Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shopify Is Illegal in Germany

lsww.de

Post reply on HN
Print view View original

321–330 of 349 posts

Re: Shopify Is Illegal in Germany

#321

Post by ghoward »

still_grokking wrote: post #311
ghoward wrote: post #33

Mini Ask HN: How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers? All operations will be in the US (interaction only through a website). The forge will be designed to allow all of a user's data to be downloaded by that user (easy access to all data). It will also allow wiping away any reference to a user in commits (right to be fo…

Short answer: Don't be based in the US until the US respects fundamental human rights, like the right to sue before a proper court. Simple, isn't it? The more pragmatic answer is: You can just ignore human rights. The other US companies operating in the EU also don't have issues with that. The EU isn't going to enforce its own laws in this regard anyway as more or less all EU governments are violating this laws thems…

I'm going to respect human rights. And I'm going to act legally, even if it appears I can't do business in the EU, which appears to be true.

Re: Shopify Is Illegal in Germany

#322

Post by oytis »

Ekaros wrote: post #316
oytis wrote: post #227

Earlier quoted context omitted.

Yeah, all countries should just fix their legislation to be compatible with the EU one. Is it so hard?

If they want to provide services to EU yes they should. Or at least limit governmental powers to their own citizens.

Well, in the case of GDPR it is the EU that extends its powers to persons (natural and legal) based outside of the EU The CLOUD act good or bad only puts requirements on companies based in the US.

Re: Shopify Is Illegal in Germany

#323

Post by still_grokking »

ghoward wrote: post #321
still_grokking wrote: post #311

Earlier quoted context omitted.

Short answer: Don't be based in the US until the US respects fundamental human rights, like the right to sue before a proper court. Simple, isn't it? The more pragmatic answer is: You can just ignore human rights. The other US companies operating in the EU also don't have issues with that. The EU isn't going to enforce its own laws in this regard anyway as more or less all EU governments are violating this laws thems…

I'm going to respect human rights. And I'm going to act legally, even if it appears I can't do business in the EU, which appears to be true.

Please complain to your representative about that!

All that's needed is that the USA start to recognize the rights of non US people. That's all.

Nobody likes the current situation. Really.

But it's not OK that governments collect data without proper court warrants, warrants which could be legally challenged. (And no, it's not only the US. We have here in the EU the exact same battle against our local authorities. Now that we've got some additional rights in form of the GDPR this rights need to get enforced finally. In all kinds of directions).

Re: Shopify Is Illegal in Germany

#324

Post by Ekaros »

oytis wrote: post #322
Ekaros wrote: post #316

Earlier quoted context omitted.

If they want to provide services to EU yes they should. Or at least limit governmental powers to their own citizens.

Well, in the case of GDPR it is the EU that extends its powers to persons (natural and legal) based outside of the EU The CLOUD act good or bad only puts requirements on companies based in the US.

GDPR only applies if you are selling or providing services to entities in EU. Which I think isn't an overreach.

Re: Shopify Is Illegal in Germany

#325

Post by messutied »

nolok wrote: post #256
messutied wrote: post #240

Earlier quoted context omitted.

Actually maybe it wasn’t clear because of the parent comment I commented in, but we are a EU company, but for our server hosting we use a US provider. Do you know if that that makes any difference? As a EU resident myself I completely understand, it just is a bit tough to make the changes as a small company, but if it’s legally required we’ll make them ASAP.

I cannot answer your subcomment I believe the thread might be too deep ? Anyway sadly no Cloudflare isn't ok, it's specifically one of the three provider that got Shopify convicted in the parent article (other two being Cloudfront and Fastly).

Oh boy CF if a difficult one to replace :/ will have to start looking for EU alternatives.

Re: Shopify Is Illegal in Germany

#326

Post by scarface74 »

dmitriid wrote: post #314
scarface74 wrote: post #305

Earlier quoted context omitted.

It’s amazing that the excuse for the web being worse is always “the web being worse is not caused by the law being bad. It’s caused by it being badly enforced”. The fact is that the cookie pop ups would never be necessary if the GDPR hadn’t been passed.

