Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shopify Is Illegal in Germany

lsww.de

Post reply on HN
Print view View original

211–220 of 349 posts

Re: Shopify Is Illegal in Germany

#211

Post by j16sdiz »

geofft wrote: post #160
tensor wrote: post #116

Earlier quoted context omitted.

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

Honestly, I think if the GDPR had been around before HTTP, we would have seen HTTP as the unreasonable part in this system. You don't have to make a direct TCP/IP connection for two people to communicate. We had systems like Usenet and UUCP that replicated data through a series of servers. Even today, when you use email, you talk to your email provider who talks to the recipient's email provider, and they have no nee…

Now you have mentioned mail providers.

It is illegal to have source ip address in EU based smtp relay?

Re: Shopify Is Illegal in Germany

#212

Post by anonymousab »

pjc50 wrote: post #103
shafyy wrote: post #71

Earlier quoted context omitted.

It's not legal for EU companies to use Google Analytics, because of the same legal reasons.

This either isn't true or nobody has noticed yet. It's on all sorts of EU sites.

Most cookie content popups and forms that you see are also flagrantly illegal under the GDPR.

The problem is that enforcement is rare and small scale compared to the overall scope of the problem. In both of these cases it's a day late and orders of magnitude short.

The Schrems II stuff is a situation where many of the politicians and the businesses really don't want to have to do anything and so they just kinda ignore the law until privacy advocates force their hand. So enforcement is effectively non-existent; the hope being that they can just run out the clock until some sort of legislation magically fixes the issue.

Re: Shopify Is Illegal in Germany

#213

Post by keewee7 »

shafyy wrote: post #7

All EU companies sending any PII to US-owned companies, regardless if the actual data stays in the EU or not, are in danger to be sued similarly to the author of this post. This is, among other laws, because of the US CLOUD act: > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requ…

What is the difference between the CLOUD Act and the actual state of data protection in EU countries like Bulgaria, Romania, and Hungary?

Why should I as a Danish entrepreneur trust a Hungarian hosting provider more than a US hosting provider?

Re: Shopify Is Illegal in Germany

#214

Post by oytis »

kuschku wrote: post #200
friendzis wrote: post #17

Earlier quoted context omitted.

GDPR core is pretty simple: You cannot do stuff (process, store, transfer to third parties) with PII unless X condition is met. An internet site, on first visit (being genuine first visit or just cookieless visit) cannot do things with PII, because there is just no way to even tell if X is met, therefore not only data storage (IP address in Apache access logs included) is illegal, but moreso transfer to third party v…

How is GDPR ugly? It's easy to build websites, even interactive ones, that comply. If you build a mobile app, you are also supposed to only ask for permissions once you actually need them. Replace interactive embeds with a dumb replacement of the actual content and e.g., "we want to show you an embedded tweet here, [allow once] [allow always]". Don't use CDNs for delivering assets, they've long stopped being useful a…

So no embeds, no CDNs, no analytics, lots of popups asking for permissions and going back to 2000s (just with cookie banners) in general. Isn't that ugly?

Re: Shopify Is Illegal in Germany

#215

Post by nolok »

pyrale wrote: post #185
ghoward wrote: post #33

Mini Ask HN: How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers? All operations will be in the US (interaction only through a website). The forge will be designed to allow all of a user's data to be downloaded by that user (easy access to all data). It will also allow wiping away any reference to a user in commits (right to be fo…

The simple answer is that collecting personal data while being located in the US means that you can't guarantee that you will respect European law. > There are zero plans to collect anything that is not needed Unfortunately, it's not up for you to decide. The US has laws that makes it legal for your government to harvest data, and it has used these laws against EU citizen in the past. The US has also asked US service…

Exactly, it's not the EU overreacting about "what could be", those things have already happened

Re: Shopify Is Illegal in Germany

#216

Post by shukantpal »

mminer237 wrote: post #159
__m wrote: post #129

Earlier quoted context omitted.

People are free to give away their PII

How do you collect consent from people before you receive their IP addresses?

Them giving their IP address is consent. If I put a dollar bill in your hand, I can come around a year later and ask for it back since I didn't "consent" explicitly.

Re: Shopify Is Illegal in Germany

#217

Post by ghoward »

pyrale wrote: post #185
ghoward wrote: post #33

Mini Ask HN: How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers? All operations will be in the US (interaction only through a website). The forge will be designed to allow all of a user's data to be downloaded by that user (easy access to all data). It will also allow wiping away any reference to a user in commits (right to be fo…

The simple answer is that collecting personal data while being located in the US means that you can't guarantee that you will respect European law. > There are zero plans to collect anything that is not needed Unfortunately, it's not up for you to decide. The US has laws that makes it legal for your government to harvest data, and it has used these laws against EU citizen in the past. The US has also asked US service…

> Unfortunately, it's not up for you to decide. The US has laws that makes it legal for your government to harvest data, and it has used these laws against EU citizen in the past.

Yeah, I was afraid of this.

> The US has also asked US services to collect data they were not previously collecting, with a gag order to prevent customers from learning it.

I'm so bullish on privacy that I would actually shut down my company if this happens. US courts cannot force me to remain in business.

Re: Shopify Is Illegal in Germany

#218

Post by WastingMyTime89 »

tensor wrote: post #116
shafyy wrote: post #7

All EU companies sending any PII to US-owned companies, regardless if the actual data stays in the EU or not, are in danger to be sued similarly to the author of this post. This is, among other laws, because of the US CLOUD act: > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requ…

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

> Also, since the EU considers an IP address to be PII

As far as I know, it’s only one German court which once considered that an IP address was PII in a specific case. There is nothing in the law that explicitly says that IP addresses are PII.

I think you might be confused about the implications the German ruling has because you are from a common law country. One court ruling something doesn’t make it the law in Europe.

Re: Shopify Is Illegal in Germany

#219

Post by lagrange77 »

capableweb wrote: post #136
TekMol wrote: post #128

Earlier quoted context omitted.

> A German CDN can setup their own infrastructure Ok, but what if you just want to run a website and not build a billion doller global CDN. > GeoDNS According to the GDPR you have to protect the data of your visitors no matter where they are.

> Ok, but what if you just want to run a website. Not build a billion doller global CDN. Ah, from the perspective of website owners, not the CDN owner... Well, use a European CDN, they tend to follow European regulation, just like US companies follow US regulation. The two companies that comes first to mind is BunnyCDN and KeyCDN, but I'm sure there are many others. Both of them have global networks. > According to t…

> The two companies that comes first to mind is BunnyCDN and KeyCDN

Merry Christmas to those two.

Re: Shopify Is Illegal in Germany

#220

Post by nolok »

stickfigure wrote: post #199
ghoward wrote: post #33

Mini Ask HN: How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers? All operations will be in the US (interaction only through a website). The forge will be designed to allow all of a user's data to be downloaded by that user (easy access to all data). It will also allow wiping away any reference to a user in commits (right to be fo…

There's only one realistic solution and that's not to care. Focus on being good to your customers and ignore the geopolitics. Nobody's going to extradite you for running a normal run-of-the-mill web business in the US.

Sure if you're willing to violate the law, but if also need to accept never having any EU businesses as customer.
Post reply on HN