4 ms·

Is there any kind of blanket CYA waiver that we can put on sign-up pages like "if you're an EU citizen, sorry you can't use this site because GDPR. Definitely d

by teeray 9y ago

Is there any kind of blanket CYA waiver that we can put on sign-up pages like "if you're an EU citizen, sorry you can't use this site because GDPR. Definitely don't click 'sign up' below anyway" ? What is the opt-out criteria for a site?

filoleg 9y ago
Interested in finding this out as well. So far, not a single thread discussing GDPR on HN made this explicitly clear.
- dingo_bat 9y ago
  That's part of the fun. It is so ambiguous and vague that nobody is clear on the specifics.
  - izacus 9y ago
    It's only unambiguous to the people who don't want to refuse to understand it because they're making profit on selling out people's data.
    - Multicomp 9y ago
      That is a false choice. According to that, you A) love this law or B) exist only to profit off tracking pixels and JavaScript beacons mwa he ha Or it could be the people running 100-user-or-less sites are trying to see if they can just leave their sites up, ignore the "oh yeah, well your web server has IP addresses in your LOGS doesn't it!? Well guess what, OUR logs show an EU IP address, so you know what the letter of the law let's us do? €20 million fine, you data slurping fiend!!" frivolous lawsuits in hopes of keeping their little side project which while (maybe) technically noncompliant, aren't actually using the data for those nefarious purposes, only DDoS and spam mitigations.
- ehsankia 9y ago
  Here's an even dumber question. If you don't live in the EU and your site is not hosted there, do they have any legal power to get to you? What is the worst case scenario if you don't respond and don't pay any fines? Will they block your site from the EU or get your provider to take it down? What kind of power do they have to come at you?
  - isostatic 9y ago
    Same power the US has over enforcing its global laws (DMCA etc)
izacus 9y ago
No, waivers don't make personal data of EU disappear. Just like you can't put a waiver on front of a restaurant and start poisoning people with in unhygienic food, you also can't just waiver yourself away from being responsible with users data.
- fasteddie 9y ago
  However, they are making it clear they are not attempting to serve EU users. Which means they are not covered by GDPR.
  - SmellyGeekBoy 9y ago
    It doesn't matter who they are "attempting" to serve. If they hold data on any EU citizens they fall under GDPR.
    - tzs 9y ago
      That's off quite a bit. See https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
      - scandox 9y ago
        Can someone legal(ish) explain to me why this sentence is so poorly structured? > the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; I mean this should really be: > the offering of goods or services to such data subjects in the Union, irrespective of whether a payment of the data subject is required; I mean why put that sub-clause in the middle of the sentence to which it relates? Seems bizarre to me.

by teeray 9y ago

filoleg 9y ago

Interested in finding this out as well. So far, not a single thread discussing GDPR on HN made this explicitly clear.

dingo_bat 9y ago
That's part of the fun. It is so ambiguous and vague that nobody is clear on the specifics.
- izacus 9y ago
  It's only unambiguous to the people who don't want to refuse to understand it because they're making profit on selling out people's data.
  - Multicomp 9y ago
    That is a false choice. According to that, you A) love this law or B) exist only to profit off tracking pixels and JavaScript beacons mwa he ha Or it could be the people running 100-user-or-less sites are trying to see if they can just leave their sites up, ignore the "oh yeah, well your web server has IP addresses in your LOGS doesn't it!? Well guess what, OUR logs show an EU IP address, so you know what the letter of the law let's us do? €20 million fine, you data slurping fiend!!" frivolous lawsuits in hopes of keeping their little side project which while (maybe) technically noncompliant, aren't actually using the data for those nefarious purposes, only DDoS and spam mitigations.
ehsankia 9y ago
Here's an even dumber question. If you don't live in the EU and your site is not hosted there, do they have any legal power to get to you? What is the worst case scenario if you don't respond and don't pay any fines? Will they block your site from the EU or get your provider to take it down? What kind of power do they have to come at you?
- isostatic 9y ago
  Same power the US has over enforcing its global laws (DMCA etc)

izacus 9y ago

No, waivers don't make personal data of EU disappear. Just like you can't put a waiver on front of a restaurant and start poisoning people with in unhygienic food, you also can't just waiver yourself away from being responsible with users data.

fasteddie 9y ago
However, they are making it clear they are not attempting to serve EU users. Which means they are not covered by GDPR.
- SmellyGeekBoy 9y ago
  It doesn't matter who they are "attempting" to serve. If they hold data on any EU citizens they fall under GDPR.
  - tzs 9y ago
    That's off quite a bit. See https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
    - scandox 9y ago
      Can someone legal(ish) explain to me why this sentence is so poorly structured? > the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; I mean this should really be: > the offering of goods or services to such data subjects in the Union, irrespective of whether a payment of the data subject is required; I mean why put that sub-clause in the middle of the sentence to which it relates? Seems bizarre to me.