GDPR compliance as a service(gdpr-shield.io)
gdpr-shield.io
GDPR compliance as a service
https://gdpr-shield.io/
157 comments
Not a joke :). GDPR Shield as a product is GDPR compliant. Customers sign a data processor agreement with the service. It anonymizes IP addresses, they aren't transferred to any other third-party provider and aren't stored.
But like I mentioned on Indie Hackers, your customers still have their own logs that need to be GDPR-compliant, which defeats the whole purpose. The page that requests your JS still has to be sent by a server, which will likely log the EU citizen’s IP. And then there’s the case where the EU citizen is using a VPN server in the US...
Maybe, but it's clear that your company doesn't specifically target its services at individuals in the EU. Your company is actually using active measure to not do that.
sure but just handling ip addresses in your access logs is a whole lot easier than changing your entire site to comply with GDPR. major reduction in surface area
[deleted]
But if your JavaScript is inserted into your customers site, then the initial request that loads their site the first time + your script will be logged on their servers just like any other HTTP request.
And if your site loads their Javascript to block anyone from the EU from visiting, then it's clear that you're not targeting customers in the EU.
You're still gathering the data on every request. And since all requests go to the site anyway (to load the JS) you might as well just put a text saying, "nothing to see here for EU citizens"—that'd be a lot cheaper than buying this silly service and it would send the same signal.
This service isn't blocking requests to your site, it's just showing the visitors different content after the fact.
This service isn't blocking requests to your site, it's just showing the visitors different content after the fact.
[deleted]
Niko, your implementation may not be right like others have mentioned (in that it triggers GDPR on your customers), but I fully support this methodology.
If it helps, I use AppEngine for my App which already provides geolocation information in the IP and my app blocks it the moment it receives the request. Users will only see a re-direction to a notice relating to GDPR and what they'll need to do if they still want to access the site.
If it helps, I use AppEngine for my App which already provides geolocation information in the IP and my app blocks it the moment it receives the request. Users will only see a re-direction to a notice relating to GDPR and what they'll need to do if they still want to access the site.
Thanks! You're right, there are many ways to achieve this goal, I just wanted to provide a drop-in solution that's independent of the infrastructure.
You might as well be selling an image saying "EU customers go away!" With regards to GDPR compliance it's just as good in that, at best, you're showing intent not to serve EU customers (yet you still don't actually block requests, you just serve them different content and log all the same data).
Or an image saying "We don't care about keeping your personal data safe".
[deleted]
> at that point the initial request(s) has already been logged and now they have to comply with the GDPR.
Are you referring to the IP address, which is personal data?
Are you referring to the IP address, which is personal data?
The idea that simply having an EU visitor load your site can subject you to a $2M fine is a recurring bit of FUD.
Directly from the EU:
> Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.
(https://ec.europa.eu/info/law/law-topic/data-protection/refo...)
Directly from the EU:
> Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.
(https://ec.europa.eu/info/law/law-topic/data-protection/refo...)
How a company "specifically targets its services at individuals in the EU" is not clearly defined within GDPR. Even if you just set your AdWords targeting to 'global', it might be enough to trigger this. GDPR Shield is a clear signal that you're not targeting EU users.
> How a company "specifically targets its services at individuals in the EU" is not clearly defined within GDPR.
Does that mean that (e.g.) German bloggers are not bound to the GDPR when they just add "made for the Swiss" to their header?
Does that mean that (e.g.) German bloggers are not bound to the GDPR when they just add "made for the Swiss" to their header?
Well, if you're in the EU you have to obviously implement the regulation either way.
What personal data are German bloggers gathering?
IP addresses, e-mail addresses from those who comment...
IP addresses alone are not personal data. They're only personal data if they can be used to identify a natural person.
If someone is gathering and storing email addresses and ip addresses it seems reasonable to ask them to take industry standard measures to protect that data, and to let users know that the data is being collected.
If someone is gathering and storing email addresses and ip addresses it seems reasonable to ask them to take industry standard measures to protect that data, and to let users know that the data is being collected.
> IP addresses alone are not personal data.
According to the GDPR, they are. https://eugdprcompliant.com/personal-data/
"The conclusion is that the GDPR does consider it as such."
According to the GDPR, they are. https://eugdprcompliant.com/personal-data/
"The conclusion is that the GDPR does consider it as such."
However specifically putting measures in place to block EU users should be sufficient to show that you are not specifically targeting them.
