Similar arguments apply to the other examples you use, I see your point and there are valid reasons to not enter a certain market because of the legal climate there but the point I am trying to make is that the OP has not raise any valid point at all other than 'I don't want to comply'. And that's fine by me but then don't bother dressing it up in a bunch of made up requirements.
This guy quite clearly states that he doesn't have resources to become compliant, while it is too risky to make a mistake here.
There are fans of GDPR on this website, who prefer to ignore the fact that the compliance has its cost, and added to that still unknown risks of practical interpretation of legislation which also have their cost. But these are real life things.
So, for example, he says he is required to appoint a DPO.
The U.K. Information Commissioner has this to say:
>Do we need to appoint a Data Protection Officer?
A> Under the GDPR, you must appoint a DPO if:
> you are a public authority (except for courts acting in their judicial capacity);
>
your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking);> * or your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences.
If
* core activities * require * large scale * regular * systematic
If you tick all those other boxes, but are concerned that your processing may be teetering on the boundary of 'large scale', I would be cautious and assume your liable.
"There must not be a conflict of interest between the duties of the individual as a DPO and her other duties, if any."
Specifically they recommend against also being the data controller. I.e. you shouldn't be responsible both for handling personal data and verifying compliance of said handling.
That's why some independent DPO jobs are appearing.
But the DPO is a small cog in the machine. Updating the processes is the most time and resource consuming regarding the GDPR.
I suppose it depends where in Europe he would like to visit
> (1) The controller and the processor shall designate a data protection officer in any case where:
> a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
> b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or
> c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10.
As poisan42 points out - it echoes the words in the actual article, directly.
Bottom line, he doesn't need a DPO.
Essentially that's it.
I am no lawyer but I am a CPO.
Pro tip: Speak with the regulators they are on your side.
I guess an XMPP Server could be considered a communication service an could be subject not to the GDPR but to regulations concerning ISPs and Phone companies.
https://www.today.com/food/kinder-joy-chocolate-eggs-are-com...
I mean, it never really took off here, very few people prefer it over the original, but better than not being able to sell it outside of the US at all.
And why should the French cripple a delicious and traditional product, which is gladly gobbled up by millions of happy consumers to sell their product in the US?
Case 1: CompanyA is already doing business in CountryB. CountryB changes regulations. CompanyA pulls out of CountryB because of regulations
Case 2: CountryB has regulations. CompanyA choose not to do business in CountryB because of regulations
am I missing something?
P.S. I sincerely hope my country gets out of this ASAP.
It takes some special talent, even as an adult, to take such a big bite off of a classic Kinder egg that you'd have any chance of accidentally swallowing the plastic capsule or somehow else hurting yourself on it.
And with the new egg, I'd be concerned that my kids swallowed that plastic spoon. Like, that's something they actively have to put into their mouth and it's not as interesting as the toy for them to be motivated to not swallow it.
It's also small enough for them to realistically pull this off.
I haven't found a single case of a child getting hurt in Germany. Only news reports about them being unhealthy (big surprise).
EDIT: Turns out the US-style kinder eggs are indeed available outside the US.
Toy is also in US version but different design
https://www.candywarehouse.com/assets/item/regular/kinder-jo...
But I'm not sure it's typical.
Most people seem to prefer the original, though. They lost a lot of charm by going from toy+edible+tinfoil to plastic+toy+plastic+edible+plastic spoon+plastic.
I have seen this outside of US also (pretty sure it was doing a Europe trip)
