Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intent to issue €2.5M fine to Disqus over GDPR breaches

datatilsynet.no

Post reply on HN
Print view View original

61–70 of 123 posts

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#61

Post by kasey_junk »

Aachen wrote: post #37
djoldman wrote: post #7

What is the deal with the GDPR vis-a-vis US companies? If we have a company incorporated solely in the USA that has web content that violates the GDPR but shows a popup and states in its ToU that the website is not to be used by any person or entity in countries that follow the GDPR, can our company be fined under the GDPR? In other words, do GDPR countries claim jurisdiction over non-GDPR countries' websites?

Sibling comments already gave legal advice, but what I'd ask is: why would you want to? If you are transparent about what tracking you do and don't do stuff that people don't want, all that's left is including some boilerplate text like "you have rights X, Y and Z and you can contact us at our@email" and you're GDPR compliant. To me at least, 95% of GDPR compliance is just acting ethically.

95% is not acting ethically it’s documenting how you are in compliance in a way that will hold up to whatever regulating agency comes asking.

Doing that requires understanding a law with out much case precedent, that is extremely broad and has a whole spectrum of enforcement options.

I completely see why a small org might decide to just geo block. That’s an easy to implement, easy to document & defend attempt at compliance.

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#62

Post by xxs »

KingOfCoders wrote: post #54
mmgu wrote: post #32

More background: The fine is mainly based on the fact that Disqus forgot to enroll Norwegian IP-addresses into their GDPR «privacy mode». That meant that websites that had enabled a specific setting ("Enable anonymous cookie targeting") in Disqus were tracking Norwegian without informing them. Most of the websites in Norway and elsewhere did not know they were sharing users data through Disqus. Major sites like the W…

"Most of the websites in Norway and elsewhere did not know they were sharing users data through Disqus." Not to sound too clever, but I would assume if I embed a third party on my website, all bets are off considering privacy/data flow. Only the biggest services with the biggest publicity like GA have rudimentary privacy (opt-out, IP anonymization).

> embed a third party on my website, all bets are off considering privacy/data flow.

That's definitely not the case. It'd be true only if there is no contract w/ the 3rd party at all. Many contracts cover data leaks and the like and the contractual obligations are "non-trivial" to put it mildly.

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#63

Post by sslalready »

mmgu wrote: post #32

More background: The fine is mainly based on the fact that Disqus forgot to enroll Norwegian IP-addresses into their GDPR «privacy mode». That meant that websites that had enabled a specific setting ("Enable anonymous cookie targeting") in Disqus were tracking Norwegian without informing them. Most of the websites in Norway and elsewhere did not know they were sharing users data through Disqus. Major sites like the W…

You could already download most of the comment data from them by querying their API. Similar to profile pictures on Gravatar, emails were only hashed with MD5. They’re easy to reveal with some wordlist attacks.

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#64

Post by djoldman »

lmkg wrote: post #29
djoldman wrote: post #7

What is the deal with the GDPR vis-a-vis US companies? If we have a company incorporated solely in the USA that has web content that violates the GDPR but shows a popup and states in its ToU that the website is not to be used by any person or entity in countries that follow the GDPR, can our company be fined under the GDPR? In other words, do GDPR countries claim jurisdiction over non-GDPR countries' websites?

Oddly enough, the disclaimer might actually increase the chance that you're subject to GDPR. The relevant part of GDPR is Article 3, and Recital 23 (full law text in the links below--read them, they're short!). GDPR applies to a non-EU website that "envisages offering services to data subjects" in the EU. Recital 23 explicitly says that a website merely being available does not count. Offering localized content (e.g.…

Thanks for your reply and for citing the law text.

This is an interesting passage.

It seems to me that saying to ALL visitors of the website that the goods and services are not offered to GDPR places should be sufficient to preclude GDPR jurisdiction.

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#65

Post by djoldman »

Aachen wrote: post #37
djoldman wrote: post #7

What is the deal with the GDPR vis-a-vis US companies? If we have a company incorporated solely in the USA that has web content that violates the GDPR but shows a popup and states in its ToU that the website is not to be used by any person or entity in countries that follow the GDPR, can our company be fined under the GDPR? In other words, do GDPR countries claim jurisdiction over non-GDPR countries' websites?

