Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shopify Is Illegal in Germany

lsww.de

Post reply on HN
Print view View original

221–230 of 349 posts

Re: Shopify Is Illegal in Germany

#221

Post by nolok »

geofft wrote: post #143
donatj wrote: post #99

Earlier quoted context omitted.

Does that mean I can send people requests to delete my contact info from their phone and they're legally required to comply?

From GDPR article 2: > 2. This Regulation does not apply to the processing of personal data: > (c) by a natural person in the course of a purely personal or household activity My sense (I am neither a lawyer nor European so this is certainly not European legal advice) is that you cannot use GDPR to compel someone to delete your contact info if they're solely a social acquaintance, but you can use it to compel them to…

Exactly, your baby sitter, your employer, your lawyer, the plumber you called two months ago ... Are covered.

The person you traded phone at the bar last week, your neighbor or your coworker from last job are not.

Re: Shopify Is Illegal in Germany

#222

Post by password4321 »

Fire-Dragon-DoL wrote: post #113

I'm somewhat concerned about an app I host. It's on Digitalocean and serves only EU customers. DigitalOcean says they are full GDPR compliant, but given the cloud act this seems impossible. What alternatives are available in Europe? It will be really frustrating to migrate

Scaleway

Re: Shopify Is Illegal in Germany

#223

Post by wizeman »

johannes1234321 wrote: post #124
tensor wrote: post #116

Earlier quoted context omitted.

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

> anyone in the EU is not even allowed to connect to any website owned by a US These laws don't bind individual citizens, but companies offering services. One might however ask, whether EU ISPs are allowed to route to U.S. as that passes IP addresses to U.S. companies. Maybe if they implement NATing?

> These laws don't bind individual citizens, but companies offering services.

Right. EU companies whose websites are accessed by individual citizens and usually have assets stored by US companies, such as CDNs.

Re: Shopify Is Illegal in Germany

#224

Post by messutied »

nolok wrote: post #210
messutied wrote: post #207

Earlier quoted context omitted.

Is it not even ok to store this data if the company is clear about the fact that they are hosting the data in servers of US company like AWS? Like making it clear in the DPA/PP?

It's not about saying where the data is / warning your customer, it's about protecting the data. You need to protect it under EU court / jurisdiction, and the US broke that and said they have jurisdiction over any piece of data your company ever touches. That's why the US now wants some sort of privacy shield 2. As an actual solution you can use: find another company, an EU company, one that you don't own, to handle…

We definitely store PII as we have to store users emails an even phone numbers.

So we basically need to migrate to a EU based could provider ASAP?

Would this privacy shield 2 fix this problem? I suppose we can’t just wait for that.

Re: Shopify Is Illegal in Germany

#225

Post by tremon »

nolok wrote: post #122
lmkg wrote: post #43

Earlier quoted context omitted.

No one knows yet, because the successor to Privacy Shield is still currently more of an "agreement to do something" rather than an actual law. There is at least some movement in the right direction, which is to say the US is paying lip service to the notion updating domestic law to curtail law enforcement's access to data. But that hasn't actually happened yet.

The problem is that the US wants an agreement (saying data can be stored in the US as long as the US can't access it and EU privacy laws are applied to it), but the US also doesn't actually want to lose the right to warrant the data from US companies without respecting EU laws. The history of the situation is like this: - Privacy shield exists - EU users data are stored and owned by Microsoft Ireland - US goes agains…

- EU is not fooled at all and ends the privacy shield

This is not entirely correct, the EU kept on pretending for a while that the problem didn't exist, until Max Schrems (from noyb.eu) forced a court ruling on the inadequacies of the Privacy Shield agreement. As shown on their homepage, NOYB does a lot more than just investigate EU-US data transfers.

Re: Shopify Is Illegal in Germany

#226

Post by lambertsimnel »

dumbfounder wrote: post #149
donatj wrote: post #99

Earlier quoted context omitted.

Does that mean I can send people requests to delete my contact info from their phone and they're legally required to comply?

And does this mean I can do this to the collection agent trying to get me to pay 4x for a parking ticket I got in Italy 5 years ago?

IANAL. Although I imagine you could, presumably they'd argue that (while your parking tickets are unpaid) they have a legal basis other than consent for processing your personal data. In that case, you'd probably have to find grounds for erasure other than withdrawal of consent. 1d or 1e of Article 17 look most relevant (but maybe not very promising):

https://gdpr-info.eu/art-17-gdpr/

Re: Shopify Is Illegal in Germany

#227

Post by oytis »

yxhuvud wrote: post #109
gok wrote: post #51

The EU is try to copying China's playbook of propping up local service providers by imposing impossible-to-follow rules on foreign tech companies. In both cases, the rest of the world should retaliate by limiting access to advanced technology until laws change.

