Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR compliance as a service

gdpr-shield.io

Post reply on HN
Print view View original

61–70 of 158 posts

Re: GDPR compliance as a service

#61

Post by reificator »

tzahola wrote: post #39
paulddraper wrote: post #25

Earlier quoted context omitted.

Frightening to think something as innoculus as making a website of chocolate chip recipes and logging visitor IPs could provoke that.

Tip: don’t log the IPs then.

I spin up a Wordpress site with default options to host my chocolate chip recipes. Is it GDPR compliant?

I go through and toggle all the settings the internet tells me to, even though I don't know their meaning or effect. Am I GDPR compliant?

I install a Wordpress plugin that sets up a Really Simple Chocolate Chip Syndication server, or RSCCS. That plugin logs IPs. If I was GDPR compliant previously, now I'm not, and how would I ever know?

Re: GDPR compliance as a service

#62

Post by lucio »

smnrchrds wrote: post #27
CLGrimes wrote: post #21

Earlier quoted context omitted.

If an EU citizen believes that their personally identifiable information was obtained without their consent, the EU GDPR allows firms to do an audit on the company. The citizen who filed the complaint would enlist help from a no-win-no-fee legal firm, meaning, if they don't win (with infractions being $10 million minimum), the citizen, who is now a client of the firm, would not be out any money. If they do win, most…

Wait! I was under the impression that fines due to GDPR are just that, fines. They are paid to the government, not individuals. At most, getting fined due to non-compliance can suggest that if individuals bring civil lawsuits against the company, they may win and be awarded damages, the amount of which depends on how much damages they can prove they have incurred as a result of misuse of their data, not statutory amo…

No, some firm will ask you to pay $100,000 as private settlement because you make a mistake, or else they'll will have to seek remedy by filing a complaint on the EU courts, potentially costing you around 10M

Re: GDPR compliance as a service

#64

Post by esya »

jfoutz wrote: post #56
lillesvin wrote: post #32

> Simply paste our JavaScript snippet into your website's code. We'll check every visitor of your site and will block access to users located within the EU. See, the problem here is that you actually have to send an HTTP request to the site that's trying to block you, then you load it along with their JavaScript which then blocks you, but at that point the initial request(s) has already been logged and now they have…

Check the terms and conditions. Their commitment to paying a portion of your legal fees if you’re sued is proof enough of their confidence.

Nope, I'm sorry but their terms and conditions are aweful, and do not protect you at all.

Re: GDPR compliance as a service

#66

Post by nightcracker »

From GDPR-shield's terms and conditions (https://gdpr-shield.io/terms):

1. GDPR Shield Service Overview

The Service provides a social media management tool that enables users to customize the link preview window of websites under their control on social platforms, in addition to other analytics tools to help bolster users' social media content.

...what? Is this a botched copy/paste job?

Re: GDPR compliance as a service

#67

Post by lillesvin »

reificator wrote: post #59
lillesvin wrote: post #36

Earlier quoted context omitted.

But if your JavaScript is inserted into your customers site, then the initial request that loads their site the first time + your script will be logged on their servers just like any other HTTP request.

And if your site loads their Javascript to block anyone from the EU from visiting, then it's clear that you're not targeting customers in the EU.

You're still gathering the data on every request. And since all requests go to the site anyway (to load the JS) you might as well just put a text saying, "nothing to see here for EU citizens"—that'd be a lot cheaper than buying this silly service and it would send the same signal.

This service isn't blocking requests to your site, it's just showing the visitors different content after the fact.

Re: GDPR compliance as a service

#68

Post by drtillberg »

rayshan wrote: post #57
tylermenezes wrote: post #46

The idea that simply having an EU visitor load your site can subject you to a $2M fine is a recurring bit of FUD. Directly from the EU: > Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR. ( https://ec.europa.eu/info/law/law-topic/data-protection/refo... )

This is what you're trying to reference: https://ec.europa.eu/info/law/law-topic/data-protection/refo...

That explanation is the first one I've seen that makes GDPR sound reasonable.

The main problem overall is that the EU appears to consider information about someone as being owned by that person. That is quite foreign from a US individual perspective and having some blogs. I don't see how the learning I have acquired about people places and things, which I acquired without any promise of confidentiality, can be owned by anyone but me. Are libraries and newspapers required to scrub their shelves and archives? And if not, what is the limiting principle?

Re: GDPR compliance as a service

#69

Post by esya »

niko001 / Niklaus or whatever. This is extremely shady. You've copy pasted your whole terms and conditions from this page :

https://buffer.com/terms VS: https://gdpr-shield.io/terms - Saved here https://web.archive.org/web/20180504020320/https://gdpr-shie... for good measure

Which is illegal to begin with. You even forgot to replace the part that explains what the service does and left the part that says that gdpr shield "provides a social media management tool".

You're selling something that just basically does a geoip lookup, and then tries to block people from an entire continent, with pure JS, which can be easily avoided, by the way. I'm shooting buffer an email to let them know you're infringing on their legal material.

Re: GDPR compliance as a service

#70

Post by mandelbulb »

tylermenezes wrote: post #46

The idea that simply having an EU visitor load your site can subject you to a $2M fine is a recurring bit of FUD. Directly from the EU: > Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR. ( https://ec.europa.eu/info/law/law-topic/data-protection/refo... )

Overall I'm content with the GDPR as it is a long needed corrective action for the path we've been treading in the West as a whole.

One requirement, imho, is quite ridiculous, however. That is the need for entities which need to abide by the GDPR but do not have a presence in the EU to assign a representative in the EU.

This part definitely needs some relaxation. Just complying with the regulation ought to be enough as the first step, especially for start-ups.

Post reply on HN