Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shopify Is Illegal in Germany

lsww.de

Post reply on HN
Print view View original

241–250 of 349 posts

Re: Shopify Is Illegal in Germany

#241

Post by tremon »

fxtentacle wrote: post #4

I believe the authorities are correct here. Shopify is sending all personal data to CloudFlare, CloudFront (Amazon) and Fastly, so 3 US companies. They could sign so-called "data processing agreements" where they promise to safeguard personal data. But the Shopify FAQ explicitly states that they are unwilling to do so. As the result, Shopify is legally considered to not be processing data under the instructions of th…

Instead, Shopify is legally considered to be the owner of the user data

As I see it, Shopify's role in this situation is more likely to be considered a data fence: because of the lack of processing agreement, they're not allowed to process any data (more accurately, the shop owner is not allowed to give them access to any data). The data that they do have through services they provide is illegally obtained; that doesn't mean they suddenly own that data.

Re: Shopify Is Illegal in Germany

#242

Post by [deleted] »

blahyawnblah wrote: post #205
tiborsaas wrote: post #157

Earlier quoted context omitted.

There is an option for a service provider not to store the IP address anywhere. For users with accounts the standard ToS can handle it.

Who in their right mind would not store a visitor's IP address. How are you supposed to handle abuse or performance issues a visitor might have? Or perform analytics? It makes sense to not store if you're running some kind of privacy service.

[deleted]

Re: Shopify Is Illegal in Germany

#243

Post by throwaway2016a »

jamie_ca wrote: post #234
blahyawnblah wrote: post #205

Earlier quoted context omitted.

Who in their right mind would not store a visitor's IP address. How are you supposed to handle abuse or performance issues a visitor might have? Or perform analytics? It makes sense to not store if you're running some kind of privacy service.

Hash the IP so you can tie sessions, and do frequency analysis for abuse, without having the raw IP that can be geo-decoded?

Hashing IPs is ineffective, the IP namespace is so small a rainbow table (or even brute force) would be trivial so effectively the hash of an I is identical to the IP itself. Unless you salt it but if you do that it becomes useless for analytical, fraud prevention, and security purposes.

Same goes for credit card numbers, as an aside, I saw a credit card number being hashed in an app I was consulting on once... don't do that. Rainbow tables are stupid simple on inputs that small.

Re: Shopify Is Illegal in Germany

#244

Post by tpxl »

dmitriid wrote: post #74
throwaway13337 wrote: post #58

Earlier quoted context omitted.

You're just incorrect here. Part of the GDPR does good things against bad actors like ad/tracking companies. But most of these companies are so big that it just works as a moat to keep out small competitors in that space. The more widely-affecting thing that the GDPR is doing is to make it impossible to legitimately run a business like the one that the article is talking about. An online shop that uses shopify which…

> You're just incorrect here. I was expecting you to show where I'm incorrect. And yet, it's the same emotionally-charged "omg moat, large companies, impossible to run a business". Which doesn't disprove what I say, but further supports my case: the bullshit narrative around GDPR persists even if it has literally no basis in reality. > A small online shop using a CDN is who is actually hurt with GDPR. Most CDNs have…

> Most CDNs have GDPR-compliant services in the EU.

How can a US company have a GDPR compliant service in the EU? The US government can force them to give up any data they own, which isn't compliant.

Re: Shopify Is Illegal in Germany

#245

Post by TekMol »

capableweb wrote: post #136
TekMol wrote: post #128

Earlier quoted context omitted.

> A German CDN can setup their own infrastructure Ok, but what if you just want to run a website and not build a billion doller global CDN. > GeoDNS According to the GDPR you have to protect the data of your visitors no matter where they are.

> Ok, but what if you just want to run a website. Not build a billion doller global CDN. Ah, from the perspective of website owners, not the CDN owner... Well, use a European CDN, they tend to follow European regulation, just like US companies follow US regulation. The two companies that comes first to mind is BunnyCDN and KeyCDN, but I'm sure there are many others. Both of them have global networks. > According to t…

How would BunnyCDN and KeyCDN be able to have endpoints in the US that are beyond the reach of the US government?

