4 ms·

FWIW, I just wrote a privacy policy and terms of service for my app. I’m not a lawyer and I don’t understand GDPR. I could probably understand it if I took the

FWIW, I just wrote a privacy policy and terms of service for my app. I’m not a lawyer and I don’t understand GDPR. I could probably understand it if I took the time to do some research. But, at this point, I don’t have a single user and I don’t think going after the EU as an early adopter (and the time spent to make sure I’m actually compliant with their laws) is a better use of my time than targeting people in a jurisdiction I understand and can be reasonably sure I’m following the laws of. So, instead of figuring out all of the laws of all the countries, my ToS require you to attest that you’re in the United States and using the service under U.S. law. If you try to access my product from the EU, you’re in breach of our contract. If you believe I’m mishandling your data under another countries law, send me your account and I’ll gladly disable it. I suspect this is going to become increasingly common as companies try to regulate digital imports/exports. I’m not interested in assuming legal liability for sending bits across a border.

martin8412 4y ago
Your contract is irrelevant. If you process data of EU subjects, then you're bound by the rules of GDPR regardless of what your contract contains. You can't sign away your rights in the EU, so I can lie and say that I'm in the US, and that's entirely your problem.
- pb7 4y ago
  Is it his problem? He doesn’t have to respect GDPR because he doesn’t operate in the EU. Sounds like it’s your problem if he doesn’t handle your data the way you think he does.
  - lfodofod 4y ago
    European authorities are still able to enforce fines against him unless he’s exceedingly careful, even if he doesn’t have direct presence in the EU. This is why many websites just block European IP addresses entirely. You might think you’re safe in the US, but perhaps you use a payment processor with significant European presence? Stripe or Paypal, for example. European authorities can take your money.
    - r3trohack3r 4y ago
      > This is why many websites just block European IP addresses entirely. This is not sufficient. IP addresses do not have sovereign rights and only loosely correlate with the legal jurisdiction of the user behind the originating packet. This is a world where, by connecting to the internet and exchanging packets, you are simultaneously liable for every law under every jurisdiction; it’s just a game of roulette which jurisdiction the packet you receive is coming from. This doesn’t seem scalable, sustainable, or particularly good for human/civil rights.
    - pb7 4y ago
      No, they can’t. People in sovereign countries aren’t beholden to your country’s laws. The EU can block access to the site from inside but nothing more. It doesn’t rule the world.
      - lfodofod 4y ago
        Of course they can.
      - martin8412 4y ago
        They can just fine you. If you don't pay up, you're persona non grata in the EU.
        deleted 4y ago
        [deleted]
        johngladtj 4y ago
        At this point that should be considered a badge of honor
- r3trohack3r 4y ago
  > If you process data of EU subjects Will be interesting so see how this shakes out in the courts over the next few decades. It’s not possible to know the legal jurisdiction of the user represented by an incoming packet with today’s internet. To me this sounds like a random person in a random country smuggling their data across a boarder into my system without my consent. Have a hard time reconciling my views on privacy and individual freedom with a world where a random country can hold me liable for some random law in their jurisdiction when I never consented to doing business with their citizens.
  - slim 4y ago
    he's a under eu juridiction if he says so (say when he asks you to delete his data). this has the added feature that gdpr protects all netizens :) yay
corobo 4y ago
Following GDPR is effectively equivalent to respecting your users' privacy. What are you doing that the GDPR doesn't allow? You do you of course but at this point GDPR has been round long enough I'm assuming you're looking to double dip and sell my details. Best case scenario you don't trust your own security. GDPR is only really scary if you're doing questionable things with your user data. If you're just annoyed at it because it's another thing you need to learn (you have you learn stuff to do a business??) alright fair, no worries. Look into it later tho. If it's in your way? You're posting your receipts to HN for folks to reference later in jokes haha. Your very own "They trust me. Dumb fucks" E: Case in point one of your Show HNs handily referenced "End Mass Surveillance Our government is actively breaking its own laws. [..]" Why would anyone believe in your campaign when you don't even want to end mass surveillance in your own projects? :)
- r3trohack3r 4y ago
  > Following GDPR is effectively equivalent to respecting your users' privacy. What are you doing that the GDPR doesn't allow? Might be. Might not. No way for me to know without understanding the GDPR. And I’m not interested in studying that law at this point. My privacy policy is transparent, lists the vendors I do business with and how they are involved with handling data, and what I use data for. > GDPR is only really scary if you're doing questionable things with your user data. Any regulation that contains any sort of legal liability that I don’t understand is scary. If I’m compliant, it’s by luck. I’m certainly not compliant deliberately because I don’t understand the GDPR. Am I willing to gamble on luck so EU citizens can access my service? Nope. I’d go as far as saying “just be a good person and assume you aren’t going to be held liable in the EU” is a bad take and you shouldn’t promote people taking such a lax approach to legal compliance.
  - corobo 4y ago
    Sorry for disengaging here but I got nothing lmao. From my POV that's like deciding to not follow copyright law anymore. Uh.. cool. Lol. If you're legit doing the rest as you say then congratulations you're already GDPR compliant, you're just being stubborn. Seems a waste of brain cycles.