Overall I'm content with the GDPR as it is a long needed corrective action for the path we've been treading in the West as a whole.
One requirement, imho, is quite ridiculous, however. That is the need for entities which need to abide by the GDPR but do not have a presence in the EU to assign a representative in the EU.
This part definitely needs some relaxation. Just complying with the regulation ought to be enough as the first step, especially for start-ups.
One requirement, imho, is quite ridiculous, however. That is the need for entities which need to abide by the GDPR but do not have a presence in the EU to assign a representative in the EU.
This part definitely needs some relaxation. Just complying with the regulation ought to be enough as the first step, especially for start-ups.
> Just complying with the regulation ought to be enough as the first step, especially for start-ups.
It is enough; most start-ups won't need a representative.
That requirement only applies to large-scale processing of special categories ( i.e. sensitive ) of data or that relating to criminal convictions and offences.
Article 27 applies: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE...
It's basically to prevent big data processors from claiming 'we don't have an EU presence so you can't fine us'.
It is enough; most start-ups won't need a representative.
That requirement only applies to large-scale processing of special categories ( i.e. sensitive ) of data or that relating to criminal convictions and offences.
Article 27 applies: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE...
It's basically to prevent big data processors from claiming 'we don't have an EU presence so you can't fine us'.
Yes! That was the part of the regulation to me that felt like a shake down. I get the need to be more careful with user data. Make me hire a rep in the EU? Now you're just trying to drum up fees for your lawyers...
This is what you're trying to reference: https://ec.europa.eu/info/law/law-topic/data-protection/refo...
That explanation is the first one I've seen that makes GDPR sound reasonable.
The main problem overall is that the EU appears to consider information about someone as being owned by that person. That is quite foreign from a US individual perspective and having some blogs. I don't see how the learning I have acquired about people places and things, which I acquired without any promise of confidentiality, can be owned by anyone but me. Are libraries and newspapers required to scrub their shelves and archives? And if not, what is the limiting principle?
The main problem overall is that the EU appears to consider information about someone as being owned by that person. That is quite foreign from a US individual perspective and having some blogs. I don't see how the learning I have acquired about people places and things, which I acquired without any promise of confidentiality, can be owned by anyone but me. Are libraries and newspapers required to scrub their shelves and archives? And if not, what is the limiting principle?
There are other interests that get balanced against the individual's right to privacy, including public interests like newsworthiness.
But indeed that can go both ways - the website of a newspaper might be required upon request to remove a 20-year-old crime blotter item reporting a single petty theft conviction for an otherwise law-abiding non-celebrity; they wouldn't be required to do that for a 2-year-old murder conviction.
But indeed that can go both ways - the website of a newspaper might be required upon request to remove a 20-year-old crime blotter item reporting a single petty theft conviction for an otherwise law-abiding non-celebrity; they wouldn't be required to do that for a 2-year-old murder conviction.
If there's a complaint,
Do you have to provide proof that your site doesn't specifically target its services at individuals in the EU?
Do you have to provide proof that your site doesn't specifically target its services at individuals in the EU?
niko001 / Niklaus or whatever. This is extremely shady. You've copy pasted your whole terms and conditions from this page :
https://buffer.com/terms VS: https://gdpr-shield.io/terms - Saved here https://web.archive.org/web/20180504020320/https://gdpr-shie... for good measure
Which is illegal to begin with. You even forgot to replace the part that explains what the service does and left the part that says that gdpr shield "provides a social media management tool".
You're selling something that just basically does a geoip lookup, and then tries to block people from an entire continent, with pure JS, which can be easily avoided, by the way. I'm shooting buffer an email to let them know you're infringing on their legal material.
https://buffer.com/terms VS: https://gdpr-shield.io/terms - Saved here https://web.archive.org/web/20180504020320/https://gdpr-shie... for good measure
Which is illegal to begin with. You even forgot to replace the part that explains what the service does and left the part that says that gdpr shield "provides a social media management tool".
You're selling something that just basically does a geoip lookup, and then tries to block people from an entire continent, with pure JS, which can be easily avoided, by the way. I'm shooting buffer an email to let them know you're infringing on their legal material.
So you're saying that a service which targets businesses who are trying to avoid a piece of legislation that is shaping up to become a worldwide industry standard turns out to be shady and doesn't respect the law? Well I never.
