8 ms·

Apparently, HN might be violating GDPR according to the website

jtbayly 5y ago
Yep. Now everybody has to decide if they actually believe the EU has the ability to tell them exactly how they have to run their website.
- janto 5y ago
  As a visitor to your website how can I know you are respecting my privacy?
  - jtbayly 5y ago
    How about I put up a huge privacy theater alert box on my site like all the other stupid websites that decided to make a morality play out of following GDPR? Are they all going to add another popover box saying “WE DON’T A USE GOOGLE FONTS! YOU CAN TRUST US WITH YOUR PERSONAL DATA! WE PROMISE!”?
    - janto 5y ago
      If it's a US site, I know that's a promise that it can't really make, due to US laws. If it's a EU site, then I could hold them legally responsible if it's just theater.
      - rpdillon 5y ago
        This hits the heart of the issue: how would you know if it's "just theater"? And if you did somehow find out, holding a random site legally responsible (I'm assuming you mean suing them?) will be dicey...even notable European sites don't comply with GDPR (the one example mentioned elsewhere in this thread was https://www.consilium.europa.eu/en/ https://www.consilium.europa.eu/en/, but I'm sure that's not an isolated instance).
        janto 5y ago
        For larger businesses, relying on whistleblowers or auditing might be one way. For smaller ones using tools like the one discussed here. Or maybe a browser plugin that automatically notifies visitors. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ "... is an overview of fines and penalties which data protection authorities within the EU have imposed under the EU [GDPR]"
        rpdillon 5y ago
        Ah, I see, I think we're talking past one another. I was critiquing this approach from a technical perspective, since once data is sent over the wire, I don't know of any good way to figure out what's being done with it, and whether in complies with any given policy (including GDPR). E.g. we can see if the _browser_ is connecting to Cloudflare in the US, but what if a connection to a US server is happening on the backend? If I'm understanding your point, it's more along the lines of: "Lots of people are looking into this sort of thing, and we can aggregate resources about their findings." This makes sense to me, but wasn't what I was intending to critique.
        janto 5y ago
        There can indeed be lots of magic going on in a backend and various ways GDPR violations may or may not be discovered. Here's an amusing 320k euro fine https://ico.org.uk/media/action-weve-taken/enforcement-notices/2616741/doorstop-en-20191217.pdf https://ico.org.uk/media/action-weve-taken/enforcement-notic... On 24 July 2018 the MHRA had executed a search warrant at the premises of Doorstep Dispensaree under the Human Medicines Regulations. In the course of its search, the MHRA discovered, stored in a rear courtyard, 47 crates, 2 disposal bags and 1 cardboard box full of documents containing personal data. MHRA estimated approximately 500,000 documents but cannot estimate the number of data subjects. MHRA have inspected the crates and the information contains: a. Names b. Addresses c. Dates of Birth d. NHS Numbers e. Medical Information f. Prescriptions The dates on the documents range from January 2016 - June 2018. The documents were not secure and they were not marked as confidential waste. Some of the documents were soaking wet, indicating that they had been stored in this way for some time. I doubt there is a purely technical solution to finding this kind of problem :) Edit: to be clear, the violation type here seems to have been "Insufficient technical and organisational measures to ensure information security"
      - jtbayly 5y ago
        In other words, the big claim that the GDPR applies to every site in the world... is not true. Just like I've said from the beginning.
        janto 5y ago
        Actually, it could be applied in an extraterritorial way. The GDPR applies to processing of data of individuals located in the EU/EEU and states the rights of these "data subjects". If your business violates the GDPR and wishes to also operate within the European Economic Area, it could face fines and penalties.
- blitzar 5y ago
  Yep. Now everybody has to decide if they actually believe the government where they live has the ability to tell them exactly when and who, if anyone they are allowed to murder for no reason at all.
