7 ms·

Block all European IPs. It's just not worth the risk.

by aantix 9y ago

pdimitar 9y ago
I admit that I'd do that. Lowest friction solution. I don't want law enforcement agencies knocking on my door because I host a hobby project on a free / $5 tier VPS for years. My intent isn't malicious. I simply don't want to invest in more maintenance. Hence I'd block EU, yes.
- Sacho 9y ago
  Do you also block all US IPs to avoid patent infringement claims? What makes you think the GDPR is broader in scope than the patents the USPTO hands out? In the patents' case, there is even a direct financial incentive for companies to sue you, whereas in the GPDR the interest of the regulatory body is primarily compliance.
- lagadu 9y ago
  That won't completely protect you, it would only greatly reduce your surface of exposure; the eu user could still reach you via a vpn or simply sign up while vising the US.
  - chii 9y ago
    Ask if user is European, and if they answered yes, deny them service. If they lie, then you have plausible deniability to mistreat their data. Users of free services will just set their country to non-EU, and continue to consume the services. GDPR will gave achieved nothing in that case.
acct1771 9y ago
If you have no presence in the EU, to what sort of "risk" do you refer?
- joering2 9y ago
  I havent read the papers but only few online summaries, but each mentions very strongly that GDPR directive are not limited to you running business or webste in EU zine. You need to implement GDPR if someone in Australia is using European IP. You also should assume that signup IS EUROPEAN if you havent given them the chance to say otherwise on your registration form. For example European citizen can visit your US based website when he/she visits USA, sign up then go home. Since she/he is EU citizen, you need full complience on your end. Or face €20 mil fine (I assume your startup is not making more than that off of 4% revenue)
  - newman8r 9y ago
    so would it be sufficient to add a line to the TOS checkbox label: "I affirm that I am not a citizen of a EU-affiliated country" that seems simple enough - I think I'll add that to the projects I'm working on.
    - joering2 9y ago
      Not enough. You also need a screenshoot of the form they completed and you need to keep it on file. There is so much info I read on this today I closed the article but it said that their ticked-box consent and IP is not sufficient.
      - tscs37 9y ago
        You don't necessarily need a screenshot, a copy of the webpage the user saw would IMO be sufficient. You need to be able to show the user agreed and what they agreed to exactly. A screenshot might do that but might also not be sufficient (if there is more text elsewhere on the signup process related to privacy)
        AlgorithmicTime 9y ago
        Are you a lawyer specializing in EU privacy laws?
evrydayhustling 9y ago
The regulation is about capturing data of EU citizens, regardless of what IP they reach you from -- so this won't keep you safe.
- tzs 9y ago
  That's not what it says. See Article 3 [1], and the accompanying recitals. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
  - kasey_junk 9y ago
    Note that the regulation talks about where the requester is, not where they report to be. Some legitimate experts have concluded that this wording allows someone in the EU using a vpn they reports them as coming from outside the EU to be covered. That seems like a low risk incident to me, but I’m not a lawyer & I can see where that interpretation comes from.
  - evrydayhustling 9y ago
    No, those recitals are exactly what make my point. Numbers 23 and 24 of the accompanying recitals on that page state that, even if you are not established in the EU, if you profile people "within the EU", the regulation claims to apply. "Within" is a physical location, so arguing that IP block associated with request is a perfect proxy is at best a legal grey area. For example, an EU citizen could use a VPN to access your services and then send you a data request. See here for discussion: https://www.gdpr360.com/gdpr-ip-addresses-and-classification-theory-and-practice https://www.gdpr360.com/gdpr-ip-addresses-and-classification... If this seems like a low risk incident, consider that there are litigious people inside the EU (as everywhere) that may actively explore the boundaries of the law.
    - tzs 9y ago
      Careful. You were talking about capturing data in the comment I responded to. Now you are talking about profiling. These are distinct things under GDPR, with different rules. Profiling data subjects in the EU is covered, regardless of where the processor/controller is located. If you are processing personal data but not profiling and you are not established in the union it only applies if the processing is related to the offering of goods and services to data subjects in the Union. For those who are not profiling, blocking EU IP addresses should help establish that they were not envisaging offering goods and services in the Union.