> the web being worse is not caused by the law being bad. It’s caused by it being badly enforced Because that's the truth > The fact is that the cookie pop ups would never be necessary if the GDPR hadn’t been passed. Show me exactly where GDPR mandates the use of cookie pop ups. (Hint: GDPR mandates: "ask the user for consent if you collect more data than is strictly necessary, and the opt-out must be as simple as op…

> Because that's the truth

So the EU isn’t inept because they made a bad law. They are inept because they have no clue how to enforce it?

> GDPR mandates: "ask the user for consent if you collect more data than is strictly necessary, and the opt-out must be as simple as opt-in".

So the websites are asking the user - as the law dictates even if the buttons are the same size.

> AppStore rule on tracking was more effective precisely because Apple has the possibility to enforce it immediately.

So you’re cheering the government making a law that made the user experience worse that the government couldn’t enforce?

Re: Shopify Is Illegal in Germany

#327

Post by ghoward »

still_grokking wrote: post #323
ghoward wrote: post #321

Earlier quoted context omitted.

I'm going to respect human rights. And I'm going to act legally, even if it appears I can't do business in the EU, which appears to be true.

Please complain to your representative about that! All that's needed is that the USA start to recognize the rights of non US people. That's all. Nobody likes the current situation. Really. But it's not OK that governments collect data without proper court warrants, warrants which could be legally challenged. (And no, it's not only the US. We have here in the EU the exact same battle against our local authorities. Now…

> Please complain to your representative about that!

I have done that. Through all levels of government. But the establishment is going to do what it's going to do, regardless of party.

Re: Shopify Is Illegal in Germany

#328

Post by einpoklum »

tensor wrote: post #116
shafyy wrote: post #7

All EU companies sending any PII to US-owned companies, regardless if the actual data stays in the EU or not, are in danger to be sued similarly to the author of this post. This is, among other laws, because of the US CLOUD act: > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requ…

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

> since the EU considers an IP address to be PII

How can an IP address _not_ be PII?

NIST defines [1] PII as: "Information that can be used to distinguish or trace an individual’s identity ... either alone or when combined with other personal or identifying information..."

So it's not some EU caprice.

[1] : https://csrc.nist.gov/glossary/term/personally_identifiable_...

Re: Shopify Is Illegal in Germany

#329

Post by einpoklum »

blahyawnblah wrote: post #205
tiborsaas wrote: post #157

Earlier quoted context omitted.

There is an option for a service provider not to store the IP address anywhere. For users with accounts the standard ToS can handle it.

Who in their right mind would not store a visitor's IP address. How are you supposed to handle abuse or performance issues a visitor might have? Or perform analytics? It makes sense to not store if you're running some kind of privacy service.

> Who in their right mind would not store a visitor's IP address.

Everyone who's mindful of site visitor's privacy.

> How are you supposed to handle abuse or performance issues a visitor might have?

How does a static website handle those issues?

... you've developed a warped default of what a website is.

> Or perform analytics?

You can base your analytics on voluntarily provided information from users. Or just, like, _not_ do them.

Re: Shopify Is Illegal in Germany

#330

Post by kuschku »

oytis wrote: post #214
kuschku wrote: post #200

Earlier quoted context omitted.

How is GDPR ugly? It's easy to build websites, even interactive ones, that comply. If you build a mobile app, you are also supposed to only ask for permissions once you actually need them. Replace interactive embeds with a dumb replacement of the actual content and e.g., "we want to show you an embedded tweet here, [allow once] [allow always]". Don't use CDNs for delivering assets, they've long stopped being useful a…

So no embeds, no CDNs, no analytics, lots of popups asking for permissions and going back to 2000s (just with cookie banners) in general. Isn't that ugly?

Of course you can have embeds. Just replace them with a blurhash and make them click to load.

That also avoids pretty much all of the popups.

Sure, no CDNs and no analytics, but that's what I'd call an absolute win. Nothing of value was lost.

Post reply on HN