  - jtbayly 5y ago
    I don’t live in the EU, which is the main point. The EU says it is illegal for anybody in the world to use Google Fonts. Guess how many people outside the EU care what the EU says they can and can’t do on their website. How many millions of websites are there using Google Fonts right now? How many were there last week? How many will there be next week? That tells you everything you need to know.
    - blitzar 5y ago
      > The EU says it is illegal for anybody in the world to use Google Fonts Total and utter horeshit, and you are fully aware of it.
      - jtbayly 5y ago
        I’m sorry if I misunderstood. The post I’m commenting on said Google Fonts are no no, did it not?
        blitzar 5y ago
        When you sell chicken in the EU it cant be washed in chlorie. That does not mean that the EU have banned anyone in the world from bathing their chickens in chlorine, but if you present your goods to the block it must comply with the laws of the block. Likewise when you present your website to people within the block, you must comply with the laws of the block. btw when you factory farm animals 10 high and they live their entire lives covered in the faeces from the 9 layers of chickens above is actually a good idea to give them a wash and disinfect them.
        5y ago
- hans1729 5y ago
  Either the customers who care about privacy trust you, or they don't. Let n cases show up in the news where US-companies are ignoring the respective rulings and the US-market will simply lose any attraction it still has left for european customers. If I have the choice between an american service and a european one, I'll choose the latter every single time, because I wouldn't trust american companies, the american government, or american citizens at all. Your comment isn't the reason why, but very likely stems from the same causes. Also, the public sector matters a lot here: they can't risk to have the data going to the US when they are legally mandated to keep it in Europe. This demand already exists and won't go anywhere, leading to all kinds of services being re-engineered on european soil. Eventually any company who doesn't respect their users privacy will probably be phased out by a european alternative - at least for the customers who care about that sort of thing. Europe made very clear that it does, but sure, time will tell what disrespecting that market segment will do to market shares.
  - jtbayly 5y ago
    You do realize the vast majority of websites don’t even have customers, right? Ask me how much I care whether my non-existent customers decide they don’t want to be my customer. And I’ll ask you how in the world a visitor to my website is supposed to know or care whether my site is hosted in the US or EU. I’m not even 100% sure myself.
    - hans1729 5y ago
      >And I’ll ask you how in the world a visitor to my website is supposed to know or care whether my site is hosted in the US or EU. I’m not even 100% sure myself. Pretty sure we'll see indicators for that in browsers in the foreseeable future. The internet will be a much more zoned-space in the future, so much seems obvious. > You do realize the vast majority of websites don’t even have customers, right? customer <- visitor
  - rpdillon 5y ago
    This path leads towards the balkanization of the web, which is a step backward in my estimation. This tool reports that static sites with no JS, no cookies, and no third-party requests are in violation because they are hosted in a place other than the EU. That surprises me greatly. It seems from your comments downthread that this is the direction you see things going (i.e. a more fragmented internet), and that may be correct, but I see it as a huge loss, and I _highly_ doubt it will solve any of the privacy problems we have. Now that I think about it, if an IP address is PII, and leaking PII outside of the EU is a violation, I wonder if any P2P network can be legal in the EU, since P2P networks leak IPs globally. How would IPFS or Bittorrent work? A quick search shows that this is indeed an issue, and the most P2P networks don't support the necessary revocation of PII necessary. IEEE has an early access paper[0] about exactly this issue: > To comply with the criteria of the European Union's General Data Protection Regulation, it is important to ensure that personal data can be completely removed by their owners. To improve the privacy and security of the P2P file-sharing system, we propose a revocable and monitorable P2P file-sharing system over a consortium blockchain to achieve revocation of files in the decentralized environment. So, for everyone who said blockchain is a solution in search of a problem, I present GDPR-compliant P2P networks! I'm mostly kidding, my brief read through the abstract suggests this also requires a bunch of other heavy-handed measures, like securely verifying the P2P executable using Intel SGX. It's hard for me to imagine such a system gaining any sort of widespread use, but I've been wrong before. [0]: https://ieeexplore.ieee.org/abstract/document/9684748 https://ieeexplore.ieee.org/abstract/document/9684748

Yep. Now everybody has to decide if they actually believe the EU has the ability to tell them exactly how they have to run their website.

