10 ms·

Explicitly banning Eurozone citizens from using the service is the easiest solution I have thought of.

by Sevii 9y ago

jacquesm 9y ago
The collective economic effect of that will be massive. Please do. And realize that you are ceding the single largest market to your competition.
- learc83 9y ago
  > single largest market The EU really isn't a single large market though for most practical purposes. For the purposes of complying with regulations and accepting payment it is, but for every other practical consideration that matters to a company doing business there, it's a few dozen separate markets.
  - notfromhere 9y ago
    and they're still in the eurozone, so banning eurozone users is still removing yourself from the largest economic bloc in the world
    - learc83 9y ago
      Are you arguing with my point or just trying to be contradictory? I never said blocking the EU was a good solution, but calling it a single market makes it sound more enticing than it is.
- Silhouette 9y ago
  The collective economic effect of that will be massive. Please do. And realize that you are ceding the single largest market to your competition. That doesn't necessarily follow. For example, EU but non-UK customers represent only a small fraction of the user base for one of my businesses. With hindsight, we would have done better to exclude those customers entirely, avoid spending time and money complying with ever-more-onerous EU rules, and invest that time and money in growing our business in more lucrative markets instead. It is entirely possible for the EU to make itself so unattractive as a market that this will be the case for others too. Indeed several of the near-future measures it is already working on may have exactly that effect. The saddest part is that those running the EU have so little idea about how small business works that they don't even realise they're doing it.
  - madez 9y ago
    It might be that the EU willingly rejects certain business. Maybe, if you aren't GDPR compliant, you are not wanted by the EU.
    - Silhouette 9y ago
      That would be a plausible theory if the EU even realised that many thousands of these smaller businesses exist, but as we learned with the VAT mess, they literally didn't.
      - jacquesm 9y ago
        Yes, the VAT mess definitely does not deserve the beauty prize but with the MOSS it is actually manageable. I've done it for a couple of years and as long as your IPSP cooperates it shouldn't be more than 15 minutes of work per quarter.
        Silhouette 9y ago
        I've done it for a couple of years and as long as your IPSP cooperates it shouldn't be more than 15 minutes of work per quarter. That might be true if you're lucky enough to have a single third-party payment service that collects all of your revenues including administering the VAT parts for you. Unfortunately, there are many reasons why that might not be the case or even possible. Even if you do use one of those services, it can't magically cope with all the edge cases any more than you or I can, and of course they tend to take an extra cut out of your revenue. For everyone who needs to manage their taxes a bit closer to home, it takes longer than your suggested time just to check the rates regularly in case some member state decided to increase them with about a week's notice again. There's not really any good answer to VAT MOSS, there are just more inconvenient and/or expensive and slightly less inconvenient and/or expensive.
        fyfy18 9y ago
        At least in the UK, HMRC email me whenever rates in a member country change, and they publish them online too: https://www.gov.uk/government/collections/vat-information-sheets https://www.gov.uk/government/collections/vat-information-sh...
- eadmund 9y ago
  Some people may find that a valuable trade-off, because the alternative would be to permit their customers to demand that they rewrite their logs at any time. I, personally, believe that logs should be fundamentally append-only, and thus will not be doing business with EU subjects (since the GDPR requires that I delete records from my logs on demand).
  - jacquesm 9y ago
    Guess what? The EU agrees with you. That's why the recommendation is that you strip PII from your logs for everybody. That way they can still be append only and you won't have to do any rewriting. > I, personally, believe that logs should be fundamentally append-only, and thus will not be doing business with EU subjects (since the GDPR requires that I delete records from my logs on demand). That statement does not hold a lot of force without a link to your business and how big a %age of your turnover you are willing to throw out.
    - eadmund 9y ago
      > That's why the recommendation is that you strip PII from your logs for everybody. The problem is that IP addresses — a fundamental requirement for an acceptable network logging system — are considered PII. If this were about things like names, dates of birth &c. then I'd be in full agreement. But considering an IP address personal information which must be deleted on demand is IMNSHO insane. > That statement does not hold a lot of force without a link to your business and how big a %age of your turnover you are willing to throw out. I'm just a guy, y'know? I'm not going to pretend that it would be easy or cheap for others to make the same decision. But it is easy & cheap for me.
      - jacquesm 9y ago
        For a network logging system yes. But for a commercial entity on the web: no. Beyond a class 'C' you're not going to get much mileage out of IP addresses, unless you're trying to track people without using cookies and that would be one very good reason why you should not be keeping those IP addresses in the first place. If you're an ISP that changes, in that case there is a retention requirement. But a regular business in the normal course of performing its expected activities has no business retaining IP addresses longer than necessary. If that to you is unacceptable because you want append-only logs that stretch back years then that's your choice. But if I had to choose between cutting off roughly half of my turnover because I didn't want to comply with the law or complying with the law and slightly re-arranging my logging then I'd happily pick the latter. So no need to delete on demand, simply don't store them longer than you feel you need to in order to meet your business goals. 30 days or so should do it. Six months or longer would require a detailed explanation. And most importantly: disclose what you do. That way your customers can make informed decisions and you won't look bad in the eyes of the law if they decide to decide on whether or not you meant to act in good faith or if you took to interpreting things in the way that suits you best.

