# Case Proposal: the service claims to be GDPR compliant for European users **URL:** \ **Category:** Case Discussions\ **Created:** [April 29, 2021, 8:33pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775 "2021-04-29T20:33:58Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![lxda](https://tosdr.community/user_avatar/tosdr.community/lxda/32/741_2.png) [@lxda](https://tosdr.community/u/lxda)\ **Post date:** [April 29, 2021, 8:33pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/1 "2021-04-29T20:33:58Z")
I propose the following data to be a new case: | Fields | Data | | --- | --- | | Name | The service claims to be GDPR compliant for European users | | Description | The service has a different behavior towards users protected by the GDPR. | | Classification | good | | Topic | [Terms of Service; Didn't Read - Phoenix](https://edit.tosdr.org/topics/44) | | Weight | 20 | ---
**Author:** ![Agnes\_de\_Lion](https://tosdr.community/user_avatar/tosdr.community/agnes_de_lion/32/263_2.png) [@Agnes\_de\_Lion](https://tosdr.community/u/Agnes_de_Lion)\ **Post date:** [April 29, 2021, 8:44pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/2 "2021-04-29T20:44:20Z")
Good idea! This summarizes some important information that other cases could not cover. I’d modify two things however: - The acronym is GDPR in English 😉 - Since other _good_ cases include GDPR requirements (such as [Case 195](https://edit.tosdr.org/cases/195) and [Case 140](https://edit.tosdr.org/cases/140)); I’d decrease the weight to 20 to avoid favouring a service too much for simply being compliant with laws ---
**Author:** ![lxda](https://tosdr.community/user_avatar/tosdr.community/lxda/32/741_2.png) [@lxda](https://tosdr.community/u/lxda)\ **Post date:** [April 29, 2021, 9:16pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/3 "2021-04-29T21:16:47Z")
I agree with you for this point. ---
**Author:** ![KnossosDomovoi](https://tosdr.community/user_avatar/tosdr.community/knossosdomovoi/32/124_2.png) [@KnossosDomovoi](https://tosdr.community/u/KnossosDomovoi)\ **Post date:** [April 29, 2021, 9:52pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/4 "2021-04-29T21:52:56Z")
I would change the wording to “the service _claims to be_ GDPR compliant for European users”, as we have no way to know whether or not the service is _actually compliant_ just by looking at the terms of service alone. This would also open up the possibility to add many similar cases for other jurisdictions, e.g. Californa, Brazil, etc., that have similar laws. ---
**Author:** ![lxda](https://tosdr.community/user_avatar/tosdr.community/lxda/32/741_2.png) [@lxda](https://tosdr.community/u/lxda)\ **Post date:** [April 30, 2021, 7:55am UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/5 "2021-04-30T07:55:33Z")
I totally agree with you, and it’s true that we could later add points for each “big” law of geographical area as you said for Brazil, California, etc. ---
**Author:** ![lxda](https://tosdr.community/user_avatar/tosdr.community/lxda/32/741_2.png) [@lxda](https://tosdr.community/u/lxda)\ **Post date:** [May 2, 2021, 10:43am UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/6 "2021-05-02T10:43:45Z")
I allow myself by this message to re-launch the discussions on this proposal of case. ---
**Author:** ![Agnes\_de\_Lion](https://tosdr.community/user_avatar/tosdr.community/agnes_de_lion/32/263_2.png) [@Agnes\_de\_Lion](https://tosdr.community/u/Agnes_de_Lion)\ **Post date:** [May 2, 2021, 1:04pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/7 "2021-05-02T13:04:49Z")
No adverse opinions have been expressed, so the case has been [created](https://edit.tosdr.org/cases/481). I’ve created a [similar case](https://edit.tosdr.org/cases/482) applying to CCPA (California Privacy Laws). Regarding Brazilian privacy laws, I don’t know much about them, but the LGPD looks very similar to European laws (such as rights over personal data according to this [article](https://www.osano.com/articles/brazil-lgpd)), so I’d propose to add in the description of Case 481 that it also applies to services compliant with similar data protection laws. ---
**Author:** ![lxda](https://tosdr.community/user_avatar/tosdr.community/lxda/32/741_2.png) [@lxda](https://tosdr.community/u/lxda)\ **Post date:** [May 2, 2021, 1:13pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/8 "2021-05-02T13:13:04Z")
I don’t know the Brazilian privacy laws, but I suggest to add The Swiss privacy laws. ---