Copying legal documents isn't illegal, and in fact many lawyers will just run a search & replace on an existing client's T&C to generate a new T&C. This is also how T&C generator websites work. It's actually recommended, as then you have standardized language that is all well-defined in the eyes of the courts.
You are going to have to do a better job of backing that claim up. It certainly seems to be an obvious breach of intellectual property law at the very least. Citing that some lawyers do this does not automatically make it legal.
My initial claim is perhaps a bit too strong. Case law is basically that the unique portions of a T&C or other contract are protected by copyright law, but boilerplate terms that have appeared in lots of different firms' documents are considered public domain.
http://pub.bna.com/ptcj/1051462Jan11.pdf
GDPR-shield's original T&C was actually copied from ShareKit, which is another product from the same company:
https://www.sharekit.io/terms
But going paragraph by paragraph down the terms, you get this list of companies, all with the same language:
https://www.google.com/search?q=%22Except+for+certain+kinds+...
https://www.google.com/search?q=%22You+must+be+at+least+%5B1...
https://www.google.com/search?q=%22To+access+most+features+o...
https://www.google.com/search?q=%22The+Service+will+require+...
https://www.google.com/search?q=%22may+seek+pre-authorizatio...
https://www.google.com/search?q=%22The+Service+may+include+a...
https://www.google.com/search?q=%22may%20suspend%20or%20term...
That's only through section 4, but so far every clause is legal boilerplate except for the first paragraph of section 4, which is unique to ShareKit (and ThreadRadar, another product by the same entrepreneur).
http://pub.bna.com/ptcj/1051462Jan11.pdf
GDPR-shield's original T&C was actually copied from ShareKit, which is another product from the same company:
https://www.sharekit.io/terms
But going paragraph by paragraph down the terms, you get this list of companies, all with the same language:
https://www.google.com/search?q=%22Except+for+certain+kinds+...
https://www.google.com/search?q=%22You+must+be+at+least+%5B1...
https://www.google.com/search?q=%22To+access+most+features+o...
https://www.google.com/search?q=%22The+Service+will+require+...
https://www.google.com/search?q=%22may+seek+pre-authorizatio...
https://www.google.com/search?q=%22The+Service+may+include+a...
https://www.google.com/search?q=%22may%20suspend%20or%20term...
That's only through section 4, but so far every clause is legal boilerplate except for the first paragraph of section 4, which is unique to ShareKit (and ThreadRadar, another product by the same entrepreneur).
The privacy of EU persons coming in from a non-EU IP address still need to be protected under GDPR. This solution is a start but it's not bulletproof.
Edit: I don't want anyone to think I believe it's a good start but it is a kind of solution. I wonder if lots of US companies, once they begin to realize GDPR is a problem for them, won't decide to try one of two things:
1. This: block access from IP addresses believed to belong in Europe.
2. Lobby Congress for a law (or a quick Executive Order) saying that US companies don't have to comply with GDPR.
A few weeks ago on Twitter [1], I speculated about #2. It was too early, I guess. Few people in USA seem to be aware of GDPR at the present time. That'll change in a couple of weeks.
[1] https://twitter.com/CnAdoctor/status/978849723808301057
Edit: I don't want anyone to think I believe it's a good start but it is a kind of solution. I wonder if lots of US companies, once they begin to realize GDPR is a problem for them, won't decide to try one of two things:
1. This: block access from IP addresses believed to belong in Europe.
2. Lobby Congress for a law (or a quick Executive Order) saying that US companies don't have to comply with GDPR.
A few weeks ago on Twitter [1], I speculated about #2. It was too early, I guess. Few people in USA seem to be aware of GDPR at the present time. That'll change in a couple of weeks.
[1] https://twitter.com/CnAdoctor/status/978849723808301057
When you make a reasonable effort to block access to EU users, EU citizens aren't covered under GDPR if they happen to access your site from a non-EU country temporarily:
"This won't apply to every U.S. business — just the ones that are knowingly, and actively, conducting business in the EU. In this vein, EU courts have the discretionary ability to determine if a U.S. company was purposely collecting EU resident data and subverting GDPR compliance. So, in some cases, the inadvertent collection of personal data will be forgiven if it is found to have been occasional and "unlikely to result in a risk to the rights and freedoms of natural persons."
