Re: Whois vs GDPR, latest news

["Anne P. Mitchell Esq." <amitchell () isipp com>]

> On May 23, 2018, at 7:18 PM, K. Scott Helms <kscott.helms () gmail com> wrote:
>
> Anything that can tie back to an individual data subject is PII, that means email addresses, names in combination 
> with addresses or phone numbers, finger prints, or even insufficiently abstracted internal ID numbers/codes.

Don't forget IP addresses, as part of the wonderfully vague "online identifiers".

> Notice I didn't say EU citizen there, that's because the law and regulations (GDPR consists of both) intentionally 
> cover any natural person in any of the 28 EU nations including the citizens of non-EU nations.
>  I don't go as far as I think Anne was suggesting, in that someone in EU airspace who sent an email or made a 
> purchase is now suddenly an EU data subject. 

You may accuse me of being a lawyer here (and rightly so :-) ), but "in", as in "in the Union" (which is the actual 
language) is very much open to interpretation.  In a judicial system where lawsuits have turned on  - I kid you not - 
the interpretation of what a comma meant, I can almost guarantee you that "in the Union" is going to get interpreted 
through lawsuits, and it is absolutely not outside the realm of possibility that a U.S. citizen visiting in the EU will 
bring a lawsuit based on something happening with their PII while they were "in the Union".

> Any company that is covered by the GDPR must be extremely careful that any company they do business with is also 
> compliant if that company will have access or act as a data processor.  That means that if you are a US company that 
> has US only customers, but some of your customers have employees that are US citizens but who live in an EU nation 
> then they are bound to only use providers that are GDPR compliant.  Now, this will result in contractual disputes 
> and/or loss of business rather than having EU regulators fine your company directly.  The end result is that many 
> many many companies that don't sell or market to the EU are finding themselves needing to comply in the same way that 
> companies that sell services to medical companies often have to follow HIPAA  (and be audited) even though they 
> provide medical services themselves.

Actually, GDPR specifically requires processors to include statements of compliance right in their contracts;  we also 
strongly recommend that controllers insist on indemnification clauses in their contracts with processors, because if 
the processor screws up and there is a breach, the _controller_ can also be held liable, and the financial penalties in 
GDPR are very stiff.

Anne

Anne P. Mitchell, 
Attorney at Law
CEO/President, 
SuretyMail Email Reputation Certification and Inbox Delivery Assistance
GDPR Compliance Consultant
GDPR Compliance Certification
http://www.SuretyMail.com/
http://www.SuretyMail.eu/

Attorney at Law / Legislative Consultant
Author: Section 6 of the CAN-SPAM Act of 2003 (the Federal anti-spam law)
Author: The Email Deliverability Handbook
Legal Counsel: The CyberGreen Institute
Legal Counsel: The Earth Law Center
Member, California Bar Cyberspace Law Committee
Member, Colorado Cybersecurity Consortium
Member, Board of Directors, Asilomar Microcomputer Workshop
Member, Advisory Board, Cause for Awareness
Member, Elevations Credit Union Member Council
Former Chair, Asilomar Microcomputer Workshop
Ret. Professor of Law, Lincoln Law School of San Jose

Available for consultations by special arrangement.
amitchell () isipp com | @AnnePMitchell
Facebook/AnnePMitchell  | LinkedIn/in/annemitchell