3 ms·

They wanted to violate my rights given by Article 7.2 of the General Data Protection Regulation (GDPR), this is clearly making the product worse. What's great

They wanted to violate my rights given by Article 7.2 of the General Data Protection Regulation (GDPR), this is clearly making the product worse. What's great with GitLab compared to other companies is that they are doing things in the open, while another company would just violate my rights without me knowing it. If you go through the comments, multiple (toxic) people in GitLab doesn't care about user rights, just want to push the change as soon as possible (just like in any other company that I have been working in). It's also clear that you get VP/Director/Staff engineer by just pushing through other people (sadly I have seen the same thing happening other times as well).

SamReidHughes 7y ago
You can opt out by not using it, right? They'd be supposed to drop EU users, under some interpretation of the law. But even if they didn't, then as an EU user, you'd still be able to protect your own rights by ceasing use of their services.
- bigiain 7y ago
  GDPR pretty much says "you can't do that". The advice I have bookmarked (which I'll admit is not a legal opinion or the source legislation) says: ‘specific website content’ means that you should not make ‘general access’ subject to conditions requiring users to accept non-essential cookies – you can only limit certain content if the user does not consent; and the term ‘legitimate purpose’ refers to facilitating the provision of an information society service – ie, a service the user explicitly requests. This does not include third parties such as analytics services or online advertising. As I read/understand things, unless the service you're providing is "being tracked by advertisers or analytics", you cannot block ac cess to users based on then not consenting to being tracked for advertising/analytics. Pretty sure "They'd be supposed to drop EU users, under some interpretation of the law." is correct there, and that if Gitlab wants to have tracking consent as a mandatory requirement for using their source control service, they'd need to stop selling it in EU completely.
  - SamReidHughes 7y ago
    There is some potent American law lurking about, so I'm not going to assume the GDPR is enforceable in ways untested in U.S. court.
    - Xelbair 7y ago
      If a company does business in Europe, they must comply with GDPR. It' doesn't matter where they are located. It won't even go to US court, but to EU one.
      - SamReidHughes 7y ago
        The EU court needs to actually be able to enforce its decisions, which may require a US court.
        witrak 7y ago
        Are you sure that American companies are immune to fines resulting from EU court sentences if they want to make business in EU?
        majewsky 7y ago
        If at all, then only as long as they're conducting their business with EU customers entirely from the US. As soon as they're putting servers in a colo in the EU, there's something that EU authorities could confiscate to cover outstanding fines.
        xxs 7y ago
        this has been explained tons of times. You cannot conduct business in the EU unless you have a VAT number issued by any of the member (still 28) states. You cannot sell anything in the EU w/o VAT, it'd be illegal. The company =must= pay the collected VAT to the respective member state(s). So they have to register in the EU to conduct business (and issue VAT receipts). This requires some assets and people to be responsible. The only way to conduct business outside is a small shipments (less than 22e) that would be free of VAT and customs clearance.
- xiphias2 7y ago
  GDPR is very clear, there are no multiple interpretations: the responsibility of telling me how they are using data about me is on the server side. It's impossible for people in the EU to track all the time how different services use their data, so what you are suggesting is not practical. As an example if you go with 200km/h on the German highway the responsibility of the road not ending is not yours. When I was going with a car in Albania and this happened to me, I (and my car) was quite shocked, but there are differences between countries.

SamReidHughes 7y ago

You can opt out by not using it, right? They'd be supposed to drop EU users, under some interpretation of the law. But even if they didn't, then as an EU user, you'd still be able to protect your own rights by ceasing use of their services.

bigiain 7y ago
GDPR pretty much says "you can't do that". The advice I have bookmarked (which I'll admit is not a legal opinion or the source legislation) says: ‘specific website content’ means that you should not make ‘general access’ subject to conditions requiring users to accept non-essential cookies – you can only limit certain content if the user does not consent; and the term ‘legitimate purpose’ refers to facilitating the provision of an information society service – ie, a service the user explicitly requests. This does not include third parties such as analytics services or online advertising. As I read/understand things, unless the service you're providing is "being tracked by advertisers or analytics", you cannot block ac cess to users based on then not consenting to being tracked for advertising/analytics. Pretty sure "They'd be supposed to drop EU users, under some interpretation of the law." is correct there, and that if Gitlab wants to have tracking consent as a mandatory requirement for using their source control service, they'd need to stop selling it in EU completely.
- SamReidHughes 7y ago
  There is some potent American law lurking about, so I'm not going to assume the GDPR is enforceable in ways untested in U.S. court.
  - Xelbair 7y ago
    If a company does business in Europe, they must comply with GDPR. It' doesn't matter where they are located. It won't even go to US court, but to EU one.
    - SamReidHughes 7y ago
      The EU court needs to actually be able to enforce its decisions, which may require a US court.
      - witrak 7y ago
        Are you sure that American companies are immune to fines resulting from EU court sentences if they want to make business in EU?
        majewsky 7y ago
        If at all, then only as long as they're conducting their business with EU customers entirely from the US. As soon as they're putting servers in a colo in the EU, there's something that EU authorities could confiscate to cover outstanding fines.
        xxs 7y ago
        this has been explained tons of times. You cannot conduct business in the EU unless you have a VAT number issued by any of the member (still 28) states. You cannot sell anything in the EU w/o VAT, it'd be illegal. The company =must= pay the collected VAT to the respective member state(s). So they have to register in the EU to conduct business (and issue VAT receipts). This requires some assets and people to be responsible. The only way to conduct business outside is a small shipments (less than 22e) that would be free of VAT and customs clearance.
xiphias2 7y ago
GDPR is very clear, there are no multiple interpretations: the responsibility of telling me how they are using data about me is on the server side. It's impossible for people in the EU to track all the time how different services use their data, so what you are suggesting is not practical. As an example if you go with 200km/h on the German highway the responsibility of the road not ending is not yours. When I was going with a car in Albania and this happened to me, I (and my car) was quite shocked, but there are differences between countries.