GDPR compliance as a service

Post by DanBC » Fri, May 04, 2018, 10:22 AM UTC

CLGrimes wrote: post #21

vemv wrote: post #12

Anyone can expand on what "vindictive reporting from no-win-no-fee legal firms" would exactly consist of?

If an EU citizen believes that their personally identifiable information was obtained without their consent, the EU GDPR allows firms to do an audit on the company. The citizen who filed the complaint would enlist help from a no-win-no-fee legal firm, meaning, if they don't win (with infractions being $10 million minimum), the citizen, who is now a client of the firm, would not be out any money. If they do win, most…

Post by DanBC » Fri, May 04, 2018, 10:25 AM UTC

Matticus_Rex wrote: post #80

Lazare wrote: post #60

Earlier quoted context omitted.

Yes, your understanding is completely correct. Only EU member states can levy fines under the GDPR, and it's likely few will have any interest in trying to fine small businesses. Lawsuits are possible, but only for damages, and good luck showing any damages from a minor technical violation by a small SaaS tool. And without any prospect of large damages from a deep-pocketed defendant, good luck finding a law firm will…

I don't have a lot of actual information on this, but the buzz in my privacy professional listservs is that EU courts have been VERY expansive about what constitutes "damage" in related legal spheres, and that those of us coming from a US legal background should not rely on our instincts about what kinds of damage could actually create a cause of action worth suing over.

Post by sebazzz » Fri, May 04, 2018, 10:38 AM UTC

lillesvin wrote: post #32

> Simply paste our JavaScript snippet into your website's code. We'll check every visitor of your site and will block access to users located within the EU. See, the problem here is that you actually have to send an HTTP request to the site that's trying to block you, then you load it along with their JavaScript which then blocks you, but at that point the initial request(s) has already been logged and now they have…

Post by rhabarba » Fri, May 04, 2018, 11:05 AM UTC

DanBC wrote: post #126

rhabarba wrote: post #122

Earlier quoted context omitted.

IP addresses, e-mail addresses from those who comment...

IP addresses alone are not personal data. They're only personal data if they can be used to identify a natural person. If someone is gathering and storing email addresses and ip addresses it seems reasonable to ask them to take industry standard measures to protect that data, and to let users know that the data is being collected.

Post by [deleted] » Fri, May 04, 2018, 12:25 PM UTC

ezekg wrote: post #35

niko001 wrote: post #33

Earlier quoted context omitted.

Not a joke :). GDPR Shield as a product is GDPR compliant. Customers sign a data processor agreement with the service. It anonymizes IP addresses, they aren't transferred to any other third-party provider and aren't stored.

But like I mentioned on Indie Hackers, your customers still have their own logs that need to be GDPR-compliant, which defeats the whole purpose. The page that requests your JS still has to be sent by a server, which will likely log the EU citizen’s IP. And then there’s the case where the EU citizen is using a VPN server in the US...