GDPR for lazy people: Block all European users with Cloudflare Workers • Hacker News Board

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#191

Post by orangecat » Fri, May 25, 2018, 8:13 PM UTC

mhw wrote: post #135

shiado wrote: post #113

I simply don't understand how or why a law that has scope in the EU is causing trouble for companies which conduct no business in the EU beyond responding to HTTP requests on a global decentralized telecommunications network. Why would an American internet business which conducts no operations in Europe and has no servers in Europe be subject to regulation that affects the EU? What is going to happen? Is the EU going…

Read up on FATCA ( https://en.m.wikipedia.org/wiki/Foreign_Account_Tax_Complian... ) before you argue further down that path. The US already has extraterritorial laws that have to be enforced by banks worldwide that don’t operate in the US.

Yes, and that sucks. Adding more overly broad extraterritorial laws is going in the wrong direction.

Note that a common response by foreign banks to FATCA is to refuse to do business with Americans, which is very likely the best course of action. So it shouldn't be surprising when companies take similar precautions because of GDPR.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#192

Post by vmarsy » Fri, May 25, 2018, 8:14 PM UTC

ams6110 wrote: post #111

newman8r wrote: post #70

Earlier quoted context omitted.

I can see why you'd be disappointed - if popular websites started blocking US customers I'd be pretty bummed out as well (even if it was easy to circumvent). As a dev though, I also understand the frustration. Creating startups is already time-intensive and stressful. A lot of us are on shoestring budgets. Most startups will fail. To a solo developer in the US, the idea of spending time understanding and complying wi…

As a developer I can understand this point of view, but as a consumer I say it's time to grow up. Internet startups have taken a "move fast and break things" approach that is analogous to early industrial revolution approaches to worker safety, product efficacy and safety, and environmental protection. You're working in the real world, with real consequences if you end up exposing people's personal data. The party is…

I feel that you're ignoring the situation of small startups with just a few founders. At this stage, it can really kill your business to spend a lot of your resources on making sure you're complying with GDPR. Usually the 'consumer' of those startups are OK to take some risk, heck a lot might even sign up with dummy emails.

The Poland proposal [1] to limit GDPR compliance to only large businesses was trying to address that. But it's flawed, because a small company (Cambridge Analytics) could still make a lot of damage to users' privacy... but the intent of Poland was good.

I feel there should be an opt-out based on the numbers of users and the age of the company/service: If you can easily prove that you're not handling more than X users and your company is less than 2 years old, then GDPR does not apply yet, as long as you warn clearly on your website that you're not-yet-falling-under-GDPR. If you're still in the GDPR-waiver zone but believe to be GDPR compliant, then you can remove the warning and are subject to GDPR like every other company.

That way entrepreneurs won't be scared to try some MVP here and there. I'm especially thinking of those trying to start a startup in countries that are part of the E.U.. The rest of the world entrepreneurs can just focus on their local userbase.

[1] https://iapp.org/news/a/polands-proposed-gdpr-exemptions-spa...

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#193

Post by mrweasel » Fri, May 25, 2018, 8:15 PM UTC

manigandham wrote: post #161

ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

It's not about privacy, its about poorly written regulation that leaves too much vagueness because its based on principles rather than hard rules. Good intentions are not enough, there must be clear paths to implementation and verification. Perhaps that should've been fixed instead of wondering why so many companies don't really want to deal with it. It will also do just about nothing in regards to the major companie…

>because its based on principles rather than hard rules

They tried hard rules, rather than principles with the cookie laws and the companies around the world turned a good idea into a shit-show of popups while continuing to behave like nothing happened.

Honestly the more I read and the more I see how different business react I start to view the GDPR as EU finally showing that will not accept businesses viewing it as a second rate legislator.

The GDPR and reactions to Trumps policies an EU that is finally starting to behave like it's representing the best interest of 500 million people.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#194

Post by johannes1234321 » Fri, May 25, 2018, 8:15 PM UTC

downandout wrote: post #132

shiado wrote: post #113

I simply don't understand how or why a law that has scope in the EU is causing trouble for companies which conduct no business in the EU beyond responding to HTTP requests on a global decentralized telecommunications network. Why would an American internet business which conducts no operations in Europe and has no servers in Europe be subject to regulation that affects the EU? What is going to happen? Is the EU going…

Recital 23 [1] of the GDPR excludes most US-based businesses from compliance with GDPR. It essentially says that sites that don’t “envisage” (their word) offering services in the EU are in fact not offering services there for the purposes of the GDPR and are thus are not subject to it. It also explicitly states that the mere accessibility of a foreign-based website from within the EU does not by itself subject the si…

A point with many sites is that they use ad networks and those ad networks send localized ads to Europeans, thus the site targets (or "envisages") Europeans. Even if the actual content is about quite local things.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#195

Post by fao_ » Fri, May 25, 2018, 8:16 PM UTC

nostromo wrote: post #185

jacquesm wrote: post #122

Earlier quoted context omitted.

