contract-law gdpr
Can a clause be added to a terms of use that forbids use of the service if the terms of use would be illegal in the user&#39;s jurisdiction?
<p>Can one add a clause stating</p>
<blockquote>
<p>Do not use this application if the terms demanded cannot be provided by law</p>
</blockquote>
<p>For example, let's say one term of use states that information collected may be retained forever, which is not possible in countries subject to the GDPR.  In this case, users would be required not to use the application.</p>

<h2>Yes, but ...</h2>
<p>It doesn’t protect you. Let’s imagine you put such a clause in and a person in Europe used your service notwithstanding: they’ve broken the contract but you’ve broken the law. You get the fine and they get ... nothing. Because you can’t contract outside the law you never had a valid contract with them so you have no basis to sue.</p>
<p>Further, because you are purporting to something you can’t legally do, you are probably on the wrong side of misleading and deceptive consumer protection law: which is another fine.</p>
<p>If you can <strong>ensure</strong> that you don’t breach local law - like by not operating over the internet - then you can choose not to deal with e.g. Europeans. If you can’t guarantee that, then you’re stuffed.</p>

<blockquote>
<p>Can a clause be added to a terms of use that forbids use of the service if the terms of use would be illegal in the user's jurisdiction?</p>
</blockquote>
<p>Yes, but that is redundant because contracts --or portions thereof-- which contravene the law are null and void.</p>
<blockquote>
<p>let's say one term of use states that information collected may be retained forever, which is not possible in countries subject to the GDPR</p>
</blockquote>
<p>That premise is mistaken in contexts which involve a <em>necessity for the performance of a contract</em>. See recital 40 and article 6.1(b) of the <a href="https://eur-lex.europa.eu/eli/reg/2016/679/oj" rel="noreferrer">GDPR</a>. That necessity needs to be true (see recital 43) and ongoing (<em>cf.</em> article 17.1(a)).</p>
<p>Likewise, data retention might be required for <em>compliance with a legal obligation to which the controller is subject</em>. See articles 6.1.(c) and 17.3(b)-(e). Depending on the context, the perpetual storing of data might be justifiable under the GDPR.</p>
<p>Accordingly, it is not necessary for the provider to exclude natural persons merely on grounds of the GDPR.</p>
