GDPR: Removing Monal from the EU • Hacker News Board

Re: GDPR: Removing Monal from the EU

#271

Post by pluto9 » Thu, May 17, 2018, 10:44 PM UTC

AnsisMalins wrote: post #35

5874-4b22-a4e0 wrote: post #6

How would they even enforce GDPR? Can't companies just claim to clear your data?

Guessing: even if you don't have assets in EU, you have a Google (or Facebook, or Amazon) account, and Google has assets in EU. EU could ask Google to ban you, or else.

That seems like a bit of a stretch, unless you were actively using Google's services as a tool of your wrongdoing. The EU would be forcing an unrelated private company to act as an arm of law enforcement. It would be like the local police punishing you for speeding by leaning on Applebee's to refuse you service.

Maybe there's a legal precedent for that sort of thing, but I'm not aware of it.

Re: GDPR: Removing Monal from the EU

#272

Post by SahAssar » Thu, May 17, 2018, 10:44 PM UTC

nickpp wrote: post #147

SahAssar wrote: post #126

Earlier quoted context omitted.

I'm guessing they would be interested in 550m unserved users in a single-market for a validated business idea, regardless of GDPR.

Maybe, but GDPR is not the only business-hostile regulation EU has. Together they make an environment in which even 550m users may not be worth it for the small startup. They will simply pivot to the more competitive, but freer, US market.

That wasn't the premise though. The premise was:

- US company A controls the market for idea B

- EU creates GDPR which scares away company A

In that case where there is a proven market demand for idea B you can either compete with company A (which presumably has more resources than you), or enter into a market that company A has willingly forfeited.

I think the second option will have plenty of takers if it turns out that US companies are that scared of GDPR.

Re: GDPR: Removing Monal from the EU

#273

Post by jacquesm » Thu, May 17, 2018, 10:45 PM UTC

This is a ridiculous over-reaction based on an extremely shallow interpretation of the GDPR.

If you are running a small business and you feel that you won't be able to operate your business because of the GDPR consider all those other laws that you have to be in compliance with as well. If that's your attitude towards legal compliance then you should probably shut your business down completely rather than to hope that just ignoring European customers is going to make the bogeyman go away.

Legal compliance is a requirement for any business, and privacy law is just one more thing to take into account and for a small business that does not process super sensitive data (such as medical information or financial information) the costs of compliance are negligible. They're not '0', but then again it is a business and costs of doing business are the norm.

Re: GDPR: Removing Monal from the EU

#274

Post by kasey_junk » Thu, May 17, 2018, 10:45 PM UTC

edaemon wrote: post #242

joering2 wrote: post #202

Earlier quoted context omitted.

I spent near to $10,000 in 6 lawyers 2 in usa 4 in different european countries and all wrote detailed report for me negating what you just said. IP is one of the most PII identifiable elements of an internet user. Exception is when you can prove such IP is a merely a proxy. please get some other lawyers opinion!!

Note that I didn't say IPs aren't PII; I said they don't count as long as you are collecting them for the specific purpose of security and don't have any way to identify the person using that IP. Pretty much by definition that is not PII. That came from the legal departments from our German, UK, and French entities.

PII is not the standard for GDPR compliance.

Re: GDPR: Removing Monal from the EU

#275

Post by falcolas » Thu, May 17, 2018, 10:45 PM UTC

fcbrooklyn wrote: post #264

danbruc wrote: post #255

While Monal is privacy focused, it is also free, open source and run by a single person — me. I simply do not have the resources or the time to jump through the regulatory hoops required by the EU. As a new and small construction company we simply don't have the resources to comply with all the building codes and the related paperwork. I just can't afford to meet all food safety requirements, I just want to provide f…

Your first two examples are cute, but your third has the unfortunate side effect of undercutting your argument. A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US, as long as it has the appropriate indicators (brake lights, turn indicators, headlights). There's a crazy subculture around building bikes that would never in a million years pass muster as production vehicles…

Well, kinda. A lot of states will still require your homebuilt car to pass smog, which requires a new, not-built-yourself engine.