(from https://community.spiceworks.com/topic/2007530-how-the-eu-ca... )
"This won't apply to every U.S. business — just the ones that are knowingly, and actively, conducting business in the EU. In this vein, EU courts have the discretionary ability to determine if a U.S. company was purposely collecting EU resident data and subverting GDPR compliance. So, in some cases, the inadvertent collection of personal data will be forgiven if it is found to have been occasional and "unlikely to result in a risk to the rights and freedoms of natural persons."
(from https://community.spiceworks.com/topic/2007530-how-the-eu-ca... )
That is an interpretation of the law and is not in accord with what the ICO (the regulator) is saying. If you have a site called "UK Expats" and you block EU IPs you will still be liable since your site is offering a service to EU citizens.
A less extreme use case but equally applicable, you have a shoe store in the US and your style is liked by french citizens living in the US, since a considerable amount of traffic is coming from EU citizens you are under GDPR. even if it is only 20%, even if they are in the US, even if you blocked all European IPs
The easy way to deal with EU persons coming from non-EU IP addresses is to mention in your terms of service that EU users are prohibited from using your website. Then if they use a VPN or otherwise access your website, they will be in violation of the CFAA https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
Why doesnt EU instead implement a continent wide firewall and allow access to only GDPR compliant sites
[deleted]
Yes. VPNs are definitely an issue.
The only foolproof solution is just to block all IP addresses.
The only foolproof solution is just to block all IP addresses.
Or take over Europe.
I'm currently an EU-ish Citizen, not residing in the EU. Will it block me?
Also will it block JS-blocking EU Citizens residing in the EU?
Let's not mention VPNs. Let's not mention Tor.
This feels like a "registry cleaner" for GDPR
o. xkcd: https://xkcd.com/1969/
Also will it block JS-blocking EU Citizens residing in the EU?
Let's not mention VPNs. Let's not mention Tor.
This feels like a "registry cleaner" for GDPR
o. xkcd: https://xkcd.com/1969/
On my (and other's) current read, it only applies when you are resident in the EU. Specifically:
> It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location.
> It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location.
When you make a reasonable effort to block access to EU users, EU citizens aren't covered under GDPR if they happen to access your site from a non-EU country temporarily:
"This won't apply to every U.S. business — just the ones that are knowingly, and actively, conducting business in the EU. In this vein, EU courts have the discretionary ability to determine if a U.S. company was purposely collecting EU resident data and subverting GDPR compliance. So, in some cases, the inadvertent collection of personal data will be forgiven if it is found to have been occasional and "unlikely to result in a risk to the rights and freedoms of natural persons."
(from https://community.spiceworks.com/topic/2007530-how-the-eu-ca... )
"This won't apply to every U.S. business — just the ones that are knowingly, and actively, conducting business in the EU. In this vein, EU courts have the discretionary ability to determine if a U.S. company was purposely collecting EU resident data and subverting GDPR compliance. So, in some cases, the inadvertent collection of personal data will be forgiven if it is found to have been occasional and "unlikely to result in a risk to the rights and freedoms of natural persons."
(from https://community.spiceworks.com/topic/2007530-how-the-eu-ca... )
> This feels like a "registry cleaner" for GDPR
Probably. It seems like a quick "let's make some money" scheme to milk the GDPR panic.
Probably. It seems like a quick "let's make some money" scheme to milk the GDPR panic.
A "GDPR Compliance" service with a 6000 word terms of service including such gems as agreeing to binding arbitration, no class-action lawsuits, and royalty-free use of your logo and name, a privacy policy that allows them to use your personal information to promote "new features and special offers" and runs google analytics...
This is a joke, right? You'd have to be crazy to protect these guys with anything to do with personal information protection and privacy.
This is a joke, right? You'd have to be crazy to protect these guys with anything to do with personal information protection and privacy.
Maybe I'm missing something - but as a US citizen, with a US company, how can EU laws be enforced against me?
What's the legal channel here? Do they plan on arresting me if I decide to vacation to an EU country? Will the US gov't comply with levying fines due to some treaty/agreement between the countries?
What's the legal channel here? Do they plan on arresting me if I decide to vacation to an EU country? Will the US gov't comply with levying fines due to some treaty/agreement between the countries?
International enforcement is a can of worms.
However, a lot of it is covered by:
1- US companies with a physical presence in the EU. They can fine that entity directly.
2- US companies will find they can't sell to EU businesses (B2B), as that means the EU company is carrying the can in terms of non-compliance.
3- The EU Member State could go via the International Courts. Or via some kind of bilateral agreement (e.g. Privacy Shield).
