5 ms·

I believe the authorities are correct here. Shopify is sending all personal data to CloudFlare, CloudFront (Amazon) and Fastly, so 3 US companies. They could s

I believe the authorities are correct here. Shopify is sending all personal data to CloudFlare, CloudFront (Amazon) and Fastly, so 3 US companies. They could sign so-called "data processing agreements" where they promise to safeguard personal data. But the Shopify FAQ explicitly states that they are unwilling to do so. As the result, Shopify is legally considered to not be processing data under the instructions of the shop owner, because they didn't sign the processing agreement. Instead, Shopify is legally considered to be the owner of the user data. And that's a problem with EU clients because they are a US company working with US CDNs. Still, all of this could easily be rectified by Shopify if they would just care enough to sign the correct paperwork.

AdrianB1 4y ago
As the author showed the volume of business and revenue in Germany is tiny, there may be not worth the effort for Shopify to do it. It may be the correct business decision. The differences in laws and requirements by country is one of the biggest factors to consider when providing international services of any sort.
- fxtentacle 4y ago
  I believe that's misleading, because while not many sellers are located in Germany, this affects any Shopify shop who sells to customers anywhere in the EU. So I'd estimate roughly 30% of their revenue might be affected. But of course, Shopify can just push this responsibility onto their customers, meaning the shop owners. That's what they currently do.
- radicalbyte 4y ago
  This affects the entire EU. I try to hammer it into people's heads here in NL. Using US-based cloud services if you touch PII is a huge risk as they're all getting like crazed addicts fighting over their next high PII-high.
  - boringg 4y ago
    It's the way the EU can protect their own tech industry.
    - hyperman1 4y ago
      While this is true, it is too easy. The privacy angle lives in the minds of Europeans, while US people seem to care a lot less.
      - boringg 4y ago
        Agree it is both but it is very palatable in the local population to implement rules to shutout foreign competition. Easy political points.
      - kmlx 4y ago
        > The privacy angle lives in the minds of Europeans without data, it’s hard to make this argument. what we know for sure is that bureaucrats fully support the privacy angle. but from my anecdotal real life experience almost no one cares (another argument that without data cannot be generalised).
        XAMPPRocky 4y ago
        The "bureaucrats" are elected officials so if people weren't in favour of it, they would stop electing MEPs that vote in favour of it.
        bmitc 4y ago
        That’s a naïve view of how politics and elections work.
        rootusrootus 4y ago
        When has any democracy worked even remotely like that? There are countless issues politicians must take a position on, you won't agree with all of them. So you prioritize. Or you just vote party line, which is by far what most people do.
- kergonath 4y ago
  > As the author showed the volume of business and revenue in Germany is tiny, there may be not worth the effort for Shopify to do it. It may be the correct business decision. The issue is with European regulations. The lawsuit was in Germany because that’s how legal systems work around here, but the sticking points are very likely to be present in national laws across the EU. So, ultimately it won’t be about the German market, but about the EU.
  - cameronh90 4y ago
    Each EU country does seem to have a different approach to the GDPR though. Germany's one is known for being particularly hard line, whereas the UK (not in EU but still follows GDPR) is known for being more pragmatic. I don't know how that affects lawsuits though. I'm guessing if you have any customers in Germany, then someone could take you to court in Germany, but I'm not sure...
jdross 4y ago
Shopify is a Canadian company, does this change anything?
- toyg 4y ago
  I don't think that matters - what matters is where the processing servers are. And if they are using CloudFront etc, they are sending data to the US.
  - rurban 4y ago
    But those 3 US companies all signed the safe heaven agreement, AFAIK.
    - anonymousab 4y ago
      Agreements mean nothing because the problem is with US law, which these companies cannot countermand.
    - Hanschri 4y ago
      The Safe Harbor Agreement was invalidated by the Schrems I case in 2015. The Schrems II case from 2020 invalidated the EU-US Privacy Shield Agreement. In addition, the physical location of the servers do not change anything when the company operating those servers is American. They still need to comply with the CLOUD Act, even to the point of pulling data and encryption keys from servers based in the EU.
yashap 4y ago
I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly). > The data protection authority justified this with the fact that US authorities could access personal data (probably primarily the IP address) for criminal purposes on the basis of the CLOUD Act, among other things. This occurs regardless of whether data is stored on servers in the USA or Europe. I have to imagine the particular bureaucrats the author was dealing with are somehow wrong here? Otherwise this implies that a European business cannot use basically any American software (directly or even indirectly, like this case), even if that software fully conforms with processing and storing all data in Europe. The fact that American authorities could coerce any American company into turning data over, even if it’s stored in Europe, is enough?
- luckylion 4y ago
  > I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly). From what I can tell, Shopify itself uses Cloudflare, so your domain that is connected to Shopify is passing all the traffic through Cloudflare, e.g. one of the other examples in the screenshot: https://www.distortedpeople.com/ https://www.distortedpeople.com/ The site is on CF (and it sets like 10 cookies, including tracking cookies, pre consent, so any dreams of compliance are gone either way), and, as far as I can tell, that's the case with all Shopify shops (but I've only ever looked into that from an outsider's perspective, maybe that's optional).
  - abliefern 4y ago
    The article quotes Shopify explicitly saying otherwise.
    - luckylion 4y ago
      Maybe they're doing something special on checkout? The main sites (including their own) are obviously using CF as a CDN not just for static assets, but for document requests as well.
deleted 4y ago
[deleted]
tremon 4y ago
Instead, Shopify is legally considered to be the owner of the user data As I see it, Shopify's role in this situation is more likely to be considered a data fence: because of the lack of processing agreement, they're not allowed to process any data (more accurately, the shop owner is not allowed to give them access to any data). The data that they do have through services they provide is illegally obtained; that doesn't mean they suddenly own that data.

