Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

801–810 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#801

Post by raverbashing »

eli wrote: post #633
gerdesj wrote: post #506

Earlier quoted context omitted.

I'm a Brit. I am the MD of a small IT company. I have two partners and 20 employees. We started in 2000. We turn over about £1.5Mpa. We sell our services to people and organisations. Our backups are now smaller these days (thanks to GDPR). I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR. There is no way on earth that the EU as a whole has looked on your…

It's reassuring to hear that the GDPR is not meant to target little startups and projects but I would like it a lot better if it said that in the actual law, rather than just trusting all current and future regulators to treat me kindly. If it's only meant to be used against big companies or extreme offenders, why doesn't it say so? It seems like the spirit of the law and the language of the law are not aligned and i…

> If it's only meant to be used against big companies or extreme offenders, why doesn't it say so?

Because, and this has been repeated millions of times on HN, Europe and the US follow different systems in writing laws

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#802

Post by cm2187 »

askmike wrote: post #422
eli wrote: post #387

Earlier quoted context omitted.

What does it mean for a website to "cater" to just my home country? The internet doesn't know political boundaries and most sites cater to all visitors on some marginal level.

Most websites are products nowadays. If you have a simple blog without trackers and ads this is really not going to effect you that much. > The internet doesn't know political boundaries Tell that to this US law the whole world has to comply with to called DMCA.

DMCA is only one example. In the financial world, the extra-territoriality of US laws is widespread, such that for example even securities sold outside of the US, to non US customers, by non-US institutions, issued by non-US entities have long US laws compliance sections in their documentation. Non US banks outside of the US are reluctant to take US clients because of these laws (not dissimilar to the discussion on blocking EU IPs here).

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#803

Post by ianamartin »

stemuk wrote: post #573
codexon wrote: post #544

Earlier quoted context omitted.

Merely setting a delete flag is not compliant with the GDPR, that's why a cascading delete is necessary. Any programmer worth their salt knows mass random deletes and updates are extremely inefficient.

Wouldn't it be possible to just delete the 'idetifiabel' parts in the database in order to be GDPR compliant? If you for instance save all the user data like user preferences under a random userId, and then delete the personal data (such as email address, name etc.) associated with the userId I would expect this to be GDPR complaint without having to do a cascading delete.

Yes, but this is actually more difficult than you think. It doesn't take very many data points to ID a user.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#804

Post by rightos »

brett40324 wrote: post #389
rightos wrote: post #269

Earlier quoted context omitted.

I'm wondering this too actually, I run a small business, we collect only the bare minimum of information from our customers but we do have some European customers. I'm ignoring GDPR completely, is there any downside for me? Will they block customers from using my service? Will they sieze my European cloud servers? Or can I safely do nothing as I currently am because I don't reside or have a registered business in Eur…

"but we do have some european customers" The entire point is, NO you can't just ignore GDPR. Your lack of action toward compliance is negligent.

Why can't I ignore it? I have european customers but they chose to sign up with a business in a foreign jurisdiction where their laws don't apply. If it's a problem, the EU can feel free to block my sites, but I can't see how it's negligent to not comply with laws that don't apply in my country.

I don't comply with laws from many other jurisdictions either. Should I start applying censorship laws for China and Saudi Arabia too? Why should the EU be special?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#805

Post by TeMPOraL »

cromwellian wrote: post #532
hk__2 wrote: post #519

Earlier quoted context omitted.

> Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. Erase the name and address fields from the user in the database. You don’t have to delete any line, and that person doesn’t have any personal info in your database anymore. Problem solved.

Assuming the remaining data can't be used to deanonymize them. This solution buys into the myth that anonymizing data protects PII.

"Anonymizing" would be replacing each user's PII with a value that's unique to that user. Instead, you could just blank it out or overwrite with universal "data removed because of GDPR" token.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#806

Post by henrikeh »

alexbeloi wrote: post #639
mc32 wrote: post #496

Earlier quoted context omitted.