**Author:** ![Agnes\_de\_Lion](https://tosdr.community/user_avatar/tosdr.community/agnes_de_lion/32/263_2.png) [@Agnes\_de\_Lion](https://tosdr.community/u/Agnes_de_Lion)\ **Post date:** [May 2, 2021, 1:15pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/9 "2021-05-02T13:15:17Z")
Are Swiss privacy laws transborders too? If soo, I’d agree. ---
**Author:** ![lxda](https://tosdr.community/user_avatar/tosdr.community/lxda/32/741_2.png) [@lxda](https://tosdr.community/u/lxda)\ **Post date:** [May 2, 2021, 1:19pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/10 "2021-05-02T13:19:20Z")
I found this in the Swiss DPA (Data Protection Act). "Art. 6 Communication transfrontiĂšre de donnĂ©es 1 Aucune donnĂ©e personnelle ne peut ĂȘtre communiquĂ©e Ă  l’étranger si la person­nalitĂ© des personnes concernĂ©es devait s’en trouver gravement menacĂ©e, notamment du fait de l’absence d’une lĂ©gislation assurant un niveau de protection adĂ©quat. 2 En dĂ©pit de l’absence d’une lĂ©gislation assurant un niveau de protection adĂ©quat Ă  l’étranger, des donnĂ©es personnelles peuvent ĂȘtre communiquĂ©es Ă  l’étranger, Ă  l’une des conditions suivantes uniquement: a. des garanties suffisantes, notamment contractuelles, permettent d’assurer un niveau de protection adĂ©quat Ă  l’étranger; b. la personne concernĂ©e a, en l’espĂšce, donnĂ© son consentement; c. le traitement est en relation directe avec la conclusion ou l’exĂ©cution d’un con­trat et les donnĂ©es traitĂ©es concernent le cocontractant; d. la communication est, en l’espĂšce, indispensable soit Ă  la sauvegarde d’un intĂ©rĂȘt public prĂ©pondĂ©rant, soit Ă  la constatation, l’exercice ou la dĂ©fense d’un droit en justice; e. la communication est, en l’espĂšce, nĂ©cessaire pour protĂ©ger la vie ou l’intĂ©gritĂ© corporelle de la personne concernĂ©e; f. la personne concernĂ©e a rendu les donnĂ©es accessibles Ă  tout un chacun et elle ne s’est pas opposĂ©e formellement au traitement; g. la communication a lieu au sein d’une mĂȘme personne morale ou sociĂ©tĂ© ou entre des personnes morales ou sociĂ©tĂ©s rĂ©unies sous une direction unique, dans la mesure oĂč les parties sont soumises Ă  des rĂšgles de protection des donnĂ©es qui garantissent un niveau de protection adĂ©quat. 3 Le PrĂ©posĂ© fĂ©dĂ©ral Ă  la protection des donnĂ©es et Ă  la transparence (prĂ©posĂ©, art. 26) doit ĂȘtre informĂ© des garanties donnĂ©es visĂ©es Ă  l’al. 2, let. a, et des rĂšgles de protection des donnĂ©es visĂ©es Ă  l’al. 2, let. g. Le Conseil fĂ©dĂ©ral rĂšgle les modalitĂ©s du devoir d’information." If you want more information, I let you consult the law online : [Fedlex](https://www.fedlex.admin.ch/eli/cc/1993/1945_1945_1945/fr) ---
**Author:** ![Agnes\_de\_Lion](https://tosdr.community/user_avatar/tosdr.community/agnes_de_lion/32/263_2.png) [@Agnes\_de\_Lion](https://tosdr.community/u/Agnes_de_Lion)\ **Post date:** [May 2, 2021, 1:22pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/11 "2021-05-02T13:22:44Z")
It isn’t completely transborders then, but protects its users somehow against data transfers outside Switzerland. I’ve never seen Privacy Policies claiming to be compliant to Swiss laws, though đŸ€” ---
**Author:** ![lxda](https://tosdr.community/user_avatar/tosdr.community/lxda/32/741_2.png) [@lxda](https://tosdr.community/u/lxda)\ **Post date:** [May 2, 2021, 1:25pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/12 "2021-05-02T13:25:29Z")
You have Protonmail, ProtonVPN and all of the Swiss administration at least, and I see them from time to time. In fact I’m swiss and for me It is important this law. I believe that the Swiss data protection law is one of the strictest in the world but not sure ---
**Author:** ![Agnes\_de\_Lion](https://tosdr.community/user_avatar/tosdr.community/agnes_de_lion/32/263_2.png) [@Agnes\_de\_Lion](https://tosdr.community/u/Agnes_de_Lion)\ **Post date:** [May 2, 2021, 4:58pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/13 "2021-05-02T16:58:54Z")
Indeed, and we have a case for jurisdictions with strong privacy laws: [Terms of Service; Didn't Read - Phoenix](https://edit.tosdr.org/cases/241) What I meant, is that no service outside Switzerland claims being compliant to Swiss Laws, while services outside the EU may try to be compliant with European laws so that they can provide services to users in the EU. ---
