terms of GDPR, but may constitute defamation. Defamation (or libel) laws differ wildly in each country; he Wikipedia article on Defamation explains the situation in each member state in more detail. In the third case: if the professor submits a request based on the rights of a data subject other than himself, they don't need to comply. These requests need to come from the data subjects themselves, not just a random person assuming authority. (although I suppose it's possible for them to give power of attorney to the department head if they wanted to) Personal data and the rights that GDPR provides to data subjects always relate to a natural person, not an institution or a company.
The 2018 Data Protection Act specifically implemented the GDPR EU Regulation in the UK - while the regulation itself was directly binding it required member states to create their own legislation for implementing the details - setting up the required supervisory and accreditation bodies etc. The various 'opening clauses' in the regulation also provided the means for the members states to implement specifics in local legislation (so long as that legislation exceeded the minimums set out in GDPR). At the end of the Brexit transition period the UK was no longer a member state (and it's citizens were no longer EU citizens), keeping the DPA 2018 as was would have actually meant that UK citizens weren't eligible for the very protections it was intended to provide them! Therefore the basis of the law needed updating (as well as certain minor provisions that no longer made sense) hence the &quot;UK GDPR&quot; provided a substitute. The fundamentals are the same and crucially it also codified the necessary basis for the UK's data protection laws to have what is referred to as &quot;adequacy&quot; - which means that the EU considers the UK GDPR/DPA to provide &quot;essentially equivalent&quot; levels of protection and therefore data is allowed to continue to flow between the UK and the EU.
Whether GDPR applies does not depend on the country of residence. Instead, GDPR applies to a non-EU site or service if the data controller offers products or services to people in the EU (see Art 3(2) GDPR). This depends solely on the behaviour and intent of the data controller / the provider of the website – compare also the discussion of the “targeting criterion” in EDPB guidelines 3/2018 on the territorial scope of the GDPR. While your proposed measures might not be entirely ineffective (in that they document an intent to not serve people in the EU), they are both unnecessarily restrictive and overly lax. For example, they would unnecessarily prevent EU tourists in the US from registering but would nevertheless allow US tourists in the EU. For the targeting criterion, it matters whether the data subject is in the EU at the time of the offer, not at all what their residency is. Even if a person who is currently in the EU registers with your service, that doesn't necessarily mean that you are targeting people in the EU. Instead of implementing signup restrictions, a better strategy might be to clarify in the copy on your website that you are only targeting the domestic US market, not the European market with your services. I have discussed this in more detail in an answer to “How can you block GDPR users from US based sites?” If you have a site where GDPR doesn't apply, and you receive a GDPR data subject request, you shouldn't deny it on the basis that the user must have lied – instead you can deny it on the basis that GDPR just doesn't apply to you.