Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shopify Is Illegal in Germany

lsww.de

Post reply on HN
Print view View original

91–100 of 349 posts

Re: Shopify Is Illegal in Germany

#91

Post by cameronh90 »

kergonath wrote: post #47
AdrianB1 wrote: post #5

Earlier quoted context omitted.

As the author showed the volume of business and revenue in Germany is tiny, there may be not worth the effort for Shopify to do it. It may be the correct business decision. The differences in laws and requirements by country is one of the biggest factors to consider when providing international services of any sort.

> As the author showed the volume of business and revenue in Germany is tiny, there may be not worth the effort for Shopify to do it. It may be the correct business decision. The issue is with European regulations. The lawsuit was in Germany because that’s how legal systems work around here, but the sticking points are very likely to be present in national laws across the EU. So, ultimately it won’t be about the Germ…

Each EU country does seem to have a different approach to the GDPR though. Germany's one is known for being particularly hard line, whereas the UK (not in EU but still follows GDPR) is known for being more pragmatic.

I don't know how that affects lawsuits though. I'm guessing if you have any customers in Germany, then someone could take you to court in Germany, but I'm not sure...

Re: Shopify Is Illegal in Germany

#92

Post by anonymousab »

rurban wrote: post #78
toyg wrote: post #30

Earlier quoted context omitted.

I don't think that matters - what matters is where the processing servers are. And if they are using CloudFront etc, they are sending data to the US.

But those 3 US companies all signed the safe heaven agreement, AFAIK.

Agreements mean nothing because the problem is with US law, which these companies cannot countermand.

Re: Shopify Is Illegal in Germany

#93

Post by Silverback_VII »

shafyy wrote: post #72
lmkg wrote: post #38

Earlier quoted context omitted.

The CLOUD Act gives US law enforcement access to the data, even if it's only stored in Europe. That's the problem, and the EU court is doing no more than recognizing that for the problem that it is.

I think it's good that the EU is forcing the US to get their privacy laws in order.

who for goodness sake needs privacy to buy some coffee online? This is just bullshit and slows down innovation. Moreover It is a big hassle just like these cookie consent banners. Nothing shows better that European leaders are powerless than this sort of nitpicking over things of little importance.

Re: Shopify Is Illegal in Germany

#94

Post by formerly_proven »

yashap wrote: post #20
fxtentacle wrote: post #4

I believe the authorities are correct here. Shopify is sending all personal data to CloudFlare, CloudFront (Amazon) and Fastly, so 3 US companies. They could sign so-called "data processing agreements" where they promise to safeguard personal data. But the Shopify FAQ explicitly states that they are unwilling to do so. As the result, Shopify is legally considered to not be processing data under the instructions of th…

I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly). > The data protection authority justified this with the fact that US authorities could access personal data (probably primarily the IP address) for criminal p…

> I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly).

This doesn't matter, EU sites have been getting fined for some time now for using CDNs like this, most popularly Google Fonts.

Re: Shopify Is Illegal in Germany

#95

Post by mbreese »

shafyy wrote: post #72
lmkg wrote: post #38

Earlier quoted context omitted.

The CLOUD Act gives US law enforcement access to the data, even if it's only stored in Europe. That's the problem, and the EU court is doing no more than recognizing that for the problem that it is.

I think it's good that the EU is forcing the US to get their privacy laws in order.

I don't think the EU will force the US to do anything w.r.t. privacy. Instead, we'll see EU based CDNs start to take over customers from US CDNs. Less "get your act together", more "we'd rather do this ourselves...".

Re: Shopify Is Illegal in Germany

#96

Post by Hanschri »

yashap wrote: post #20
fxtentacle wrote: post #4

I believe the authorities are correct here. Shopify is sending all personal data to CloudFlare, CloudFront (Amazon) and Fastly, so 3 US companies. They could sign so-called "data processing agreements" where they promise to safeguard personal data. But the Shopify FAQ explicitly states that they are unwilling to do so. As the result, Shopify is legally considered to not be processing data under the instructions of th…

I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly). > The data protection authority justified this with the fact that US authorities could access personal data (probably primarily the IP address) for criminal p…

It is correct that the CLOUD Act complicates things, the issue is that servers located within the EU operated by American companies have some form of remote access to the hypervisor, meaning US intelligence agencies can compel these companies to hand over data and encryption keys for the data, even if it's physically located within the EU/EEA.

Before the Schrems II judgement[0] by the European Court of Justice, companies in the US could use the EU-US Privacy Shield[1] to ensure adequate protection of EU personal data. The Privacy Shield agreement replaced and improved upon it's predecessor, the Safe Harbor agreement, which was invalidated by the Schrems 1 case.

Transfers between the EU and US can still be legal, as long as standard contractual clauses (SCC), although this requires more effort after the Schrems II case than before. Companies are now required to verify the privacy protection in the recipient country in order to use the SCCs.

The first source provided gives insight into what is required by US companies to comply with GDPR when tranferring personal data to third countries. As an anecdote, a guest lecturer for a masters course I took this semester mentioned in passing that transfers to the US are almost as bad as transferring personal data into China.

[0]: https://www.gdprsummary.com/schrems-ii/

[1]: https://www.gdprsummary.com/gdpr-definitions/privacy-shield/

Re: Shopify Is Illegal in Germany

#97

Post by nopenopenopeno »

shafyy wrote: post #72
lmkg wrote: post #38

Earlier quoted context omitted.

The CLOUD Act gives US law enforcement access to the data, even if it's only stored in Europe. That's the problem, and the EU court is doing no more than recognizing that for the problem that it is.

I think it's good that the EU is forcing the US to get their privacy laws in order.

The EU does not force the US to do anything.

Re: Shopify Is Illegal in Germany

#98

Post by anonymousab »

ronsor wrote: post #75
Aerroon wrote: post #24

With all of this popping up: how are you even supposed to run an internet service in the EU? Do you have to write all pieces of the software yourself or what? Since all the big services seem to be off-limits.

At least if you're US-based and not accepting money, I have one bit of advice: just don't care. Even if they complain, don't care. The Internet is global; if they really have an issue, they can block your site, or they can just put up with it. If you're gonna sell a product or service, then worry about figuring stuff out.

In theory you could individually be sanctioned, prevented from entering EU countries (or face the courts upon doing so), etc. Gotta cross a bunch of countries off of your vacation list.

But in practice that's never going to happen.

Re: Shopify Is Illegal in Germany

#99

Post by donatj »

martijnarts wrote: post #86
judge2020 wrote: post #42

Earlier quoted context omitted.

To add, would EU privacy requirements apply even if you're just running some Gitlab or even Mastodon instance? Maybe running it as an individual vs llc changes things?

GDPR applies to everyone, including individuals.

Does that mean I can send people requests to delete my contact info from their phone and they're legally required to comply?

Re: Shopify Is Illegal in Germany

#100

Post by a2128 »

generationP wrote: post #9

Wait, does this imply that running a website behind CloudFlare is illegal in the EU? After all, webshop or not, IPs will be transmitted... Or are IPs only a problem in connection with getting user data like name and address? Or is it the IP+cookie combo?

This would be funny, considering my local (EU) tax authority's website is protected by Cloudflare. And the state health insurance website. And the government information website. And the E-government gateway website. And the data protection authority(!) website. In fact I'm struggling to find any government-affiliated website that isn't protected by Cloudflare.
Post reply on HN