6 ms·

No, the legal costs of compliance, having a lawyer verify stuff, having a designated Data Protection Officer, etc, are a lot when your some small town newspaper

by kayfox 4y ago

No, the legal costs of compliance, having a lawyer verify stuff, having a designated Data Protection Officer, etc, are a lot when your some small town newspaper.

skilled 4y ago
Ok, well, I have no idea how all that works in the USA. But, hosting a plaintext news site requires you to get a lawyer involved if you want to serve EU visitors? Sorry but that makes very little sense to me. Verify what? That the news are in fact written in English?
- quartz 4y ago
  > Verify what? ...that can be an expensive question to answer if you're trying to be in compliance and don't know what compliance means. Even an answer of "you need to do nothing" can be pretty expensive.
  - jacquesm 4y ago
    Show me one single instance of a US company that was fined by the EU for being out of compliance when that wasn't patently obvious and without them being warned time and again first. Just one. I'll wait.
    - ziddoap 4y ago
      I'm going to go out on a limb and guess that you aren't involved in much risk analysis? Whether or not someone has already been fined (even within your constraints) influences the risk decision, but it does not remove the risk. Since there is still risk, it must be weighed against the organization's risk tolerance. Evidently, the risk still exceeds the risk tolerance of several smaller websites.
      - jacquesm 4y ago
        > I'm going to go out on a limb and guess that you aren't involved in much risk analysis? Try again. I take it you have rock falling from the sky insurance as well? And don't forget about the crocodiles.
        ziddoap 4y ago
        >Try again. They say, without refuting anything. >I take it you have rock falling from the sky insurance as well? And don't forget about the crocodiles. I have life insurance, yep! Which includes accidents, etc. Not that either of those situations is remotely analogous to GDPR fines. Edit: I should make it clear that I don't operate the sites, so if your upset about what conclusion these websites came to, take it up with them. I am just pointing out that there still is a risk, and it is obvious that this remaining risk matters to some of these sites as they choose not to serve EU visitors. Do I block EU citizens from my site? No, I don't.
        jacquesm 4y ago
        It's not the risk analysis that drives these companies to shut down EU traffic, it is cost benefit analysis. Until the USA implements a similar law - hopefully without the warts, which the GDPR definitely has - this situation will persist. Note that parties that make money on their products rather than on their users have no problem with GDPR compliance at all.
    - bityard 4y ago
      If you are a US business and have no interest in reaching EU customers, why take the risk, even if it's very small?
      - jacquesm 4y ago
        The simple truth is: these companies are trampling the rights of their visitors, EU or otherwise, but in the case of the EU they have decided that if they can't do that that they'd rather not see them at all. Make of that what you will, but if I were living in the US and an entity would block the EU I would take that as a very bad sign regarding the stewardship of my data in the hands of that company.
- colpabar 4y ago
  here is how I imagine the tech-savvy people at the monterey county weekly handled the news of GDPR. lawyer: so there's this new EU law that could get us in trouble if we keep using google analytics and an EU citizen tries to access our site manager: do we have to comply? lawyer: we could, but it would require work. we can also just block visitors from the EU and not have to worry about it at all manager: ok moving on
- kayfox 4y ago
  Verify all of the following are compliance with GDPR: * Logs, including firewall logs, web server logs, WAF logs, flow logs, etc. (Remember: Under a number of legal interpretations of GDPR, an IP address is a unique identifier.) * Any comment sections, feedback forms, contact forms, etc. * WAF, Anti-Bot, DDoS protection. * Any third party vendors used in serving the site, and the specific integrations. * Advertisements, which the side probably depends on for a lot of its income.
- kmlx 4y ago
  > hosting a plaintext news site requires you to get a lawyer involved if you want to serve EU visitors? you clearly have not dealt with GDPR. you have 3 options: 1. you do it properly. it will cost a lot of time and money. you will need to hire or sub contract. sometime subcontracting costs even more than hiring. 2. you completely ignore the problem. you hope some activist won’t notify the european authorities. 3. you put up a firewall. the cheapest and safest route is 3.
  - baud147258 4y ago
    > 2. you completely ignore the problem. you hope some activist won’t notify the european authorities. has that ever happened?