martin8412 4y ago

Your contract is irrelevant. If you process data of EU subjects, then you're bound by the rules of GDPR regardless of what your contract contains. You can't sign away your rights in the EU, so I can lie and say that I'm in the US, and that's entirely your problem.

pb7 4y ago
Is it his problem? He doesn’t have to respect GDPR because he doesn’t operate in the EU. Sounds like it’s your problem if he doesn’t handle your data the way you think he does.
- lfodofod 4y ago
  European authorities are still able to enforce fines against him unless he’s exceedingly careful, even if he doesn’t have direct presence in the EU. This is why many websites just block European IP addresses entirely. You might think you’re safe in the US, but perhaps you use a payment processor with significant European presence? Stripe or Paypal, for example. European authorities can take your money.
  - r3trohack3r 4y ago
    > This is why many websites just block European IP addresses entirely. This is not sufficient. IP addresses do not have sovereign rights and only loosely correlate with the legal jurisdiction of the user behind the originating packet. This is a world where, by connecting to the internet and exchanging packets, you are simultaneously liable for every law under every jurisdiction; it’s just a game of roulette which jurisdiction the packet you receive is coming from. This doesn’t seem scalable, sustainable, or particularly good for human/civil rights.
  - pb7 4y ago
    No, they can’t. People in sovereign countries aren’t beholden to your country’s laws. The EU can block access to the site from inside but nothing more. It doesn’t rule the world.
    - lfodofod 4y ago
      Of course they can.
    - martin8412 4y ago
      They can just fine you. If you don't pay up, you're persona non grata in the EU.
      - deleted 4y ago
        [deleted]
      - johngladtj 4y ago
        At this point that should be considered a badge of honor
r3trohack3r 4y ago
> If you process data of EU subjects Will be interesting so see how this shakes out in the courts over the next few decades. It’s not possible to know the legal jurisdiction of the user represented by an incoming packet with today’s internet. To me this sounds like a random person in a random country smuggling their data across a boarder into my system without my consent. Have a hard time reconciling my views on privacy and individual freedom with a world where a random country can hold me liable for some random law in their jurisdiction when I never consented to doing business with their citizens.
- slim 4y ago
  he's a under eu juridiction if he says so (say when he asks you to delete his data). this has the added feature that gdpr protects all netizens :) yay

corobo 4y ago

Following GDPR is effectively equivalent to respecting your users' privacy. What are you doing that the GDPR doesn't allow? You do you of course but at this point GDPR has been round long enough I'm assuming you're looking to double dip and sell my details. Best case scenario you don't trust your own security. GDPR is only really scary if you're doing questionable things with your user data. If you're just annoyed at it because it's another thing you need to learn (you have you learn stuff to do a business??) alright fair, no worries. Look into it later tho. If it's in your way? You're posting your receipts to HN for folks to reference later in jokes haha. Your very own "They trust me. Dumb fucks" E: Case in point one of your Show HNs handily referenced "End Mass Surveillance Our government is actively breaking its own laws. [..]" Why would anyone believe in your campaign when you don't even want to end mass surveillance in your own projects? :)

r3trohack3r 4y ago
> Following GDPR is effectively equivalent to respecting your users' privacy. What are you doing that the GDPR doesn't allow? Might be. Might not. No way for me to know without understanding the GDPR. And I’m not interested in studying that law at this point. My privacy policy is transparent, lists the vendors I do business with and how they are involved with handling data, and what I use data for. > GDPR is only really scary if you're doing questionable things with your user data. Any regulation that contains any sort of legal liability that I don’t understand is scary. If I’m compliant, it’s by luck. I’m certainly not compliant deliberately because I don’t understand the GDPR. Am I willing to gamble on luck so EU citizens can access my service? Nope. I’d go as far as saying “just be a good person and assume you aren’t going to be held liable in the EU” is a bad take and you shouldn’t promote people taking such a lax approach to legal compliance.
- corobo 4y ago
  Sorry for disengaging here but I got nothing lmao. From my POV that's like deciding to not follow copyright law anymore. Uh.. cool. Lol. If you're legit doing the rest as you say then congratulations you're already GDPR compliant, you're just being stubborn. Seems a waste of brain cycles.