Even if you delete it from disk and remove from memory, you may be required to remove it from offline backups too like tapes and other media.

Presumably you are also required to delete it from any training data for an ML model, does that make any models trained on previous set of data illegal to use?

Are the weights in the NN “relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier”?

If not, then it isn’t personal information.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#807

Post by viraptor »

themacguffinman wrote: post #687
viraptor wrote: post #451

Earlier quoted context omitted.

I don't get the complaints about how hard GDPR is and having to understand it all. If you're based in the US, have you read the actual DMCA document? CFAA? California S.B. 1386? TWEA? ADA? Or at least any interpretations of them and validated that you comply? If not, then worrying about GDPR which is mostly not enforceable in the US sounds disingenuous.

Who are you arguing with that thinks DMCA was a great idea but GDPR isn't?

Not saying anyone thinks it's a good idea. I'm saying I haven't seen that many comments, annoyed people, and general discussion about other laws, which actually impact US people and can be enforced there.

I'm guessing they also ignore those laws, because of posts like this one. If you're running a business complying with regulations, you likely already know how to block a country. I mean, you keep track of the current embargoes and block relevant countries, right?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#808

Post by jdlshore »

JoshuaEN wrote: post #766
hekfu wrote: post #613

Earlier quoted context omitted.

> This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every web…

> If you don't store PII, you don't have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights A server 'processing' (which seems to include using it in any way, not just storing [1]) your IP address appears to fall under the GDPR[1], and said server would be in violation of the law unless its processing falls under o…

Yeah, you're putting too much emphasis on consent. It's only one of six lawful bases for processing data, and in fact the one with the most stringent rules.

I used "legitimate interest" as my lawful basis for logging IP addresses and website usage information. From the UK ICO's guidelines [1]:

"It is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing."

There's a three part test:

1. Identify the legitimate interest: ensure the security and stability of my systems.

2. Show that processing is necessary to achieve it: need to know when and how the site is used in order to troubleshoot problems and detect abuse

3. Balanced against individuals' interests: We pseudonymize logins so usage information is not obviously related to specific individuals. There is no sensitive data on the site that can be revealed by usage data. The retention period is short which further limits what can be revealed.

Now, people here on HN might nitpick my logic, but fortunately they're not the regulators. I'm confident that, in the very unlikely event that a regulator even notices my little businesses, that I'll be able to correct any mistakes before fines come into play.

[1] https://ico.org.uk/for-organisations/guide-to-the-general-da...

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#809

Post by dan-0 »

drtillberg wrote: post #616
dan-0 wrote: post #521

Earlier quoted context omitted.

> Not true. ... unless you plan to use the backups. Then you have to have another service that tracks entities to delete when a backup it's restored... and back that up separately.

If you back up a list of things to delete is that GDPR compliant? Ponder.

> If you back up a list of things to delete is that GDPR compliant? Ponder.

There's little to ponder, that's why I mentioned "entities" rather than "user data." Use unique keys to reference the data rather than sensitive identifiers. The nontrivial part is storing your backup of entities to be deleted in a way that doesn't get destroyed at the same time as the event that forces you to revert to a backup. This now requires a separate storage, backup, and retrieval mechanism to maintain compliance.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#810

Post by ianamartin »

Naomarik wrote: post #800
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

As the solo developer/cofounder of a two man business I have absolutely no time to worry about these things. Only a few days ago I've googled GDPR to get a facile understanding of what it is. If at some point I create something that is large enough to matter, I can worry about it then and will have the resources to do so. Until then I'll continue working on software as if it does not exist. It's hard enough to build…

Welp, have fun with SESTA/FOSTA when you aren't busy having fun with GDPR.

I really hope you get noticed by some regulator somewhere. You're not a special snowflake. Your design decisions and creativity don't make you special. You're not an artist, and if you were that wouldn't matter either.

If you don't have time to worry about whether your business is legal, I hope your business fails, gets fined, or you and your cofounder go to jail.

Post reply on HN