Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

881–890 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#881

Post by auganov »

gkya wrote: post #774
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

The business culture defined in this post is really freaky, to say the least. You can't point me to one other industry where you can start selling shit w/o "knowing what you're doing". Or if you can't sell your things you lure people in with free stuff and sneakily fuck them up w/o no laws to work around which protect them. Simply and brutally put: if you are incompetent and/or malevolent in your business practices a…

This culture has driven innovation of the last 2 decades. You can't point me to one other industry which enjoyed as much success.

Of course, Europe couldn't care less - they never had a real startup industry in the first place.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#882

Post by delinka »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

I'm in the US and I can't agree with this sentiment.

1) Don't collect more information than is necessary to provide service. Why do you need to care about someone's physical address? "Shipping physical product" is a good answer. Why do you need to maintain historical usage data? "Providing user the ability to view their own usage history" seem acceptable. If any of your answers involve "Just in case", "because marketing said so", or "I don't know", then your plan smells. If you think you need to make money selling my data, think again: maybe you should be charging me enough to cover your costs and make a profit; or if you already are doing that and you still want to sell my data, the you should just stop being greedy.

2) Allow the user to fix incorrect data. I mean, you wrote it to a database at one point in time, you can issue UPDATEs to allow the user to edit information.

3) Remove data when it's no longer needed (e.g. when it's out of date, or when a user says "I'm outta here") If you can't be arsed to figure out how to properly delete data from your database, or hire someone who knows how, then I suggest you're not really dedicated to the business of creating software of value to customers.

4) Provide all of a user's data to that user. It's right there in your systems, and your software is accessing it to make decisions, provide service, etc. How hard can it be to put it all into some CSV files to download? You don't have to copy the users rows from your MySQL tables into a SQLite database that the user can download. Some files with basic explanation of content will suffice.

Yep, it raises the bar on what's "bare minimum" to get your company going. But keep in mind this is more 'line of business' than all the other requirements foisted on you by the law: things like corporate structure, taxes, occupancy permits, etc.

VC firms pair your technical ability with another founder who, presumably, has more of a business bent. That person should understand how to set your business up and how it's regulated - and if not, know where to find answers.

You sound to me like all the GOP whiners about how "regulations hurt business" who fail to see that lack of regulations hurts consumers.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#883

Post by camillomiller »

fanzhang wrote: post #696
gerdesj wrote: post #655

Earlier quoted context omitted.

"but I would like it a lot better if it said that in the actual law" Have you read the bloody law! http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... This is legislation designed to protect not only me (as an individual) but you as well (as a probable foreigner) from me!

Reading the law, I only see a single exception for small companies: Article 30.1 and 30.2 doesn't apply for companies less than 250 employees. Out of an 88 page law, 1% of an auxiliary middle of the law is carved out for small companies. I'm not sure that counts as differential application for small companies. In the US at least, large portions of entire key burdensome laws don't apply for employers below size 50, 10…

You can be a company of ten people and still turn over millions by selling your users’ data in shadowy ways. Why shouldn’t you be stopped just because you’re small. How can the size a company be used as a rational differentiator in a law like this?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#884

Post by beauzero »

closeparen wrote: post #839
kennywinker wrote: post #734

Earlier quoted context omitted.

That’s the wrong analogy. How about “everyone who is in new york for any amount of time had to not be actively harming new yorkers”. Sure some people who want to actively harm new yorkers are going to go away and never come back... but they’ll all be better off for it - and really every other state should probably pass a similar law. Edit: duely noted. Libertarian capitalists of hacker news do not agree.

This comment is personal data about you, specifically your political views. It's now in my browser cache. If you were to ask me to clear it, I'd probably say no. Am I actively harming you?

I was actively harmed by kennywinker's idea I actually would like to seek restitution from him for expressing it because I don't know of a way for him to have it fully erased from my mind.

...or maybe I shouldn't have used this site if I didn't want to be exposed. This is going to end up being less exposure for the EU to things on the internet until someone figures out how to monetize them. If they cost money without somehow contributing something they will be actively excluded.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#885

Post by Tomte »

jeremyt wrote: post #855
Spivak wrote: post #735

Earlier quoted context omitted.

