Another consequence could be that GDPR severely restricts access to technology for EU residents and companies. The technology industry is practically defined by the Two-People-in-a-Garage trope. The vast majority of of the 3,122,110 apps in the iTunes AppStore  1. Are created by small companies and 2. Collect a lot of personal information. Every internet startup dreams of getting their first million users and they get there by going viral with inexpensive, often free software. Their model is collect info and use Big Data to extract value.

But now they will fall under GDPR because they will have personal data on EU residents. The definition of personal data includes IP address, geolocation, home address, email address, and on and on.

One way to avoid the cost of compliance, of hiring a DPO ($150K), building in controls, creating a 72 hour breach notification ability, is just don’t collect data on EU residents. Make them click a button asserting that they do not reside in the EU before installing.  Or use geo-location to block them altogether.

This means the EU will be cutting itself off from the latest and greatest technology. Want to install the newest secure communications app? Sorry. How about that new business app for managing contacts, or accounting? Not available in the EU. That new VR/AR game that is taking the world by storm? Sorry, only people outside the EU get to experience it.


I predict even tech startups based in the EU will choose to sell only to foreign markets when they launch.

This is a major problem for the EU. It will be disruptive in the extreme and add new digital borders that the internet does not need. GDPR will accelerate the trend towards digital mercantilism.

Richard Stiennon has covered the IT security industry for 17 years. He is Chief Research Analyst at IT-Harvest. Follow him on Twitter @cyberwar