Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shopify Is Illegal in Germany

lsww.de

Post reply on HN
Print view View original

131–140 of 349 posts

Re: Shopify Is Illegal in Germany

#131

Post by erinnh »

tensor wrote: post #116
shafyy wrote: post #7

All EU companies sending any PII to US-owned companies, regardless if the actual data stays in the EU or not, are in danger to be sued similarly to the author of this post. This is, among other laws, because of the US CLOUD act: > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requ…

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

Its not about the connection. You can connect to the website. But the website shouldnt save the IP address for anything other than technical relevant purposes.

Ie. logs should be ok if its to combat DDOS and the like (for a limited time, ie 24h), but not for advertising purposes.

Re: Shopify Is Illegal in Germany

#132

Post by [deleted] »

Aachen wrote: post #114
austinthetaco wrote: post #54

Earlier quoted context omitted.

I'm unfortunately able to find it, but I was pretty sure a lot of the restrictions around doing business in the EU require a certain $ amount transacted or web traffic. Citation definitely needed but that would make sense, as it's how a lot of laws are written.

This might be about the digital services act or digital markets act. GDPR doesn't discriminate even between large businesses and individual consumers. Of course, a data protection authority will look at the circumstances, and the GDPR is 80% common sense, 15% communicating better what you do with people's data, and 5% required boilerplate that makes every privacy policy so redundant and dull and long that nobody read…

[deleted]

Re: Shopify Is Illegal in Germany

#133

Post by __alexs »

andy_ppp wrote: post #130
tensor wrote: post #116

Earlier quoted context omitted.

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

I thought it was the storage of such data that is illegal not the connection? Obviously logs and analytics are an issue in some cases for this law, but I slightly agree with it; should we not all want our digital footprint to be as small as possible?

How long does your TCP connection need to be open for until it becomes "logs"?

The law doesn't care what format that this information is stored in.

Re: Shopify Is Illegal in Germany

#134

Post by bcrosby95 »

shafyy wrote: post #72
lmkg wrote: post #38

Earlier quoted context omitted.

The CLOUD Act gives US law enforcement access to the data, even if it's only stored in Europe. That's the problem, and the EU court is doing no more than recognizing that for the problem that it is.

I think it's good that the EU is forcing the US to get their privacy laws in order.

Wait, do you think law enforcement agencies in Europe can't force companies to reveal ip addresses and/or other customer information?

Re: Shopify Is Illegal in Germany

#135

Post by ghoward »

oytis wrote: post #123
12baad4db82 wrote: post #52

Earlier quoted context omitted.

In terms of the GDPR, your company would need to satisfy compliance of the GDPR. For small companies this is pretty straight forward, and it definitely helps to think about this early. https://gdpr.eu/compliance-checklist-us-companies/

Designate a representative in the EU? That doesn't seem straightforward to me, especially for a small company.

I was thinking the same thing. Even if I managed to do everything else, having to hire someone to do that would be nigh impossible.

Re: Shopify Is Illegal in Germany

#136

Post by capableweb »

TekMol wrote: post #128
capableweb wrote: post #119

Earlier quoted context omitted.

> If using a CDN that is owned by a US company is illegal in Germany, then how can Germans run international websites? Just like US companies can run computers outside of the US border, so can other companies. A German CDN can setup their own infrastructure within US borders, then German companies can work with that CDN to speed up connections within the US for users coming from there. > There is no way to avoid this…

> A German CDN can setup their own infrastructure Ok, but what if you just want to run a website and not build a billion doller global CDN. > GeoDNS According to the GDPR you have to protect the data of your visitors no matter where they are.

> Ok, but what if you just want to run a website. Not build a billion doller global CDN.

Ah, from the perspective of website owners, not the CDN owner... Well, use a European CDN, they tend to follow European regulation, just like US companies follow US regulation. The two companies that comes first to mind is BunnyCDN and KeyCDN, but I'm sure there are many others. Both of them have global networks.

> According to the GDPR you have to protect the data of your visitors no matter where they are.

Yes, of course, that's the ground truth we're assuming here. Is that some sort of gotcha? I'm not sure I'm understanding if you're arguing against what I said or just adding information on top without disagreeing.

Re: Shopify Is Illegal in Germany

#137

Post by tzmudzin »

__m wrote: post #129
tensor wrote: post #116

Earlier quoted context omitted.

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

People are free to give away their PII

… but the receiver needs to provide evidence of consent

Re: Shopify Is Illegal in Germany

#138

Post by sveme »

tensor wrote: post #116
shafyy wrote: post #7

All EU companies sending any PII to US-owned companies, regardless if the actual data stays in the EU or not, are in danger to be sued similarly to the author of this post. This is, among other laws, because of the US CLOUD act: > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requ…

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

It‘s not that simple (actually untrue): https://bluecatnetworks.com/blog/is-an-ip-address-pii-the-an...

Re: Shopify Is Illegal in Germany

#139

Post by tiborsaas »

tensor wrote: post #116
shafyy wrote: post #7

All EU companies sending any PII to US-owned companies, regardless if the actual data stays in the EU or not, are in danger to be sued similarly to the author of this post. This is, among other laws, because of the US CLOUD act: > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requ…

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

Don't spread FUD please.

> anyone in the EU is not even allowed to connect to any website owned by a US company

This is blatantly false, of course you are allowed to connect to non-EU websites even if the IP address could be PII in some circumstances. It's the service providers problem to manage the data they collect in legal way.

Re: Shopify Is Illegal in Germany

#140

Post by lock-the-spock »

tensor wrote: post #116
shafyy wrote: post #7

All EU companies sending any PII to US-owned companies, regardless if the actual data stays in the EU or not, are in danger to be sued similarly to the author of this post. This is, among other laws, because of the US CLOUD act: > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requ…

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

This is not at all correct. Technically necessary use is fully legal under gdpr.
Post reply on HN