Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR compliance as a service

gdpr-shield.io

Post reply on HN
Print view View original

91–100 of 158 posts

Re: GDPR compliance as a service

#91

Post by neya »

niko001 wrote: post #33
lillesvin wrote: post #32

> Simply paste our JavaScript snippet into your website's code. We'll check every visitor of your site and will block access to users located within the EU. See, the problem here is that you actually have to send an HTTP request to the site that's trying to block you, then you load it along with their JavaScript which then blocks you, but at that point the initial request(s) has already been logged and now they have…

Not a joke :). GDPR Shield as a product is GDPR compliant. Customers sign a data processor agreement with the service. It anonymizes IP addresses, they aren't transferred to any other third-party provider and aren't stored.

Niko, your implementation may not be right like others have mentioned (in that it triggers GDPR on your customers), but I fully support this methodology.

If it helps, I use AppEngine for my App which already provides geolocation information in the IP and my app blocks it the moment it receives the request. Users will only see a re-direction to a notice relating to GDPR and what they'll need to do if they still want to access the site.

Re: GDPR compliance as a service

#92

Post by yorwba »

lucio wrote: post #62
smnrchrds wrote: post #27

Earlier quoted context omitted.

Wait! I was under the impression that fines due to GDPR are just that, fines. They are paid to the government, not individuals. At most, getting fined due to non-compliance can suggest that if individuals bring civil lawsuits against the company, they may win and be awarded damages, the amount of which depends on how much damages they can prove they have incurred as a result of misuse of their data, not statutory amo…

No, some firm will ask you to pay $100,000 as private settlement because you make a mistake, or else they'll will have to seek remedy by filing a complaint on the EU courts, potentially costing you around 10M

But unlike copyright trolls, the law firm in question can't guarantee that paying the protection money will actually protect you from being reported, so there isn't the same incentive to pay. A protection racket only works if the mafia monopolizes the threat, otherwise any random thug could destroy their business.

Re: GDPR compliance as a service

#93

Post by privacypoller »

A "GDPR Compliance" service with a 6000 word terms of service including such gems as agreeing to binding arbitration, no class-action lawsuits, and royalty-free use of your logo and name, a privacy policy that allows them to use your personal information to promote "new features and special offers" and runs google analytics...

This is a joke, right? You'd have to be crazy to protect these guys with anything to do with personal information protection and privacy.

Re: GDPR compliance as a service

#94

Post by yorwba »

threeseed wrote: post #78
CLGrimes wrote: post #21

Earlier quoted context omitted.

If an EU citizen believes that their personally identifiable information was obtained without their consent, the EU GDPR allows firms to do an audit on the company. The citizen who filed the complaint would enlist help from a no-win-no-fee legal firm, meaning, if they don't win (with infractions being $10 million minimum), the citizen, who is now a client of the firm, would not be out any money. If they do win, most…

> with infractions being $10 million minimum Stop talking nonsense. It is up to $10 million or 2% of revenue. https://www.gdpreu.org/compliance/fines-and-penalties/ And so for most websites the fine would be significantly smaller than what lawyers typically earn to litigate. Hence your entire "no win no fee" premise falls completely apart.

Both amounts are lower bounds. "No win no fee" falls apart because the lawyers don't get a fee for a fine collected by the government, not because the fine is too small.

Re: GDPR compliance as a service

#95

Post by mkagenius »

jwilliams wrote: post #38
CorpOverreach wrote: post #11

Maybe I'm missing something - but as a US citizen, with a US company, how can EU laws be enforced against me? What's the legal channel here? Do they plan on arresting me if I decide to vacation to an EU country? Will the US gov't comply with levying fines due to some treaty/agreement between the countries?

International enforcement is a can of worms. However, a lot of it is covered by: 1- US companies with a physical presence in the EU. They can fine that entity directly. 2- US companies will find they can't sell to EU businesses (B2B), as that means the EU company is carrying the can in terms of non-compliance. 3- The EU Member State could go via the International Courts. Or via some kind of bilateral agreement (e.g.…

Seems this is targeted mainly to the likes of uber, google.. small time websites who do not have much volume aren’t the target audience.

