Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shopify Is Illegal in Germany

lsww.de

Post reply on HN
Print view View original

261–270 of 349 posts

Re: Shopify Is Illegal in Germany

#261

Post by jansan »

dmitriid wrote: post #56
throwaway13337 wrote: post #44

Earlier quoted context omitted.

When you make common practice illegal, you invite corruption into your system because selective enforcement of the rules becomes the new normal. Laws need to understand the environment that they are made in or will never be effective and oftentimes counter productive. As is the case here. GDPR goes even further than would be reasonable for any small business that handles email addresses. Requiring a salaried data pro…

> When you make common practice illegal, you invite corruption into your system because selective enforcement of the rules becomes the new normal. Child labor. Drugs and radioactive substances in medicine. Water pollution. The list of practices that used to be common is extremely long. And yet here we are. > GDPR goes even further that would be reasonable for any small business that handles email addresses. Of course…

>. Don't sell user data left and right, and boom! Your poor small business is in the clear.

And the article shows that this is not true.

Re: Shopify Is Illegal in Germany

#262

Post by geofft »

dcow wrote: post #203
geofft wrote: post #177

Earlier quoted context omitted.

My personal website is a publicly-accessible static site. Blocking people from it is not meaningful. It might be meaningful under the model of direct HTTP, where you could be DoSing me or trying to exploit my web server. But if you don't contact me over HTTP, then that problem doesn't arise. There's no meaningful concept of blocking people from a Usenet post I write. Even for indirect HTTP, I don't need to block peop…

I get your point, but you said “happen to self host”. You’re (I think inadvertently) conflating content distribution and infrastructure. If you are self hosting a website then there aren’t other people distributing your content: you are. If you are just publishing content to be hosted on some static site platform like gh-pages, then yeah, blocking bad infrastructure players is their problem. What’s what with the inte…

Yeah, but I think the term "self-host" is a little bit conditioned on the HTTP model itself. If we had some sort of Usenet-style distributed infrastructure, you could imagine two ways of publishing content, either running a static site generator locally and using that to push content to the world (and you would be directly negotiating with people about whether you're a spammer), or using some helper online tool a la WordPress to render the content and have them do the push (and they would take responsibility for making sure it gets pushed). In that world, where the end-to-end model of our world's HTTP is uncommon, I think people would still call the first way "self-hosting."

In fact I think we do use the term "self-host" in exactly that way when talking about "self-hosted newsletters." I can (and do!) run a newsletter where I generate the HTML and the MIME document locally, find an SMTP provider of my choice, and instruct it to directly mail recipients. I maintain the mailing list (in a text file in a Git repo) and pass it to my SMTP provider every time I do a mailing, and people contact me directly to sign up. I could also use Substack/Tinyletter/Buttondown/etc., which would have various advantages and disadvantages; the hosting provider would handle most of this for me, including maintaining the list of subscribers. You can also talk about "self-hosted Mailman," etc. In these cases, the self-hoster sees the email addresses of subscribers but not (necessarily) their IP addresses.

I don't think I'm conflating TCP and HTTP. NNTP, UUCP, and SMTP all use TCP, but they're designed in a way that doesn't have this property. In fact it's not even HTTP per se that's a problem. It's mostly about what I called "direct HTTP" - though you posted your comment to me over HTTP, there's no HTTP (nor TCP) connection to me.

(Also other comments claim that the CLOUD Act means that if GH the US entity runs EU servers, that doesn't actually solve the problem - it'd have to be a non-US entity not subject to US jurisdiction. That's why I think the old-school-web model of mirrors is a better example; they're generally run by universities or other entities with no legal relation to the site they're mirroring.)

Re: Shopify Is Illegal in Germany

#263

Post by zelphirkalt »

nisegami wrote: post #144
tiborsaas wrote: post #139

Earlier quoted context omitted.

Don't spread FUD please. > anyone in the EU is not even allowed to connect to any website owned by a US company This is blatantly false, of course you are allowed to connect to non-EU websites even if the IP address could be PII in some circumstances. It's the service providers problem to manage the data they collect in legal way.

There _is_ no legal way to manage that data if the service provider is subject to the CLOUD act.

Isn't it consent based? Just ask visitors of your website/services, whether they are OK with the IP address being possibly leaked to US entities. And don't engage in dark patterns while asking for consent of course, but that is obvious ...

Re: Shopify Is Illegal in Germany

#264

Post by ronsor »

mminer237 wrote: post #155
andy_ppp wrote: post #130

Earlier quoted context omitted.

I thought it was the storage of such data that is illegal not the connection? Obviously logs and analytics are an issue in some cases for this law, but I slightly agree with it; should we not all want our digital footprint to be as small as possible?

No, courts have made it clear that sending EU IP addresses to the US is illegal unless you can prove that the US government can't intercept it or someday force you to log them. No one the US is immune to subpeona, so no one can comply with that requirement. https://www.cnil.fr/sites/default/files/atoms/files/decision...