Re: GDPR: Removing Monal from the EU

#276

Post by tobltobs » Thu, May 17, 2018, 10:45 PM UTC

jdietrich wrote: post #174

nickpp wrote: post #156

Earlier quoted context omitted.

ICO is just the UK regulator. How about the regulators of the other 28 EU states?

There are specific mechanisms in place to ensure that the regulations are applied consistently, set out in Chapter 7 of the GDPR. https://gdpr-info.eu/chapter-7/

This is already falling apart. Some countries like Austria already decided to reprove but not to fine offenders. See German article: https://www.heise.de/newsticker/meldung/Keine-Strafen-Oester...

Re: GDPR: Removing Monal from the EU

#277

Post by lossolo » Thu, May 17, 2018, 10:46 PM UTC

nickpp wrote: post #166

lossolo wrote: post #150

Earlier quoted context omitted.

> Europe doesn’t have a stellar record when it comes to high tech startups. For many reasons. For many reasons indeed, this is broad topic and GDPR doesn't change anything if we are talking about big US players and their domination. None of them is getting out of EU. > And I am afraid GDPR has just added another one. I disagree, it's the other way around. Small single person companies/developers that will get out fro…

I fail to see how adding another onerous regulation makes the EU founder more likely to succeed where the US founder decided to give up.

You wrote:

> Europe doesn’t have a stellar record when it comes to high tech startups

Which automatically implies that you were talking about non-EU tech companies leaving EU because of GDPR and EU startups filling their space. And now you fail to see how this will make more likely succeed EU companies? What?

I think you fail to understand what the point of my argument was. It doesn't matter if this will be EU founder or US founder or XX founder, if there is a void it will be filled, doesn't matter who will fill it. This is an axiom describing the free market.

> onerous regulation

I am conducting online business in EU handling personal data and I don't find it onerous at all. Adding to that as EU citizen I am happy that this regulation was introduced in EU law system.

Re: GDPR: Removing Monal from the EU

#278

Post by GordonS » Thu, May 17, 2018, 10:46 PM UTC

belorn wrote: post #123

> registering for a push does make an HTTP call which logs a user’s IP and this requires GDPR compliance. APNS push tokens are associated with devices which can be traced back to a user if combined with info on the originating XMPP server. Obviously, this is needed for a notification to be delivered to the right person. Article 6, Paragraph 1, seems to cover those two parts of data collection. Logging a user's IP for…

Agreed, I don't see how this possibly cannot be a legitimate interest - the user knows they need to be contacted for a push request to work, even if they don't understand or care about the underlying vagaries of IP addresses.

Re: GDPR: Removing Monal from the EU

#279

Post by jacquesm » Thu, May 17, 2018, 10:46 PM UTC

fcbrooklyn wrote: post #264

danbruc wrote: post #255

While Monal is privacy focused, it is also free, open source and run by a single person — me. I simply do not have the resources or the time to jump through the regulatory hoops required by the EU. As a new and small construction company we simply don't have the resources to comply with all the building codes and the related paperwork. I just can't afford to meet all food safety requirements, I just want to provide f…

Your first two examples are cute, but your third has the unfortunate side effect of undercutting your argument. A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US, as long as it has the appropriate indicators (brake lights, turn indicators, headlights). There's a crazy subculture around building bikes that would never in a million years pass muster as production vehicles…

> A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US, as long as it has the appropriate indicators (brake lights, turn indicators, headlights).

They don't do safety inspections in the US?

Doesn't the vehicle need to have brakes, a means to change direction, emission checks and so on?

Re: GDPR: Removing Monal from the EU

#280

Post by djrogers » Thu, May 17, 2018, 10:46 PM UTC

GordonS wrote: post #186

wuliwong wrote: post #162

Earlier quoted context omitted.

Is "large scale" defined?

I think it's clear that 1 person is not a large scale op. I do agree it should be defined in at least somewhat precise terms though.

The number of employees isn't a factor as far as the scale of data processing is concerned - it's the scale of the actual data processing...