Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shopify Is Illegal in Germany

lsww.de

Post reply on HN
Print view View original

41–50 of 349 posts

Re: Shopify Is Illegal in Germany

#41

Post by iso1631 »

friendzis wrote: post #17
wusel wrote: post #2

Sorry for the German only link, but this is from today and didn't make the rounds yet. It is not really about Shopify itself, but about the use of CDNs - which would be even more worrisome. Shopify Support couldn't help the shop owner.

GDPR core is pretty simple: You cannot do stuff (process, store, transfer to third parties) with PII unless X condition is met. An internet site, on first visit (being genuine first visit or just cookieless visit) cannot do things with PII, because there is just no way to even tell if X is met, therefore not only data storage (IP address in Apache access logs included) is illegal, but moreso transfer to third party v…

Storing IP addresses for technical requirements is legal (for example you need to keep the IP address in memory because you have an open TCP session). Likewise a session cookie is fine too.

Keeping those IP logs for security reasons is also legal (assuming you keep them safe for an applicable amount of time)

Using that data for analysis is not legal.

Re: Shopify Is Illegal in Germany

#42

Post by judge2020 »

ghoward wrote: post #33

Mini Ask HN: How would a small company, say a code forge, that is based in the US ensure that it is operating such that it is legal to have EU customers? All operations will be in the US (interaction only through a website). The forge will be designed to allow all of a user's data to be downloaded by that user (easy access to all data). It will also allow wiping away any reference to a user in commits (right to be fo…

To add, would EU privacy requirements apply even if you're just running some Gitlab or even Mastodon instance? Maybe running it as an individual vs llc changes things?

Re: Shopify Is Illegal in Germany

#43

Post by lmkg »

tmikaeld wrote: post #23
shafyy wrote: post #7

All EU companies sending any PII to US-owned companies, regardless if the actual data stays in the EU or not, are in danger to be sued similarly to the author of this post. This is, among other laws, because of the US CLOUD act: > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requ…

Does any one know if the Privacy Shield V2 will address this?

No one knows yet, because the successor to Privacy Shield is still currently more of an "agreement to do something" rather than an actual law. There is at least some movement in the right direction, which is to say the US is paying lip service to the notion updating domestic law to curtail law enforcement's access to data. But that hasn't actually happened yet.

Re: Shopify Is Illegal in Germany

#44

Post by throwaway13337 »

iso1631 wrote: post #36
throwaway13337 wrote: post #29

Though the intentions of GDPR were good, Following the GDPR to the letter is not feasible for any company that isn't a monopoly. We're in a situation where no one is following it all the way as it's not even clear what that means. More of the same will continue and the GDPR will only be used coercively as an attack against competition or companies others don't like. It's really a major blow for small businesses that…

In the UK it's illegal to pay a bribe to allow your company to operate, despite it being normal behaviour in many areas [0], I assume other countries have similar laws. In the same way, just because normal behaviour in some countries is to misuse customer data, it doesn't mean it should be legal for an EU company to operate in that way. [0] https://www.bbc.co.uk/news/business-13977221

When you make common practice illegal, you invite corruption into your system because selective enforcement of the rules becomes the new normal.

Laws need to understand the environment that they are made in or will never be effective and oftentimes counter productive. As is the case here.

GDPR goes even further than would be reasonable for any small business that handles email addresses. Requiring a salaried data protection officer is not feasible. Unless you want to make small businesses illegal to operate online, you either are for selective enforcement or you do not want the GDPR.

Re: Shopify Is Illegal in Germany

#45

Post by boringg »

hyperman1 wrote: post #28
boringg wrote: post #16

Earlier quoted context omitted.

It's the way the EU can protect their own tech industry.

While this is true, it is too easy. The privacy angle lives in the minds of Europeans, while US people seem to care a lot less.

Agree it is both but it is very palatable in the local population to implement rules to shutout foreign competition. Easy political points.

