6 ms·

For sure, GDPR is causing headaches for companies that were secretly selling your data. But it's also a big problem for companies that were (perhaps sloppily) l

by eli 8y ago

For sure, GDPR is causing headaches for companies that were secretly selling your data. But it's also a big problem for companies that were (perhaps sloppily) logging & storing data for their own reasons or maybe even for no real reason. I think the latter is much more common than the former.

ghaff 8y ago
A lot of smaller sites don't necessarily know everything that they're collecting. Arguably, this is a good opportunity to figure that out. However, it's equally arguable that in many cases it's just easier to cut off EU access if there's any doubt and the EU just isn't important to their business (or hobby). If I ran a US centric ecommerce site, for example, I'd be very tempted to just stop selling in the EU for now.
- enginaar 8y ago
  What if EU citizens who are visiting US make purchases from your site?
  - ghaff 8y ago
    Almost certainly does not apply. [1] For that matter, the same FAQ suggests that it's probably not necessary to block IP addresses if you're not located in the EU and aren't actively marketing to EU residents. But I can certainly understand small companies taking a better safe than sorry approach if they don't do material EU business. [1] https://www.gdpreu.org/the-regulation/who-must-comply/ https://www.gdpreu.org/the-regulation/who-must-comply/
    - merinowool 8y ago
      It wouldn't apply if you explicitly ask user if he/she is an EU resident, preferably by checking ID and route to /dev/null if user is.
  - merinowool 8y ago
    It does apply. All EU residents are covered regardless where they are.
    - snowwolf 8y ago
      The misunderstanding of this is widespread. GDPR does not make any mention of EU citizens OR residents. It only says "data subjects who are IN the Union". See my other comment for more detail: https://news.ycombinator.com/item?id=17143923 https://news.ycombinator.com/item?id=17143923
      - merinowool 8y ago
        It is not defined what "who are in the Union" means. The safest bet is that it means a subject is European Union resident. If they mean that person should be physically present in the European Union, the law would have stated that, but it is not.
        snowwolf 8y ago
        Equally, if they had meant resident, they would have stated that.
        merinowool 8y ago
        "Resident" has a full scope of protection, whereas your interpretation has limited cover. I wouldn't have thought that GDPR would protect me only if I was physically in the EU territory - as if somehow once I stepped out of the EU my personal information is no longer worth protecting. Your interpretation makes no sense.
        snowwolf 8y ago
        I think you are missing some context here. Firstly if the company is established in the union then they need to be compliant for all their users no matter where they are [1] (so US resident, EU resident, whatever are equally protected). So the relevant section for this is: "This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union." So lets look at Amazon. They are a US company offering goods in the EU. So if you make a purchase from them as an EU resident (living in Germany) from amazon.de to your home address, then any personal data you give them as part of that purchase needs to be handled in a GDPR compliant way. If you now go on holiday to the US and order something from Amazon.com to be delivered to your hotel, even though you are an EU resident, they do not need to handle that personal data in a GDPR compliant way. But just because you are now in the US doesn't mean the data they hold on you about your purchase on amazon.de is suddenly free from GDPR protections. Or to put it another way. Imagine the law did mean EU resident. What does Amazon.com do? How do they ensure they process an order in the US to a US address in a GDPR compliant way for an EU resident? They can't without asking for additional data to establish each persons residency. Which GDPR doesn't allow. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
