201–210 of 349 posts
It's kind of ingenious. If you make practically every online service illegal then instead of taxing your citizens you can just fine foreign companies for doing business with you.
Earlier quoted context omitted.
But their CDN providers (CloudFlare, Amazon and Fastly) aren’t. That’s the claim made in the article, that using American owned CDNs makes your business illegal in Europe, even if no data processing or storage happens outside Europe. I find this hard to believe …
It is illegal according to many recent court verdicts, there are some examples with Google Fonts, too. Now, of course in practice you won't be sued if you only run a small business (or you might, if you get unlucky like this guy in the article).
There are lawyers that threaten to sue you in court, treating this as a business model bordering on extortion, but that’s not the case here.
Earlier quoted context omitted.
> Why should it be the case that when you visit my personal website, which I happen to self-host, I have access to your IP address? So when you misbehave, I have the means to block you in particular.
My personal website is a publicly-accessible static site. Blocking people from it is not meaningful. It might be meaningful under the model of direct HTTP, where you could be DoSing me or trying to exploit my web server. But if you don't contact me over HTTP, then that problem doesn't arise. There's no meaningful concept of blocking people from a Usenet post I write. Even for indirect HTTP, I don't need to block peop…
What’s what with the internet is that it allows both types of models, and both are widespread and actively used today. It wouldn’t be hard for e.g. GH to run EU servers and manage mirroring all content and static sites so that traffic is roughly region local. I wouldn't be surprised if they did this to some extent just for efficiency concerns irrespective of any legal ones.
You also seem to be conflating TCP and HTTP.
Earlier quoted context omitted.
I think it's good that the EU is forcing the US to get their privacy laws in order.
Wait, do you think law enforcement agencies in Europe can't force companies to reveal ip addresses and/or other customer information?
(we would NOT be in this situation if Patriot Act => Snowden scandal had not happened)
https://www.lawfareblog.com/how-europes-intelligence-service...
Still, I think you can see how a lot of people might feel more comfortable being spied upon by "their own" intelligence agencies, than foreign ones ? (Since, in democratic countries, these agencies are at least theoretically under the control of governments, which are in theory representative of citizens.)
And while the USA (unlike, say, Russia or China), is treated as an EU ally, their unrivaled power combined with their "world police" actions end up chafing even in the EU...
Earlier quoted context omitted.
There _is_ no legal way to manage that data if the service provider is subject to the CLOUD act.
There is an option for a service provider not to store the IP address anywhere. For users with accounts the standard ToS can handle it.
It makes sense to not store if you're running some kind of privacy service.
Earlier quoted context omitted.
How long does your TCP connection need to be open for until it becomes "logs"? The law doesn't care what format that this information is stored in.
Maybe I’m getting confused with GDPR, anyway I think interpretation of these laws that the stop the internet from working completely is usually incorrect in my experience.
Mini Ask HN: How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers? All operations will be in the US (interaction only through a website). The forge will be designed to allow all of a user's data to be downloaded by that user (easy access to all data). It will also allow wiping away any reference to a user in commits (right to be fo…
> How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers? Do not store any kind of PII as defined by the GDPR, ever, anywhere. If you do, the PII data you store about your companies must be in respect of the GDPR and in particular access to it by law enforcement has to go through EU court. Because the US has decided with the CLOUD Ac…
Like making it clear in the DPA/PP?
Earlier quoted context omitted.
Does it also mean I can't use AWS in Europe?
AWS is owned by a US company subject to subpeonas, so yes, regardless of where you are, you are technically not allowed to receive EU PII (including residential IP addresses) without prior consent or unless it's necessary for the performance of a contract or to take steps requested by the Data Subject.
Earlier quoted context omitted.
> How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers? Do not store any kind of PII as defined by the GDPR, ever, anywhere. If you do, the PII data you store about your companies must be in respect of the GDPR and in particular access to it by law enforcement has to go through EU court. Because the US has decided with the CLOUD Ac…
Is it not even ok to store this data if the company is clear about the fact that they are hosting the data in servers of US company like AWS? Like making it clear in the DPA/PP?
You need to protect it under EU court / jurisdiction, and the US broke that and said they have jurisdiction over any piece of data your company ever touches.
That's why the US now wants some sort of privacy shield 2.
As an actual solution you can use: find another company, an EU company, one that you don't own, to handle your PII data for you, so you never store that data yourself.
Also, be sure to read in the GDPR exactly what is and isn't PII under it, a lot of companies can work just fine without much or any PII, and a lot of people think "any" data is PII.