by kayfox 4y ago

No, the legal costs of compliance, having a lawyer verify stuff, having a designated Data Protection Officer, etc, are a lot when your some small town newspaper.

skilled 4y ago

Ok, well, I have no idea how all that works in the USA. But, hosting a plaintext news site requires you to get a lawyer involved if you want to serve EU visitors? Sorry but that makes very little sense to me. Verify what? That the news are in fact written in English?

quartz 4y ago
> Verify what? ...that can be an expensive question to answer if you're trying to be in compliance and don't know what compliance means. Even an answer of "you need to do nothing" can be pretty expensive.
- jacquesm 4y ago
  Show me one single instance of a US company that was fined by the EU for being out of compliance when that wasn't patently obvious and without them being warned time and again first. Just one. I'll wait.
  - ziddoap 4y ago
    I'm going to go out on a limb and guess that you aren't involved in much risk analysis? Whether or not someone has already been fined (even within your constraints) influences the risk decision, but it does not remove the risk. Since there is still risk, it must be weighed against the organization's risk tolerance. Evidently, the risk still exceeds the risk tolerance of several smaller websites.
    - jacquesm 4y ago
      > I'm going to go out on a limb and guess that you aren't involved in much risk analysis? Try again. I take it you have rock falling from the sky insurance as well? And don't forget about the crocodiles.
      - ziddoap 4y ago
        >Try again. They say, without refuting anything. >I take it you have rock falling from the sky insurance as well? And don't forget about the crocodiles. I have life insurance, yep! Which includes accidents, etc. Not that either of those situations is remotely analogous to GDPR fines. Edit: I should make it clear that I don't operate the sites, so if your upset about what conclusion these websites came to, take it up with them. I am just pointing out that there still is a risk, and it is obvious that this remaining risk matters to some of these sites as they choose not to serve EU visitors. Do I block EU citizens from my site? No, I don't.
        jacquesm 4y ago
        It's not the risk analysis that drives these companies to shut down EU traffic, it is cost benefit analysis. Until the USA implements a similar law - hopefully without the warts, which the GDPR definitely has - this situation will persist. Note that parties that make money on their products rather than on their users have no problem with GDPR compliance at all.
  - bityard 4y ago
    If you are a US business and have no interest in reaching EU customers, why take the risk, even if it's very small?
    - jacquesm 4y ago
      The simple truth is: these companies are trampling the rights of their visitors, EU or otherwise, but in the case of the EU they have decided that if they can't do that that they'd rather not see them at all. Make of that what you will, but if I were living in the US and an entity would block the EU I would take that as a very bad sign regarding the stewardship of my data in the hands of that company.
colpabar 4y ago
here is how I imagine the tech-savvy people at the monterey county weekly handled the news of GDPR. lawyer: so there's this new EU law that could get us in trouble if we keep using google analytics and an EU citizen tries to access our site manager: do we have to comply? lawyer: we could, but it would require work. we can also just block visitors from the EU and not have to worry about it at all manager: ok moving on
kayfox 4y ago
Verify all of the following are compliance with GDPR: * Logs, including firewall logs, web server logs, WAF logs, flow logs, etc. (Remember: Under a number of legal interpretations of GDPR, an IP address is a unique identifier.) * Any comment sections, feedback forms, contact forms, etc. * WAF, Anti-Bot, DDoS protection. * Any third party vendors used in serving the site, and the specific integrations. * Advertisements, which the side probably depends on for a lot of its income.
kmlx 4y ago
> hosting a plaintext news site requires you to get a lawyer involved if you want to serve EU visitors? you clearly have not dealt with GDPR. you have 3 options: 1. you do it properly. it will cost a lot of time and money. you will need to hire or sub contract. sometime subcontracting costs even more than hiring. 2. you completely ignore the problem. you hope some activist won’t notify the european authorities. 3. you put up a firewall. the cheapest and safest route is 3.
- baud147258 4y ago
  > 2. you completely ignore the problem. you hope some activist won’t notify the european authorities. has that ever happened?