> Is the EU going to target American banks of American businesses and try to extract fines? You mean like America? That time when the USA decided to enforce their embargo against Cuba by intercepting a payment from one of the Nordics for a bunch of Cuban cigars? No, that's unlikely. > Is the EU going to extradite owners of these businesses? Extremely unlikely, besides that would require the cooperation of the other c…

> You mean like America? Yes, like America. This may shock you, but America isn't always right.

> Yes, like America. This may shock you, but America isn't always right.

That was exactly your parent's point?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#196

Post by cesarb » Fri, May 25, 2018, 8:16 PM UTC

sp332 wrote: post #13

LinuxBender wrote: post #11

How does CloudFlare know if someone is a citizen of the EU and traveling abroad? In haproxy, I redirect a few accept-language headers, but even this has its faults.

You're the third person to ask this and I'd like to ask you: is this idea coming from a specific source? The law, like any other EU law, obviously does not apply outside the EU. It applies to companies that do business in the EU (even if they are based outside), but it can't apply to companies that don't do business there. https://ec.europa.eu/info/law/law-topic/data-protection/refo...

> The law, like any other EU law, obviously does not apply outside the EU.

There are precedents for the opposite. If you have a grandparent born in some EU countries, you have EU citizenship according to the law of that EU country, even if you never set foot on that country and have no contact at all with the EU. There is a (non-EU) country which says that if you're a citizen of that country, you have to pay income taxes to it, even if you never set foot on that country and have no contact at all with it. At least one country says that its law applies to buyers of widgets manufactured in that country, even if they are sold by someone who never set foot on that country and has no contact at all with it, to someone who likewise has no contact with it. And so on.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#197

Post by zajd » Fri, May 25, 2018, 8:16 PM UTC

manigandham wrote: post #161

ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

It's not about privacy, its about poorly written regulation that leaves too much vagueness because its based on principles rather than hard rules. Good intentions are not enough, there must be clear paths to implementation and verification. Perhaps that should've been fixed instead of wondering why so many companies don't really want to deal with it. It will also do just about nothing in regards to the major companie…

And yet, multiple companies that do all kinds of crazy things with your data (https://www.google.com/search?q=gdpr+shutdown) have shut down already as a result of GDPR. You could argue that wasn't the goal but I'm pretty sure it was part of it and seems to be effective in that way at least.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#198

Post by Kalium » Fri, May 25, 2018, 8:16 PM UTC

ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

> Nothing has been learned.

I don't know about you, but I have learned a great deal!

I've mostly learned that Eurocrats can't actually write useful regulation. Blah blah blah human rights blah blah reasonable measures. Next chapter. Blah blah envisage blah blah reasonable measures. Blah blah blah inter-government communications protocols blah blah codes of conduct.

What's a reasonable measure? How do I know if I'm compliant? How do I know if a vendor is compliant?

GDPR is a wonderful, incredible, essential document for laying out human rights for the digital world. It's also terrible and incomprehensible regulation.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#199

Post by IncRnd » Fri, May 25, 2018, 8:16 PM UTC

briandear wrote: post #154

throwaway974 wrote: post #75

Earlier quoted context omitted.

GDPR has effects way beyond better user privacy. Sorry I've been pasting this in multiple GDPR related threads, but here it goes: I have a profitable, bootstrapped SaaS business based in US. It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. It's a trivial application that stores mostly already public data. Only email is required t…

The loudest GDPR advocates don’t care about you. 90 years ago they would have been the ones helping collectivize the farms, unintended consequences be damned. And this law’s effects are all about the unintended consequences. Anyone thinking government regulators are reasonable and benevolent has never dealt with said regulators beyond any trivial level. To make it more fun each member country handles enforcement, so…

Well said.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#200

Post by zenovision » Fri, May 25, 2018, 8:16 PM UTC

shiado wrote: post #113

I simply don't understand how or why a law that has scope in the EU is causing trouble for companies which conduct no business in the EU beyond responding to HTTP requests on a global decentralized telecommunications network. Why would an American internet business which conducts no operations in Europe and has no servers in Europe be subject to regulation that affects the EU? What is going to happen? Is the EU going…

EU will not be able to enforce GDPR law in other countries, unless company has a subsidiary in the EU. Otherwise any country in the world can create their laws and expect that anyone in the world following them.