6 ms·

That stuff scares me. More than US government surveillance could ever scare me. The most likely outcome is that smaller companies just don't do business in the

That stuff scares me. More than US government surveillance could ever scare me. The most likely outcome is that smaller companies just don't do business in the EU. At least before they are large enough to deal with GDPR. I am located in Germany, but if I would start a SAAS site today, I wouldn't try to sell to the EU. Just isn't worth the trouble. Over time, many people in the EU will start using VPNs to get access to the latest web sites without GDPR restrictions. Even today I have to use a VPN to access some websites (mostly news sites), but I suspect it will be much worse if noyb succeeds.

cblconfederate 5y ago
> but if I would start a SAAS site today, I wouldn't try to sell to the EU. You 'd still be liable for GDPR by non-europeans since you are located in germany It's like the EU is pushing entrepreneurs to emigrate.
JanSt 5y ago
What should really scare you is the vast amount of privacy violations, data collection and tracking that is happening around the web. Imagine someone following you everywhere in the real world, even getting into your apartment and noting down everything you do. If following the basic principles laid out in GDPR is too much of a hassle for you, you should probably not be in business anyway. It's not rocket science.
- cblconfederate 5y ago
  The solution is to make a worldwide framework where people OWN their data. That's not what GDPR does, it in fact prevents people from selling their data at will. (People's privacy is protected by constitutions. That is orthogonal to the ability of people to choose how to use their data)
  - M2Ys4U 5y ago
    So only the rich should have their human right to privacy protected?
- tjansen 5y ago
  > What should really scare you is the vast amount of privacy violations, data collection and tracking that is happening around the web. Even if it would scare me (it really doesn't), as an EU citizen I would care about surveillance by the EU, not by the US. > Imagine someone following you everywhere in the real world, even getting into your apartment and noting down everything you do. To do what? Collect a lot of useless information? I would bother me if someone I know does it. I don't care if some abstract entity in a different country thousands of miles away does it.
  - fsflover 5y ago
    > To do what? Collect a lot of useless information? To force you into buying something you don't need, see https://en.wikipedia.org/wiki/Surveillance_capitalism https://en.wikipedia.org/wiki/Surveillance_capitalism. Also, to obtain your commercial secrets: https://en.wikipedia.org/wiki/Global_surveillance#Purposes https://en.wikipedia.org/wiki/Global_surveillance#Purposes.
    - kmlx 5y ago
      > To force you into buying something you don't need No one can force you to do anything.
      - fsflover 5y ago
        If it was true, the surveillance capitalism would not exist. You can call this "trick you into buying useless staff" if you wish. See also: https://en.wikipedia.org/wiki/Targeted_advertising#Consumers_2 https://en.wikipedia.org/wiki/Targeted_advertising#Consumers....
        nickpp 5y ago
        People have been buying useless crap since the begging of time. It didn't start with targeted advertising.
        5y ago
kmlx 5y ago
> The most likely outcome is that smaller companies just don't do business in the EU. it's one of these: 1. blocking business with the EU 2. just ignoring the local regulations 3. big enough to actually implement GDPR 3.1. implement it partially 3.2. implement it erroneously 3.3. implement it fully GDPR brought us the wide usage of HTTP code 451 Unavailable For Legal Reasons, the myriad of cookie stuff, endless legislation and litigation. It also split the internet into one more part. Unfortunately the part that was split off was never too successful or important to the rest of the planet. But it also brought us a new way of thinking about data, and what personal data means. It's just that the implementation sucks big time.
- deleted 5y ago
  [deleted]
- ohgodplsno 5y ago
  Companies unwilling to actually protect your personal data and milking everything they can out of you brought you HTTP 451. Companies lying through their teeth pretending that ePrivacy & GDPR forces them to have a cookie banner. Companies (and clueless HN posters) that lie to you, telling you that GDPR is impossible to implement, and that if you even get the slightest thing wrong, you'll get fined the maximum fine. Fines have always been a last resort, or for egregious and willful violations of the GDPR. Your company doesn't implement it properly and it goes all the way to a court ? For almost all cases, the court will simply tell you "you have X days to be GDPR compliant". Said X being more than 90.
- MauranKilom 5y ago
  > It's just that the implementation sucks big time. Yes, the way companies are "implementing" GDPR compliance sucks, even though GDPR compliance is not that complicated. That should tell you that those companies think it is more profitable to annoy you than to have a privacy-compatible business model. Github, for example, gets it right. It only stores data it needs for fulfilling the services it provides to you, so there is no need for cookie banners and similar. That's exactly how the GDPR intends it to work. The problem is companies dragging their feet and trying to fool you into thinking it's the fault of the GDPR that they don't respect your privacy. Incredibly backwards, but sadly it seems to work.
q3k 5y ago
> Just isn't worth the trouble. What trouble? It's really not rocket surgery to be compliant with the GDPR if your business model isn't to sell (or profit from) targeted advertisements. There's tons of fearmongering about it, though - by companies whose business model it is to sell targeted advertisements, and by companies whose business model is to sell GDPR compliance consultancy services.
- tjansen 5y ago