The general recommendation is that if it's too difficult to purge specific users from your backups then: * Have a clear data retention policy and make sure that all backups have an expiration date. * Secure your backups with strong encryption to protect user data in the event of a leak. * Explain it to the user when the account is deleted when the deletion will filter through your backups. * Guarantee that if a resto…

How do you keep track of what info needs to be deleted on restore without violating GDPR?

Save "on restore, delete all data sets pertaining to user id 47263".

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#886

Post by beojan »

hennsen wrote: post #880
beojan wrote: post #865

Earlier quoted context omitted.

Because if your business model is based on selling user data, it doesn't matter if you're a small startup, it absolutely is meant to target you. If you aren't competent at responsibly handling personal data and you want to build a project or startup, pick one that doesn't handle personal data, or put in the effort to learn how to do things properly.

How does for example a small yoga studio’s email list fit in your examples? Or even just it’s website? Without cookies and login even - the IP adress in the log files alone is considered potential personal data that basically puts people in the need of consulting a lawyer about how to safely deal with that. And makes you a potential target to being sued and getting a lot of hassle. Even found nit guilty in the end, n…

> the IP adress in the log files alone is considered potential personal data

Stop logging the IP address then. Hopefully default settings in web servers will change.

> What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost?

That means you have a legitimate interest, so long as you don't send marketing emails to those addresses, or sell them, and so long as you delete them if someone deletes their account.

> How does for example a small yoga studio’s email list fit in your examples?

If someone signs up to your email list, they've consented to receiving emails. Just don't sell the list, and remove people if they unsubscribe.

The only real complication (if you're in the UK, I don't know about other countries) is that there is a fee to register as a data controller. https://ico.org.uk/for-organisations/data-protection-fee/

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#887

Post by 23443463455 »

raverbashing wrote: post #801
eli wrote: post #633

Earlier quoted context omitted.

It's reassuring to hear that the GDPR is not meant to target little startups and projects but I would like it a lot better if it said that in the actual law, rather than just trusting all current and future regulators to treat me kindly. If it's only meant to be used against big companies or extreme offenders, why doesn't it say so? It seems like the spirit of the law and the language of the law are not aligned and i…

> If it's only meant to be used against big companies or extreme offenders, why doesn't it say so? Because, and this has been repeated millions of times on HN, Europe and the US follow different systems in writing laws

Trust the benevolent dictates of the undemocratic EU, right?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#888

Post by delinka »

baryphonic wrote: post #876
sequoia wrote: post #788

Earlier quoted context omitted.

"The hacker spirit" was NEVER about harvesting user data so you could sell it to advertisers. Bite your tongue.

This is a false dichotomy that I fully reject. I feel disgust for the current generation of creepy, centralized, ad-ridden websites that make a pittance on each of us and use our data to create the next generation of (proprietary) AI. I also don't think the _solution_ to that problem is to create a new bureaucracy and complex set of rules ("you won't be targeted, trust us!") that seems to address a "problem" (if it e…

My understanding of "blockchain ledgers" is that it's not the case that every single byte of a ledger entry is present in the blockchain, but that some other ledger is maintained and its digest (at various points along the way) is incorporated into the blockchain.

That being the case, "the network" doesn't own these 'side ledgers.' They have owners who may well keep non-public data. Further, that the data comprising a particular digest needn't be disclosed, only that the owner of the digest vouches for the digest. For forgettable mode, said owner validates their own data, generates the digest, adds it to the blockchain, and subsequently 'forgets' the data that created the digest.

Now maybe that flies in the face of a fully public blockchain, but it allows the implementation of that which you couldn't fathom: a right to be forgotten alongside blockchain technology.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#889

Post by madez »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

I think it's mind boggling how you equate startup with abusing user data without users consent. Is that really the only way you think someone can make a business and earn money?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#890

Post by [deleted] »

baryphonic wrote: post #876
sequoia wrote: post #788

Earlier quoted context omitted.

"The hacker spirit" was NEVER about harvesting user data so you could sell it to advertisers. Bite your tongue.

This is a false dichotomy that I fully reject. I feel disgust for the current generation of creepy, centralized, ad-ridden websites that make a pittance on each of us and use our data to create the next generation of (proprietary) AI. I also don't think the _solution_ to that problem is to create a new bureaucracy and complex set of rules ("you won't be targeted, trust us!") that seems to address a "problem" (if it e…

[deleted]
Post reply on HN