Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shopify Is Illegal in Germany

lsww.de

Post reply on HN
Print view View original

31–40 of 349 posts

Re: Shopify Is Illegal in Germany

#31

Post by duxup »

fxtentacle wrote: post #12
shafyy wrote: post #7

All EU companies sending any PII to US-owned companies, regardless if the actual data stays in the EU or not, are in danger to be sued similarly to the author of this post. This is, among other laws, because of the US CLOUD act: > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requ…

In theory, yes. In practice, the issue is that Shopify refuses to sign a data processing agreement: https://gdpr.eu/what-is-data-processing-agreement/

If this is required I would think Cloudflare would have some ready agreement for everyone to sign / agree to wouldn't they?

This is one of those EU rules where if it is so universal everyone should have thi right? But rather I'm not sure how widespread it is... is anyone doing it or are they all just waiting out the situation?

Re: Shopify Is Illegal in Germany

#32

Post by yashap »

abrichr wrote: post #27
shafyy wrote: post #7

All EU companies sending any PII to US-owned companies, regardless if the actual data stays in the EU or not, are in danger to be sued similarly to the author of this post. This is, among other laws, because of the US CLOUD act: > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requ…

To clarify: Shopify is a Canadian company (edit: but as mentioned elsewhere in this thread: they send data to CloudFlare, CloudFront (Amazon) and Fastly, which are US companies.)

But their CDN providers (CloudFlare, Amazon and Fastly) aren’t. That’s the claim made in the article, that using American owned CDNs makes your business illegal in Europe, even if no data processing or storage happens outside Europe. I find this hard to believe …

Re: Shopify Is Illegal in Germany

#33

Post by ghoward »

Mini Ask HN: How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers?

All operations will be in the US (interaction only through a website). The forge will be designed to allow all of a user's data to be downloaded by that user (easy access to all data). It will also allow wiping away any reference to a user in commits (right to be forgotten).

But PII does need to be collected, such as username, password, IP address, public keys, etc. There are zero plans to collect anything that is not needed; only the minimum data needed will be collected.

Edit: Oh, and the forge would not send data to third parties at all, unless such third parties are cloning code, but then they would be users, right?

Would it be legal to accept EU customers? If not, would there be anything to do to make it legal?

Re: Shopify Is Illegal in Germany

#34

Post by pvg »

wusel wrote: post #2

Sorry for the German only link, but this is from today and didn't make the rounds yet. It is not really about Shopify itself, but about the use of CDNs - which would be even more worrisome. Shopify Support couldn't help the shop owner.

You just wait for an English version of the story to appear. From scripture:

re: language

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

re: from today

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

Re: Shopify Is Illegal in Germany

#36

Post by iso1631 »

throwaway13337 wrote: post #29

Though the intentions of GDPR were good, Following the GDPR to the letter is not feasible for any company that isn't a monopoly. We're in a situation where no one is following it all the way as it's not even clear what that means. More of the same will continue and the GDPR will only be used coercively as an attack against competition or companies others don't like. It's really a major blow for small businesses that…

In the UK it's illegal to pay a bribe to allow your company to operate, despite it being normal behaviour in many areas [0], I assume other countries have similar laws.

In the same way, just because normal behaviour in some countries is to misuse customer data, it doesn't mean it should be legal for an EU company to operate in that way.

[0] https://www.bbc.co.uk/news/business-13977221

Re: Shopify Is Illegal in Germany

#37

Post by DocTomoe »

6510 wrote: post #15

Pretty incompetent to communicate the issues with the shop rather than the platform.

Nah, that's not incompetence, it's by design: The actual violation of the GDPR was committed by the local shop owner. The owner also is responsible for any fines. The shop owner could have chosen a data-protection-compliant solution, but choose not to do so.

The platform did not violate any local laws - it's outside the jurisdiction of the GDPR. They chose - and are within their right to do so - to cooperate with a legislative framework that is data-protection-averse (the US CLOUD act). This makes them incompatible with the EU, which they must be aware of. So why bother them?

Re: Shopify Is Illegal in Germany

#38

Post by lmkg »

yashap wrote: post #32
abrichr wrote: post #27

Earlier quoted context omitted.

To clarify: Shopify is a Canadian company (edit: but as mentioned elsewhere in this thread: they send data to CloudFlare, CloudFront (Amazon) and Fastly, which are US companies.)

But their CDN providers (CloudFlare, Amazon and Fastly) aren’t. That’s the claim made in the article, that using American owned CDNs makes your business illegal in Europe, even if no data processing or storage happens outside Europe. I find this hard to believe …

The CLOUD Act gives US law enforcement access to the data, even if it's only stored in Europe. That's the problem, and the EU court is doing no more than recognizing that for the problem that it is.

Re: Shopify Is Illegal in Germany

#39

Post by judge2020 »

duxup wrote: post #31
fxtentacle wrote: post #12

Earlier quoted context omitted.

In theory, yes. In practice, the issue is that Shopify refuses to sign a data processing agreement: https://gdpr.eu/what-is-data-processing-agreement/

If this is required I would think Cloudflare would have some ready agreement for everyone to sign / agree to wouldn't they? This is one of those EU rules where if it is so universal everyone should have thi right? But rather I'm not sure how widespread it is... is anyone doing it or are they all just waiting out the situation?

Cloudflare themselves have a DPA in contract with their customers, however, it's unclear how/if this transfers from Shopify to shop owners.

https://www.cloudflare.com/cloudflare-customer-dpa/

Re: Shopify Is Illegal in Germany

#40

Post by andrewmutz »

blueflow wrote: post #13

Not unsurprising. At work (Germany) we are forbidden to use any US cloud services, i wonder why this hasn't been the new normal yet.

Sounds like great news for home-grown German alternatives to US cloud services. And bad news for the competitiveness of all other German companies.
Post reply on HN