Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intent to issue €2.5M fine to Disqus over GDPR breaches

datatilsynet.no

Post reply on HN
Print view View original

91–100 of 123 posts

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#91

Post by eitland »

StavrosK wrote: post #68
speedgoose wrote: post #67

Earlier quoted context omitted.

For people who are not aware, if you write the value no in YAML, it parses it as the boolean false which is then usually converted back to the string "false". The solution is to write "no" and not no, but Norway is the only country code requiring this so a lot of people forget about it. For example I noticed this week that an environment variable in a few of my Norwegian company's deployments was "false" and not "no"…

This actually sounds extremely plausible.

Agree, but they probably aren't off the hook just because of that.

I think user data is "fissile material" and the "fallout" from a high profile "meltdown" at certain places can easily destroy more lives than the Chernobyl actully ended up destroying.

Given this yaml and a number of other known problematic technologies probably shouldn't be used anywhere near the "reactors".

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#92

Post by StavrosK »

eitland wrote: post #91
StavrosK wrote: post #68

Earlier quoted context omitted.

This actually sounds extremely plausible.

Agree, but they probably aren't off the hook just because of that. I think user data is "fissile material" and the "fallout" from a high profile "meltdown" at certain places can easily destroy more lives than the Chernobyl actully ended up destroying. Given this yaml and a number of other known problematic technologies probably shouldn't be used anywhere near the "reactors".

Certainly, but I can sympathize more with a mistake than with a deliberate tracking attempt.

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#94

Post by chillax »

FriedrichN wrote: post #90
KingOfCoders wrote: post #55

Earlier quoted context omitted.

Yes, loved that HN story.

Can you share it? I must've missed it and I'm in need of a good laugh.

Might have been this noe: https://hitchdev.com/strictyaml/why/implicit-typing-removed/

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#96

Post by e12e »

tzs wrote: post #33
nso wrote: post #11

Earlier quoted context omitted.

Yes. Any EU citizen in our out of country has their PII protected by EU law, regardless of who processes that data. A pop-up or ToU would not skirt the visitors rights, regardless of what the message said and regardless of the action the user took as a result of the message

> Any EU citizen in our out of country has their PII protected by EU law, regardless of who processes that data. That's a common misconception. GDPR applies to "data subjects who are in the Union". Whether or not the data subjects are EU citizens is irrelevant. It also applies to all data processing of processors or controllers who are in the Union, regardless of where the processing takes place or whose data is bein…

And, if a US citizen travel to the EU/EEA, your existing, ripe-for-abuse, US customers are protected under the GDPR.

Not sure how likely a fine would be in that case, though.

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#97

Post by kstrauser »

peanut_worm wrote: post #86

Question to anyone who knows; I am assuming if you don’t live in the EU they can’t make you pay a fine. What do they actually do to stop you from doing business in the EU then? Do they outright block your website? I can’t think of how they’d stop you from collecting ad revenue from EU visitors otherwise.

I'm curious about this, too. I once commented that, say, my hobby website isn't subject to the GDPR because I love, work, and play in the US and that's where my blog is, too. Turns out some people have very strong opinions about this and insisted that I am subject to the GDPR. But as a practical matter, how? I don't have a presence outside the US. Even if I violated a EU law, is there a reason I'd ever need to care? For instance, I know I've violated some Chinese laws by criticizing their government, but I'm OK with that because, really, what are they going to do about it?

As an aside, I'm completely behind GDPR, CCPA, and related privacy laws. I think they're great. I definitely comply with the spirit of the laws in my hobby projects by doing things like not tracking anonymous users, not retaining identifiable logs, etc. This isn't me trying to get away with something nefarious. More like, I don't (and won't) bother with things like cookie banners even if GDPR would want me to.

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#98

Post by [deleted] »

rmah wrote: post #78
remus wrote: post #76

Earlier quoted context omitted.

> I guess if you have a company that is completely isolated from the EU, you just ignore EU fines. Ignoring legitimate fines seems like a pretty bad idea. I think most countries have law to the effect that the directors of the company being fined are liable, so if you skip those fines then one of the directors goes on holiday to that country then they could be sent to prison.

How is it a legitimate fine if the company doesn't do business in the country that issued the fine?

[deleted]

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#99

Post by Barrin92 »

peanut_worm wrote: post #86

Question to anyone who knows; I am assuming if you don’t live in the EU they can’t make you pay a fine. What do they actually do to stop you from doing business in the EU then? Do they outright block your website? I can’t think of how they’d stop you from collecting ad revenue from EU visitors otherwise.

Yes if push comes to shove they could obviously just shut down websites or go after companies that continue to use Disqus and they in turn will drop it. There's also plenty of countries outside the EU who have adopted GDPR compatible laws and so the EU could likely pursue them in their national jurisdictions. Also EU and US regulatory agencies tend to cooperate routinely because it's in either case to keep market access so if the case is large enough I wouldn't bet on being sheltered from enforcement.

There was for example one case of Canadian firm 'AggregateIQ' being pursued by the UK's ICO over privacy violations, and Canadian regulators agreed.

https://www.theguardian.com/world/2019/nov/26/brexit-data-fi...

Re: Intent to issue €2.5M fine to Disqus over GDPR breaches

#100

Post by colejohnson66 »

sslalready wrote: post #63
mmgu wrote: post #32

More background: The fine is mainly based on the fact that Disqus forgot to enroll Norwegian IP-addresses into their GDPR «privacy mode». That meant that websites that had enabled a specific setting ("Enable anonymous cookie targeting") in Disqus were tracking Norwegian without informing them. Most of the websites in Norway and elsewhere did not know they were sharing users data through Disqus. Major sites like the W…

You could already download most of the comment data from them by querying their API. Similar to profile pictures on Gravatar, emails were only hashed with MD5. They’re easy to reveal with some wordlist attacks.

Is there a website to allow me to check my own email address?
Post reply on HN