For anyone wondering how Google could make that mistake:

- Talk to your data engineers more often: they knew that would happen and they need your shoulder to cry on. Don’t mention “disputed territories” and time zones unless they feel in a safe place.

- Several places are not fully independent countries but are somewhat sovereign. They tend to be listed in lists of ‘countries,’ which is really a list of *‘polities’*. “Polities” include distinctions like the Åland Islands being distinct from mainland Finland. Corsica, Sardinia, and Sicily are often not on those lists, despite all having a solid national identity, so those are not always great lists of polities either. And those lists often include military and scientific bases afar, like Antarctic bases and the International Space Station, so… There’s no clear name for it. Essentially, it’s a list of what comes out of a GeoIP lookup.

Like Åland, French Polynesia, French Guyana, Reunion Island, both Saint-Martins (French and Dutch), Azores, and Greenland are all polities with very interesting statuses around the EU. Staying “near” the EU, some scientific bases and areas with hardly any population on that list of polities, too: Kerguelen, French Austral Territory, Tristan de Cunha, etc. Those are more curiosities to give content fodder for Wendover Production and administrative exams than actual legal risks for Google, but I thought I’d pile up, to help you develop empathy for Data engineers building privacy filters.

The point is: there is no “mainland Finland” in the list of polities: just “Finland — FI” one of 27 members of the EU. “French Polynesia - FP”, “French Guyana - FG” and all the others mentioned above are not on that list of 27 country codes either. Therefore, any territory in the EU but listed as a polity might get excluded from hastily configured EU filters, like what Google seems to have made. I would assume that GPDR does apply to most of the places I mentioned, making the mistake that Google made common among all those edge cases.

rikkuri, you are not alone.

France seems to be being most of those headaches. However, both the US (with Porto Rico, Guam, and more) and the UK are impressive specialists in confusing sovereignty): the Faroe Islands, the Isle of Man, Guernsey, and Jersey all used to be somehow in the EU, but not when the UK was in. Northern Ireland is probably the most heated situation of all those. I will not go into the nightmare that is deciding between UK, or GB, or one of EN, SC, WA, and NI.

Andorra, Monaco, Vatican, San Marino, and Liechtenstein are generally considered outside, or “observers,” of the EU but in the EEA (those countries plus Norway). Pro-tip: EEA is de facto the relevant grouping in most cases.

More importantly, all those places plus many rather large actual countries (Canada, Switzerland, Japan, Israel, New Zealand, South Korea, and Argentina) have privacy rules that are equivalent to the EU’s and have been granted “adequacy” status. I’d expect all those need to be excluded from Bard for the same reason but many are not… Curious.

https://commission.europa.eu/law/law-topic/data-protection/i... to be

Overall, that makes a much longer and more complicated list than 27 country codes.