  - downandout 8y ago
    Recital 23 states that sites based outside the EU are not subject to GDPR unless it is apparent that they “envisage” the offering of their goods or services to EU residents. The test for this is translation to EU-only languages, mentioning of EU users, targeting EU users, using an EU based domain extension, etc. The easiest way to announce to the world that I do not “envisage” servicing EU customers is to block EU customers. If one happens to use a VPN or otherwise evades this block, it doesn’t matter. I’ve met the clear definitions under Recital 23 and you have no legal right to GDPR protections on my site.
- ryandrake 8y ago
  One could argue that "Aww shucks! Ya know, we're jus' a Small Mom'n'Pop Business™! We're too small to have any darned idea what all that data we're collectin' is!" is no longer a valid excuse. No more valid than "We're too small to worry about worker safety!" or "We're too small to know what's in the waste we're dumping out back!"
setquk 8y ago
This is the entire point of the GDPR really. It appears to be working.
eli 8y ago
I think there's also a sizable number of companies that basically were already compliant... but aren't sure. It's not like you can submit your processes to the EU for approval. You don't actually know if what you're doing is OK unless, some day, a regulator decides it isn't.
- HelloNurse 8y ago
  This kind of problem is what lawyers are for. Unless, of course, one is shortsighted enough to compromise business in order to avoid being bothered with law compliance, a rather common attitude among the aggressive startup-minded audience of Hacker News. I look forward to GDPR-like laws in the USA.
  - Silhouette 8y ago
    The trouble with the GDPR is that there is so much ambiguity in even quite basic areas of the regulations and the official guidance so far that any formal opinion you get from lawyers, consultants, regulators and the like is riddled with vague terms like "reasonable", "legitimate", "proportionate" and "balanced". It's advice that doesn't actually answer any of the important questions like "Am I compliant?" or "What specific actions can I take to become compliant?".
    - setquk 8y ago
      I think that's intentional as it massively increases the risk of doing something negative for the end user and leaves loopholes uncertain and prone to interpretation. It will forces businesses to stay well clear of the line or pack up and go home. And that's not a bad thing. Also it stops a whole legal and compliance industry appearing in the grey zone as no one wants to abstract liability.
      - Silhouette 8y ago
        It will forces businesses to stay well clear of the line or pack up and go home. And that's not a bad thing. I'm not so sure. No-one knows where the line is, so many organisations can only be sure they're staying well clear by stopping all kinds of legitimate, reasonable data processing, which is throwing the baby out with the bathwater. An alternative, which I've seen quite a few small organisations and individuals adopting and now a few larger ones as well, is to just cut the EU off entirely if they're based outside and thus put themselves outside the scope of the GDPR for practical purposes, and then carry on as before under more liberal regimes like the US. Both of these strategies are harmful without really helping anyone.