I expect #3 will need to egregious to really make sense.
However, I also expect a significant amount is already hovered up by #1 or #2. Certainly many of the cases that GDPR wants to target.
Additionally, the EU may cut deals with other states to bring in enforcement powers (fines).
However, a lot of it is covered by:
1- US companies with a physical presence in the EU. They can fine that entity directly.
2- US companies will find they can't sell to EU businesses (B2B), as that means the EU company is carrying the can in terms of non-compliance.
3- The EU Member State could go via the International Courts. Or via some kind of bilateral agreement (e.g. Privacy Shield).
I expect #3 will need to egregious to really make sense.
However, I also expect a significant amount is already hovered up by #1 or #2. Certainly many of the cases that GDPR wants to target.
Additionally, the EU may cut deals with other states to bring in enforcement powers (fines).
Seems this is targeted mainly to the likes of uber, google.. small time websites who do not have much volume aren’t the target audience.
[deleted]
At the moment there is no way the EU can enforce you to comply with that law, unless you have a subsidiary in the EU. Only if USA sign a special agreement with the EU this may change, but I don't think this will ever happen (very unlikely). Otherwise every country on planet can create their own draconian laws and expect that every single company in the world comply with it...
this is true, but kinda pointless, you are not gonna fight the EU over this...
Several countries in the EU (UK, Ireland, ...) can assign personal liability for intentionally ignoring privacy law, in which case someone in your company is basically going to end up a wanted man in Europe
> Several countries in the EU (UK, Ireland, ...)
UK is not part of the EU.
> assign personal liability
Citation needed? If CEO decides to ignore privacy law, everyone else is accountable?
UK is not part of the EU.
> assign personal liability
Citation needed? If CEO decides to ignore privacy law, everyone else is accountable?
The most likely solution is the same way the US enforces US laws (e.g. Megaupload case) in other countries: Seizing their assets (through cooperation with banks) and then asking for extradition.
Frightening to think something as innoculus as making a website of chocolate chip recipes and logging visitor IPs could provoke that.
Your chocolate chip recipe website will have to be compliant to a number of laws, GDPR isn't the only law in the internet.
It wouldn't, that's just pure FUD.
Tip: don’t log the IPs then.
I spin up a Wordpress site with default options to host my chocolate chip recipes. Is it GDPR compliant?
I go through and toggle all the settings the internet tells me to, even though I don't know their meaning or effect. Am I GDPR compliant?
I install a Wordpress plugin that sets up a Really Simple Chocolate Chip Syndication server, or RSCCS. That plugin logs IPs. If I was GDPR compliant previously, now I'm not, and how would I ever know?
I go through and toggle all the settings the internet tells me to, even though I don't know their meaning or effect. Am I GDPR compliant?
I install a Wordpress plugin that sets up a Really Simple Chocolate Chip Syndication server, or RSCCS. That plugin logs IPs. If I was GDPR compliant previously, now I'm not, and how would I ever know?
If you don't know what you're doing, don't involve others.
Since I don't quite get the point you're making here, I think I should specify that I was playing the role of someone who wants to start up a website on the side but isn't an expert on computers, networking, software development, or international privacy law.
I know plenty of people with a get rich quick scheme to sell widgets, but who don't know the difference between WordPress and Microsoft Word.
Expecting them to know that starting a website with a plug and play webserver could collect sensitive information on their behalf is pushing it a bit. Expecting them to know they have to comply with a law passed by a governing body they've never come within 1k miles of...
I know plenty of people with a get rich quick scheme to sell widgets, but who don't know the difference between WordPress and Microsoft Word.
Expecting them to know that starting a website with a plug and play webserver could collect sensitive information on their behalf is pushing it a bit. Expecting them to know they have to comply with a law passed by a governing body they've never come within 1k miles of...
> I was playing the role of someone who wants to start up a website on the side but isn't an expert on computers, networking, software development, or international privacy law.
If you're not an expert, you have to get one. Same reason why you cannot just go and plan a non-trivial building by yourself when you're not a architect or civil engineer.
If you're not an expert, you have to get one. Same reason why you cannot just go and plan a non-trivial building by yourself when you're not a architect or civil engineer.
> > I was playing the role of someone who wants to start up a website on the side but isn't an expert on computers, networking, software development, or international privacy law.
> If you're not an expert, you have to get one. Same reason why you cannot just go and plan a non-trivial building by yourself when you're not a architect or civil engineer.