It is neither impossible to follow or very hard. It just happens to be incompatible with US laws that grant local law enforcement access to stuff that is stored outside their jurisdiction, for customers also outside any jurisdiction.

Yeah, all countries should just fix their legislation to be compatible with the EU one. Is it so hard?

Re: Shopify Is Illegal in Germany

#228

Post by jsmith45 »

nolok wrote: post #182
ghoward wrote: post #33

Mini Ask HN: How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers? All operations will be in the US (interaction only through a website). The forge will be designed to allow all of a user's data to be downloaded by that user (easy access to all data). It will also allow wiping away any reference to a user in commits (right to be fo…

> How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers? Do not store any kind of PII as defined by the GDPR, ever, anywhere. If you do, the PII data you store about your companies must be in respect of the GDPR and in particular access to it by law enforcement has to go through EU court. Because the US has decided with the CLOUD Ac…

The correct solution would be to set up as a EU company that is in charge and runs everything and controls all the EU data, which only uses cloud services operated by companies that do not have any US based parent company, grandparent company, etc. (Ideally only using crowd services from EU companies whose whole ownsership chain remains in the EU, as that keeps things simple).

One could retain a US subsidiary, which might handle US or even all non-EU data.

Unfortunately it is not clear if an American individual could own or control the EU parent company. It depends on if the owner could be considered "A provider of electronic communication service or remote computing service", because if so, they could subpena you personally, on basis that you control the EU company and thus the information is within your control.

The relevant part of the law is:

> A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider’s possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.

Re: Shopify Is Illegal in Germany

#229

Post by nolok »

messutied wrote: post #224
nolok wrote: post #210

Earlier quoted context omitted.

It's not about saying where the data is / warning your customer, it's about protecting the data. You need to protect it under EU court / jurisdiction, and the US broke that and said they have jurisdiction over any piece of data your company ever touches. That's why the US now wants some sort of privacy shield 2. As an actual solution you can use: find another company, an EU company, one that you don't own, to handle…

We definitely store PII as we have to store users emails an even phone numbers. So we basically need to migrate to a EU based could provider ASAP? Would this privacy shield 2 fix this problem? I suppose we can’t just wait for that.

> So we basically need to migrate to a EU based could provider ASAP?

Sadly no because you still own the data, which is the criteria the US has decided on.

> Would this privacy shield 2 fix this problem?

No idea since at this point it's merely a name for a vague demand being asked by the US.

I'm sorry for the trouble this whole situation causes to your company, though to be honest as you can imagine I am very glad that my representative in the EU didn't back down and protect my rights.

Re: Shopify Is Illegal in Germany

#230

Post by indrora »

kuschku wrote: post #200
friendzis wrote: post #17

Earlier quoted context omitted.

GDPR core is pretty simple: You cannot do stuff (process, store, transfer to third parties) with PII unless X condition is met. An internet site, on first visit (being genuine first visit or just cookieless visit) cannot do things with PII, because there is just no way to even tell if X is met, therefore not only data storage (IP address in Apache access logs included) is illegal, but moreso transfer to third party v…

How is GDPR ugly? It's easy to build websites, even interactive ones, that comply. If you build a mobile app, you are also supposed to only ask for permissions once you actually need them. Replace interactive embeds with a dumb replacement of the actual content and e.g., "we want to show you an embedded tweet here, [allow once] [allow always]". Don't use CDNs for delivering assets, they've long stopped being useful a…

> only ask for permissions once you actually need them

Hard on Android, where "did my wifi go away" means asking "can I have access to your phone's internal state including call logs and if you're in a call right now?"

> replace interactive embeds with a dumb replacement

Sucks when you depend on that content or the content has to be interactive under the TOS of the service you're using.

> [CDNs have] stopped being useful

Not at all. In many a corporate network as well as situations where you're paying for transit (e.g. AWS) they still make sense.

> build websites like we used to in the early 2000s

Ah yes with Flash for our interactivity, __Just throw an executable format that has a hard to render, proprietary ISA running unsupervised__, that worked for us then it should work fine today?

I'd say "Let's build more websites like we did in 2010". That's right around when Javascript peaked.

> Minio

due to their licensing change, a lot of legal departments have banned minio.

Post reply on HN