  > What trouble? It's really not rocket surgery to be compliant with the GDPR if > your business model isn't to sell (or profit from) targeted advertisements. There are a lot of popular services you apparently can't use, like Stripe, and a lot of rules to follow, especially if you store any kind of personal data.
  - Silhouette 5y ago
    If the regulators actually enforced the letter of the law and the current court precedents fully and consistently, could you even use many popular payment methods or communications channels anywhere in the EU (or possibly the UK), given that underlying a lot of that infrastructure at some level is the use of services operated by businesses with a presence in the US? Maybe the situation has changed again recently but I thought a literal reading of the current regulations and precedents implied that no such business can ever be compliant, because of the US laws that give parts of the US government privileged access to any data available to any such business even if that data is held off-shore?
    - ben_w 5y ago
      I believe a significant part of enforcement is supposed to be a deterrent. If the U.K. fully enforced speed limits, the only people who would have not had their licenses revoked would be people like me who don’t drive or aren’t in the country any more. It’s not clear to me that any particular analytics service needs to be run by an American firm, so the point about USA rules forcing actions on USA feels situational rather than permanent. (I won’t pretend to know if the GDPR allowance for handing data over due to legal obligations is or isn’t relevant here, even normal law is way outside my ken, let alone international).
viraptor 5y ago
What exactly are you worried about? What would your SaaS do that would be going against the GDPR?
- tjansen 5y ago
  Using common services like GA or Stripe (https://noyb.eu/en/edps-sanctions-parliament-over-eu-us-data-transfers-google-and-stripe https://noyb.eu/en/edps-sanctions-parliament-over-eu-us-data...), and even more services by smaller companies that don't really care about GDPR. Embedding Facebook or Twitter content.
  - Silhouette 5y ago
    It's worth noting that the specific objections to using Stripe there seem to be reasonable. Stripe has actively recommended that merchants include their scripts on all pages of the merchant's site and not just the payment pages, so that Stripe could track and analyse visitor behaviour to look for warning signs of high risk transactions. Given that a visitor to the merchant's site might never visit a Stripe-backed payment page or make any purchase using Stripe, this has always seemed a questionable degree of tracking under the EU rules, even if the intentions might have been honest. Personally I'd be more worried that many payments using cards and other methods rely on underlying US-based infrastructure, so the actual payment processing itself could fall foul of EU data transfer rules. Obviously you can't record financial transactions properly without the various parties involved in implementing the transaction having records that will necessarily include personal data (and potentially sensitive personal data at that, depending on who a payment was being made from and to). And you most likely have all kinds of legal obligations under financial regulation to keep those records. But if there is some sort of blanket ban on processing EU personal data by any US service, that's a big problem.
  - viraptor 5y ago
    Tbh, only stripe is surprising. The rest (Ga, FB, twtr) you can easily not include and be safe from the US transfers. They make money from the visitors data, of course they'll be problematic. The stripe part is the one that will be interesting to watch, because "The EDPS confirmed that the website actually transferred data to the US without ensuring an adequate level of protection for the data". Anyone can easily point out that Stripe claims compliance: https://stripe.com/en-au/guides/general-data-protection-regulation#stripe-and-the-gdpr https://stripe.com/en-au/guides/general-data-protection-regu... So I hope that that part will die soon. You can however implement stripe server-side where they can't see more than explicitly provided by the user for the purpose of the checkout. I believe that would have a different result in court. (We'd need to see that tested though) But! If you're actually worked even able the stripe part, there are EU-based payment processors. More expensive, but they exist.
M2Ys4U 5y ago
>I am located in Germany, but if I would start a SAAS site today, I wouldn't try to sell to the EU. Just isn't worth the trouble. If you're located in Germany then the GDPR applies irrespective of where your users are. It applies because you - as a data controller or processor - are in the EU. You would have to be established outside of the EU in addition to not targeting EU users in order to not be bound by the GDPR.
- tjansen 5y ago
  Yes, you need something like Stripe Atlas...
raxxorrax 5y ago
I am vastly more scared by surveillance and data acquisition, regardless if that would be domestic services or US ones. Still true that you should think about your preferred solution to tunnel out of the EU, preferable with a service outside of your legislation.
- Aerroon 5y ago
  The spy agencies will do their surveillance anyway though.
foxfluff 5y ago
> I am located in Germany, but if I would start a SAAS site today, I wouldn't try to sell to the EU. Just isn't worth the trouble. If the European market with half a billion people isn't worth it for you, right, whatever I guess? I'm sure someone else will be happy to fill the gap that you so generously leave for them :) I'm more likely to just stop using those sites with GDPR violations than try to work around it with VPNs.

cblconfederate 5y ago

> but if I would start a SAAS site today, I wouldn't try to sell to the EU. You 'd still be liable for GDPR by non-europeans since you are located in germany It's like the EU is pushing entrepreneurs to emigrate.

