7 ms·

>and you'll have to engage with it on those terms Or you can just disengage with Europe all together, which is an obvious choice for many small to medium sized

>and you'll have to engage with it on those terms Or you can just disengage with Europe all together, which is an obvious choice for many small to medium sized companies, given the risks and costs involved.

downandout 8y ago
That's what we've chosen to do. The reality is that most businesses outside the EU will wind up blocking EU traffic, simply because they don't want the liability.
- AmericanChopper 8y ago
  Same here. EU makes up such a small amount of or customer base, and EU customers spend far less money with us. Which is generally true in most industries, US consumers spend far more than consumers anywhere else in the world. If we ever choose to enter the EU again, it will be a careful and deliberate choice, and will likely only ever happen if our growth slows in other regions.
  - dboreham 8y ago
    As a formerly European person running internet companies in the USA this baffles me. Why the teeth gnashing over being told not to spy on your users?
    - downandout 8y ago
      GDPR and “not spying on your users” are not even remotely related. GDPR is a massive regulation requiring significant resources that most small businesses simply don’t have.
      - dboreham 8y ago
        Can you list one or two of those "significant resources" you need and tell us why you need them, and didn't need them last year?
        downandout 8y ago
        Insurance to cover the liability of GDPR fines, massive legal fees, and development time to name a few.
        dboreham 8y ago
        Surely you already had "cyber" coverage on your general liability policy, right, since you are handling users' data? I haven't been notified of any changes in premium for our policy related to the new regulations, fwiw. Massive legal fees for what, exactly?
        Mirioron 8y ago
        >I haven't been notified of any changes in premium for our policy related to the new regulations, fwiw. I don't see how you can legitimately believe that there is not going to be an increase in costs. Either the insurance company was overcharging you before, they're lowering their margins or the price goes up. Anything else would require that the risk would be basically non-existent. The price might not increase right now, but it might increase next year or the year after that or the service might get worse. >Massive legal fees for what, exactly? To deal with situations that you didn't expect to happen, but did happen anyway. Even if you try your best, mistakes can happen.
    - AmericanChopper 8y ago
      We’ve got a great privacy policy, and don’t abuse our customers data in any way. However compliance would be very expensive for us, largely due to some of our early architecture decisions. The liability is also insane, and we don’t want anything to do with it. When we looked at how little our EU customers were worth to us, it was a very easy decision to simply abandon them.
      - jiveturkey 8y ago
        so you say. if you don’t have strong processes to make sure that is true, it isn’t true. gdpr is mostly about ensuring you have such processes. if you can’t do things such as tell the user what data you have, and delete it, you do not have a great policy. methinks you need some advice from better counsel. i bet that you are closer to compliant than you think.
        AmericanChopper 8y ago
        Do you actually think the only way to respect users privacy is to comply with GDPR? That is an absurd and narrow minded opinion. Do you also actually believe that the entire regulation is reflected in your two line comment? Listen, you’ve said higher up the thread that you are plan to spread FUD about all companies that don’t comply with GDPR as a marketing strategy for your own product. I don’t see how anybody here could possibly take you seriously. GDPR is going to have a lot of unintended consequences, and people aren’t going to be happy with all of them. One of them is that small to medium sized companies will reconsidering doing business in the EU, another is that the scope of the legislation is especially anti-competitive for small EU based businesses. There’s been a lot of FUD going around HN recently that the only reasons a company would plan to pull out of the EU are hysteria and malevolence. That’s not true, and for many companies this is just a simple business decision.
        DanBC 8y ago
        > That’s not true, and for many companies this is just a simple business decision. But likely based on incorrect advice. You haven't said why you think your company isn't compliant with GDPR, and it's possible your company is compliant with GDPR, or would require only minor tweaks to privacy policies to make it compliant.
    - Grue3 8y ago
      This argument makes about as much sense as "if you have nothing to hide, you have nothing to fear" in support of surveillance laws. Presumption of guilt is a terrible rule to live by.
      - dboreham 8y ago
        Actually your argument makes no sense because it amounts to : I am honest therefore there is no need for laws. Thousands of years of human history suggests you are wrong.
  - dalore 8y ago
    One could read this as you're being dodgy with your user data. If you were reasonable with the data in the first place, then compliance costs nothing.
    - apple4ever 8y ago
      That doesn’t compute. There is a difference between what GDPR says is okay with user data and what is actually okay with user data. We may be reasonable with user data, but either disagree with a portion of GDPR (like IP addresses) or do not have the time or money to very we comply.
      - dalore 8y ago