This attitude is really sad to me. It was and is one of the greatest things about the internet, that pretty much anyone anywhere could publish something. If you now need an "expert" to do that, we've lost something.
This attitude is really sad to me. It was and is one of the greatest things about the internet, that pretty much anyone anywhere could publish something. If you now need an "expert" to do that, we've lost something.
Unfortunately, copy/pasting a formatted comment on HN doesn't have enough newlines to quote the post properly.
Anywhere you want one newline in your output, you have to use two.
Anywhere you want one newline in your output, you have to use two.
While I agree, if you're an American setting up a plug-and-play site with chocolate chip cookie recipes, that happens to collect data out of the box, where along the process are you going to realize that you even need to know anything about EU regulations?
I've never hired a Wumbologist because I don't know what Wumbology is or where it applies.
I've never hired a Wumbologist because I don't know what Wumbology is or where it applies.
Which is relatively easy when you’ve written the software stack powering the recipe site, or can at least grok its source (if available). It may not A) be clear to the operator of a recipe site that their stack is logging IPs and B) be reasonably straightforward for the owner of a recipe site to stop their software from doing so.
Some things are very deliberate, but others are the consequence of decisions far removed from those of site operators.
Some things are very deliberate, but others are the consequence of decisions far removed from those of site operators.
That's a very unlikely "solution" and is not going to happen unless the EU wants retribution in some form from the rest of the world.
As mentioned, this is the retribution. The US has been enforcing their laws on the rest of the world with equally radical methods for many years already.
I always found this interesting because surely no matter what effort you go through to prevent yourself from providing your service to EU citizens, you're probably going to collect enough information to be subjected to GDPR during the period where you did not remotely know a set of users were EU citizens. (e.g., those residing overseas, traveling, etc)
And then -- what if you finally have confirmation? You were attempting to avoid it, but now you cannot. If your attempt is to avoid it at all costs, you're effectively required to validate whether users are EU citizens much earlier in the process than before GDPR, which means GDPR already has had a big impact despite efforts to avoid its umbrella.
And then -- what if you finally have confirmation? You were attempting to avoid it, but now you cannot. If your attempt is to avoid it at all costs, you're effectively required to validate whether users are EU citizens much earlier in the process than before GDPR, which means GDPR already has had a big impact despite efforts to avoid its umbrella.
Despite the propaganda flying around HN for known political purposes, they can't and won't arrest you because there is no jurisdiction unless you have operations in the EU.
I have this eerie suspicion that GDPR cases will be a haven for trollish and/or opportunist behavior. Instead of huge corporations having to shell out significant money to swallow up start-up competitors, they could much more cheaply pay EU citizens to exploit the huge burden of the law on small companies or even solo endeavors. I hope I can be convinced to be optimistic.
Yes, government regulation is unquestionably more of a burden to companies without legal teams. If you’re smaller it’s an eternal calculus of flying under the radar and trying not to be the bug that gets the windscreen.
> I hope I can be convinced to be optimistic.
I'm kinda hoping my pessimism becomes justified. At that point, I can then only hope that an epiphany is reached and other approaches used without resorting to large sweeping legislation (which, among many other things could include more timid and actually enforced legislation at first). However, regardless of which side of the Atlantic I look on, it seems legislators only double down when their desired effect is not achieved. They only know one direction.
I'm kinda hoping my pessimism becomes justified. At that point, I can then only hope that an epiphany is reached and other approaches used without resorting to large sweeping legislation (which, among many other things could include more timid and actually enforced legislation at first). However, regardless of which side of the Atlantic I look on, it seems legislators only double down when their desired effect is not achieved. They only know one direction.
Yes I remember reading about this thought here: https://wtfuh.com/2018-04-09/gdpr-has-a-few-problems/
[deleted]
From GDPR-shield's terms and conditions (https://gdpr-shield.io/terms):
1. GDPR Shield Service Overview
The Service provides a social media management tool that enables users to customize the link preview window of websites under their control on social platforms, in addition to other analytics tools to help bolster users' social media content.
...what? Is this a botched copy/paste job?
1. GDPR Shield Service Overview
The Service provides a social media management tool that enables users to customize the link preview window of websites under their control on social platforms, in addition to other analytics tools to help bolster users' social media content.
...what? Is this a botched copy/paste job?
Yep, it's copy pasted from https://buffer.com/terms
He's running a really shady business.