JanSt 5y ago

What should really scare you is the vast amount of privacy violations, data collection and tracking that is happening around the web. Imagine someone following you everywhere in the real world, even getting into your apartment and noting down everything you do. If following the basic principles laid out in GDPR is too much of a hassle for you, you should probably not be in business anyway. It's not rocket science.

cblconfederate 5y ago
The solution is to make a worldwide framework where people OWN their data. That's not what GDPR does, it in fact prevents people from selling their data at will. (People's privacy is protected by constitutions. That is orthogonal to the ability of people to choose how to use their data)
- M2Ys4U 5y ago
  So only the rich should have their human right to privacy protected?
tjansen 5y ago
> What should really scare you is the vast amount of privacy violations, data collection and tracking that is happening around the web. Even if it would scare me (it really doesn't), as an EU citizen I would care about surveillance by the EU, not by the US. > Imagine someone following you everywhere in the real world, even getting into your apartment and noting down everything you do. To do what? Collect a lot of useless information? I would bother me if someone I know does it. I don't care if some abstract entity in a different country thousands of miles away does it.
- fsflover 5y ago
  > To do what? Collect a lot of useless information? To force you into buying something you don't need, see https://en.wikipedia.org/wiki/Surveillance_capitalism https://en.wikipedia.org/wiki/Surveillance_capitalism. Also, to obtain your commercial secrets: https://en.wikipedia.org/wiki/Global_surveillance#Purposes https://en.wikipedia.org/wiki/Global_surveillance#Purposes.
  - kmlx 5y ago
    > To force you into buying something you don't need No one can force you to do anything.
    - fsflover 5y ago
      If it was true, the surveillance capitalism would not exist. You can call this "trick you into buying useless staff" if you wish. See also: https://en.wikipedia.org/wiki/Targeted_advertising#Consumers_2 https://en.wikipedia.org/wiki/Targeted_advertising#Consumers....
      - nickpp 5y ago
        People have been buying useless crap since the begging of time. It didn't start with targeted advertising.
        5y ago

kmlx 5y ago

> The most likely outcome is that smaller companies just don't do business in the EU. it's one of these: 1. blocking business with the EU 2. just ignoring the local regulations 3. big enough to actually implement GDPR 3.1. implement it partially 3.2. implement it erroneously 3.3. implement it fully GDPR brought us the wide usage of HTTP code 451 Unavailable For Legal Reasons, the myriad of cookie stuff, endless legislation and litigation. It also split the internet into one more part. Unfortunately the part that was split off was never too successful or important to the rest of the planet. But it also brought us a new way of thinking about data, and what personal data means. It's just that the implementation sucks big time.

deleted 5y ago
[deleted]
ohgodplsno 5y ago
Companies unwilling to actually protect your personal data and milking everything they can out of you brought you HTTP 451. Companies lying through their teeth pretending that ePrivacy & GDPR forces them to have a cookie banner. Companies (and clueless HN posters) that lie to you, telling you that GDPR is impossible to implement, and that if you even get the slightest thing wrong, you'll get fined the maximum fine. Fines have always been a last resort, or for egregious and willful violations of the GDPR. Your company doesn't implement it properly and it goes all the way to a court ? For almost all cases, the court will simply tell you "you have X days to be GDPR compliant". Said X being more than 90.
MauranKilom 5y ago
> It's just that the implementation sucks big time. Yes, the way companies are "implementing" GDPR compliance sucks, even though GDPR compliance is not that complicated. That should tell you that those companies think it is more profitable to annoy you than to have a privacy-compatible business model. Github, for example, gets it right. It only stores data it needs for fulfilling the services it provides to you, so there is no need for cookie banners and similar. That's exactly how the GDPR intends it to work. The problem is companies dragging their feet and trying to fool you into thinking it's the fault of the GDPR that they don't respect your privacy. Incredibly backwards, but sadly it seems to work.

q3k 5y ago

> Just isn't worth the trouble. What trouble? It's really not rocket surgery to be compliant with the GDPR if your business model isn't to sell (or profit from) targeted advertisements. There's tons of fearmongering about it, though - by companies whose business model it is to sell targeted advertisements, and by companies whose business model is to sell GDPR compliance consultancy services.