        Still don't understand the issue. IP addresses are being kept private like with all the other user details right? You still can have web logs with ip addresses without needing consent. And also (as stated in numerous places) that you won't get hit with fines. If you aren't compliant (and it would take a big violation to get their notice) you are given ample time to comply. Or you could in your case if you really are violating it flagrantly then you could just block access to EU. But you would have to a big violater. So if you look at a prisoners dilemma outline you've got: - you are violating / you block EU: outcome is no market access to EU - you are violating / you don't block EU: you have access to the market and if you are caught violating you got ample time to change or you can just block EU and you're in the same boat as before - you aren't violating / you block EU: you just blocked access for no reason and losing out on a market - you aren't violating / you don't block EU: You have access to the market So if you don't know you're violating or you wonder about the IP address and weblogs issue which is minor, then the prisoners dilemma show that best go with continue as normal. There is no case were you would be hit with big fines.
  - Animats 8y ago
    In most industries, US consumers spend far more than consumers anywhere else in the world. Not any more. China's citizens spend twice as much on international tourism as US citizens do. The EU has 508 million people. The US has 325 million.
    - AmericanChopper 8y ago
      The GDP, the consumer spending market and the consumer spending per household is all higher in the US than the EU. You can cherry pick out a few industries where other countries spend more than the US, but it's still the most valuable market by far in most industries.
phyzome 8y ago
Good lord, it's like you didn't read the article. Or, you're fine with a competitor who isn't afraid of entirely reasonable international laws coming in and eating your lunch.
- AmericanChopper 8y ago
  We ran the numbers on how much it would cost to establish compliance, and with that alone it was barley worth it based on the current EU customer base we have. We also considered all the additional liability we’d be taking on, and with that alone it was barely worth it based on the current EU customer base we have. We’d also be very happy if one of our competitors started investing in the EU market. It’s worth about 10 times less than the US market in our industry, so having them chasing peanuts in Europe (and investing in compliance with European - absolutely not international - regulations) would be a truely fantastic outcome for us.
  - M2Ys4U 8y ago
    I find it amazing so many companies are willing to advertise the fact that they will abuse their customers in the way you are doing right now.
    - AmericanChopper 8y ago
      Where did I advertise misuse of our customers data? Compliance and privacy are not the same thing, just like compliance and security are not the same thing. We have a great privacy policy and we don’t misuse our customers data in any way. For us, it didn’t make sense to invest the amount of money we’d have to to establish compliance with the GDPR, or to invest in maintaining that compliance, and the liability that GDPR would introduce for us most certainly didn’t make sense. Europe is worth almost nothing to us, we don’t market ourselves there because it’s a waste of money. The EU customers we have all sought us out, not the other way around. For us, the cost and liability is simply not worth it. I think you’ll start to see more businesses make this decision, based on facts and numbers. You can’t just cry that they’re all being hysterical or want to abuse they’re customers data and privacy. When you introduce expensive new regulations, that have very strong punitive elements, this is exactly what you’d expect to happen. Small to medium sized businesses will wear the most of the cost (while posing the least of the risk). Luckily for us, EU is worth close to nothing for us.
salvar 8y ago
Then they can just do that. I'm sure other companies will be happy to scoop up that business.
- AmericanChopper 8y ago
  We’d be quite happy if that happened. Seeing our competitors investing in Europe would simply mean less competition in markets with much greater growth.
  - salvar 8y ago
    Sounds like that's a solution everyone can be happy with!
merinowool 8y ago
It is not possible, unless you'll check id and residence certificate of all visitors. Blocking EU IP is not sufficient.
- 0care 8y ago
  I am having a hard time seeing how EU judgements will be enforceable in the US?
  - merinowool 8y ago
    Probably they will not be - but there are cases of extradition of EU citizens to the US for various crimes like hacking. Who knows, maybe it will happen the other way around or some people will have to take holidays in the EU off the list.
  - apple4ever 8y ago
    I was really wondering that as well. Can we be held accountable? It would be nice if the GDPR had a piece about “if a company refuses sales, even if they accidentally happen, the company isn’t liable” and/or “blocking EU IPs or redirecting to a no sale page is sufficient to avoid compliance”.
- DanBC 8y ago
  This is, yet again, untrue. https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/ > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. 3Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. By blocking EU IPs the service is very clearly, unambiguously, not targetting EU residents.
ric2b 8y ago
A bunch of companies are going to do this and then regret it when they notice that their competitors really didn't have to do much work to become compliant. Then they'll try to come back... after their EU user-base was kicked out and forced to find alternatives.
- apple4ever 8y ago
  That’s assuming that a competitor can make it cost effective. If the original business couldn’t, its unlikely the competitor could. I know in my business I’m shutting off EU sales.
  - _Tev 8y ago
    > If the original business couldn’t, its unlikely the competitor could. Considering amount of FUD spread about fines, even here, with fairly educated readership - I don't think you can really trust other people's cost / benefit analysis, even when they happen to have same variables with same values. People are often wrong even in much clearer cases . . .

downandout 8y ago

That's what we've chosen to do. The reality is that most businesses outside the EU will wind up blocking EU traffic, simply because they don't want the liability.