Re: GDPR compliance as a service

#96

Post by niko001 »

neya wrote: post #91
niko001 wrote: post #33

Earlier quoted context omitted.

Not a joke :). GDPR Shield as a product is GDPR compliant. Customers sign a data processor agreement with the service. It anonymizes IP addresses, they aren't transferred to any other third-party provider and aren't stored.

Niko, your implementation may not be right like others have mentioned (in that it triggers GDPR on your customers), but I fully support this methodology. If it helps, I use AppEngine for my App which already provides geolocation information in the IP and my app blocks it the moment it receives the request. Users will only see a re-direction to a notice relating to GDPR and what they'll need to do if they still want t…

Thanks! You're right, there are many ways to achieve this goal, I just wanted to provide a drop-in solution that's independent of the infrastructure.

Re: GDPR compliance as a service

#97

Post by niko001 »

threeseed wrote: post #81
niko001 wrote: post #40

Earlier quoted context omitted.

Not a joke :). The pricing is actually cheaper than "bare" geolocation APIs, which don't do the blocking-part. Have a look at https://ipstack.com/product for example. If you get a quote from an experienced data protection lawyer for GDPR compliance, this will be an order of magnitude cheaper in the long run. There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to col…

> There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to collect fees for small mistakes in your privacy policy No there isn't. When the GPDR fines are 2% of revenue there isn't the incentive for lawyers to go after businesses earning less than a million a year in revenue.

You're mixing up the member states' enforcement (4% of worldwide turnover or €20 million, whichever is higher) and civil suits. There are law firms that send out thousands of cease and desist letters (which is a civil action) based on automated searches for mistakes. It absolutely makes economic sense for lawyers to pursue out-of-court settlements from businesses if it's mostly automated.

Re: GDPR compliance as a service

#98

Post by niko001 »

pietroglyph wrote: post #19

This appears to be Javscript based... Assuming then that it works on the client side, I wonder how long it will take for someone to release a browser plugin to bypass it.

That's of course possible, but shouldn't matter: When you make a reasonable effort to block access to EU users, EU citizens aren't covered under GDPR if they take active measures (through a browser plugin, for example) to circumvent the ban: "This won't apply to every U.S. business — just the ones that are knowingly, and actively, conducting business in the EU. In this vein, EU courts have the discretionary ability to determine if a U.S. company was purposely collecting EU resident data and subverting GDPR compliance. So, in some cases, the inadvertent collection of personal data will be forgiven if it is found to have been occasional and "unlikely to result in a risk to the rights and freedoms of natural persons."

(from https://community.spiceworks.com/topic/2007530-how-the-eu-ca... )

Re: GDPR compliance as a service

#99

Post by niko001 »

esya wrote: post #89

The more I look into this, the shadier it seems. They're selling at a whooping $79/month, a single php script that does not even check any sort of authentication or API key, and only does a dumb lookup against a GeoIP database : https://gdpr-shield.io/check.php And this is called by this tiny javascript script https://code.gdpr-shield.io/script.js that just.. displays an overlay div when you're in the EU. Smells like…

The pricing is actually cheaper than "bare" geolocation APIs, which don't do the blocking-part. Have a look at https://ipstack.com/product for example.

If you get a quote from an experienced data protection lawyer for GDPR compliance, GDPR Shield will be an order of magnitude cheaper in the long run. There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to collect fees for small mistakes in your privacy policy.

You're making assumptions about how the service works, which happen to be wrong. Even if they were true, the time it takes to develop something isn't a measure of the value it provides.

Re: GDPR compliance as a service

#100

Post by detuur »

esya wrote: post #69

niko001 / Niklaus or whatever. This is extremely shady. You've copy pasted your whole terms and conditions from this page : https://buffer.com/terms VS: https://gdpr-shield.io/terms - Saved here https://web.archive.org/web/20180504020320/https://gdpr-shie... for good measure Which is illegal to begin with. You even forgot to replace the part that explains what the service does and left the part that says that gdpr sh…

So you're saying that a service which targets businesses who are trying to avoid a piece of legislation that is shaping up to become a worldwide industry standard turns out to be shady and doesn't respect the law? Well I never.
Post reply on HN