6 ms·
> You and your business are crossing borders when you serve traffic I’d argue that if the request originates outside my country, the customer has crossed the b
by wepple 5y ago
> You and your business are crossing borders when you serve traffic
I’d argue that if the request originates outside my country, the customer has crossed the border with the intent to bring the content back to their country
- rovr138 5y agoI'd definitely put the onus on them. It's pretty insane that even routing and logs will cause issues because of a law on their side.
- netizen-936824 5y agoI agree there, but also there is the perspective that the consumer of the content did not ask your server to take their data for analytics purposes. So it goes both ways
- rovr138 5y agoI understand that, but even without analytics, it wouldn't conform simply because it's hosted in the US and the IP can be stored there. The way routing works, you can't prevent the IP from going to the US if it's just hosted there.
- netizen-936824 5y agoAFAIK the IP from requests doesn't necessarily need to be logged or stored anywhere, does it? Perhaps this comes from my lack of understanding of GDPR but I thought the issue was from storage where it could be retrieved or shared
- janto 5y agoThe problem is that the US CLOUD act compels US companies to provide data access to US agencies, regardless of where the data flows. It could even be servers on EU soil. EU courts hold that these kind of acts violate the data rights of individuals located in the EU.
- bryanrasmussen 5y agowell, it seems that the EU has already decided that is not going to be the interpretation they will accept so argue away. There are also thousands of different analogies like yours that one might choose that would put the benefit on the EU side, for example, someone might argue your website is like a product and as such is open to all sorts of regulations and taxes when it gets 'imported'.
- colechristensen 5y agoThe result of this argument is that every company can easily make themselves immune to all laws and regulation by setting up shells across borders.
- KptMarchewa 5y agoAs long as they don't register users, accept payments, etc - just serve content - I'm okay with this interpretation.
- colechristensen 5y agoAnd if they, keep records of unregistered users, track their behavior, and sell that data or use it to make business decisions?
- KptMarchewa 5y agoAs long as they do it on their site, not third-party ones or via third-party ones, then also ok.
- pinephoneguy 5y agoI'm not sure GDPR applies if they're not using any third party services. That's the thing with GDPR compliance, if you're already doing things right it doesn't really change anything, you don't even need to ask about cookies (because cookies are actually ok under GDPR if they're used the way they were originally intended.)
- kazinator 5y agoSounds good to me; I'd like to take advantage of something like that one of these days.
- janto 5y agoIt's not actually about serving traffic across borders, it's about what you collect. If you collect PII, according to EU courts, you are responsible for it and will be held responsible if you plan to do business in the EU.