Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR compliance as a service

gdpr-shield.io

Post reply on HN
Print view View original

81–90 of 158 posts

Re: GDPR compliance as a service

#81

Post by threeseed »

niko001 wrote: post #40
threeseed wrote: post #4

I can't tell if this is a joke or not. Don't pay "thousands" for GPDR compliance work which will improve your product by providing basic privacy and security features. Instead pay up to $79 a month for a service to block a large percentage of your traffic.

Not a joke :). The pricing is actually cheaper than "bare" geolocation APIs, which don't do the blocking-part. Have a look at https://ipstack.com/product for example. If you get a quote from an experienced data protection lawyer for GDPR compliance, this will be an order of magnitude cheaper in the long run. There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to col…

> There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to collect fees for small mistakes in your privacy policy

No there isn't.

When the GPDR fines are 2% of revenue there isn't the incentive for lawyers to go after businesses earning less than a million a year in revenue.

Re: GDPR compliance as a service

#83

Post by peterhunt »

threeseed wrote: post #81
niko001 wrote: post #40

Earlier quoted context omitted.

Not a joke :). The pricing is actually cheaper than "bare" geolocation APIs, which don't do the blocking-part. Have a look at https://ipstack.com/product for example. If you get a quote from an experienced data protection lawyer for GDPR compliance, this will be an order of magnitude cheaper in the long run. There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to col…

> There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to collect fees for small mistakes in your privacy policy No there isn't. When the GPDR fines are 2% of revenue there isn't the incentive for lawyers to go after businesses earning less than a million a year in revenue.

or 10m euro, whichever is higher

Re: GDPR compliance as a service

#84

Post by foolfoolz »

ezekg wrote: post #35
niko001 wrote: post #33

Earlier quoted context omitted.

Not a joke :). GDPR Shield as a product is GDPR compliant. Customers sign a data processor agreement with the service. It anonymizes IP addresses, they aren't transferred to any other third-party provider and aren't stored.

But like I mentioned on Indie Hackers, your customers still have their own logs that need to be GDPR-compliant, which defeats the whole purpose. The page that requests your JS still has to be sent by a server, which will likely log the EU citizen’s IP. And then there’s the case where the EU citizen is using a VPN server in the US...

sure but just handling ip addresses in your access logs is a whole lot easier than changing your entire site to comply with GDPR. major reduction in surface area

Re: GDPR compliance as a service

#85

Post by jfoutz »

esya wrote: post #64
jfoutz wrote: post #56

Earlier quoted context omitted.

Check the terms and conditions. Their commitment to paying a portion of your legal fees if you’re sued is proof enough of their confidence.

Nope, I'm sorry but their terms and conditions are aweful, and do not protect you at all.

Perhaps I needed to indicate sarcasm more explicitly.

Re: GDPR compliance as a service

#86

Post by tchock23 »

mandelbulb wrote: post #70
tylermenezes wrote: post #46

The idea that simply having an EU visitor load your site can subject you to a $2M fine is a recurring bit of FUD. Directly from the EU: > Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR. ( https://ec.europa.eu/info/law/law-topic/data-protection/refo... )

Overall I'm content with the GDPR as it is a long needed corrective action for the path we've been treading in the West as a whole. One requirement, imho, is quite ridiculous, however. That is the need for entities which need to abide by the GDPR but do not have a presence in the EU to assign a representative in the EU. This part definitely needs some relaxation. Just complying with the regulation ought to be enough…

Yes! That was the part of the regulation to me that felt like a shake down. I get the need to be more careful with user data. Make me hire a rep in the EU? Now you're just trying to drum up fees for your lawyers...

Re: GDPR compliance as a service

#87

Post by tchock23 »

_Chief wrote: post #79
hartator wrote: post #44

I wonder if you can do something like this directly in Cloudflare.

you could use cloudflare IP geolocation to block EU countries based on the Cf-Ipcountry header they provide. Though just by checking their IP I think you may need to comply with gdpr

Is just checking IP with no other personal information a violation of GDPR? Particularly if that IP is not retained in a database (just temporarily in production logs)? Asking for a friend...

Re: GDPR compliance as a service

#88

Post by kodablah »

rjv wrote: post #41

I have this eerie suspicion that GDPR cases will be a haven for trollish and/or opportunist behavior. Instead of huge corporations having to shell out significant money to swallow up start-up competitors, they could much more cheaply pay EU citizens to exploit the huge burden of the law on small companies or even solo endeavors. I hope I can be convinced to be optimistic.

> I hope I can be convinced to be optimistic.

I'm kinda hoping my pessimism becomes justified. At that point, I can then only hope that an epiphany is reached and other approaches used without resorting to large sweeping legislation (which, among many other things could include more timid and actually enforced legislation at first). However, regardless of which side of the Atlantic I look on, it seems legislators only double down when their desired effect is not achieved. They only know one direction.

Re: GDPR compliance as a service

#89

Post by esya »

The more I look into this, the shadier it seems.

They're selling at a whooping $79/month, a single php script that does not even check any sort of authentication or API key, and only does a dumb lookup against a GeoIP database : https://gdpr-shield.io/check.php

And this is called by this tiny javascript script https://code.gdpr-shield.io/script.js that just.. displays an overlay div when you're in the EU. Smells like scam when you're willing to sell a whole product that can be coded in 20 minutes for up to $1000 a year.

Re: GDPR compliance as a service

#90

Post by cddotdotslash »

Put your site behind CloudFront, block EU countries. There, we've solved the problem without a shady SaaS.

Edit: which wasn't even a problem to start with but if this is the route you want to go, the above is nearly fool proof and costs next to nothing.

Post reply on HN