3 ms·

> ridiculous conclusions > - IP addresses are personally identifiable information I really thought you were going to go in a different direction than this. Th

> ridiculous conclusions > - IP addresses are personally identifiable information I really thought you were going to go in a different direction than this. This is very obvious and there's nothing ridiculous about it. To most people in the EU, an IP address gives a very high resolution to a person. > That means it is non-compliant to host your website at e.g. AWS Yes, this is correct. AWS, Azure and GCP cannot possibly be compliant. It's taking everyone a while to figure this out. There's nothing wrong with that, privacy-sensitive information should never touch the US. No US-based company can guarantee your privacy. > effectively everyone is non-compliant. This is of course hyperbole. If you don't log or track you are perfectly compliant in every case.

dmitriid 5y ago
Additionally, for data that's strictly needed for your business, you don't even need to ask consent, but you're responsible for keeping data safe. It's weird how the whole "you need to keep your users' data safe and not collect more than is necessary" is such a controversial topic for some on HN.
- krageon 5y ago
  > It's weird how the whole "you need to keep your users' data safe and not collect more than is necessary" is such a controversial topic for some on HN. I think it stems from a long lawless time online where everyone was free to aggressively exploit everyone else. The fact that such behaviour is becoming frowned upon is something that we should expect will generate some friction. That said, I also find it hard to empathise with.
dkyc 5y ago
> If you don't log or track you are perfectly compliant in every case. But that is simply not true, right? If I host my website on AWS and 'log or track' nothing I am still not compliant. It's not about what I do as a website provider, it's effectively outlawing working with companies based in other jurisdictions.
- krageon 5y ago
  > based in other jurisdictions. Instead of this we can just say "the US" and only because of local laws and hyper-invasive corporate culture.
  - dkyc 5y ago
    It's definitely 'other jurisdictions'. There's a (short) whitelist of countries that are deemed adequate, which you can find here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en https://ec.europa.eu/info/law/law-topic/data-protection/inte... To save you the click, it's Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom and Uruguay. These are 14 countries.
    - krageon 5y ago
      You can use a provider from anywhere, as long as you know they do not track. "The effect of such a decision is that personal data can flow from the EU (and Norway, Liechtenstein and Iceland) to that third country without any further safeguard being necessary." operant words being "without any further safeguard".
freemint 5y ago
My impression was they can very much be compliant as long as they sign a contract with you that they only process data themselves in manner compliant with GDPR in the services you make available for EU citizens.
erik_seaberg 5y ago
> If you don't log or track you are perfectly compliant in every case The GDPR is not merely a list of bad things not to do. You must also hire people to carry out slow and expensive processes to continually demonstrate compliance, e.g., https://gdpr-info.eu/art-36-gdpr/ https://gdpr-info.eu/art-36-gdpr/.

dmitriid 5y ago

Additionally, for data that's strictly needed for your business, you don't even need to ask consent, but you're responsible for keeping data safe. It's weird how the whole "you need to keep your users' data safe and not collect more than is necessary" is such a controversial topic for some on HN.

krageon 5y ago
> It's weird how the whole "you need to keep your users' data safe and not collect more than is necessary" is such a controversial topic for some on HN. I think it stems from a long lawless time online where everyone was free to aggressively exploit everyone else. The fact that such behaviour is becoming frowned upon is something that we should expect will generate some friction. That said, I also find it hard to empathise with.

dkyc 5y ago

> If you don't log or track you are perfectly compliant in every case. But that is simply not true, right? If I host my website on AWS and 'log or track' nothing I am still not compliant. It's not about what I do as a website provider, it's effectively outlawing working with companies based in other jurisdictions.

krageon 5y ago
> based in other jurisdictions. Instead of this we can just say "the US" and only because of local laws and hyper-invasive corporate culture.
- dkyc 5y ago
  It's definitely 'other jurisdictions'. There's a (short) whitelist of countries that are deemed adequate, which you can find here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en https://ec.europa.eu/info/law/law-topic/data-protection/inte... To save you the click, it's Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom and Uruguay. These are 14 countries.
  - krageon 5y ago
    You can use a provider from anywhere, as long as you know they do not track. "The effect of such a decision is that personal data can flow from the EU (and Norway, Liechtenstein and Iceland) to that third country without any further safeguard being necessary." operant words being "without any further safeguard".

freemint 5y ago

My impression was they can very much be compliant as long as they sign a contract with you that they only process data themselves in manner compliant with GDPR in the services you make available for EU citizens.

erik_seaberg 5y ago

> If you don't log or track you are perfectly compliant in every case The GDPR is not merely a list of bad things not to do. You must also hire people to carry out slow and expensive processes to continually demonstrate compliance, e.g., https://gdpr-info.eu/art-36-gdpr/ https://gdpr-info.eu/art-36-gdpr/.