Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

371–380 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#371

Post by bialpio »

newman8r wrote: post #184
ams6110 wrote: post #111

Earlier quoted context omitted.

As a developer I can understand this point of view, but as a consumer I say it's time to grow up. Internet startups have taken a "move fast and break things" approach that is analogous to early industrial revolution approaches to worker safety, product efficacy and safety, and environmental protection. You're working in the real world, with real consequences if you end up exposing people's personal data. The party is…

I agree that exposing personal data is serious, and companies should be held responsible if they violate the terms of their privacy policy. I think companies should follow the law of the land. The thing about GDPR that I disagree with is how it aims to have global jurisdiction. If it was a US law (as a US-based developer), perhaps I'd protest it, but I'd still follow it if I wanted to work in software.

But just because it requires changes affecting companies outside of EU that doesn't make the jurisdiction global. It's the same as with any other product that you are selling - if you want to sell it in EU, it has to satisfy EU's rules, irrespective of where it's being assembled / produced.

So if you "sell" to EU residents, follow EU's rules.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#372

Post by NeutronStar »

seanmcdirmid wrote: post #363
jacquesm wrote: post #122

Earlier quoted context omitted.

> Is the EU going to target American banks of American businesses and try to extract fines? You mean like America? That time when the USA decided to enforce their embargo against Cuba by intercepting a payment from one of the Nordics for a bunch of Cuban cigars? No, that's unlikely. > Is the EU going to extradite owners of these businesses? Extremely unlikely, besides that would require the cooperation of the other c…

That makes me wonder: what about wechat? Surely Tencent has many overseas Chinese users in Europe, and I’m sure they play as or more aggressively as the American majors. Is Europe going to sanction Chinese companies for violations along with American ones?

Facebook is legally an Ireland company FYI.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#373

Post by acatton »

ziftface wrote: post #330
acatton wrote: post #218

Earlier quoted context omitted.

As a French guy, these type of comments make me smile. The GDPR is basically just the implementation of the French law "Informatique et Liberté" into the European Level. (You can read on HN many Germans saying that it's actually the implementation of the Datenschutzgesetzt. The truth is: these two laws are extremely similar.) This law has been in application since 1978 [1]. And in 2018, we have adtech companies like…

I looked up information on how to legally comply with GDPR and it's a lot more complicated than you're making it out to be. You have to show regulators the well-defined pipeline for any personal data, and justify to them why that data is being collected. There are also extra procedures you have to follow that could be really complicated depending on the business. This is even worse for small businesses. I can definit…

When I read that, I don't know how to answer.

As I said other comments, I'm not sure if people on HN have a problem with the GDPR, or just with the concept of regulation itself.

Also, when I read about "complicated rules for small businesses". It reminds me about American republican politicians explaining how taxes on the rich will affect the average joe's taxes.

The reality is that many rules only apply to big businesses. And small businesses are exempt of many rules. My favorite one is the "Data Protection Officer", everybody on the internet™ says that you need one. The reality? Most small business won't. The article 37 explains that the Data Protection Officer is when a business is "collecting data on a large scale" [1] Second of all, people interpret that as "Hiring somebody", you don't. It's just a role, take your CEO, and now he's your "Data Protection Officer", ...

--

[1] https://gdpr-info.eu/art-37-gdpr/

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#374

Post by anf »

zenovision wrote: post #254
Bud wrote: post #214

Earlier quoted context omitted.

Why? You're opposed to privacy? And how do you plan to react when you get penalized?

I do care about privacy - I don't use Analytics on my website, don't show any ads, don't send marketing emails and don't sell customer data to anyone. However, I will not comply with that bureaucratic law, because the EU will not be able to enforce it in my country and I have much more important things to do to stay competitive on the market (I have a lot of competitors).

Do you send user data anywhere in a way users may not expect? If not there's probably nothing to comply with. It's really the opposite of bureaucratic law — the entire thing is quite readable and reasonable.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#375

Post by guelo »

takeitto wrote: post #312
ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

I am European browsing from a non-EU IP. Seems to me a blanket ban on EU IPs is both draconic and ineffective. As for SV seeing GDPR as more of a hindrance: SV was build on the freemium model of gathering as much data as possible. Companies were funded under the assumption that their user growth would lead to valuable data stores. GDPR and an increased privacy aware public are existential threats to these companies,…

> ban on EU IPs is both draconic and ineffective

It doesn't matter it's ineffective. The block means they're complying with GDPR's requirement that they not target Europeans.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#376

Post by [deleted] »

rightos wrote: post #353
orwin wrote: post #342

Earlier quoted context omitted.

You have two solution: 1: ignore GDPR, you'll probably fly under. And if you dont, fine are scaled for business and people affected, as well as privacy infraction. Encrypt your backups, encrypt PII if you can do it effortlessly, and you're good. If you are not using emails except for checking double inscription, encrypt them too, the entropy is low BUT this is better than nothing . 2: If you have some time and money…

Is there some way they can fine me with me being in a country completely and totally unrelated to the EU?

[deleted]

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#377

Post by weirdkid »

progre wrote: post #366
zmmmmm wrote: post #344

Earlier quoted context omitted.

I can't think of any web server that doesn't log ip addresses by default, and I think it's been established that satisfies the GDPR threshold test for personal data. So while what you say is true, I think you're being a little bit deceptive when you say 'As long as you're just "responding to HTTP requests"' because all practical and established means of doing that violate the GDPR by default.

So hash the IP before you log. Now it cant be traced to a user and you are GDPR compliant. Its really not that hard.

What's the setting in httpd.conf for that?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#378

Post by GuthL »

zmmmmm wrote: post #344
lima wrote: post #141

Earlier quoted context omitted.

As long as you're just "responding to HTTP requests", there's nothing to worry about and the GDPR does not apply. It's when you start collecting personal data on EU residents, send their personal data to third parties for analytics/targeted advertising, and so on, that things get interesting.

I can't think of any web server that doesn't log ip addresses by default, and I think it's been established that satisfies the GDPR threshold test for personal data. So while what you say is true, I think you're being a little bit deceptive when you say 'As long as you're just "responding to HTTP requests"' because all practical and established means of doing that violate the GDPR by default.

Ip used for technical reasons such as logging access are not concerned by the gdpr per se. The same goes to KYC informations. The gdpr is actually a well written piece of legislation which should worry you only if you do shady stuff. The only edge case that I know are not well addressed concerns the status of encrypted data (would be deleting private keys considered to be deleting them? This question is important on blockchain data storage)

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#379

Post by phyzome »

zenovision wrote: post #254
Bud wrote: post #214

Earlier quoted context omitted.

Why? You're opposed to privacy? And how do you plan to react when you get penalized?

I do care about privacy - I don't use Analytics on my website, don't show any ads, don't send marketing emails and don't sell customer data to anyone. However, I will not comply with that bureaucratic law, because the EU will not be able to enforce it in my country and I have much more important things to do to stay competitive on the market (I have a lot of competitors).

"Oh no, the EU passed a law that is totally in line with my ethics! I'd better rebel against them."

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#380

Post by ww520 »

djhworld wrote: post #134
ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

I really enjoyed this quote from [1] > I would be very wary of a company who claims this legislation is onerous. It is potentially life threatening to companies who do very shady things without your consent. That much is true. That is the entire point. I somewhat suspect those companies hiding behind the 'oh lets just block Europe' excuse just don't want to admit the extent of what they are doing with the data. US ci…

That is the equivalence of, "if you haven't done anything wrong, why do you need to hide your information?"
Post reply on HN