Re: Shopify Is Illegal in Germany

#47

Post by kergonath »

AdrianB1 wrote: post #5
fxtentacle wrote: post #4

I believe the authorities are correct here. Shopify is sending all personal data to CloudFlare, CloudFront (Amazon) and Fastly, so 3 US companies. They could sign so-called "data processing agreements" where they promise to safeguard personal data. But the Shopify FAQ explicitly states that they are unwilling to do so. As the result, Shopify is legally considered to not be processing data under the instructions of th…

As the author showed the volume of business and revenue in Germany is tiny, there may be not worth the effort for Shopify to do it. It may be the correct business decision. The differences in laws and requirements by country is one of the biggest factors to consider when providing international services of any sort.

> As the author showed the volume of business and revenue in Germany is tiny, there may be not worth the effort for Shopify to do it. It may be the correct business decision.

The issue is with European regulations. The lawsuit was in Germany because that’s how legal systems work around here, but the sticking points are very likely to be present in national laws across the EU. So, ultimately it won’t be about the German market, but about the EU.

Re: Shopify Is Illegal in Germany

#48

Post by luckylion »

yashap wrote: post #20
fxtentacle wrote: post #4

I believe the authorities are correct here. Shopify is sending all personal data to CloudFlare, CloudFront (Amazon) and Fastly, so 3 US companies. They could sign so-called "data processing agreements" where they promise to safeguard personal data. But the Shopify FAQ explicitly states that they are unwilling to do so. As the result, Shopify is legally considered to not be processing data under the instructions of th…

I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly). > The data protection authority justified this with the fact that US authorities could access personal data (probably primarily the IP address) for criminal p…

> I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly).

From what I can tell, Shopify itself uses Cloudflare, so your domain that is connected to Shopify is passing all the traffic through Cloudflare, e.g. one of the other examples in the screenshot: https://www.distortedpeople.com/

The site is on CF (and it sets like 10 cookies, including tracking cookies, pre consent, so any dreams of compliance are gone either way), and, as far as I can tell, that's the case with all Shopify shops (but I've only ever looked into that from an outsider's perspective, maybe that's optional).

Re: Shopify Is Illegal in Germany

#49

Post by photochemsyn »

Corporations are increasingly multinational, and the stated 'national affiliation' is really just 'flag-of-convenience' (a notion that probably arose in the global marine shipping industry, but which has spread everywhere). Look at the number of businesses incorporated in Delaware or other states that provide additional layers of legal shields as another example.

As far as this, it's probably related to this story from one month ago (Oct 7 2022):

https://www.reuters.com/business/retail-consumer/eu-says-sho...

> "Shopify committed to change the design of its templates to include fields for company information and contact details, to provide clear guidance to traders on relevant EU consumer law and to provide company details about any EU trader when requested by any national consumer authority. The company also agreed to take down web shops in breach of EU consumer law, as well as to provide the relevant company details."

Re: Shopify Is Illegal in Germany

#50

Post by dmitriid »

friendzis wrote: post #17
wusel wrote: post #2

Sorry for the German only link, but this is from today and didn't make the rounds yet. It is not really about Shopify itself, but about the use of CDNs - which would be even more worrisome. Shopify Support couldn't help the shop owner.

GDPR core is pretty simple: You cannot do stuff (process, store, transfer to third parties) with PII unless X condition is met. An internet site, on first visit (being genuine first visit or just cookieless visit) cannot do things with PII, because there is just no way to even tell if X is met, therefore not only data storage (IP address in Apache access logs included) is illegal, but moreso transfer to third party v…

> GDPR is ugly. The only thing it allows you to do before you get confirmation to process PII is to show static page requesting for permissions. That's basically it. You can't do any "cloudy" stuff prior.

No, GDPR is not ugly. Yes, you can do "cloudy stuff".

The bullshit narratives around GDPR need to stop, however people driving the narrative are extremely incentivized to siphon and sell all the data they can get your data, so the narrative is always bullshit.

Post reply on HN