Sibling comments already gave legal advice, but what I'd ask is: why would you want to? If you are transparent about what tracking you do and don't do stuff that people don't want, all that's left is including some boilerplate text like "you have rights X, Y and Z and you can contact us at our@email" and you're GDPR compliant. To me at least, 95% of GDPR compliance is just acting ethically.

1. It seems to me that a common question many would like answered is: whats the simplest way that I can serve http requests without incurring the wrath of the GDPR?

2. It was my understanding that GDPR compliance is extremely expensive, is this not the case? Perhaps it is very simple.

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#66

Post by KingOfCoders »

xxs wrote: post #62
KingOfCoders wrote: post #54

Earlier quoted context omitted.

"Most of the websites in Norway and elsewhere did not know they were sharing users data through Disqus." Not to sound too clever, but I would assume if I embed a third party on my website, all bets are off considering privacy/data flow. Only the biggest services with the biggest publicity like GA have rudimentary privacy (opt-out, IP anonymization).

> embed a third party on my website, all bets are off considering privacy/data flow. That's definitely not the case. It'd be true only if there is no contract w/ the 3rd party at all. Many contracts cover data leaks and the like and the contractual obligations are "non-trivial" to put it mildly.

Then our experiences differ somehow. Most Disqus users don't look like they have a contract, rather they accept terms and services than can be unilaterally changed by Disqus.

I've signed some DPAs and those that I've signed were very vague and liberal on what data they take - at least none of them felt that they would not try to get all the data that they can.

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#67

Post by speedgoose »

zepolen wrote: post #53
maccard wrote: post #47

Earlier quoted context omitted.

Forgetting for a single country (which is also not part of the EU) certainly seems plausible, more plausible than a targeted attempt at undermining the GDPR in a very specific country

They probably used yaml for their config...

For people who are not aware, if you write the value no in YAML, it parses it as the boolean false which is then usually converted back to the string "false". The solution is to write "no" and not no, but Norway is the only country code requiring this so a lot of people forget about it.

For example I noticed this week that an environment variable in a few of my Norwegian company's deployments was "false" and not "no".

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#68

Post by StavrosK »

speedgoose wrote: post #67
zepolen wrote: post #53

Earlier quoted context omitted.

They probably used yaml for their config...

For people who are not aware, if you write the value no in YAML, it parses it as the boolean false which is then usually converted back to the string "false". The solution is to write "no" and not no, but Norway is the only country code requiring this so a lot of people forget about it. For example I noticed this week that an environment variable in a few of my Norwegian company's deployments was "false" and not "no"…

This actually sounds extremely plausible.

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#69

Post by varispeed »

djoldman wrote: post #7

What is the deal with the GDPR vis-a-vis US companies? If we have a company incorporated solely in the USA that has web content that violates the GDPR but shows a popup and states in its ToU that the website is not to be used by any person or entity in countries that follow the GDPR, can our company be fined under the GDPR? In other words, do GDPR countries claim jurisdiction over non-GDPR countries' websites?

You would have to check each user documents like a passport to confirm they don't have EU citizenship. Even if you have one EU user (doesn't matter if you block EU IP addresses etc. they can still use VPN) you have to comply with GDPR. If you have "significant" amount of EU users then you are also liable for the upcoming terreg regulation that requires you to set up a legal entity in the EU for the purpose of censorship. You will have 1 hour SLA to delete any content that EU deems to be undesirable. If you have any user generated content it also means you are likely be mandated to use content filters in the EU.

Have a read if you don't believe: https://decoded.legal/blog/2021/04/the-eus-terrorist-content...

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#70

Post by varispeed »

Grollicus wrote: post #15
nso wrote: post #11

Earlier quoted context omitted.

Yes. Any EU citizen in our out of country has their PII protected by EU law, regardless of who processes that data. A pop-up or ToU would not skirt the visitors rights, regardless of what the message said and regardless of the action the user took as a result of the message

On the other hand, geoblocking e.g. by ip address (and then completely not letting EU visitors access the website) would probably work, but somehow most companies don't want to do that.

Geo blocking won't help, because EU users can use VPN.
Post reply on HN