**Author:** ![KnossosDomovoi](https://tosdr.community/user_avatar/tosdr.community/knossosdomovoi/32/124_2.png) [@KnossosDomovoi](https://tosdr.community/u/KnossosDomovoi)\ **Post date:** [May 2, 2021, 5:05pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/14 "2021-05-02T17:05:35Z")
> [@Agnes\_de\_Lion](#): > > What I meant, is that no service outside Switzerland claims being compliant to Swiss Laws, while services outside the EU may try to be compliant with European laws so that they can provide services to users in the EU. Does that also happen in regards to CCPA for Californian users? Could you give an example of a service not in Californa that claims to be compliant with CCPA? ---
**Author:** ![Agnes\_de\_Lion](https://tosdr.community/user_avatar/tosdr.community/agnes_de_lion/32/263_2.png) [@Agnes\_de\_Lion](https://tosdr.community/u/Agnes_de_Lion)\ **Post date:** [May 2, 2021, 5:10pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/15 "2021-05-02T17:10:42Z")
By searching on ToS;DR database, I’ve found for instance [Discogs](https://edit.tosdr.org/services/603) for which the court governing is in the state of Oregon and not California, and yet provides a [California Privacy Notice](https://support.discogs.com/hc/en-us/articles/360039846494-California-Privacy-Notice). Same for [the New York Times](https://edit.tosdr.org/services/727) ([The New York Times Company Privacy Policy - The New York Times Help Center](https://www.nytimes.com/privacy/california-notice)) ---
**Author:** ![KnossosDomovoi](https://tosdr.community/user_avatar/tosdr.community/knossosdomovoi/32/124_2.png) [@KnossosDomovoi](https://tosdr.community/u/KnossosDomovoi)\ **Post date:** [May 2, 2021, 6:05pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/16 "2021-05-02T18:05:34Z")
Thanks for the example @Agnes_de_Lion, that’s very interesting indeed. In regard to your proposal of conflating GDPR and LGPD in the same case, if the reasoning is just from the similarity between the two laws, I would advise against it. While the GDPR served as inspiration and motivation for the LGPD, there are some important differences. Like, for instance, [the blanket exemption](https://revistaforum.com.br/debates/os-bancos-implantaram-um-backdoor-na-lgpd-por-deivi-kuhn/) given in the LGPD for financial institutions and credit bureaus. I suggest that, when we can find an example of a service not originating from Brazil that claims compliance with the LGPD, then we create a new case for the LGPD. ---
**Author:** ![Agnes\_de\_Lion](https://tosdr.community/user_avatar/tosdr.community/agnes_de_lion/32/263_2.png) [@Agnes\_de\_Lion](https://tosdr.community/u/Agnes_de_Lion)\ **Post date:** [May 2, 2021, 6:29pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/18 "2021-05-02T18:29:24Z")
[The Endurance International Group](https://edit.tosdr.org/services/2376) is governed by the laws of Massachusetts and yet has a [Privacy Policy](https://edit.tosdr.org/documents/2968) specially for users in Brazil. I’m creating the case then! [Terms of Service; Didn't Read - Phoenix](https://edit.tosdr.org/cases/483) ---
**Author:** ![lxda](https://tosdr.community/user_avatar/tosdr.community/lxda/32/741_2.png) [@lxda](https://tosdr.community/u/lxda)\ **Post date:** [May 9, 2021, 5:57pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/20 "2021-05-09T17:57:12Z")
Coming back to the Swiss data protection law, I found a service based in California that makes a difference for Swiss residents. > If you are a resident in Switzerland, the contact details for the data protection authorities are available here: [Welcome to the FDPIC](https://www.edoeb.admin.ch/edoeb/en/home.html). > **[Terms of Service; Didn't Read - Phoenix](https://edit.tosdr.org/services/2804)** > > I have read and understood the terms of service is the biggest lie on the Internet. We aim to fix that. ---
**Author:** ![Agnes\_de\_Lion](https://tosdr.community/user_avatar/tosdr.community/agnes_de_lion/32/263_2.png) [@Agnes\_de\_Lion](https://tosdr.community/u/Agnes_de_Lion)\ **Post date:** [May 9, 2021, 6:00pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/21 "2021-05-09T18:00:04Z")
They don’t give more rights to Swiss residents, they only provide a specific contact form
 ---
**Author:** ![lxda](https://tosdr.community/user_avatar/tosdr.community/lxda/32/741_2.png) [@lxda](https://tosdr.community/u/lxda)\ **Post date:** [May 9, 2021, 6:02pm UTC](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775/22 "2021-05-09T18:02:19Z")
oke oke, so much for me Sorry [Next page](https://tosdr.community/t/case-proposal-the-service-claims-to-be-gdpr-compliant-for-european-users/1775.md?page=2)