He's running a really shady business.
Put your site behind CloudFront, block EU countries. There, we've solved the problem without a shady SaaS.
Edit: which wasn't even a problem to start with but if this is the route you want to go, the above is nearly fool proof and costs next to nothing.
Edit: which wasn't even a problem to start with but if this is the route you want to go, the above is nearly fool proof and costs next to nothing.
There are many ways to achieve this goal, I just wanted to provide a drop-in solution that's independent of the underlying infrastructure.
I can't tell if this is a joke or not.
Don't pay "thousands" for GPDR compliance work which will improve your product by providing basic privacy and security features.
Instead pay up to $79 a month for a service to block a large percentage of your traffic.
Don't pay "thousands" for GPDR compliance work which will improve your product by providing basic privacy and security features.
Instead pay up to $79 a month for a service to block a large percentage of your traffic.
Not a joke :). The pricing is actually cheaper than "bare" geolocation APIs, which don't do the blocking-part. Have a look at https://ipstack.com/product for example.
If you get a quote from an experienced data protection lawyer for GDPR compliance, this will be an order of magnitude cheaper in the long run. There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to collect fees for small mistakes in your privacy policy.
If you get a quote from an experienced data protection lawyer for GDPR compliance, this will be an order of magnitude cheaper in the long run. There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to collect fees for small mistakes in your privacy policy.
> There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to collect fees for small mistakes in your privacy policy
No there isn't.
When the GPDR fines are 2% of revenue there isn't the incentive for lawyers to go after businesses earning less than a million a year in revenue.
No there isn't.
When the GPDR fines are 2% of revenue there isn't the incentive for lawyers to go after businesses earning less than a million a year in revenue.
or 10m euro, whichever is higher
You're mixing up the member states' enforcement (4% of worldwide turnover or €20 million, whichever is higher) and civil suits. There are law firms that send out thousands of cease and desist letters (which is a civil action) based on automated searches for mistakes. It absolutely makes economic sense for lawyers to pursue out-of-court settlements from businesses if it's mostly automated.
This is just nonsense. I don't see how the GDPR possibly allows civil actions for infractions, doubly so for countries outside the EU.
I’m wondering the same, the submitter of the link is definitely having some fun with the title.
I can't tell if this is a fake service or not, but blocking users from EU IP address ranges (which I'm assuming how it works) will still not stop the EU from following a trail of data that could originate from your organization.
That's the biggest thing from the EU's GDPR rules - what is your organization's data inventory, how does it map outside of your organization, and how are you securing PII?
If a complaint is made from someone who is an EU citizen, and another organization shows logs that they got this information from your web app or service, that will trigger an audit from the EU. Blocking access to a subset of IP ranges will do absolutely nothing to stop this, and will not stop the sharks once they have smelled blood.
In a sense, the EU has plain rules that you can protect against, unlike the FTC/FDA (for HIPPA etc) who are vague and will not disclose how you can protect your own organization.
That's the biggest thing from the EU's GDPR rules - what is your organization's data inventory, how does it map outside of your organization, and how are you securing PII?
If a complaint is made from someone who is an EU citizen, and another organization shows logs that they got this information from your web app or service, that will trigger an audit from the EU. Blocking access to a subset of IP ranges will do absolutely nothing to stop this, and will not stop the sharks once they have smelled blood.
In a sense, the EU has plain rules that you can protect against, unlike the FTC/FDA (for HIPPA etc) who are vague and will not disclose how you can protect your own organization.
Disclaimer: This is not legal advice.
Blocking EU visitors by IP doesn’t eliminate the need to comply with GDPR, because GDPR jurisdiction isn’t based on where the service thinks think the user is (whether from IP geocoding or another source).
If an EU resident is using a VPN, or using an IP that incorrectly geocodes to a non-EU country, or behind a private corporate network and NAT that egresses traffic in a non-EU country, GDPR still applies. Any site with more than trivial traffic will have some users with those characteristics.
Experts debate whether explicitly requiring users to confirm that they aren’t in the EU - say, a country dropdown - is even a solution. If an EU resident visitor lies, they may well still be protected by GDPR (and the EU is large enough for enforcement to matter even if a site doesn't have an EU presence).
Blocking EU visitors by IP doesn’t eliminate the need to comply with GDPR, because GDPR jurisdiction isn’t based on where the service thinks think the user is (whether from IP geocoding or another source).