AmericanChopper 8y ago
Same here. EU makes up such a small amount of or customer base, and EU customers spend far less money with us. Which is generally true in most industries, US consumers spend far more than consumers anywhere else in the world. If we ever choose to enter the EU again, it will be a careful and deliberate choice, and will likely only ever happen if our growth slows in other regions.
- dboreham 8y ago
  As a formerly European person running internet companies in the USA this baffles me. Why the teeth gnashing over being told not to spy on your users?
  - downandout 8y ago
    GDPR and “not spying on your users” are not even remotely related. GDPR is a massive regulation requiring significant resources that most small businesses simply don’t have.
    - dboreham 8y ago
      Can you list one or two of those "significant resources" you need and tell us why you need them, and didn't need them last year?
      - downandout 8y ago
        Insurance to cover the liability of GDPR fines, massive legal fees, and development time to name a few.
        dboreham 8y ago
        Surely you already had "cyber" coverage on your general liability policy, right, since you are handling users' data? I haven't been notified of any changes in premium for our policy related to the new regulations, fwiw. Massive legal fees for what, exactly?
        Mirioron 8y ago
        >I haven't been notified of any changes in premium for our policy related to the new regulations, fwiw. I don't see how you can legitimately believe that there is not going to be an increase in costs. Either the insurance company was overcharging you before, they're lowering their margins or the price goes up. Anything else would require that the risk would be basically non-existent. The price might not increase right now, but it might increase next year or the year after that or the service might get worse. >Massive legal fees for what, exactly? To deal with situations that you didn't expect to happen, but did happen anyway. Even if you try your best, mistakes can happen.
  - AmericanChopper 8y ago
    We’ve got a great privacy policy, and don’t abuse our customers data in any way. However compliance would be very expensive for us, largely due to some of our early architecture decisions. The liability is also insane, and we don’t want anything to do with it. When we looked at how little our EU customers were worth to us, it was a very easy decision to simply abandon them.
    - jiveturkey 8y ago
      so you say. if you don’t have strong processes to make sure that is true, it isn’t true. gdpr is mostly about ensuring you have such processes. if you can’t do things such as tell the user what data you have, and delete it, you do not have a great policy. methinks you need some advice from better counsel. i bet that you are closer to compliant than you think.
      - AmericanChopper 8y ago
        Do you actually think the only way to respect users privacy is to comply with GDPR? That is an absurd and narrow minded opinion. Do you also actually believe that the entire regulation is reflected in your two line comment? Listen, you’ve said higher up the thread that you are plan to spread FUD about all companies that don’t comply with GDPR as a marketing strategy for your own product. I don’t see how anybody here could possibly take you seriously. GDPR is going to have a lot of unintended consequences, and people aren’t going to be happy with all of them. One of them is that small to medium sized companies will reconsidering doing business in the EU, another is that the scope of the legislation is especially anti-competitive for small EU based businesses. There’s been a lot of FUD going around HN recently that the only reasons a company would plan to pull out of the EU are hysteria and malevolence. That’s not true, and for many companies this is just a simple business decision.
        DanBC 8y ago
        > That’s not true, and for many companies this is just a simple business decision. But likely based on incorrect advice. You haven't said why you think your company isn't compliant with GDPR, and it's possible your company is compliant with GDPR, or would require only minor tweaks to privacy policies to make it compliant.
  - Grue3 8y ago
    This argument makes about as much sense as "if you have nothing to hide, you have nothing to fear" in support of surveillance laws. Presumption of guilt is a terrible rule to live by.
    - dboreham 8y ago
      Actually your argument makes no sense because it amounts to : I am honest therefore there is no need for laws. Thousands of years of human history suggests you are wrong.
- dalore 8y ago
  One could read this as you're being dodgy with your user data. If you were reasonable with the data in the first place, then compliance costs nothing.
  - apple4ever 8y ago
    That doesn’t compute. There is a difference between what GDPR says is okay with user data and what is actually okay with user data. We may be reasonable with user data, but either disagree with a portion of GDPR (like IP addresses) or do not have the time or money to very we comply.
    - dalore 8y ago
      Still don't understand the issue. IP addresses are being kept private like with all the other user details right? You still can have web logs with ip addresses without needing consent. And also (as stated in numerous places) that you won't get hit with fines. If you aren't compliant (and it would take a big violation to get their notice) you are given ample time to comply. Or you could in your case if you really are violating it flagrantly then you could just block access to EU. But you would have to a big violater. So if you look at a prisoners dilemma outline you've got: - you are violating / you block EU: outcome is no market access to EU - you are violating / you don't block EU: you have access to the market and if you are caught violating you got ample time to change or you can just block EU and you're in the same boat as before - you aren't violating / you block EU: you just blocked access for no reason and losing out on a market - you aren't violating / you don't block EU: You have access to the market So if you don't know you're violating or you wonder about the IP address and weblogs issue which is minor, then the prisoners dilemma show that best go with continue as normal. There is no case were you would be hit with big fines.
- Animats 8y ago
  In most industries, US consumers spend far more than consumers anywhere else in the world. Not any more. China's citizens spend twice as much on international tourism as US citizens do. The EU has 508 million people. The US has 325 million.
  - AmericanChopper 8y ago
    The GDP, the consumer spending market and the consumer spending per household is all higher in the US than the EU. You can cherry pick out a few industries where other countries spend more than the US, but it's still the most valuable market by far in most industries.

