Re: Whois vs GDPR, latest news

["K. Scott Helms" <kscott.helms () gmail com>]

 Anne,

While I was re-reading some of the emails last night I realized that I
mischaracterized your description here, *"You may accuse me of being a
lawyer here (and rightly so :-) ), but "in", as in "in the Union" (which is
the actual language) is very much open to interpretation.  In a judicial
system where lawsuits have turned on  - I kid you not - the interpretation
of what a comma meant, I can almost guarantee you that "in the Union" is
going to get interpreted through lawsuits, and it is absolutely not outside
the realm of possibility that a U.S. citizen visiting in the EU will bring
a lawsuit based on something happening with their PII while they were "in
the Union".*

I didn't make it clear that you were suggesting that some would make this
claim rather than you making that claim.  Mea culpa :)

Our counselors made it clear (as did the regulators I was able to ask) that
short term visits weren't intended to be covered *in their opinion.*  There
are and will be many questions that won't be fully answered until
adjudicated or more precise language is used to make the meaning clear.
 Juhan Lepassaar (Head of VP Ansip Cabinet, European Commission) was one of
the speakers and we were able to ask questions of him.  It looks like the
video of one of the presentations I was at is now publicly available and I
encourage those with questions to watch it.

https://www.rsaconference.com/speakers/juhan-lepassaar

*" Actually, GDPR specifically requires processors to include statements of
compliance right in their contracts;  we also strongly recommend that
controllers insist on indemnification clauses in their contracts with
processors, because if the processor screws up and there is a breach, the
_controller_ can also be held liable, and the financial penalties in GDPR
are very stiff."*

Yep, this is better (clearer) wording than what I used and is absolutely
correct.



On Thu, May 24, 2018 at 10:21 AM Anne P. Mitchell Esq. <amitchell () isipp com>
wrote:

> > On May 23, 2018, at 7:18 PM, K. Scott Helms <kscott.helms () gmail com>
> wrote:
> > Anything that can tie back to an individual data subject is PII, that
> means email addresses, names in combination with addresses or phone
> numbers, finger prints, or even insufficiently abstracted internal ID
> numbers/codes.
>
> Don't forget IP addresses, as part of the wonderfully vague "online
> identifiers".
>
> > Notice I didn't say EU citizen there, that's because the law and
> regulations (GDPR consists of both) intentionally cover any natural person
> in any of the 28 EU nations including the citizens of non-EU nations.
> >  I don't go as far as I think Anne was suggesting, in that someone in EU
> airspace who sent an email or made a purchase is now suddenly an EU data
> subject.
>
> You may accuse me of being a lawyer here (and rightly so :-) ), but "in",
> as in "in the Union" (which is the actual language) is very much open to
> interpretation.  In a judicial system where lawsuits have turned on  - I
> kid you not - the interpretation of what a comma meant, I can almost
> guarantee you that "in the Union" is going to get interpreted through
> lawsuits, and it is absolutely not outside the realm of possibility that a
> U.S. citizen visiting in the EU will bring a lawsuit based on something
> happening with their PII while they were "in the Union".
>
> > Any company that is covered by the GDPR must be extremely careful that
> any company they do business with is also compliant if that company will
> have access or act as a data processor.  That means that if you are a US
> company that has US only customers, but some of your customers have
> employees that are US citizens but who live in an EU nation then they are
> bound to only use providers that are GDPR compliant.  Now, this will result
> in contractual disputes and/or loss of business rather than having EU
> regulators fine your company directly.  The end result is that many many
> many companies that don't sell or market to the EU are finding themselves
> needing to comply in the same way that companies that sell services to
> medical companies often have to follow HIPAA  (and be audited) even though
> they provide medical services themselves.
> >
>
> Actually, GDPR specifically requires processors to include statements of
> compliance right in their contracts;  we also strongly recommend that
> controllers insist on indemnification clauses in their contracts with
> processors, because if the processor screws up and there is a breach, the
> _controller_ can also be held liable, and the financial penalties in GDPR
> are very stiff.
>
> Anne
>
> Anne P. Mitchell,
> Attorney at Law
> CEO/President,
> SuretyMail Email Reputation Certification and Inbox Delivery Assistance
> GDPR Compliance Consultant
> GDPR Compliance Certification
> http://www.SuretyMail.com/
> http://www.SuretyMail.eu/
>
> Attorney at Law / Legislative Consultant
> Author: Section 6 of the CAN-SPAM Act of 2003 (the Federal anti-spam law)
> Author: The Email Deliverability Handbook
> Legal Counsel: The CyberGreen Institute
> Legal Counsel: The Earth Law Center
> Member, California Bar Cyberspace Law Committee
> Member, Colorado Cybersecurity Consortium
> Member, Board of Directors, Asilomar Microcomputer Workshop
> Member, Advisory Board, Cause for Awareness
> Member, Elevations Credit Union Member Council
> Former Chair, Asilomar Microcomputer Workshop
> Ret. Professor of Law, Lincoln Law School of San Jose
>
> Available for consultations by special arrangement.
> amitchell () isipp com | @AnnePMitchell
> Facebook/AnnePMitchell  | LinkedIn/in/annemitchell