4 ms·

> Well, it's "choosing this absurd behavior itself" insofar as risking tens of millions of dollars in fines for violating murky and ambiguous that can be interp

by emn13 7y ago

> Well, it's "choosing this absurd behavior itself" insofar as risking tens of millions of dollars in fines for violating murky and ambiguous that can be interpreted differently in any of the 28 member states counts as "choosing the behavior itself". And companies blocked by the great firewall can simply choose to comply with whatever the CCP tells them to do, too. So in a sense they're choosing to be blocked as well. That's just nonsense. It could (shocking I know) (1) try not to save personally identifiable data for undefined periods of time; and (2) accept that it has no business presence in the EU and thus flout the law with no repercussions; or (3) use a modicum of common sense and notice that just because there exist maximum penalties for truly egregious behavior doesn't mean they're in any risk of those if they're non-malicious, especially given the not-exactly hard-to-find actually assessed penalties are nothing like what you're saying there for behavior that's much worse than anything I can imagine a local news station doing unless they really are Machiavellian; and (4) note that GDPR regulators have approximately a googleplex of more relevant cases, and are literally never ever going to be interested in them; and (5) not forget they;re likely in some technical sense breaking untold laws in all kind of jurisdictions even closer to home, and the sky isn't falling. This is just FUD. And comparing the censorship by the great firewall with the truly onerous restriction not to cyber-stalk all of your users is a farce.

manfredo 7y ago
It takes a hell of a lot more than a "modicum of common sense" to comply with GDPR. If you really just think that saying "well I'm not going to save PII indefinitely" is enough, you're setting yourself up for a lawsuit. Did you go through every layer of your stack and ensure that every tool and platform you use doesn't log or persist PII? Did you think of justifications for every use of PII? Did you consult with attorneys on these justifications, or are you just hoping that all 28 member states of the EU agree with your personal opinion? And don't forget you need to build a system to give people all the info you have on them at their request. Points 3, 4, and 5 basically amount to, "well, as long as I have good intentions I'm sure the government won't sue me even if I do screw up and violate GDPR". You might be willing to risk your business on this assumption. But if that's the case then I sure wouldn't want my retirement funds invested in your company. Put yourself in the shoes of a West Virginia local news station. What percentage of your revenue comes from EU users? Does it even remotely justify the cost to audit all of your tech and make it GDPR compliant - let alone run the risk that one of the 28 EU member states interprets GDPR differently than you do? Chances are, it doesn't. This is the natural consequence of regulation. People who don't have interest in complying with it leave the market.
- emn13 7y ago
  I understand the worries; and the fact that it's a local interest site. Hence the appeal to HN to block such links, since HN is presumably not local-interest. But while the massive media blitz on the GDPR makes it appear terrifying; it doesn't magically grant jurisdiction over a local west virginia site. The enforcement agency isn't likely to bother, because they have no means to enforce any sanction. It's not even clear to me whether the GDPR even applies; article 3(1) says that "This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not." Is a west virginia site "established" in the EU? That's dubious enough that I doubt they need to worry - for now. Yes, if a hostile foreign regulator wanted to fine them - they probably could find some pretext. But that's likely the case under any number of other laws too! But there's simply no motivation for a foreign regulator to do so; and numerous motivations for them not to. (A) they might fail, (B) there's not much to win, even if they do, (C) they do actually need evidence, and if the site at least attempted not to collect PII, then there is likely not to be any easily accessible evidence, so it's going to be a lot of work, (D) the politics are terrible, which regulators are far from immune from; (E) even if they "win" it's not clear they can collect. The real risk here seems overstated - as in, does anybody think there is ever going to be a single case like this resulting in a fine? Literally ever? Note furthermore that their IP filter is likely insufficient anyhow. IP filters are never reliable for all kinds of reasons, e.g. VPNs, out of date filtering rules, etc, and the law applies to natural persons in the EU regardless of where you think they are. And it's not entirely clear to me that it doesn't apply to EU persons that happen to be on vacation (even if it does not, it almost certainly does the moment the vacation is over and the site has not wiped the PII - it's not like that magically dissappears). The only tricky bit in avoiding PII (for news sites!) is going to be embeds (i.e. ads). But this affects the adtech firms much more than them; most of them need to have some solution (e.g. a contextual ad mode). Some local news site almost certainly doesn't need to solve this; they likely only need to check the right box for the adtech firm to do so; which is probably not a lot harder than the solution they've chosen now. Finally: none of this is happening in a vacuum, nor overnight. The few cases so far have been either pretty egregious, limited to largely symbolic fines, or both. And that's just natural (given the way the GDPR was set up): the worst excesses are the most likely to be addressed first (don't forget that the GDPR is not enforceable by an individual no matter how egregious the violation, all they can do is refer a site, which serves as a filter). All in all: this sounds like an overreaction. Maybe it's a cultural thing too; lawsuits with huge punitive fines are much more common in the US, so the habit of avoiding liability is perhaps more deeply ingrained. But again, the risk seems trivial. And you know, if you don't care about overseas readers, would it kill you to be so polite as to say so? It currently says only: "Our European visitors are important to us. This site is currently unavailable to visitors from the European Economic Area while we work to ensure your data is protected in accordance with applicable EU laws." That's just a lie, likely both parts of it. But back to my original request: even if the site has zero costs from doing this, and it really wants to avoid accidental mistakes: that doesn't make them any less spam in the HN feed, which was my initial point: HN is less valuable to EU residents if contains spam like this.

