Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shopify Is Illegal in Germany

lsww.de

Post reply on HN
Print view View original

181–190 of 349 posts

Re: Shopify Is Illegal in Germany

#181

Post by dmix »

formerly_proven wrote: post #94
yashap wrote: post #20

Earlier quoted context omitted.

I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly). > The data protection authority justified this with the fact that US authorities could access personal data (probably primarily the IP address) for criminal p…

> I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly). This doesn't matter, EU sites have been getting fined for some time now for using CDNs like this, most popularly Google Fonts.

Regulators focusing on the important stuff once again.

I guess if you fear Quantum inserts it might have some privacy/security gains.

Re: Shopify Is Illegal in Germany

#182

Post by nolok »

ghoward wrote: post #33

Mini Ask HN: How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers? All operations will be in the US (interaction only through a website). The forge will be designed to allow all of a user's data to be downloaded by that user (easy access to all data). It will also allow wiping away any reference to a user in commits (right to be fo…

> How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers?

Do not store any kind of PII as defined by the GDPR, ever, anywhere.

If you do, the PII data you store about your companies must be in respect of the GDPR and in particular access to it by law enforcement has to go through EU court.

Because the US has decided with the CLOUD Act that US access to all data from US companies, or any company owned by a US company, only had to go through US court, it is not possible to comply at the moment.

(before the CLOUD Act, storing the PII data within the EU and owned by a EU subsidiary was the best solution)

Re: Shopify Is Illegal in Germany

#183

Post by TekMol »

Who decides what is legal and what is illegal?

The politicians, the courts or agencies like the one that send letter to the author of this article.

I would say it is the politicians. By making laws.

Since the GDPR is the same in all EU countries, Shopify is either illegal in all EU countries or in none, right?

Re: Shopify Is Illegal in Germany

#184

Post by kuschku »

shafyy wrote: post #68
yashap wrote: post #32

Earlier quoted context omitted.

But their CDN providers (CloudFlare, Amazon and Fastly) aren’t. That’s the claim made in the article, that using American owned CDNs makes your business illegal in Europe, even if no data processing or storage happens outside Europe. I find this hard to believe …

It is illegal according to many recent court verdicts, there are some examples with Google Fonts, too. Now, of course in practice you won't be sued if you only run a small business (or you might, if you get unlucky like this guy in the article).

There are some lawyers in Germany that have made a business out of suing every tiny website that violates the GDPR by using any US service at all.

So no, don't expect your personal website from being exempt.

Re: Shopify Is Illegal in Germany

#185

Post by pyrale »

ghoward wrote: post #33

Mini Ask HN: How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers? All operations will be in the US (interaction only through a website). The forge will be designed to allow all of a user's data to be downloaded by that user (easy access to all data). It will also allow wiping away any reference to a user in commits (right to be fo…

The simple answer is that collecting personal data while being located in the US means that you can't guarantee that you will respect European law.

> There are zero plans to collect anything that is not needed

Unfortunately, it's not up for you to decide. The US has laws that makes it legal for your government to harvest data, and it has used these laws against EU citizen in the past. The US has also asked US services to collect data they were not previously collecting, with a gag order to prevent customers from learning it.

Re: Shopify Is Illegal in Germany

#186

Post by oytis »

Fire-Dragon-DoL wrote: post #113

I'm somewhat concerned about an app I host. It's on Digitalocean and serves only EU customers. DigitalOcean says they are full GDPR compliant, but given the cloud act this seems impossible. What alternatives are available in Europe? It will be really frustrating to migrate

Hetzner Cloud (sarcasm, kind of)

Re: Shopify Is Illegal in Germany

#188

Post by BlueTemplar »

mbreese wrote: post #95
shafyy wrote: post #72

Earlier quoted context omitted.

I think it's good that the EU is forcing the US to get their privacy laws in order.

I don't think the EU will force the US to do anything w.r.t. privacy. Instead, we'll see EU based CDNs start to take over customers from US CDNs. Less "get your act together", more "we'd rather do this ourselves...".

Yeah, see for instance this discussion :

https://news.ycombinator.com/item?id=27393854

Re: Shopify Is Illegal in Germany

#189

Post by shafyy »

pjc50 wrote: post #103
shafyy wrote: post #71

Earlier quoted context omitted.

It's not legal for EU companies to use Google Analytics, because of the same legal reasons.

This either isn't true or nobody has noticed yet. It's on all sorts of EU sites.

It it true, e.g. see here:

https://isgoogleanalyticsillegal.com/

https://plausible.io/blog/google-analytics-illegal

Law is a code that needs to be interpreted by society. This interpretation is done by judge rulings. There is a growing number of rulings that Google Analytics, and in fact any sending of customer PII to US-owned legal entities, is illegal.

Naturally, smaller companies won't be sued, right now. But the more time passes, the clearer it becomes that given the current GDPR and US laws, it's illegal.

Re: Shopify Is Illegal in Germany

#190

Post by rootusrootus »

XAMPPRocky wrote: post #104
kmlx wrote: post #59

Earlier quoted context omitted.

> The privacy angle lives in the minds of Europeans without data, it’s hard to make this argument. what we know for sure is that bureaucrats fully support the privacy angle. but from my anecdotal real life experience almost no one cares (another argument that without data cannot be generalised).

The "bureaucrats" are elected officials so if people weren't in favour of it, they would stop electing MEPs that vote in favour of it.

When has any democracy worked even remotely like that? There are countless issues politicians must take a position on, you won't agree with all of them. So you prioritize. Or you just vote party line, which is by far what most people do.
Post reply on HN