Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR compliance as a service

gdpr-shield.io

Post reply on HN
Print view View original

31–40 of 158 posts

Re: GDPR compliance as a service

#31

Post by RcouF1uZ4gsC »

jloughry wrote: post #5

The privacy of EU persons coming in from a non-EU IP address still need to be protected under GDPR. This solution is a start but it's not bulletproof. Edit: I don't want anyone to think I believe it's a good start but it is a kind of solution. I wonder if lots of US companies, once they begin to realize GDPR is a problem for them, won't decide to try one of two things: 1. This: block access from IP addresses believed…

The easy way to deal with EU persons coming from non-EU IP addresses is to mention in your terms of service that EU users are prohibited from using your website. Then if they use a VPN or otherwise access your website, they will be in violation of the CFAA https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

Re: GDPR compliance as a service

#32

Post by lillesvin »

> Simply paste our JavaScript snippet into your website's code. We'll check every visitor of your site and will block access to users located within the EU.

See, the problem here is that you actually have to send an HTTP request to the site that's trying to block you, then you load it along with their JavaScript which then blocks you, but at that point the initial request(s) has already been logged and now they have to comply with the GDPR.

I refuse to believe this is not a joke.

Re: GDPR compliance as a service

#33

Post by niko001 »

lillesvin wrote: post #32

> Simply paste our JavaScript snippet into your website's code. We'll check every visitor of your site and will block access to users located within the EU. See, the problem here is that you actually have to send an HTTP request to the site that's trying to block you, then you load it along with their JavaScript which then blocks you, but at that point the initial request(s) has already been logged and now they have…

Not a joke :). GDPR Shield as a product is GDPR compliant. Customers sign a data processor agreement with the service. It anonymizes IP addresses, they aren't transferred to any other third-party provider and aren't stored.

Re: GDPR compliance as a service

#34

Post by zenovision »

CorpOverreach wrote: post #11

Maybe I'm missing something - but as a US citizen, with a US company, how can EU laws be enforced against me? What's the legal channel here? Do they plan on arresting me if I decide to vacation to an EU country? Will the US gov't comply with levying fines due to some treaty/agreement between the countries?

At the moment there is no way the EU can enforce you to comply with that law, unless you have a subsidiary in the EU. Only if USA sign a special agreement with the EU this may change, but I don't think this will ever happen (very unlikely). Otherwise every country on planet can create their own draconian laws and expect that every single company in the world comply with it...

Re: GDPR compliance as a service

#35

Post by ezekg »

niko001 wrote: post #33
lillesvin wrote: post #32

> Simply paste our JavaScript snippet into your website's code. We'll check every visitor of your site and will block access to users located within the EU. See, the problem here is that you actually have to send an HTTP request to the site that's trying to block you, then you load it along with their JavaScript which then blocks you, but at that point the initial request(s) has already been logged and now they have…

Not a joke :). GDPR Shield as a product is GDPR compliant. Customers sign a data processor agreement with the service. It anonymizes IP addresses, they aren't transferred to any other third-party provider and aren't stored.

But like I mentioned on Indie Hackers, your customers still have their own logs that need to be GDPR-compliant, which defeats the whole purpose. The page that requests your JS still has to be sent by a server, which will likely log the EU citizen’s IP. And then there’s the case where the EU citizen is using a VPN server in the US...

Re: GDPR compliance as a service

#36

Post by lillesvin »

niko001 wrote: post #33
lillesvin wrote: post #32

> Simply paste our JavaScript snippet into your website's code. We'll check every visitor of your site and will block access to users located within the EU. See, the problem here is that you actually have to send an HTTP request to the site that's trying to block you, then you load it along with their JavaScript which then blocks you, but at that point the initial request(s) has already been logged and now they have…

Not a joke :). GDPR Shield as a product is GDPR compliant. Customers sign a data processor agreement with the service. It anonymizes IP addresses, they aren't transferred to any other third-party provider and aren't stored.

But if your JavaScript is inserted into your customers site, then the initial request that loads their site the first time + your script will be logged on their servers just like any other HTTP request.

Re: GDPR compliance as a service

#37

Post by sebow »

CorpOverreach wrote: post #11

Maybe I'm missing something - but as a US citizen, with a US company, how can EU laws be enforced against me? What's the legal channel here? Do they plan on arresting me if I decide to vacation to an EU country? Will the US gov't comply with levying fines due to some treaty/agreement between the countries?

well technically you're kind of operating on 2 continents,mainly because you're storing data about an EU citizen on your servers located in US. Since the data is originating from an EU citizen,i assume the GDPR is making sure you at least inform the user of the data collection. Also consider that GDPR is kind of a TOS for connecting with an EU citizen,some sort of a "copyright" system.

As an EU citizen, "cheap" wourkarounds like these ones will definitely not solve the problem, might actually make it worse.It's like an anti-adblocker, it won't work on the long run,people who are tech literate enough will just start using a VPN

Re: GDPR compliance as a service

#38

Post by jwilliams »

CorpOverreach wrote: post #11

Maybe I'm missing something - but as a US citizen, with a US company, how can EU laws be enforced against me? What's the legal channel here? Do they plan on arresting me if I decide to vacation to an EU country? Will the US gov't comply with levying fines due to some treaty/agreement between the countries?

International enforcement is a can of worms.

However, a lot of it is covered by:

1- US companies with a physical presence in the EU. They can fine that entity directly.

2- US companies will find they can't sell to EU businesses (B2B), as that means the EU company is carrying the can in terms of non-compliance.

3- The EU Member State could go via the International Courts. Or via some kind of bilateral agreement (e.g. Privacy Shield).

I expect #3 will need to egregious to really make sense.

However, I also expect a significant amount is already hovered up by #1 or #2. Certainly many of the cases that GDPR wants to target.

Additionally, the EU may cut deals with other states to bring in enforcement powers (fines).

Re: GDPR compliance as a service

#39

Post by tzahola »

paulddraper wrote: post #25
kuschku wrote: post #13

Earlier quoted context omitted.

The most likely solution is the same way the US enforces US laws (e.g. Megaupload case) in other countries: Seizing their assets (through cooperation with banks) and then asking for extradition.

Frightening to think something as innoculus as making a website of chocolate chip recipes and logging visitor IPs could provoke that.

Tip: don’t log the IPs then.

Re: GDPR compliance as a service

#40

Post by niko001 »

threeseed wrote: post #4

I can't tell if this is a joke or not. Don't pay "thousands" for GPDR compliance work which will improve your product by providing basic privacy and security features. Instead pay up to $79 a month for a service to block a large percentage of your traffic.

Not a joke :). The pricing is actually cheaper than "bare" geolocation APIs, which don't do the blocking-part. Have a look at https://ipstack.com/product for example.

If you get a quote from an experienced data protection lawyer for GDPR compliance, this will be an order of magnitude cheaper in the long run. There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to collect fees for small mistakes in your privacy policy.

Post reply on HN