Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

761–770 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#761

Post by CryptoPunk »

azernik wrote: post #294
qop wrote: post #226

Can American businesses actually be sued or anything over GDPR? What if all my servers are housed in america? If I have a user agreement that my users agree to, I don't particularly care what another country thinks about what kinds of privacy they think my users are entitled to. I would already have a legal agreement in that case.

If it is against the GDPR, then it is an illegal agreement in the EU. Non-enforceable contracts are a thing. You are not allowed to literally sign away your firstborn, sell yourself into slavery, or accept a job at less than minimum wage. Enforceability will generally be based on revenue streams coming from the EU (oh you want a credit card processed from an EU user? We'll be taking that money as a payment towards yo…

>>You are not allowed to literally sign away your firstborn, sell yourself into slavery, or accept a job at less than minimum wage.

The last item is nothing like the first two. The EU is now going to see the natural conclusion of a society based on its conception of contract rights. Digital technology magnifies the effect of everything by several orders of magnitude, so I suspect we'll see dramatic consequences flow from the law.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#762

Post by usr1106 »

Matticus_Rex wrote: post #737
gerdesj wrote: post #655

Earlier quoted context omitted.

"but I would like it a lot better if it said that in the actual law" Have you read the bloody law! http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... This is legislation designed to protect not only me (as an individual) but you as well (as a probable foreigner) from me!

In the history of laws, many of the ones designed with good intentions have been quite harmful. And yes, I've read the law. It's typical of legislation in that it obviously wasn't written by people who knew what it looked like to perform that in a real life business.

> And yes, I've read the law.

Have you read recital 1? https://gdpr-info.eu/recitals/no-1/ ? The starting point of the law is that data protoection is a fundamental human right,. The data subject owns their PII, not some company collecting it.

It's all up whether you are willing to accept that as a fundamental right or not.

I mean there is a billion of Chinese that live with the fact that free speech is not a fundamental human right. Most Westerners have a problem with that.

Now many US based IT professionals seems to have problems with accepting that nobody else can own the data about a human.

> It's typical of legislation in that it obviously wasn't written by people who knew what it looked like to perform that in a real life business.

That's what a cotton farmer could have said when they made slavery illegal. Obviously respecting other's human rights makes some business models illegal.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#763

Post by berti »

johnbellone wrote: post #536
contravariant wrote: post #530

Earlier quoted context omitted.

This might be a bit of a weird question, but how do you remember which information needs to be deleted when you're at the point where you need to use backups?

You would keep a list of unique identifiers (opaque) that were deleted and filter data out prior to rewriting/restoring it. It’s cumbersome but not impossible.

So you then need to make sure that dataset is at least as resilient as your cold backups. That's not exactly a trivial problem in most cases.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#764

Post by rorykoehler »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

While i agree with your last 2 paragraphs i don't agree with the rest. I have a small team (2 fulltime devs and a designer) and we have no problem achieving GDPR compliance.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#765

Post by Bizarro »

hekfu wrote: post #613
strken wrote: post #590

Earlier quoted context omitted.

This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every websi…

> This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every web…

You can't have a legitimate opinion on whether GDPR is a good thing or not, because you don't event understand what data is.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#766

Post by JoshuaEN »

hekfu wrote: post #613
strken wrote: post #590

Earlier quoted context omitted.

This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every websi…

> This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every web…

> If you don't store PII, you don't have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights

A server 'processing' (which seems to include using it in any way, not just storing [1]) your IP address appears to fall under the GDPR[1], and said server would be in violation of the law unless its processing falls under one of the exemptions.

The main exemption appears to be getting the user's explicit consent, though there's also this super vague exemption: "for your organisation’s legitimate interests, but only after having checked that the fundamental rights and freedoms of the person whose data you’re processing aren’t seriously impacted." [2]

In general, it seems very hard to avoid the GDPR because what is considered 'personal data' is extremely broad.

Maybe I'm misunderstanding something.

---

[1] https://ec.europa.eu/info/law/law-topic/data-protection/refo...

[2] https://ec.europa.eu/info/law/law-topic/data-protection/refo...

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#768

Post by fantad »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

Many industries are already like this. Certainly anything that touches securities laws or payments. Or safety regulations, or government customers. It was once possible to start a bank (Goldman Sachs origins buying receivables), a hedge fund, PayPal, etc etc without heavy compliance costs and infrastructure. Then things change. Though GDPR has a longer history, the US election showed that data-collecting people-connecting internet companies can do even more systematic damage and e.g. permit more foreign election manipulation than any one financial institution.

They might not crash an economy but they can crash a democracy.

So really the regulation is somewhat deserved and levels the playing field with other industries that have the potential to damage society.

Personally I wish two people could start an internet company or a bank or an exchange or an investment fund without deep pockets for compliance and legal. But it’s no more. Mourn it and think about the next sector that is open for growth.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#769

Post by inopinatus »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

I'm running a small startup and finding GDPR compliance is small beans compared to the tax code and employment law, both of which we have no trouble complying with.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#770

Post by berti »

yzmtf2008 wrote: post #747
Hermel wrote: post #730

Earlier quoted context omitted.

> If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. Are you aware that setting “delete=1” is essentially what file systems do when deleting a file? What file system do you suggest companies to use when they want to comply with GDPR?

I’m well aware of that, but are you aware of any SQLi that can output a deleted file? There’s a big difference between the two things you’re trying to equalize.

Does the GDPR actually draw that line somewhere above the filesystem, but below the database?
Post reply on HN