by eli 8y ago

ghaff 8y ago

A lot of smaller sites don't necessarily know everything that they're collecting. Arguably, this is a good opportunity to figure that out. However, it's equally arguable that in many cases it's just easier to cut off EU access if there's any doubt and the EU just isn't important to their business (or hobby). If I ran a US centric ecommerce site, for example, I'd be very tempted to just stop selling in the EU for now.

enginaar 8y ago
What if EU citizens who are visiting US make purchases from your site?
- ghaff 8y ago
  Almost certainly does not apply. [1] For that matter, the same FAQ suggests that it's probably not necessary to block IP addresses if you're not located in the EU and aren't actively marketing to EU residents. But I can certainly understand small companies taking a better safe than sorry approach if they don't do material EU business. [1] https://www.gdpreu.org/the-regulation/who-must-comply/ https://www.gdpreu.org/the-regulation/who-must-comply/
  - merinowool 8y ago
    It wouldn't apply if you explicitly ask user if he/she is an EU resident, preferably by checking ID and route to /dev/null if user is.
- merinowool 8y ago
  It does apply. All EU residents are covered regardless where they are.
  - snowwolf 8y ago
    The misunderstanding of this is widespread. GDPR does not make any mention of EU citizens OR residents. It only says "data subjects who are IN the Union". See my other comment for more detail: https://news.ycombinator.com/item?id=17143923 https://news.ycombinator.com/item?id=17143923
    - merinowool 8y ago
      It is not defined what "who are in the Union" means. The safest bet is that it means a subject is European Union resident. If they mean that person should be physically present in the European Union, the law would have stated that, but it is not.
      - snowwolf 8y ago
        Equally, if they had meant resident, they would have stated that.
        merinowool 8y ago
        "Resident" has a full scope of protection, whereas your interpretation has limited cover. I wouldn't have thought that GDPR would protect me only if I was physically in the EU territory - as if somehow once I stepped out of the EU my personal information is no longer worth protecting. Your interpretation makes no sense.
        snowwolf 8y ago
        I think you are missing some context here. Firstly if the company is established in the union then they need to be compliant for all their users no matter where they are [1] (so US resident, EU resident, whatever are equally protected). So the relevant section for this is: "This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union." So lets look at Amazon. They are a US company offering goods in the EU. So if you make a purchase from them as an EU resident (living in Germany) from amazon.de to your home address, then any personal data you give them as part of that purchase needs to be handled in a GDPR compliant way. If you now go on holiday to the US and order something from Amazon.com to be delivered to your hotel, even though you are an EU resident, they do not need to handle that personal data in a GDPR compliant way. But just because you are now in the US doesn't mean the data they hold on you about your purchase on amazon.de is suddenly free from GDPR protections. Or to put it another way. Imagine the law did mean EU resident. What does Amazon.com do? How do they ensure they process an order in the US to a US address in a GDPR compliant way for an EU resident? They can't without asking for additional data to establish each persons residency. Which GDPR doesn't allow. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
- downandout 8y ago
  Recital 23 states that sites based outside the EU are not subject to GDPR unless it is apparent that they “envisage” the offering of their goods or services to EU residents. The test for this is translation to EU-only languages, mentioning of EU users, targeting EU users, using an EU based domain extension, etc. The easiest way to announce to the world that I do not “envisage” servicing EU customers is to block EU customers. If one happens to use a VPN or otherwise evades this block, it doesn’t matter. I’ve met the clear definitions under Recital 23 and you have no legal right to GDPR protections on my site.
ryandrake 8y ago
One could argue that "Aww shucks! Ya know, we're jus' a Small Mom'n'Pop Business™! We're too small to have any darned idea what all that data we're collectin' is!" is no longer a valid excuse. No more valid than "We're too small to worry about worker safety!" or "We're too small to know what's in the waste we're dumping out back!"

setquk 8y ago

This is the entire point of the GDPR really. It appears to be working.

eli 8y ago

I think there's also a sizable number of companies that basically were already compliant... but aren't sure. It's not like you can submit your processes to the EU for approval. You don't actually know if what you're doing is OK unless, some day, a regulator decides it isn't.

HelloNurse 8y ago
This kind of problem is what lawyers are for. Unless, of course, one is shortsighted enough to compromise business in order to avoid being bothered with law compliance, a rather common attitude among the aggressive startup-minded audience of Hacker News. I look forward to GDPR-like laws in the USA.
- Silhouette 8y ago
  The trouble with the GDPR is that there is so much ambiguity in even quite basic areas of the regulations and the official guidance so far that any formal opinion you get from lawyers, consultants, regulators and the like is riddled with vague terms like "reasonable", "legitimate", "proportionate" and "balanced". It's advice that doesn't actually answer any of the important questions like "Am I compliant?" or "What specific actions can I take to become compliant?".
  - setquk 8y ago
    I think that's intentional as it massively increases the risk of doing something negative for the end user and leaves loopholes uncertain and prone to interpretation. It will forces businesses to stay well clear of the line or pack up and go home. And that's not a bad thing. Also it stops a whole legal and compliance industry appearing in the grey zone as no one wants to abstract liability.
    - Silhouette 8y ago
      It will forces businesses to stay well clear of the line or pack up and go home. And that's not a bad thing. I'm not so sure. No-one knows where the line is, so many organisations can only be sure they're staying well clear by stopping all kinds of legitimate, reasonable data processing, which is throwing the baby out with the bathwater. An alternative, which I've seen quite a few small organisations and individuals adopting and now a few larger ones as well, is to just cut the EU off entirely if they're based outside and thus put themselves outside the scope of the GDPR for practical purposes, and then carry on as before under more liberal regimes like the US. Both of these strategies are harmful without really helping anyone.