I don't think it's that strict, otherwise the court is mandating something that is literally impossible with current internet (routing) architecture.

Re: Shopify Is Illegal in Germany

#265

Post by ronsor »

a2128 wrote: post #100
generationP wrote: post #9

Wait, does this imply that running a website behind CloudFlare is illegal in the EU? After all, webshop or not, IPs will be transmitted... Or are IPs only a problem in connection with getting user data like name and address? Or is it the IP+cookie combo?

This would be funny, considering my local (EU) tax authority's website is protected by Cloudflare. And the state health insurance website. And the government information website. And the E-government gateway website. And the data protection authority(!) website. In fact I'm struggling to find any government-affiliated website that isn't protected by Cloudflare.

The data protection authority will have to fine itself for non-compliance.

Re: Shopify Is Illegal in Germany

#266

Post by kyriakos »

blahyawnblah wrote: post #205
tiborsaas wrote: post #157

Earlier quoted context omitted.

There is an option for a service provider not to store the IP address anywhere. For users with accounts the standard ToS can handle it.

Who in their right mind would not store a visitor's IP address. How are you supposed to handle abuse or performance issues a visitor might have? Or perform analytics? It makes sense to not store if you're running some kind of privacy service.

GDPR doesn't ask not to store it but it's a matter if how it's used once you do. For example it should be kept only as long as its needed, for example for the case of abuse if you are required to investigate abuse cases up to 3 months in the past you don't need to keep the IP assesses longer than that. If you do then you breach gdpr. In addition if the user requests his information deleted then unless that user is under investigation at the time you got 30 days to delete his data and forget he ever existed.

Re: Shopify Is Illegal in Germany

#267

Post by dumbfounder »

lambertsimnel wrote: post #226
dumbfounder wrote: post #149

Earlier quoted context omitted.

And does this mean I can do this to the collection agent trying to get me to pay 4x for a parking ticket I got in Italy 5 years ago?

IANAL. Although I imagine you could, presumably they'd argue that (while your parking tickets are unpaid) they have a legal basis other than consent for processing your personal data. In that case, you'd probably have to find grounds for erasure other than withdrawal of consent. 1d or 1e of Article 17 look most relevant (but maybe not very promising): https://gdpr-info.eu/art-17-gdpr/

So Italy issued the ticket, gets my contact info from the rental company, then hands it over to the collection agency. Is it reasonable that all of that is something I agreed to beforehand? I have no idea. If you rent a car in the EU should you immediately send them a GDPR request after you are done to get them to remove your data so you can't be found? Or is there a legal requirement for them to hold on to the data? Are my rights different because I do not reside in the EU?

Re: Shopify Is Illegal in Germany

#268

Post by nolok »

nickpp wrote: post #257
nolok wrote: post #251

Earlier quoted context omitted.

You are allowed to dismiss your right to privacy is you so desire but the majority of EU citizens have decided not to.

We've actually never been asked. Some unelected bureaucrats decided "for our own good".

They're elected representative. You were asked in the most official way possible, with elections.

Both in your national election which then decided the government which chose your country EU representative for the council and commission, which then created the law and decided to put it to a vote and where your government had a direct veto right, and in the European election where you elected the parliament that voted on the GDPR.

I recommend you inform yourself on the institution that govern you and how you can influence them, you seem to be deeply uneducated about them.

Re: Shopify Is Illegal in Germany

#269

Post by radicalbyte »

boringg wrote: post #16
radicalbyte wrote: post #11

Earlier quoted context omitted.

This affects the entire EU. I try to hammer it into people's heads here in NL. Using US-based cloud services if you touch PII is a huge risk as they're all getting like crazed addicts fighting over their next high PII-high.

It's the way the EU can protect their own tech industry.

The thing is - it isn't. Where is the EU-based top tier cloud player? One to compete with Google/Microsoft/Amazon?

There is a huge EU project which in theory is trying to build those competitors - Gaia-X - but as is typical with such projects the results have been poor. Looks to me like a lot of the money was wasted on "blockchain" scam projects.

The thing is - there is real significant potential in the EU for some of the existing large colocation/VPS provides to become just that only the EU's own implementation has failed.

Re: Shopify Is Illegal in Germany

#270

Post by radicalbyte »

kmlx wrote: post #59
hyperman1 wrote: post #28

Earlier quoted context omitted.

While this is true, it is too easy. The privacy angle lives in the minds of Europeans, while US people seem to care a lot less.

> The privacy angle lives in the minds of Europeans without data, it’s hard to make this argument. what we know for sure is that bureaucrats fully support the privacy angle. but from my anecdotal real life experience almost no one cares (another argument that without data cannot be generalised).

US people certainly care about their privacy however there aren't any strong institutions left in the US anymore (outside of the Military) and the political system in the US give a choice between two corporate-owned parties.
Post reply on HN