Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

951–960 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#951

Post by coreyoconnor »

Moter8 wrote: post #912
jcadam wrote: post #902

Earlier quoted context omitted.

Yep. Doing a one person startup (in the US) I absolutely do not have time (or money) to mess around trying to figure out GPDR compliance. I'm not selling data to anyone, and I'm not collecting anything beyond an email address during sign-ups at this point, in any case. If a user decides they want to store PII or other sensitive data on my system, I can't stop them, but I'm not going to go combing through their data i…

Sounds like you wouldn't have to change anything then. Make extra personal data stuff opt-in, rest should be the same as usual.

Incorrect: Even a single person company described above will still need to handle GPDR requests. The operational requirements is not 0 even for a company retaining no unnecessary records.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#952

Post by GW150914 »

ng12 wrote: post #635
Barrin92 wrote: post #623

Earlier quoted context omitted.

I'm not onboard with the idea that Silicon Valley holds a monopoly on technical innovation. Getting people to click on ads on smartphones doesn't capture the entire scope of technology. Europe's economy is roughly as large as that of the United States. Many world-leading companies from the car industry, to chemicals, to biotech reside in Europe. The US holds one dominating advantage in one subset of technology. Consu…

That's exactly my point. The EU is built for entrenched institutions. There is no entrepreneurial spirit -- and that's why there's N-number of self driving car companies in the US and zero(?) in the EU, for example.

Whereas the US with its ISP, fossile fuel, pharmaceutical monopolies, it’s GM and Apple, Google, Amazon, Apple, and Facebook, Lockheed, and Boeing is obviously a Randian utopia. Yes indeed, no entrenched institutions in the US!

/s In cased you missed it.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#953

Post by Mirioron »

eli wrote: post #633
gerdesj wrote: post #506

Earlier quoted context omitted.

I'm a Brit. I am the MD of a small IT company. I have two partners and 20 employees. We started in 2000. We turn over about £1.5Mpa. We sell our services to people and organisations. Our backups are now smaller these days (thanks to GDPR). I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR. There is no way on earth that the EU as a whole has looked on your…

It's reassuring to hear that the GDPR is not meant to target little startups and projects but I would like it a lot better if it said that in the actual law, rather than just trusting all current and future regulators to treat me kindly. If it's only meant to be used against big companies or extreme offenders, why doesn't it say so? It seems like the spirit of the law and the language of the law are not aligned and i…

He's talking a nice talk, but history has shown us that when EU makes regulations/laws then they just don't care about the consequences or the collateral. As evidence I would bring the completely useless cookie law and the completely botched "digital VAT" change.

In the latter it just confounds me that the legislators set up a situation, where a small business in the UK is better off not selling a digital good (that you can make infinite copies of) to a buyer in Malta, because the bureaucracy would cost more than the sale would pay. You can't have a "single market" like that.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#954

Post by tensor »

codexon wrote: post #544
yzmtf2008 wrote: post #512

Earlier quoted context omitted.

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

Merely setting a delete flag is not compliant with the GDPR, that's why a cascading delete is necessary. Any programmer worth their salt knows mass random deletes and updates are extremely inefficient.

A cascading delete is not necessary. You need only to remove personal information, not all information. Now if you are producing an application that only contains personal information like a chat app, then sure, you might need to remove everything.

But often all you need to do is overwrite the name, address, or similar bits of information, and you can then leave the rest of the data intact and set your delete flag.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#955

Post by pedalpete »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

As a start-up, you do what you need to do, and probably skirt the laws in some areas (I do anyway).

We can't get to full compliance, and in the timeframe with the workload we're working with, we didn't send out a message to all of our users asking them to reconfirm that we can email them.

That's just a hassle I don't think is worthwhile at this stage. So, we're risking it. Are we going to get a $4m fine for this. No, did we every implement the cookie law, which because we are an embed would create a brutal UI and result in some of our customers having multiple "accept cookie" messages on a single page? No, we said screw it, it's a stupid law.

If we listened to every stupid law on the books, nobody would have any fun.

BUT, in my opinion, we work within the objective of the law. The law is about protecting users private data. That is a good thing. Due to GPDR, we are taking extra steps to protect user data, and making it easier for users to delete their data. We have had to create Data Processing Agreements for our customers.

Take a look at the law, see what you can implement, understand why the EU has implemented the law as they have, and get as close to legal as you can.

Every start-up is making trade-offs, just because this is a big-bad LAW, does that mean it should get all the attention and that your customers should suffer while you implement.

Weigh the odds and get to work. If this kills a start-up, I suspect it is the start-up gave up or needed to act shady.

This is definitely doable for a one-man start-up with no lawyer.

Just like Terms of Use, take a look at what others are doing, and then copy what works for you and your busy.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#956

Post by eksemplar »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

This is mostly false.

The GDPR doesn’t fine small companies that aren’t making a lot of money. The fines also don’t apply fully to startups until they are a certain age, depending on country.

The GDOR doesn’t require you to delete user data that you need. That would be insane, you could obtain a loan and ask to have the record of it deleted if it did. The GDPR does require you to inform people that you keep their data, and it requires you to tell your national how you plan to keep the data safe.

You’re not required to have GDPR legal representation in one man - small companies or startups.

The GDPR is only really a problem if your business model evolves around selling privacy data. I won’t lose any sleep over it being harder to make a new Facebook and I’m looking forward to see what new business models spring up.

I work in the Danish public sector by the way. I have around 500 systems that need to comply, some of these systems run on mainframes and have bits of software that are older than me. I’m not worried, especially not when we haven’t seen a single case in the courts. Until that happens the GDPR is really just a piece of paper because nobody knows exactly how it’ll be interpreted by the legal system.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#957

Post by skunkwerk »

You need a legal basis for automated decision-making, such as doing geolocation on a user's IP address (which can be considered PII, as per EU legal rulings from last year). Which means you cannot block them without first getting that legal basis (i.e. consent). Therefore, you're in a catch 22.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#958

Post by segmondy »

skunkwerk wrote: post #957

You need a legal basis for automated decision-making, such as doing geolocation on a user's IP address (which can be considered PII, as per EU legal rulings from last year). Which means you cannot block them without first getting that legal basis (i.e. consent). Therefore, you're in a catch 22.

Rubbish, folks block Africa and China all the time

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#959

Post by carapace »

throwaway974 wrote: post #75
ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

GDPR has effects way beyond better user privacy. Sorry I've been pasting this in multiple GDPR related threads, but here it goes: I have a profitable, bootstrapped SaaS business based in US. It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. It's a trivial application that stores mostly already public data. Only email is required t…

> This is the side-effect of GDPR.

And the GDPR is the side-effect of people running hog-wild with PII etc. I feel for you but I see your situation as collateral damage of the privacy crisis.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#960

Post by devocracy »

jeremyt wrote: post #855
Spivak wrote: post #735

Earlier quoted context omitted.

The general recommendation is that if it's too difficult to purge specific users from your backups then: * Have a clear data retention policy and make sure that all backups have an expiration date. * Secure your backups with strong encryption to protect user data in the event of a leak. * Explain it to the user when the account is deleted when the deletion will filter through your backups. * Guarantee that if a resto…

How do you keep track of what info needs to be deleted on restore without violating GDPR?

You should be able to record the deletion request for the life of the backup and purge those records once the backups are deleted (all tied to the same rolling dates)
Post reply on HN