Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

501–510 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#501

Post by viraptor »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

> the requirement that you can permanently delete all of your information. Most early-stage startup use the best practice of “delete=1”.

What's your system for dealing with COPPA then? You're required to have a way for permanently removing data of children.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#502

Post by meko »

takeitto wrote: post #327
tquinn wrote: post #244

Earlier quoted context omitted.

I feel the EU regulators could stand to learn something. If EU citizens are small portion of your users, and your tasked with parsing this document http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... just blocking them doesn't seem like that bad of an idea, especially with the fines involved. I think the things that bother me is: 1) A College student working on a side project with no revenue are treated t…

> It's a foreign requirement that feels like a violation of sovereignty. Sure, if you cater to users in your own country. If you cater (read: deal with data) to users from the EU, you should follow local consumer protection laws. EU laws have always been more strict than US privacy laws: This caused unfair competition, where US companies were free to export their privacy-damaging business model overseas, while local…

I find it odd that people take issue with regulation, perhaps its been ingrained into the cultural consciousness of the west that regulation is always bad, but historical analysis shows that regulation has always had an overwhelmingly net positive effect for the members of a given society. You can link the stage of a country's development to how effective their government is in protecting it's constituents.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#503

Post by manfredo »

viraptor wrote: post #482
manfredo wrote: post #454

Earlier quoted context omitted.

If a kid makes a meme generator site where you can create a profile and organize your dank memes, then now they have to have a data protection officer, build a system to purge user data, and build a system to get user consent, etc. I can easily see small websites just ignoring GDPR and hoping they fly under the radar. Or, using something like this Cloudflare configuration to block all EU users until they reach a size…

> they have to have a data protection officer DPO is only needed in specific cases. Dank meme sites don't fit in any of: a) public authority b) monitoring subjects on large scale c) dealing with criminal conviction data. > build a system to get user consent It's called a checkbox. They likely use one to agree to TOS anyway. If you don't have that one, DMCA and COPA is what you should be worried about before GDPR. (If…

Article 37 1.a and 1.b are extremely vauge. Hiring a DPO becomes necessary once your service "requires regular and systematic monitoring of data subjects on a large scale", or processing personal info specified in article 9 "on a large scale".

However, nowhere does it actually specify what sort of scale constitutes "large". I don't see any user count threshholds or anything like that.

Also, it's possible that someone's list of authored memes is personal data. If somebody creates a lot of political memes then this could easily be covered by article 9, since political affiliation is explicitly covered there.

Additionally just saying "have a checkbox" isn't going to cut it. GDPR forbids blanket opt in or opt out schemes. You would have to build a system to track what the user has consented to and refactor all features to abide by each user's consent configuration.

I'm not saying every these tasks are hugely onerous - just that I can see the use case for blocking EU traffic to avoid having to abide by their regulations.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#504

Post by nelsntk »

manfredo wrote: post #454
takeda wrote: post #429

Earlier quoted context omitted.

> A College student working on a side project with no revenue are treated the same as some massive multi-national. Am I reading this wrong? If the college student creates just a simple page, he/she is already complaint with GDPR. If the student starts collecting personal information, then they need to know what's allowed or not. There are already things that are not legal to do, GDPR just adds private information int…

If a kid makes a meme generator site where you can create a profile and organize your dank memes, then now they have to have a data protection officer, build a system to purge user data, and build a system to get user consent, etc. I can easily see small websites just ignoring GDPR and hoping they fly under the radar. Or, using something like this Cloudflare configuration to block all EU users until they reach a size…

>they have to have a data protection officer

Themselves

> build a system to purge user data

SELECT * from users, memes, usermemes where userid = #####

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#505

Post by 4ndrewl »

mc32 wrote: post #496
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

Even if you delete it from disk and remove from memory, you may be required to remove it from offline backups too like tapes and other media.

Not true.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#506

Post by gerdesj »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

I'm a Brit. I am the MD of a small IT company. I have two partners and 20 employees. We started in 2000. We turn over about £1.5Mpa. We sell our services to people and organisations. Our backups are now smaller these days (thanks to GDPR).

I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR. There is no way on earth that the EU as a whole has looked on your company/project or whatever and decided to screw you.

Have a look at the first few paras of this: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... after it says "Whereas". Does the language look a little familiar? Do the sentiments look strangely familiar in some way?

GDPR is not about destroying people's livelihoods. It is about protecting basic, fundamental rights that say 30 years ago we never knew needed to exist.

After all the knee jerk reactions have calmed down a bit, you may find that you personally have benefited in some way from EU regs. If you find that, then I suggest you fight tooth and nail for similar to be enacted at home. I'll be the first to thank you for that.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#507

Post by guelo »

viraptor wrote: post #501
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

> the requirement that you can permanently delete all of your information. Most early-stage startup use the best practice of “delete=1”. What's your system for dealing with COPPA then? You're required to have a way for permanently removing data of children.

COPA was struck down by the courts last decade.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#508

Post by castis »

jsjohnst wrote: post #499

I’m really getting sick of seeing IP filtering being mentioned in the context of blocking a specific nationality of person. Do people not understand a European citizen can travel? Use VPNs? Have an IP that is misreported to the wrong location?

Yeah this is basically the equivalent of sticking your fingers in your ears and going "LALALALALALALALA"

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#509

Post by mc32 »

4ndrewl wrote: post #505
mc32 wrote: post #496

Earlier quoted context omitted.

Even if you delete it from disk and remove from memory, you may be required to remove it from offline backups too like tapes and other media.

Not true.

Has that interpretation changed? I recall reading that in some circumstances it could. Or was that misinformation?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#510

Post by amarkov »

viraptor wrote: post #501
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

> the requirement that you can permanently delete all of your information. Most early-stage startup use the best practice of “delete=1”. What's your system for dealing with COPPA then? You're required to have a way for permanently removing data of children.

COPPA only applies to sites that are directed towards children or have "actual knowledge" that they're collecting data from children. It's legally sufficient to ask for birthdays and refuse signups from anyone under 13.
Post reply on HN