AdrianB1 4y ago

As the author showed the volume of business and revenue in Germany is tiny, there may be not worth the effort for Shopify to do it. It may be the correct business decision. The differences in laws and requirements by country is one of the biggest factors to consider when providing international services of any sort.

fxtentacle 4y ago
I believe that's misleading, because while not many sellers are located in Germany, this affects any Shopify shop who sells to customers anywhere in the EU. So I'd estimate roughly 30% of their revenue might be affected. But of course, Shopify can just push this responsibility onto their customers, meaning the shop owners. That's what they currently do.
radicalbyte 4y ago
This affects the entire EU. I try to hammer it into people's heads here in NL. Using US-based cloud services if you touch PII is a huge risk as they're all getting like crazed addicts fighting over their next high PII-high.
- boringg 4y ago
  It's the way the EU can protect their own tech industry.
  - hyperman1 4y ago
    While this is true, it is too easy. The privacy angle lives in the minds of Europeans, while US people seem to care a lot less.
    - boringg 4y ago
      Agree it is both but it is very palatable in the local population to implement rules to shutout foreign competition. Easy political points.
    - kmlx 4y ago
      > The privacy angle lives in the minds of Europeans without data, it’s hard to make this argument. what we know for sure is that bureaucrats fully support the privacy angle. but from my anecdotal real life experience almost no one cares (another argument that without data cannot be generalised).
      - XAMPPRocky 4y ago
        The "bureaucrats" are elected officials so if people weren't in favour of it, they would stop electing MEPs that vote in favour of it.
        bmitc 4y ago
        That’s a naïve view of how politics and elections work.
        rootusrootus 4y ago
        When has any democracy worked even remotely like that? There are countless issues politicians must take a position on, you won't agree with all of them. So you prioritize. Or you just vote party line, which is by far what most people do.
kergonath 4y ago
> As the author showed the volume of business and revenue in Germany is tiny, there may be not worth the effort for Shopify to do it. It may be the correct business decision. The issue is with European regulations. The lawsuit was in Germany because that’s how legal systems work around here, but the sticking points are very likely to be present in national laws across the EU. So, ultimately it won’t be about the German market, but about the EU.
- cameronh90 4y ago
  Each EU country does seem to have a different approach to the GDPR though. Germany's one is known for being particularly hard line, whereas the UK (not in EU but still follows GDPR) is known for being more pragmatic. I don't know how that affects lawsuits though. I'm guessing if you have any customers in Germany, then someone could take you to court in Germany, but I'm not sure...

jdross 4y ago

Shopify is a Canadian company, does this change anything?

toyg 4y ago
I don't think that matters - what matters is where the processing servers are. And if they are using CloudFront etc, they are sending data to the US.
- rurban 4y ago
  But those 3 US companies all signed the safe heaven agreement, AFAIK.
  - anonymousab 4y ago
    Agreements mean nothing because the problem is with US law, which these companies cannot countermand.
  - Hanschri 4y ago
    The Safe Harbor Agreement was invalidated by the Schrems I case in 2015. The Schrems II case from 2020 invalidated the EU-US Privacy Shield Agreement. In addition, the physical location of the servers do not change anything when the company operating those servers is American. They still need to comply with the CLOUD Act, even to the point of pulling data and encryption keys from servers based in the EU.

yashap 4y ago

I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly). > The data protection authority justified this with the fact that US authorities could access personal data (probably primarily the IP address) for criminal purposes on the basis of the CLOUD Act, among other things. This occurs regardless of whether data is stored on servers in the USA or Europe. I have to imagine the particular bureaucrats the author was dealing with are somehow wrong here? Otherwise this implies that a European business cannot use basically any American software (directly or even indirectly, like this case), even if that software fully conforms with processing and storing all data in Europe. The fact that American authorities could coerce any American company into turning data over, even if it’s stored in Europe, is enough?

luckylion 4y ago
> I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly). From what I can tell, Shopify itself uses Cloudflare, so your domain that is connected to Shopify is passing all the traffic through Cloudflare, e.g. one of the other examples in the screenshot: https://www.distortedpeople.com/ https://www.distortedpeople.com/ The site is on CF (and it sets like 10 cookies, including tracking cookies, pre consent, so any dreams of compliance are gone either way), and, as far as I can tell, that's the case with all Shopify shops (but I've only ever looked into that from an outsider's perspective, maybe that's optional).
- abliefern 4y ago
  The article quotes Shopify explicitly saying otherwise.
  - luckylion 4y ago
    Maybe they're doing something special on checkout? The main sites (including their own) are obviously using CF as a CDN not just for static assets, but for document requests as well.

deleted 4y ago

[deleted]

tremon 4y ago

Instead, Shopify is legally considered to be the owner of the user data As I see it, Shopify's role in this situation is more likely to be considered a data fence: because of the lack of processing agreement, they're not allowed to process any data (more accurately, the shop owner is not allowed to give them access to any data). The data that they do have through services they provide is illegally obtained; that doesn't mean they suddenly own that data.