by emn13 7y ago

manfredo 7y ago

It takes a hell of a lot more than a "modicum of common sense" to comply with GDPR. If you really just think that saying "well I'm not going to save PII indefinitely" is enough, you're setting yourself up for a lawsuit. Did you go through every layer of your stack and ensure that every tool and platform you use doesn't log or persist PII? Did you think of justifications for every use of PII? Did you consult with attorneys on these justifications, or are you just hoping that all 28 member states of the EU agree with your personal opinion? And don't forget you need to build a system to give people all the info you have on them at their request. Points 3, 4, and 5 basically amount to, "well, as long as I have good intentions I'm sure the government won't sue me even if I do screw up and violate GDPR". You might be willing to risk your business on this assumption. But if that's the case then I sure wouldn't want my retirement funds invested in your company. Put yourself in the shoes of a West Virginia local news station. What percentage of your revenue comes from EU users? Does it even remotely justify the cost to audit all of your tech and make it GDPR compliant - let alone run the risk that one of the 28 EU member states interprets GDPR differently than you do? Chances are, it doesn't. This is the natural consequence of regulation. People who don't have interest in complying with it leave the market.

emn13 7y ago
I understand the worries; and the fact that it's a local interest site. Hence the appeal to HN to block such links, since HN is presumably not local-interest. But while the massive media blitz on the GDPR makes it appear terrifying; it doesn't magically grant jurisdiction over a local west virginia site. The enforcement agency isn't likely to bother, because they have no means to enforce any sanction. It's not even clear to me whether the GDPR even applies; article 3(1) says that "This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not." Is a west virginia site "established" in the EU? That's dubious enough that I doubt they need to worry - for now. Yes, if a hostile foreign regulator wanted to fine them - they probably could find some pretext. But that's likely the case under any number of other laws too! But there's simply no motivation for a foreign regulator to do so; and numerous motivations for them not to. (A) they might fail, (B) there's not much to win, even if they do, (C) they do actually need evidence, and if the site at least attempted not to collect PII, then there is likely not to be any easily accessible evidence, so it's going to be a lot of work, (D) the politics are terrible, which regulators are far from immune from; (E) even if they "win" it's not clear they can collect. The real risk here seems overstated - as in, does anybody think there is ever going to be a single case like this resulting in a fine? Literally ever? Note furthermore that their IP filter is likely insufficient anyhow. IP filters are never reliable for all kinds of reasons, e.g. VPNs, out of date filtering rules, etc, and the law applies to natural persons in the EU regardless of where you think they are. And it's not entirely clear to me that it doesn't apply to EU persons that happen to be on vacation (even if it does not, it almost certainly does the moment the vacation is over and the site has not wiped the PII - it's not like that magically dissappears). The only tricky bit in avoiding PII (for news sites!) is going to be embeds (i.e. ads). But this affects the adtech firms much more than them; most of them need to have some solution (e.g. a contextual ad mode). Some local news site almost certainly doesn't need to solve this; they likely only need to check the right box for the adtech firm to do so; which is probably not a lot harder than the solution they've chosen now. Finally: none of this is happening in a vacuum, nor overnight. The few cases so far have been either pretty egregious, limited to largely symbolic fines, or both. And that's just natural (given the way the GDPR was set up): the worst excesses are the most likely to be addressed first (don't forget that the GDPR is not enforceable by an individual no matter how egregious the violation, all they can do is refer a site, which serves as a filter). All in all: this sounds like an overreaction. Maybe it's a cultural thing too; lawsuits with huge punitive fines are much more common in the US, so the habit of avoiding liability is perhaps more deeply ingrained. But again, the risk seems trivial. And you know, if you don't care about overseas readers, would it kill you to be so polite as to say so? It currently says only: "Our European visitors are important to us. This site is currently unavailable to visitors from the European Economic Area while we work to ensure your data is protected in accordance with applicable EU laws." That's just a lie, likely both parts of it. But back to my original request: even if the site has zero costs from doing this, and it really wants to avoid accidental mistakes: that doesn't make them any less spam in the HN feed, which was my initial point: HN is less valuable to EU residents if contains spam like this.