tjansen 5y ago
> What trouble? It's really not rocket surgery to be compliant with the GDPR if > your business model isn't to sell (or profit from) targeted advertisements. There are a lot of popular services you apparently can't use, like Stripe, and a lot of rules to follow, especially if you store any kind of personal data.
- Silhouette 5y ago
  If the regulators actually enforced the letter of the law and the current court precedents fully and consistently, could you even use many popular payment methods or communications channels anywhere in the EU (or possibly the UK), given that underlying a lot of that infrastructure at some level is the use of services operated by businesses with a presence in the US? Maybe the situation has changed again recently but I thought a literal reading of the current regulations and precedents implied that no such business can ever be compliant, because of the US laws that give parts of the US government privileged access to any data available to any such business even if that data is held off-shore?
  - ben_w 5y ago
    I believe a significant part of enforcement is supposed to be a deterrent. If the U.K. fully enforced speed limits, the only people who would have not had their licenses revoked would be people like me who don’t drive or aren’t in the country any more. It’s not clear to me that any particular analytics service needs to be run by an American firm, so the point about USA rules forcing actions on USA feels situational rather than permanent. (I won’t pretend to know if the GDPR allowance for handing data over due to legal obligations is or isn’t relevant here, even normal law is way outside my ken, let alone international).

viraptor 5y ago

What exactly are you worried about? What would your SaaS do that would be going against the GDPR?

tjansen 5y ago
Using common services like GA or Stripe (https://noyb.eu/en/edps-sanctions-parliament-over-eu-us-data-transfers-google-and-stripe https://noyb.eu/en/edps-sanctions-parliament-over-eu-us-data...), and even more services by smaller companies that don't really care about GDPR. Embedding Facebook or Twitter content.
- Silhouette 5y ago
  It's worth noting that the specific objections to using Stripe there seem to be reasonable. Stripe has actively recommended that merchants include their scripts on all pages of the merchant's site and not just the payment pages, so that Stripe could track and analyse visitor behaviour to look for warning signs of high risk transactions. Given that a visitor to the merchant's site might never visit a Stripe-backed payment page or make any purchase using Stripe, this has always seemed a questionable degree of tracking under the EU rules, even if the intentions might have been honest. Personally I'd be more worried that many payments using cards and other methods rely on underlying US-based infrastructure, so the actual payment processing itself could fall foul of EU data transfer rules. Obviously you can't record financial transactions properly without the various parties involved in implementing the transaction having records that will necessarily include personal data (and potentially sensitive personal data at that, depending on who a payment was being made from and to). And you most likely have all kinds of legal obligations under financial regulation to keep those records. But if there is some sort of blanket ban on processing EU personal data by any US service, that's a big problem.
- viraptor 5y ago
  Tbh, only stripe is surprising. The rest (Ga, FB, twtr) you can easily not include and be safe from the US transfers. They make money from the visitors data, of course they'll be problematic. The stripe part is the one that will be interesting to watch, because "The EDPS confirmed that the website actually transferred data to the US without ensuring an adequate level of protection for the data". Anyone can easily point out that Stripe claims compliance: https://stripe.com/en-au/guides/general-data-protection-regulation#stripe-and-the-gdpr https://stripe.com/en-au/guides/general-data-protection-regu... So I hope that that part will die soon. You can however implement stripe server-side where they can't see more than explicitly provided by the user for the purpose of the checkout. I believe that would have a different result in court. (We'd need to see that tested though) But! If you're actually worked even able the stripe part, there are EU-based payment processors. More expensive, but they exist.

M2Ys4U 5y ago

>I am located in Germany, but if I would start a SAAS site today, I wouldn't try to sell to the EU. Just isn't worth the trouble. If you're located in Germany then the GDPR applies irrespective of where your users are. It applies because you - as a data controller or processor - are in the EU. You would have to be established outside of the EU in addition to not targeting EU users in order to not be bound by the GDPR.

tjansen 5y ago
Yes, you need something like Stripe Atlas...

raxxorrax 5y ago

I am vastly more scared by surveillance and data acquisition, regardless if that would be domestic services or US ones. Still true that you should think about your preferred solution to tunnel out of the EU, preferable with a service outside of your legislation.

Aerroon 5y ago
The spy agencies will do their surveillance anyway though.

foxfluff 5y ago

> I am located in Germany, but if I would start a SAAS site today, I wouldn't try to sell to the EU. Just isn't worth the trouble. If the European market with half a billion people isn't worth it for you, right, whatever I guess? I'm sure someone else will be happy to fill the gap that you so generously leave for them :) I'm more likely to just stop using those sites with GDPR violations than try to work around it with VPNs.