Block all European IPs. It's just not worth the risk.

by aantix 9y ago

Block all European IPs. It's just not worth the risk.

I admit that I'd do that. Lowest friction solution. I don't want law enforcement agencies knocking on my door because I host a hobby project on a free / $5 tier VPS for years. My intent isn't malicious. I simply don't want to invest in more maintenance. Hence I'd block EU, yes.

Sacho 9y ago
Do you also block all US IPs to avoid patent infringement claims? What makes you think the GDPR is broader in scope than the patents the USPTO hands out? In the patents' case, there is even a direct financial incentive for companies to sue you, whereas in the GPDR the interest of the regulatory body is primarily compliance.
lagadu 9y ago
That won't completely protect you, it would only greatly reduce your surface of exposure; the eu user could still reach you via a vpn or simply sign up while vising the US.
- chii 9y ago
  Ask if user is European, and if they answered yes, deny them service. If they lie, then you have plausible deniability to mistreat their data. Users of free services will just set their country to non-EU, and continue to consume the services. GDPR will gave achieved nothing in that case.

acct1771 9y ago

If you have no presence in the EU, to what sort of "risk" do you refer?

joering2 9y ago
I havent read the papers but only few online summaries, but each mentions very strongly that GDPR directive are not limited to you running business or webste in EU zine. You need to implement GDPR if someone in Australia is using European IP. You also should assume that signup IS EUROPEAN if you havent given them the chance to say otherwise on your registration form. For example European citizen can visit your US based website when he/she visits USA, sign up then go home. Since she/he is EU citizen, you need full complience on your end. Or face €20 mil fine (I assume your startup is not making more than that off of 4% revenue)
- newman8r 9y ago
  so would it be sufficient to add a line to the TOS checkbox label: "I affirm that I am not a citizen of a EU-affiliated country" that seems simple enough - I think I'll add that to the projects I'm working on.
  - joering2 9y ago
    Not enough. You also need a screenshoot of the form they completed and you need to keep it on file. There is so much info I read on this today I closed the article but it said that their ticked-box consent and IP is not sufficient.
    - tscs37 9y ago
      You don't necessarily need a screenshot, a copy of the webpage the user saw would IMO be sufficient. You need to be able to show the user agreed and what they agreed to exactly. A screenshot might do that but might also not be sufficient (if there is more text elsewhere on the signup process related to privacy)
      - AlgorithmicTime 9y ago
        Are you a lawyer specializing in EU privacy laws?

evrydayhustling 9y ago

The regulation is about capturing data of EU citizens, regardless of what IP they reach you from -- so this won't keep you safe.

tzs 9y ago
That's not what it says. See Article 3 [1], and the accompanying recitals. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
- kasey_junk 9y ago
  Note that the regulation talks about where the requester is, not where they report to be. Some legitimate experts have concluded that this wording allows someone in the EU using a vpn they reports them as coming from outside the EU to be covered. That seems like a low risk incident to me, but I’m not a lawyer & I can see where that interpretation comes from.
- evrydayhustling 9y ago
  No, those recitals are exactly what make my point. Numbers 23 and 24 of the accompanying recitals on that page state that, even if you are not established in the EU, if you profile people "within the EU", the regulation claims to apply. "Within" is a physical location, so arguing that IP block associated with request is a perfect proxy is at best a legal grey area. For example, an EU citizen could use a VPN to access your services and then send you a data request. See here for discussion: https://www.gdpr360.com/gdpr-ip-addresses-and-classification-theory-and-practice https://www.gdpr360.com/gdpr-ip-addresses-and-classification... If this seems like a low risk incident, consider that there are litigious people inside the EU (as everywhere) that may actively explore the boundaries of the law.
  - tzs 9y ago
    Careful. You were talking about capturing data in the comment I responded to. Now you are talking about profiling. These are distinct things under GDPR, with different rules. Profiling data subjects in the EU is covered, regardless of where the processor/controller is located. If you are processing personal data but not profiling and you are not established in the union it only applies if the processing is related to the offering of goods and services to data subjects in the Union. For those who are not profiling, blocking EU IP addresses should help establish that they were not envisaging offering goods and services in the Union.