Explicitly banning Eurozone citizens from using the service is the easiest solution I have thought of.

by Sevii 9y ago

Explicitly banning Eurozone citizens from using the service is the easiest solution I have thought of.

The collective economic effect of that will be massive. Please do. And realize that you are ceding the single largest market to your competition.

learc83 9y ago
> single largest market The EU really isn't a single large market though for most practical purposes. For the purposes of complying with regulations and accepting payment it is, but for every other practical consideration that matters to a company doing business there, it's a few dozen separate markets.
- notfromhere 9y ago
  and they're still in the eurozone, so banning eurozone users is still removing yourself from the largest economic bloc in the world
  - learc83 9y ago
    Are you arguing with my point or just trying to be contradictory? I never said blocking the EU was a good solution, but calling it a single market makes it sound more enticing than it is.
Silhouette 9y ago
The collective economic effect of that will be massive. Please do. And realize that you are ceding the single largest market to your competition. That doesn't necessarily follow. For example, EU but non-UK customers represent only a small fraction of the user base for one of my businesses. With hindsight, we would have done better to exclude those customers entirely, avoid spending time and money complying with ever-more-onerous EU rules, and invest that time and money in growing our business in more lucrative markets instead. It is entirely possible for the EU to make itself so unattractive as a market that this will be the case for others too. Indeed several of the near-future measures it is already working on may have exactly that effect. The saddest part is that those running the EU have so little idea about how small business works that they don't even realise they're doing it.
- madez 9y ago
  It might be that the EU willingly rejects certain business. Maybe, if you aren't GDPR compliant, you are not wanted by the EU.
  - Silhouette 9y ago
    That would be a plausible theory if the EU even realised that many thousands of these smaller businesses exist, but as we learned with the VAT mess, they literally didn't.
    - jacquesm 9y ago
      Yes, the VAT mess definitely does not deserve the beauty prize but with the MOSS it is actually manageable. I've done it for a couple of years and as long as your IPSP cooperates it shouldn't be more than 15 minutes of work per quarter.
      - Silhouette 9y ago
        I've done it for a couple of years and as long as your IPSP cooperates it shouldn't be more than 15 minutes of work per quarter. That might be true if you're lucky enough to have a single third-party payment service that collects all of your revenues including administering the VAT parts for you. Unfortunately, there are many reasons why that might not be the case or even possible. Even if you do use one of those services, it can't magically cope with all the edge cases any more than you or I can, and of course they tend to take an extra cut out of your revenue. For everyone who needs to manage their taxes a bit closer to home, it takes longer than your suggested time just to check the rates regularly in case some member state decided to increase them with about a week's notice again. There's not really any good answer to VAT MOSS, there are just more inconvenient and/or expensive and slightly less inconvenient and/or expensive.
        fyfy18 9y ago
        At least in the UK, HMRC email me whenever rates in a member country change, and they publish them online too: https://www.gov.uk/government/collections/vat-information-sheets https://www.gov.uk/government/collections/vat-information-sh...
eadmund 9y ago
Some people may find that a valuable trade-off, because the alternative would be to permit their customers to demand that they rewrite their logs at any time. I, personally, believe that logs should be fundamentally append-only, and thus will not be doing business with EU subjects (since the GDPR requires that I delete records from my logs on demand).
- jacquesm 9y ago
  Guess what? The EU agrees with you. That's why the recommendation is that you strip PII from your logs for everybody. That way they can still be append only and you won't have to do any rewriting. > I, personally, believe that logs should be fundamentally append-only, and thus will not be doing business with EU subjects (since the GDPR requires that I delete records from my logs on demand). That statement does not hold a lot of force without a link to your business and how big a %age of your turnover you are willing to throw out.
  - eadmund 9y ago
    > That's why the recommendation is that you strip PII from your logs for everybody. The problem is that IP addresses — a fundamental requirement for an acceptable network logging system — are considered PII. If this were about things like names, dates of birth &c. then I'd be in full agreement. But considering an IP address personal information which must be deleted on demand is IMNSHO insane. > That statement does not hold a lot of force without a link to your business and how big a %age of your turnover you are willing to throw out. I'm just a guy, y'know? I'm not going to pretend that it would be easy or cheap for others to make the same decision. But it is easy & cheap for me.
    - jacquesm 9y ago
      For a network logging system yes. But for a commercial entity on the web: no. Beyond a class 'C' you're not going to get much mileage out of IP addresses, unless you're trying to track people without using cookies and that would be one very good reason why you should not be keeping those IP addresses in the first place. If you're an ISP that changes, in that case there is a retention requirement. But a regular business in the normal course of performing its expected activities has no business retaining IP addresses longer than necessary. If that to you is unacceptable because you want append-only logs that stretch back years then that's your choice. But if I had to choose between cutting off roughly half of my turnover because I didn't want to comply with the law or complying with the law and slightly re-arranging my logging then I'd happily pick the latter. So no need to delete on demand, simply don't store them longer than you feel you need to in order to meet your business goals. 30 days or so should do it. Six months or longer would require a detailed explanation. And most importantly: disclose what you do. That way your customers can make informed decisions and you won't look bad in the eyes of the law if they decide to decide on whether or not you meant to act in good faith or if you took to interpreting things in the way that suits you best.