janto 5y ago
As a visitor to your website how can I know you are respecting my privacy?
- jtbayly 5y ago
  How about I put up a huge privacy theater alert box on my site like all the other stupid websites that decided to make a morality play out of following GDPR? Are they all going to add another popover box saying “WE DON’T A USE GOOGLE FONTS! YOU CAN TRUST US WITH YOUR PERSONAL DATA! WE PROMISE!”?
  - janto 5y ago
    If it's a US site, I know that's a promise that it can't really make, due to US laws. If it's a EU site, then I could hold them legally responsible if it's just theater.
    - rpdillon 5y ago
      This hits the heart of the issue: how would you know if it's "just theater"? And if you did somehow find out, holding a random site legally responsible (I'm assuming you mean suing them?) will be dicey...even notable European sites don't comply with GDPR (the one example mentioned elsewhere in this thread was https://www.consilium.europa.eu/en/ https://www.consilium.europa.eu/en/, but I'm sure that's not an isolated instance).
      - janto 5y ago
        For larger businesses, relying on whistleblowers or auditing might be one way. For smaller ones using tools like the one discussed here. Or maybe a browser plugin that automatically notifies visitors. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ "... is an overview of fines and penalties which data protection authorities within the EU have imposed under the EU [GDPR]"
        rpdillon 5y ago
        Ah, I see, I think we're talking past one another. I was critiquing this approach from a technical perspective, since once data is sent over the wire, I don't know of any good way to figure out what's being done with it, and whether in complies with any given policy (including GDPR). E.g. we can see if the _browser_ is connecting to Cloudflare in the US, but what if a connection to a US server is happening on the backend? If I'm understanding your point, it's more along the lines of: "Lots of people are looking into this sort of thing, and we can aggregate resources about their findings." This makes sense to me, but wasn't what I was intending to critique.
        janto 5y ago
        There can indeed be lots of magic going on in a backend and various ways GDPR violations may or may not be discovered. Here's an amusing 320k euro fine https://ico.org.uk/media/action-weve-taken/enforcement-notices/2616741/doorstop-en-20191217.pdf https://ico.org.uk/media/action-weve-taken/enforcement-notic... On 24 July 2018 the MHRA had executed a search warrant at the premises of Doorstep Dispensaree under the Human Medicines Regulations. In the course of its search, the MHRA discovered, stored in a rear courtyard, 47 crates, 2 disposal bags and 1 cardboard box full of documents containing personal data. MHRA estimated approximately 500,000 documents but cannot estimate the number of data subjects. MHRA have inspected the crates and the information contains: a. Names b. Addresses c. Dates of Birth d. NHS Numbers e. Medical Information f. Prescriptions The dates on the documents range from January 2016 - June 2018. The documents were not secure and they were not marked as confidential waste. Some of the documents were soaking wet, indicating that they had been stored in this way for some time. I doubt there is a purely technical solution to finding this kind of problem :) Edit: to be clear, the violation type here seems to have been "Insufficient technical and organisational measures to ensure information security"
    - jtbayly 5y ago
      In other words, the big claim that the GDPR applies to every site in the world... is not true. Just like I've said from the beginning.
      - janto 5y ago
        Actually, it could be applied in an extraterritorial way. The GDPR applies to processing of data of individuals located in the EU/EEU and states the rights of these "data subjects". If your business violates the GDPR and wishes to also operate within the European Economic Area, it could face fines and penalties.
blitzar 5y ago
Yep. Now everybody has to decide if they actually believe the government where they live has the ability to tell them exactly when and who, if anyone they are allowed to murder for no reason at all.
- jtbayly 5y ago
  I don’t live in the EU, which is the main point. The EU says it is illegal for anybody in the world to use Google Fonts. Guess how many people outside the EU care what the EU says they can and can’t do on their website. How many millions of websites are there using Google Fonts right now? How many were there last week? How many will there be next week? That tells you everything you need to know.
