GDPR for lazy people: Block all European users with Cloudflare Workers • Hacker News Board

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#151

Post by matte_black » Fri, May 25, 2018, 7:54 PM UTC

notananthem wrote: post #100

drspacemonkey wrote: post #69

Earlier quoted context omitted.

>Nothing has been learned In my limited view, this is pretty much the case. When I was telling our management team about the GDPR and how it relates to our new European-focused project, the first thing the CEO said was "how do we get around this?" Management decided we're not gonna comply with the GDPR and just hope nobody notices.

Some of us do work for companies who respect and promote GDPR who are not based in EU, and we're hiring. Leave, that's a perfect example of terrible leadership.

It’s foolish to comply when there isn’t even one example yet of a small non-EU company successfully being hit with fines.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#152

Post by llukas » Fri, May 25, 2018, 7:54 PM UTC

drstewart wrote: post #72

ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

I'm curious as to how many European companies comply with SOX, HIPAA, or COPPA just for the opportunity of making security/privacy compliance better?

Please read about FATCA

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#153

Post by falcon620 » Fri, May 25, 2018, 7:57 PM UTC

jacquesm wrote: post #122

shiado wrote: post #113

I simply don't understand how or why a law that has scope in the EU is causing trouble for companies which conduct no business in the EU beyond responding to HTTP requests on a global decentralized telecommunications network. Why would an American internet business which conducts no operations in Europe and has no servers in Europe be subject to regulation that affects the EU? What is going to happen? Is the EU going…

> Is the EU going to target American banks of American businesses and try to extract fines? You mean like America? That time when the USA decided to enforce their embargo against Cuba by intercepting a payment from one of the Nordics for a bunch of Cuban cigars? No, that's unlikely. > Is the EU going to extradite owners of these businesses? Extremely unlikely, besides that would require the cooperation of the other c…

Jacques - I love the effort you've put into explaining the GDPR to clueless and needlessly exasperated (mostly) americans here on HN.

To be honest I used to think you were just a shameless self-promoter like almost everyone else, but in this case you've risen to the occasion. Bravo. I think you're now rating quite high in most people's "mental books of good people". Or at the very least, in the minds of people who actually have a strong impact.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#154

Post by briandear » Fri, May 25, 2018, 7:57 PM UTC

throwaway974 wrote: post #75

ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

GDPR has effects way beyond better user privacy. Sorry I've been pasting this in multiple GDPR related threads, but here it goes: I have a profitable, bootstrapped SaaS business based in US. It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. It's a trivial application that stores mostly already public data. Only email is required t…

The loudest GDPR advocates don’t care about you. 90 years ago they would have been the ones helping collectivize the farms, unintended consequences be damned.

And this law’s effects are all about the unintended consequences. Anyone thinking government regulators are reasonable and benevolent has never dealt with said regulators beyond any trivial level. To make it more fun each member country handles enforcement, so now you have a risk of 28 different interpretations of the law. It’s madness. Even if you do everything right there is still a compliance risk. It’s like HIPAA in the US — HIPAA is pretty “easy” to comply with, but the consequences are so severe that it necessarily drives up operational costs significantly. Unless Europe is a significant part of your revenue, better to block Europe and decrease your risk to near zero rather than have a potential risk of catastrophic, company-ending fines. Because the fine isn’t against profit, it’s against total, worldwide revenue. So unless your European profit exceeds 5% of your worldwide revenue, no sane person would take that risk. Even without the enforcement risk, you still have to deal with potentially hundreds or thousands of information requests — even if you are doing everything by the book.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#155

Post by djhworld » Fri, May 25, 2018, 7:57 PM UTC

bloak wrote: post #150

Slightly OTT: Does anyone know why May 25 was chosen as "GDPR day"? I asked a data protection specialist, a real expert on the legislation, but they couldn't answer that question for me.

Just a deadline.

Two years ago (14 April 2016) the regulation was adopted, and a 2 year notice period was put in place so businesses could prepare

That notice period ended today

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#156

Post by maxsilver » Fri, May 25, 2018, 7:57 PM UTC

throwaway974 wrote: post #75

ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

GDPR has effects way beyond better user privacy. Sorry I've been pasting this in multiple GDPR related threads, but here it goes: I have a profitable, bootstrapped SaaS business based in US. It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. It's a trivial application that stores mostly already public data. Only email is required t…

> The VP and director love my product and want to start using it right away for their department. But their legal team is scared shitless with 4% fines in GDPR. (snip) That's their interpretation of GDPR. It doesn't matter whether it's right or wrong. This is the side-effect of GDPR.

I understand it's frustrating on your side, because you have no control over the response of your customers. But understanding what GDPR is (and not falling for FUD) is why the VPs and Directors get paid the big bucks and get the fancy titles. If they can't or won't work with legal to become compliant, they should resign and let someone else do the job properly.

I'm not saying, "oh it's easy" -- it's not easy. But that doesn't make the law wrong either. And it's not OK to blame GDPR as being "bad", when those rules are mostly just putting some real enforcement around stuff all moral and ethical organizations should have already been doing anyway.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#157

Post by freedomben » Fri, May 25, 2018, 7:58 PM UTC

bertolo1988 wrote: post #143

Nothing will happen to companies outside the EU. You can violate GDPR freely. There is no possible way they can enforce any law, fine or penalty outside their borders. They won't even try.

I heard one person say that they were worried about traveling to Europe to visit if they had any GDPR violations. Do you that's a valid concern?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#158

Post by manigandham » Fri, May 25, 2018, 7:58 PM UTC

shiado wrote: post #113

I simply don't understand how or why a law that has scope in the EU is causing trouble for companies which conduct no business in the EU beyond responding to HTTP requests on a global decentralized telecommunications network. Why would an American internet business which conducts no operations in Europe and has no servers in Europe be subject to regulation that affects the EU? What is going to happen? Is the EU going…

The fact that the regulation is so vague around it in the first place is the whole problem. There are dozens of conflicting statements (from law firms, no less) about what exactly exposes you to GDPR.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#159

Post by loup-vaillant » Fri, May 25, 2018, 7:59 PM UTC

throwaway974 wrote: post #75

ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

GDPR has effects way beyond better user privacy. Sorry I've been pasting this in multiple GDPR related threads, but here it goes: I have a profitable, bootstrapped SaaS business based in US. It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. It's a trivial application that stores mostly already public data. Only email is required t…

Wait a minute… You provide a service, and your users are afraid the GDPR could come to them?!?

Please tell me I've read something wrong. Otherwise, this is just panic induced stupidity. I expect they will grow out of it (though maybe not before you go bankrupt, which obviously sucks big time).

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#160

Post by Exuma » Fri, May 25, 2018, 7:59 PM UTC

apple4ever wrote: post #119

Exuma wrote: post #78

Why wouldn't you use the built in `request.headers.get("CF-IpCountry")`? This is a very weak and lame attempt at just getting people to use your service when it's already built in...

Or even better, just use the Firewall to block by country. That's what we do to stop bots from countries we don't sell in.

Id argue the web workers are better (although they are paid for), only because you have full control over what to do with them (like showing them a message that you're not GDPR compliant in their area yet, etc)