phyzome 8y ago

Good lord, it's like you didn't read the article. Or, you're fine with a competitor who isn't afraid of entirely reasonable international laws coming in and eating your lunch.

AmericanChopper 8y ago
We ran the numbers on how much it would cost to establish compliance, and with that alone it was barley worth it based on the current EU customer base we have. We also considered all the additional liability we’d be taking on, and with that alone it was barely worth it based on the current EU customer base we have. We’d also be very happy if one of our competitors started investing in the EU market. It’s worth about 10 times less than the US market in our industry, so having them chasing peanuts in Europe (and investing in compliance with European - absolutely not international - regulations) would be a truely fantastic outcome for us.
- M2Ys4U 8y ago
  I find it amazing so many companies are willing to advertise the fact that they will abuse their customers in the way you are doing right now.
  - AmericanChopper 8y ago
    Where did I advertise misuse of our customers data? Compliance and privacy are not the same thing, just like compliance and security are not the same thing. We have a great privacy policy and we don’t misuse our customers data in any way. For us, it didn’t make sense to invest the amount of money we’d have to to establish compliance with the GDPR, or to invest in maintaining that compliance, and the liability that GDPR would introduce for us most certainly didn’t make sense. Europe is worth almost nothing to us, we don’t market ourselves there because it’s a waste of money. The EU customers we have all sought us out, not the other way around. For us, the cost and liability is simply not worth it. I think you’ll start to see more businesses make this decision, based on facts and numbers. You can’t just cry that they’re all being hysterical or want to abuse they’re customers data and privacy. When you introduce expensive new regulations, that have very strong punitive elements, this is exactly what you’d expect to happen. Small to medium sized businesses will wear the most of the cost (while posing the least of the risk). Luckily for us, EU is worth close to nothing for us.

salvar 8y ago

Then they can just do that. I'm sure other companies will be happy to scoop up that business.

AmericanChopper 8y ago
We’d be quite happy if that happened. Seeing our competitors investing in Europe would simply mean less competition in markets with much greater growth.
- salvar 8y ago
  Sounds like that's a solution everyone can be happy with!

merinowool 8y ago

It is not possible, unless you'll check id and residence certificate of all visitors. Blocking EU IP is not sufficient.

0care 8y ago
I am having a hard time seeing how EU judgements will be enforceable in the US?
- merinowool 8y ago
  Probably they will not be - but there are cases of extradition of EU citizens to the US for various crimes like hacking. Who knows, maybe it will happen the other way around or some people will have to take holidays in the EU off the list.
- apple4ever 8y ago
  I was really wondering that as well. Can we be held accountable? It would be nice if the GDPR had a piece about “if a company refuses sales, even if they accidentally happen, the company isn’t liable” and/or “blocking EU IPs or redirecting to a no sale page is sufficient to avoid compliance”.
DanBC 8y ago
This is, yet again, untrue. https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/ > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. 3Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. By blocking EU IPs the service is very clearly, unambiguously, not targetting EU residents.

ric2b 8y ago

A bunch of companies are going to do this and then regret it when they notice that their competitors really didn't have to do much work to become compliant. Then they'll try to come back... after their EU user-base was kicked out and forced to find alternatives.

apple4ever 8y ago
That’s assuming that a competitor can make it cost effective. If the original business couldn’t, its unlikely the competitor could. I know in my business I’m shutting off EU sales.
- _Tev 8y ago
  > If the original business couldn’t, its unlikely the competitor could. Considering amount of FUD spread about fines, even here, with fairly educated readership - I don't think you can really trust other people's cost / benefit analysis, even when they happen to have same variables with same values. People are often wrong even in much clearer cases . . .