  - blitzar 5y ago
    > The EU says it is illegal for anybody in the world to use Google Fonts Total and utter horeshit, and you are fully aware of it.
    - jtbayly 5y ago
      I’m sorry if I misunderstood. The post I’m commenting on said Google Fonts are no no, did it not?
      - blitzar 5y ago
        When you sell chicken in the EU it cant be washed in chlorie. That does not mean that the EU have banned anyone in the world from bathing their chickens in chlorine, but if you present your goods to the block it must comply with the laws of the block. Likewise when you present your website to people within the block, you must comply with the laws of the block. btw when you factory farm animals 10 high and they live their entire lives covered in the faeces from the 9 layers of chickens above is actually a good idea to give them a wash and disinfect them.
        5y ago
hans1729 5y ago
Either the customers who care about privacy trust you, or they don't. Let n cases show up in the news where US-companies are ignoring the respective rulings and the US-market will simply lose any attraction it still has left for european customers. If I have the choice between an american service and a european one, I'll choose the latter every single time, because I wouldn't trust american companies, the american government, or american citizens at all. Your comment isn't the reason why, but very likely stems from the same causes. Also, the public sector matters a lot here: they can't risk to have the data going to the US when they are legally mandated to keep it in Europe. This demand already exists and won't go anywhere, leading to all kinds of services being re-engineered on european soil. Eventually any company who doesn't respect their users privacy will probably be phased out by a european alternative - at least for the customers who care about that sort of thing. Europe made very clear that it does, but sure, time will tell what disrespecting that market segment will do to market shares.
- jtbayly 5y ago
  You do realize the vast majority of websites don’t even have customers, right? Ask me how much I care whether my non-existent customers decide they don’t want to be my customer. And I’ll ask you how in the world a visitor to my website is supposed to know or care whether my site is hosted in the US or EU. I’m not even 100% sure myself.
  - hans1729 5y ago
    >And I’ll ask you how in the world a visitor to my website is supposed to know or care whether my site is hosted in the US or EU. I’m not even 100% sure myself. Pretty sure we'll see indicators for that in browsers in the foreseeable future. The internet will be a much more zoned-space in the future, so much seems obvious. > You do realize the vast majority of websites don’t even have customers, right? customer <- visitor
- rpdillon 5y ago
  This path leads towards the balkanization of the web, which is a step backward in my estimation. This tool reports that static sites with no JS, no cookies, and no third-party requests are in violation because they are hosted in a place other than the EU. That surprises me greatly. It seems from your comments downthread that this is the direction you see things going (i.e. a more fragmented internet), and that may be correct, but I see it as a huge loss, and I _highly_ doubt it will solve any of the privacy problems we have. Now that I think about it, if an IP address is PII, and leaking PII outside of the EU is a violation, I wonder if any P2P network can be legal in the EU, since P2P networks leak IPs globally. How would IPFS or Bittorrent work? A quick search shows that this is indeed an issue, and the most P2P networks don't support the necessary revocation of PII necessary. IEEE has an early access paper[0] about exactly this issue: > To comply with the criteria of the European Union's General Data Protection Regulation, it is important to ensure that personal data can be completely removed by their owners. To improve the privacy and security of the P2P file-sharing system, we propose a revocable and monitorable P2P file-sharing system over a consortium blockchain to achieve revocation of files in the decentralized environment. So, for everyone who said blockchain is a solution in search of a problem, I present GDPR-compliant P2P networks! I'm mostly kidding, my brief read through the abstract suggests this also requires a bunch of other heavy-handed measures, like securely verifying the P2P executable using Intel SGX. It's hard for me to imagine such a system gaining any sort of widespread use, but I've been wrong before. [0]: https://ieeexplore.ieee.org/abstract/document/9684748 https://ieeexplore.ieee.org/abstract/document/9684748