Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

71–80 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#71

Post by sp332 »

chatmasta wrote: post #44
sp332 wrote: post #13

Earlier quoted context omitted.

You're the third person to ask this and I'd like to ask you: is this idea coming from a specific source? The law, like any other EU law, obviously does not apply outside the EU. It applies to companies that do business in the EU (even if they are based outside), but it can't apply to companies that don't do business there. https://ec.europa.eu/info/law/law-topic/data-protection/refo...

You’re going to get downvoted for that comment, but you do raise a legitimate question of enforceability. Sure the EU can say any company in the world who has EU residents’ data should comply with GDPR. But... or what exactly? The EU doesn’t have the power to fine companies outside of their jurisdiction. I mean, they can try. But as far as I know there is no enforceability to ensure that the company actually pays the…

It applies to companies that do business in the EU. They could at least seize any assets that you have in the EU, including future profits there. If you don't do any business in the EU to disrupt then this doesn't apply to you anyway.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#72

Post by drstewart »

ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

I'm curious as to how many European companies comply with SOX, HIPAA, or COPPA just for the opportunity of making security/privacy compliance better?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#73

Post by tatersolid »

chatmasta wrote: post #44
sp332 wrote: post #13

Earlier quoted context omitted.

You're the third person to ask this and I'd like to ask you: is this idea coming from a specific source? The law, like any other EU law, obviously does not apply outside the EU. It applies to companies that do business in the EU (even if they are based outside), but it can't apply to companies that don't do business there. https://ec.europa.eu/info/law/law-topic/data-protection/refo...

You’re going to get downvoted for that comment, but you do raise a legitimate question of enforceability. Sure the EU can say any company in the world who has EU residents’ data should comply with GDPR. But... or what exactly? The EU doesn’t have the power to fine companies outside of their jurisdiction. I mean, they can try. But as far as I know there is no enforceability to ensure that the company actually pays the…

Corporate counsel, who actually went to many of the lead-up conferences for GDPR, said the data authorities from many member countries didn’t even hesitate before saying they would file civil lawsuits against non-EU companies.

Such a suit could be ignored too, but it would certainly be a PITA for vacationing executives who get locked up in Italy for an outstanding summary judgement.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#74

Post by celticninja »

chatmasta wrote: post #44
sp332 wrote: post #13

Earlier quoted context omitted.

You're the third person to ask this and I'd like to ask you: is this idea coming from a specific source? The law, like any other EU law, obviously does not apply outside the EU. It applies to companies that do business in the EU (even if they are based outside), but it can't apply to companies that don't do business there. https://ec.europa.eu/info/law/law-topic/data-protection/refo...

You’re going to get downvoted for that comment, but you do raise a legitimate question of enforceability. Sure the EU can say any company in the world who has EU residents’ data should comply with GDPR. But... or what exactly? The EU doesn’t have the power to fine companies outside of their jurisdiction. I mean, they can try. But as far as I know there is no enforceability to ensure that the company actually pays the…

If they have significant business in the EU then they can be fined regardless of size but the rules indicate that working towards compliance can go a long way to reducing the size or even existence of fines. Plus to get to that stage you have to ignore someone's request to remove their personal data.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#75

Post by throwaway974 »

ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

GDPR has effects way beyond better user privacy. Sorry I've been pasting this in multiple GDPR related threads, but here it goes:

I have a profitable, bootstrapped SaaS business based in US. It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. It's a trivial application that stores mostly already public data. Only email is required to login so that I can send password reset and other such communication.

I've been talking to a very well known giant corporation (also based in US, but has many global offices) for months. The VP and director love my product and want to start using it right away for their department. But their legal team is scared shitless with 4% fines in GDPR. They are putting some draconian clauses, (various ISO certifications and such) in the contract that I, as a small company, cannot comply. That's their interpretation of GDPR. It doesn't matter whether it's right or wrong.

The VP and Director are really nice people and I've developed very good rapport with them. But I'm afraid their patience will run out soon and they'll go back to using spreadsheets. A lose-lose situation.

This is the side-effect of GDPR.

I'm all up for GDPR. I have uBlock, have blackholed all Facebook domains, etc. But don't assume that GDPR doesn't affect normal business transactions. Of course, blocking European users doesn't do anything for me since I want to do everything I can to protect user privacy.

But anyone who says, "Oh, how hard could it be?" has no idea what they are talking about.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#76

Post by lima »

Some notes:

- This is insufficient for GDPR compliance. Besides the other points mentioned in this thread, you also need to delete any data about EU residents you have already collected.

- CloudFlare sets a geolocation header, you can probably just use that without consulting a third party, without adding any latency!

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#77

Post by matte_black »

orf wrote: post #50
matte_black wrote: post #28

Earlier quoted context omitted.

It's no laughing matter for some companies. EU citizens have turned into pests overnight. There are businesses who don't make much money from the EU to justify compliance with the regulations.

Is it onerous because you are doing dodgy things with EU citizens data, because you don't take information security seriously or because you've fallen for some of the FUD around GDPR (having to hire a DPO, being fined 2 trillion dollars, etc etc)? If it's too hard for you to copy paste a GDPR compliant privacy policy and monitor a GDPR email address then well, maybe you're in the wrong job.

We do take security seriously and we're not doing anything dodgy.

We have business reasons for collecting user data, and users have no real reason to tell us to delete it at will, other than the fact that it makes them feel "creeped out".

The future is probably going to be super creepy. If you want to participate, get over it.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#79

Post by matte_black »

mephitix wrote: post #49
matte_black wrote: post #28

Earlier quoted context omitted.

It's no laughing matter for some companies. EU citizens have turned into pests overnight. There are businesses who don't make much money from the EU to justify compliance with the regulations.

>> EU citizens have turned into pests overnight. Are they really pests for demanding privacy? In today's environment?

You are a pest when you use a service and give nothing back in return, stealing resources that are better allocated to users that actually contribute to revenue.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#80

Post by mephitix »

ythn wrote: post #67
mephitix wrote: post #49

Earlier quoted context omitted.

>> EU citizens have turned into pests overnight. Are they really pests for demanding privacy? In today's environment?

To me it seems like a case of wanting to have the cake and eat it too. "I want to use your free service without participating in your monetization model. K thanks" -- EU citizens

'Free' is a powerful word - there's a lot of incentive for companies to tout 'free' and for users to feel like they're getting a good deal - when in reality there's a whole lot of other stuff happening behind the scenes.

My take is that consumers need to be aware of what 'free' really means for each service that advertises it. What are the real implications - not just something hidden in doublespeak in a ToS or privacy policy.

Everything spelled out in the GDPR is a great thing for users and should have been there from the very beginning - being able to erase all their data, see all their data, export their data, and get notified when data is accessed.

Post reply on HN