The recent rulings say that no packets are allowed to travel to the US because that would enable the US government to access them if it wants to. I don't see how this can be avoided. As soon as a tcp packet enters the US, it is on infrastructure the US government can access if it wants to.

Re: Shopify Is Illegal in Germany

#246

Post by BlueTemplar »

gok wrote: post #51

The EU is try to copying China's playbook of propping up local service providers by imposing impossible-to-follow rules on foreign tech companies. In both cases, the rest of the world should retaliate by limiting access to advanced technology until laws change.

Google refused to follow Chinese laws (by spying on the Chinese for their government IIRC). So they got out of China. This allowed for companies respecting Chinese laws to bloom.

I would hope that the same is possible in EU (except that, as an EU citizen, EU laws of course seem more moral than either Chinese or US ones...)

Re: Shopify Is Illegal in Germany

#247

Post by tensor »

lock-the-spock wrote: post #140
tensor wrote: post #116

Earlier quoted context omitted.

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

This is not at all correct. Technically necessary use is fully legal under gdpr.

I don't think it's legal to send PII to the US under any circumstances. The technically necessary clause works fine only in non-US jurisdictions.

Re: Shopify Is Illegal in Germany

#248

Post by tgv »

ghoward wrote: post #135
oytis wrote: post #123

Earlier quoted context omitted.

Designate a representative in the EU? That doesn't seem straightforward to me, especially for a small company.

I was thinking the same thing. Even if I managed to do everything else, having to hire someone to do that would be nigh impossible.

https://gdpr.eu/article-27-representatives-of-controllers-no...

The obligation laid down in paragraph 1 of this Article shall not apply to:

* processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or

* a public authority or body.

Re: Shopify Is Illegal in Germany

#249

Post by nolok »

messutied wrote: post #240
nolok wrote: post #229

Earlier quoted context omitted.

> So we basically need to migrate to a EU based could provider ASAP? Sadly no because you still own the data, which is the criteria the US has decided on. > Would this privacy shield 2 fix this problem? No idea since at this point it's merely a name for a vague demand being asked by the US. I'm sorry for the trouble this whole situation causes to your company, though to be honest as you can imagine I am very glad tha…

Actually maybe it wasn’t clear because of the parent comment I commented in, but we are a EU company, but for our server hosting we use a US provider. Do you know if that that makes any difference? As a EU resident myself I completely understand, it just is a bit tough to make the changes as a small company, but if it’s legally required we’ll make them ASAP.

Oh yes then, you are fine if you migrate to a EU provider as long as you respect the general provisions of the GDPR (inform the user, allow access and deletion of PII, don't share it outside the EU, etc ...) ! Sorry I assumed you were a US citizen with a US company

To ensure you don't have problem down the line, make sure they themselves store their data in the EU (for exemple, french OVH allows you to chose where you data is stored, their french datacenters are fine, but I would not go with their canadian datacenters).

Allow me to remind you that it's not just the hosting but anything that touches that data, eg analytics and error reporting services are concerned too

Re: Shopify Is Illegal in Germany

#250

Post by tpxl »

throwaway13337 wrote: post #88
dmitriid wrote: post #74

Earlier quoted context omitted.

> You're just incorrect here. I was expecting you to show where I'm incorrect. And yet, it's the same emotionally-charged "omg moat, large companies, impossible to run a business". Which doesn't disprove what I say, but further supports my case: the bullshit narrative around GDPR persists even if it has literally no basis in reality. > A small online shop using a CDN is who is actually hurt with GDPR. Most CDNs have…

Oddly this argument feels familiar - like we've sparred in the past over GDPR on another hacker news article. I won't continue this as it seems like it's more a flame war where no side can convince the other. I'll say this, though: please imagine who I am who feels so passionately about this. Likely, I am a small business that has been affected personally by the GDPR though I am not in advertising or tracking. Maybe…

> Likely, I am a small business that has been affected personally by the GDPR though I am not in advertising or tracking. Maybe I'm just a small business owner trying to navigate the uncertain waters created by these rules.

Hey, I was a small business owner and the GDPR was a complete non-issue. The website was hosted by a small service provider in my country. No CDN required (static files, not that much traffic).

If you're a small business owner you're either not affected by GDPR, or you're doing something shady.

Post reply on HN