Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

431–440 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#431

Post by eli »

askmike wrote: post #422
eli wrote: post #387

Earlier quoted context omitted.

What does it mean for a website to "cater" to just my home country? The internet doesn't know political boundaries and most sites cater to all visitors on some marginal level.

Most websites are products nowadays. If you have a simple blog without trackers and ads this is really not going to effect you that much. > The internet doesn't know political boundaries Tell that to this US law the whole world has to comply with to called DMCA.

Even my simple blog with no ads has google analytics on it. I don't feel like I was doing anything wrong or abusive, but I guess there's a case to be made.

I assure you I have been against the DMCA since before it passed, though I don't think it's quite the same nor do two wrongs make a right.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#432

Post by HumanDrivenDev »

SJetKaran wrote: post #286
shiado wrote: post #113

I simply don't understand how or why a law that has scope in the EU is causing trouble for companies which conduct no business in the EU beyond responding to HTTP requests on a global decentralized telecommunications network. Why would an American internet business which conducts no operations in Europe and has no servers in Europe be subject to regulation that affects the EU? What is going to happen? Is the EU going…

Not directly related, but see FATCA. Because of a US law, individuals in many countries who don't deal with US securities/markets, have to fill a form saying they don't have any direct investments in US, or that they are not a citizen/resident of US.

Interesting that the end result was the same - block people from the country using their services.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#433

Post by HumanDrivenDev »

saagarjha wrote: post #277
vbezhenar wrote: post #229

Earlier quoted context omitted.

Fun fact: Russia recently approved similar law which requires all personal data of Russian citizens to be stored in a server hosted in Russia. So theoretically many webmasters are already be in trouble :)

> Russia recently approved similar law which requires all personal data of Russian citizens to be stored in a server hosted in Russia I wouldn't call that a similar law at all, because the spirit of it is so that the government can have access to that data…

Oh are European governments and intelligence agencies going to follow the GDPR as well?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#434

Post by fiatjaf »

downandout wrote: post #132
shiado wrote: post #113

I simply don't understand how or why a law that has scope in the EU is causing trouble for companies which conduct no business in the EU beyond responding to HTTP requests on a global decentralized telecommunications network. Why would an American internet business which conducts no operations in Europe and has no servers in Europe be subject to regulation that affects the EU? What is going to happen? Is the EU going…

Recital 23 [1] of the GDPR excludes most US-based businesses from compliance with GDPR. It essentially says that sites that don’t “envisage” (their word) offering services in the EU are in fact not offering services there for the purposes of the GDPR and are thus are not subject to it. It also explicitly states that the mere accessibility of a foreign-based website from within the EU does not by itself subject the si…

For those purposes, a simple JS snippet as provided by my https://euroshield.xyz/ would serve very well.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#435

Post by gerdesj »

Jeema101 wrote: post #239
shiado wrote: post #113

I simply don't understand how or why a law that has scope in the EU is causing trouble for companies which conduct no business in the EU beyond responding to HTTP requests on a global decentralized telecommunications network. Why would an American internet business which conducts no operations in Europe and has no servers in Europe be subject to regulation that affects the EU? What is going to happen? Is the EU going…

It's because: A) The law seems to extend beyond the borders of the EU. B) It's extremely long and vague, doesn't really offer a lot of actionable advice, and nobody outside of privacy lawyers seems to really understand it fully. C) The penalties are harsh. Further muddying the waters, the EU and US already have some existing bilateral agreements with respect to data privacy [1], but does the GDPR supersede or unilate…

You haven't actually read any of it have you?

A) It covers behaviour towards the citizens (ie passport carrying members) of the EU. It basically says: "please do not be evil" - OK it says a lot more but I think you get the idea.

B) It does cover a lot of ground but it is written in pretty accessible language for such a large and complex subject.

C) The possible maximum penalties are set at a level that will not destroy a serial transgressor but should hopefully deter anyone from becoming such a beast in the first place.

Overall, GDPR is really a manifesto for how people should be treated in the burgeoning data economy. I still find it hard to understand how such a reasonable and farsighted set of regs came to be designed in the first place. As a citizen of the UK, at least I am reasonably certain that the GDPR will stay on the local statute books post Brexit because to contemplate otherwise is economic suicide.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#436

Post by eli »

takeitto wrote: post #409
eli wrote: post #387

Earlier quoted context omitted.

What does it mean for a website to "cater" to just my home country? The internet doesn't know political boundaries and most sites cater to all visitors on some marginal level.

The internet doesn't know, but e-commerce/data business pretty darn well knows where their customers/users are situated. The old web was mostly static websites. We spoke of visitors. The new web is app-ified/interactive, walled off to logged-in agreement-abiding geolocated users, and even a single logged-out "visit" broadcasts this to 100s of trackers who will remember your every move online.

Odds are whatever you were using on the old web to measure visitors would be a data processing activity under GDPR.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#437

Post by kevinr »

Laforet wrote: post #426
kevinr wrote: post #414

There's one very important problem with this approach: this blocks people from accessing your site who are doing so from the EU, whereas the GDPR applies to EU citizens , wherever they access the Internet from. In other words, an EU citizen residing in and accessing the Internet from the US has just as much right to invoke the GDPR with these sites as an EU citizen residing in and accessing the Internet from the EU.…

Do EU laws still apply when a person has physically left EU jurisdiction? I doubt it. After all, every egg sold in the US would be in violation of EU food safety laws (and vice versa).

It depends on the law. In the case of the GDPR, it does apply despite the person not being physically in the EU.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#438

Post by Bizarro »

Clearly, the EU can't enforce or even make laws that apply globally. If you don't have a presence in the EU the GDPR does not apply to you, period. And the GDPR doesn't apply to EU citizens outside the EU, period.

But this thread and others just show how people will continually lie when it comes to the politics of GDPR. And when they don't want to lie, they partake in whataboutism. Even EU bureaucrats seem to be willing to partake in at least promoting the idea that it's a global law for their political agenda, when they know it's not.

I don't know why people continue to lie about the jurisdiction of this law, when everybody here knows it's not true.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#439

Post by zerostar07 »

chrononaut wrote: post #425

I think there are a number of comments being made throughout this whole thread that are conflating the effort required to comply with the best security practices to protect user data, compared to the effort required to comply with the language of GDPR. A general theme seems to be that if a company is afraid to do the latter, they must not be willing to do the former. Which brings up a question, is the complexity of b…

GDPR is not about security but about privacy and data access protection. In fact security is mostly on paper: requires that you document the data and procedures, but doesn't require you to upgrade your security. So the effort for the one has little to do with effort for the other.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#440

Post by mychael »

Msurrow wrote: post #408
shiado wrote: post #113

I simply don't understand how or why a law that has scope in the EU is causing trouble for companies which conduct no business in the EU beyond responding to HTTP requests on a global decentralized telecommunications network. Why would an American internet business which conducts no operations in Europe and has no servers in Europe be subject to regulation that affects the EU? What is going to happen? Is the EU going…

Well thats because you dont understand GDPR. If the company doesnt conduct any business in EU - or more correctly with EU private persones - then GDPR doesnt apply to the company. It also doesnt apply for any Business-2-business relations. GDPR only applies if you are providing a service to a EU citizen. That also explains what EU will do if a company doesnt comply with GDPR (where it should); they will stop the comp…

You're mistaking GDPR's intent with its implementation, an error that lots of people are making.

As Americans we're particularly sensitive about having to follow rules made by people who don't represent us and are not accountable to us. This is a totally fair and justifiable reason to be against GDPR even if you agree with its objectives.

Post reply on HN