Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shopify Is Illegal in Germany

lsww.de

Post reply on HN
Print view View original

171–180 of 349 posts

Re: Shopify Is Illegal in Germany

#171

Post by jansan »

throwaway13337 wrote: post #29

Though the intentions of GDPR were good, Following the GDPR to the letter is not feasible for any company that isn't a monopoly. We're in a situation where no one is following it all the way as it's not even clear what that means. More of the same will continue and the GDPR will only be used coercively as an attack against competition or companies others don't like. It's really a major blow for small businesses that…

I could not agree more. It is absolutely insane who much intellectual capacity the GDPR is binding, which could otherwise be used to innovate. It is a good thing to force companies to think about how their data is used, just as it is a good thing to make them think about network and website security. But the GDPR is more problem than solution.

Re: Shopify Is Illegal in Germany

#172

Post by utopcell »

tensor wrote: post #116
shafyy wrote: post #7

All EU companies sending any PII to US-owned companies, regardless if the actual data stays in the EU or not, are in danger to be sued similarly to the author of this post. This is, among other laws, because of the US CLOUD act: > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requ…

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

Is it illegal for a EU citizen to access google.com ?

Re: Shopify Is Illegal in Germany

#173

Post by capableweb »

taormina wrote: post #168
capableweb wrote: post #136

Earlier quoted context omitted.

> Ok, but what if you just want to run a website. Not build a billion doller global CDN. Ah, from the perspective of website owners, not the CDN owner... Well, use a European CDN, they tend to follow European regulation, just like US companies follow US regulation. The two companies that comes first to mind is BunnyCDN and KeyCDN, but I'm sure there are many others. Both of them have global networks. > According to t…

The point you are missing is that if I am an EU citizen, in the US, on my US friend’s computer even, your crappy “location detector” just denied me my rights as an EU citizen. No one cares if the IP address was thought to originate in the EU or US or wherever because that has never been enough information to tell if you are dealing with an EU customer.

I think the point you're missing about the GDPR is that it doesn't matter where your citizenship is from, your location is what matters. US persons in the EU is as well protected as EU persons in the EU. No matter where you're from, if you're in the EU, GDPR applies.

Edit: in order to make this discussion a bit more fact based, as some misinformation is starting to leak into it: I'm referring to Article 3 from GDPR, "Territorial scope". It states:

> This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union

Re: Shopify Is Illegal in Germany

#174

Post by Msurrow »

ghoward wrote: post #33

Mini Ask HN: How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers? All operations will be in the US (interaction only through a website). The forge will be designed to allow all of a user's data to be downloaded by that user (easy access to all data). It will also allow wiping away any reference to a user in commits (right to be fo…

IANAL

As it stands right now, it is not possible for a US owned busniess to provide a service to EU citizens legally, if the business handles PII.

The reason is partly due to the basic rights of the registrant granted by GDPR must be ensured by the data processor (the company), and due to the Schrems II ruling [1] that determines that GDPR is incompatible with US law.

The non-legalese version is that US law that gives Intelligence agencies (etc) the power demand a US owned (not just based) company to hand over any data including PII, means that the basic rights of the GDPR cannot be fullfilled. [1]: https://www.gdprsummary.com/schrems-ii/

Re: Shopify Is Illegal in Germany

#175

Post by jansan »

lmkg wrote: post #79
throwaway13337 wrote: post #29

Though the intentions of GDPR were good, Following the GDPR to the letter is not feasible for any company that isn't a monopoly. We're in a situation where no one is following it all the way as it's not even clear what that means. More of the same will continue and the GDPR will only be used coercively as an attack against competition or companies others don't like. It's really a major blow for small businesses that…

This ruling is about the US CLOUD Act moreso than GDPR. The CLOUD Act says US law enforcement can get anyone's data from a US company, with no safeguards. GDPR is just calling a spade a spade.

What ruling? There was not court ruling in the case described in the article.

Re: Shopify Is Illegal in Germany

#177

Post by geofft »

rootusrootus wrote: post #167
geofft wrote: post #160

Earlier quoted context omitted.

Honestly, I think if the GDPR had been around before HTTP, we would have seen HTTP as the unreasonable part in this system. You don't have to make a direct TCP/IP connection for two people to communicate. We had systems like Usenet and UUCP that replicated data through a series of servers. Even today, when you use email, you talk to your email provider who talks to the recipient's email provider, and they have no nee…

> Why should it be the case that when you visit my personal website, which I happen to self-host, I have access to your IP address? So when you misbehave, I have the means to block you in particular.

My personal website is a publicly-accessible static site. Blocking people from it is not meaningful.

It might be meaningful under the model of direct HTTP, where you could be DoSing me or trying to exploit my web server. But if you don't contact me over HTTP, then that problem doesn't arise. There's no meaningful concept of blocking people from a Usenet post I write. Even for indirect HTTP, I don't need to block people from my GitHub Pages or from my HN comments. They're public.

If I add dynamic feature like a comment system or discussion forum to my website, then it becomes meaningful, but also at that point I can implement a way for you to consent to sharing your IP address with me as part of signing up.

Re: Shopify Is Illegal in Germany

#178

Post by bmitc »

XAMPPRocky wrote: post #104
kmlx wrote: post #59

Earlier quoted context omitted.

> The privacy angle lives in the minds of Europeans without data, it’s hard to make this argument. what we know for sure is that bureaucrats fully support the privacy angle. but from my anecdotal real life experience almost no one cares (another argument that without data cannot be generalised).

The "bureaucrats" are elected officials so if people weren't in favour of it, they would stop electing MEPs that vote in favour of it.

That’s a naïve view of how politics and elections work.

Re: Shopify Is Illegal in Germany

#179

Post by ksidudwbw »

johannes1234321 wrote: post #124
tensor wrote: post #116

Earlier quoted context omitted.

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

> anyone in the EU is not even allowed to connect to any website owned by a US These laws don't bind individual citizens, but companies offering services. One might however ask, whether EU ISPs are allowed to route to U.S. as that passes IP addresses to U.S. companies. Maybe if they implement NATing?

Just don't be creepy, that's all.

Re: Shopify Is Illegal in Germany

#180

Post by mminer237 »

generationP wrote: post #9

Wait, does this imply that running a website behind CloudFlare is illegal in the EU? After all, webshop or not, IPs will be transmitted... Or are IPs only a problem in connection with getting user data like name and address? Or is it the IP+cookie combo?

Yes, US CDNs are definitely illegal under GDPR. They've fined people before for using Google Fonts' CDN because it transmitted residential EU residential IP addresses to someone within the reach of the US government. The law is that you have to have prior consent or it has to be necessary to take steps requested by the Data Subject. US CDNs are not considered necessary because an EU server could host those assets instead.

GDPR just has incredibly sparse, scattershot enforcement because of how disruptive complying with it would be to EU Internet users.

Post reply on HN