Ask HN: Is HN GDPR compliant? • Hacker News Board

Re: Ask HN: Is HN GDPR compliant?

#21

Post by jclay » Mon, Apr 30, 2018, 3:13 AM UTC

cyberferret wrote: post #12

ARothfusz wrote: post #7

Why would it need to be compliant? Ycombinator is not a European company.

But if they hold and manage data for users who reside in the EU (which they do), then I believe the rules apply too. From what I can gather, if a user in the EU approaches HN and asks for their profile data and posts to be removed, then that falls under the GDPR laws.

How would one manage to sidestep GDPR responsibilities? If it made sense, could you opt to block EU based IP addresses? You'd also have to ensure that any past data you have is cleansed of EU based users which could be tricky.

Re: Ask HN: Is HN GDPR compliant?

#22

Post by jannes » Mon, Apr 30, 2018, 3:13 AM UTC

Even if HN isn't compliant, I doubt any European country has jurisdiction over Y Combinator Management LLC, because they don't do business with any European residents.

Re: Ask HN: Is HN GDPR compliant?

#23

Post by mikekij » Mon, Apr 30, 2018, 3:13 AM UTC

Does the fact that HN is not using this data to generate revenue impact their need to comply? Being charged 4% (or whatever) if HN’s revenue as a penalty would seem to be $0.

Re: Ask HN: Is HN GDPR compliant?

#24

Post by donohoe » Mon, Apr 30, 2018, 3:14 AM UTC

Short answer: No, but it doesn’t matter.

If you are a Non-EU business, that is a business with no legal presence or employees in the EU then you can comfortably skip GDPR compliance with minimal risk (some unknown obscure treaty provision?)

#notalawyer

Re: Ask HN: Is HN GDPR compliant?

#25

Post by mholt » Mon, Apr 30, 2018, 3:14 AM UTC

nodesocket wrote: post #4

Probably not. I really have mixed emotions about GDPR being a SaaS founder. It seems overstepping and heavy handed that the EU can enact laws that affect American's and American companies. The EU can do what it wants, but generally I am against regulation as it promotes bureaucracy, stifles innovation, and creates fluff and burden's especially on small companies such Chief Data Protection Officer and Chief Data Offic…

This also bothers me a lot. I've always wondered how the EU intends to enforce its laws upon my little side projects here in the US.

Re: Ask HN: Is HN GDPR compliant?

#26

Post by trothamel » Mon, Apr 30, 2018, 3:14 AM UTC

nodesocket wrote: post #11

ARothfusz wrote: post #7

Why would it need to be compliant? Ycombinator is not a European company.

Unfortunately GPDR effects any site/company that has EU visitors which is nearly all sites.

The EU government would certainly like that to be the case, but it's not clear why it would be. If the US passed a law that required citizens of other countries to pay a $20/year tax (say, a GPS license fee), would that be enforceable?

Re: Ask HN: Is HN GDPR compliant?

#27

Post by acct1771 » Mon, Apr 30, 2018, 3:14 AM UTC

shiado wrote: post #20

American businesses should add a clause that all authorized access is predicated on a user knowingly acknowledging that they are not a resident of the EU. If GDPR becomes an issue they could abuse the CFAA to get the persons of interest extradited to the USA for prosecution of unauthorized access. It would be funny too because the data the lawyers would collect to proceed with a case would be from unauthorized access…

from* the USA?

Re: Ask HN: Is HN GDPR compliant?

#28

Post by jclay » Mon, Apr 30, 2018, 3:15 AM UTC

ars wrote: post #17

cyberferret wrote: post #12

Earlier quoted context omitted.

But if they hold and manage data for users who reside in the EU (which they do), then I believe the rules apply too. From what I can gather, if a user in the EU approaches HN and asks for their profile data and posts to be removed, then that falls under the GDPR laws.

If that it truly the case, then I suspect we will see more and more sites refuse service to Europeans. Are Europeans permitted to decline to be covered under the GDPR? (In exchange for being permitted to use such sites?)

I was wondering the same. I wonder where this falls if the EU resident is using a VPN. It'd likely still be on the site owner to prove that were the case.

Re: Ask HN: Is HN GDPR compliant?

#29

Post by acct1771 » Mon, Apr 30, 2018, 3:15 AM UTC

cyberferret wrote: post #12

ARothfusz wrote: post #7

Why would it need to be compliant? Ycombinator is not a European company.

But if they hold and manage data for users who reside in the EU (which they do), then I believe the rules apply too. From what I can gather, if a user in the EU approaches HN and asks for their profile data and posts to be removed, then that falls under the GDPR laws.

"Come and take them."

Re: Ask HN: Is HN GDPR compliant?

#30

Post by 013a » Mon, Apr 30, 2018, 3:17 AM UTC

nodesocket wrote: post #11

ARothfusz wrote: post #7

Why would it need to be compliant? Ycombinator is not a European company.

Unfortunately GPDR effects any site/company that has EU visitors which is nearly all sites.

I was under the impression that it only affects businesses which do business in the EU, meaning they have an officially registered company within the EU.

If my random little website isn't GDPR compliant, what is their strategy for getting me to pay the restitution if I'm not doing business in the EU? Where do the fines go? How could they force me to pay them? The worst they can do is block access to the website, but I haven't read anything which suggests that is written in the law.