If an EU resident is using a VPN, or using an IP that incorrectly geocodes to a non-EU country, or behind a private corporate network and NAT that egresses traffic in a non-EU country, GDPR still applies. Any site with more than trivial traffic will have some users with those characteristics.
Experts debate whether explicitly requiring users to confirm that they aren’t in the EU - say, a country dropdown - is even a solution. If an EU resident visitor lies, they may well still be protected by GDPR (and the EU is large enough for enforcement to matter even if a site doesn't have an EU presence).
> If an EU resident visitor lies, they may well still be protected by GDPR (and the EU is large enough for enforcement to matter even if a site doesn't have an EU presence).
What's your basis for this statement? If it's true, then literally everyone in the world is covered by the GDPR, because they might be from the EU and lying. That seems (a) absurd--you think an American court is going to enforce a judgment against an American company that accidentally violated the GDPR because an EU resident lied to it?--and (b) inconsistent with the statements of Facebook et al. that they will comply with the GDPR only for those subject to it.
What's your basis for this statement? If it's true, then literally everyone in the world is covered by the GDPR, because they might be from the EU and lying. That seems (a) absurd--you think an American court is going to enforce a judgment against an American company that accidentally violated the GDPR because an EU resident lied to it?--and (b) inconsistent with the statements of Facebook et al. that they will comply with the GDPR only for those subject to it.
> What's your basis for this statement?
Lying does not necessarily waive rights. E.g. purgery does not waive 5th amendment rights. Hence "may well still". If you know this _not_ to be case here, do share.
> If it's true, then literally everyone in the world is covered by the GDPR
You mean GDPR is a massive overreach where one organization is trying to regulate effectively the entire internet? Yeah, that about sums it up.
Lying does not necessarily waive rights. E.g. purgery does not waive 5th amendment rights. Hence "may well still". If you know this _not_ to be case here, do share.
> If it's true, then literally everyone in the world is covered by the GDPR
You mean GDPR is a massive overreach where one organization is trying to regulate effectively the entire internet? Yeah, that about sums it up.
In a certain sense, no one can know any law until the judge rules; but it seems there are people who believe:
1. To within some threshold of certainty, it is not yet possible to determine whether blocking EU visitors by IP, asking the remainder if they are subject to the GDPR, and blocking them if they say yes complies.
2. To within that same threshold, I can determine that some other plan (e.g., whatever troydavis is implementing) complies.
For anyone who thinks both of these can be true: Are you sure that you're basing those statements on the law? Or do you mean that the regulators will view (1) unfavorably and go after you, but they'll treat (2) as a good-faith effort and be nice?
The latter is probably true, but it's not the rule of law. Are you okay with that? How sure are you that all those regulators (and courts) will always behave in the way that you predict, or a way that you personally consider right?
I am disturbed by how willing most commenters are here to abandon the rule of law when it gets them something they want. Selective enforcement of regulations on business is a routine tactic of unfree states--remember the guy with the leopard-print fabric in Russia? I don't think it's a good idea to create powerful new tools for that, just because Europe--a continent that within living memory harbored some of the worst dictators of modern history--is well-governed right now.
1. To within some threshold of certainty, it is not yet possible to determine whether blocking EU visitors by IP, asking the remainder if they are subject to the GDPR, and blocking them if they say yes complies.
2. To within that same threshold, I can determine that some other plan (e.g., whatever troydavis is implementing) complies.
For anyone who thinks both of these can be true: Are you sure that you're basing those statements on the law? Or do you mean that the regulators will view (1) unfavorably and go after you, but they'll treat (2) as a good-faith effort and be nice?
The latter is probably true, but it's not the rule of law. Are you okay with that? How sure are you that all those regulators (and courts) will always behave in the way that you predict, or a way that you personally consider right?
I am disturbed by how willing most commenters are here to abandon the rule of law when it gets them something they want. Selective enforcement of regulations on business is a routine tactic of unfree states--remember the guy with the leopard-print fabric in Russia? I don't think it's a good idea to create powerful new tools for that, just because Europe--a continent that within living memory harbored some of the worst dictators of modern history--is well-governed right now.
Disclaimer: This is not legal advice.
Good question. An American court won’t enforce it, but any decent-sized entity is, for all practical purposes, subject to decisions by ECJ (and potentially by individual EU countries).
If an EU resident case is brought to ECJ, they’ll almost certainly have jurisdiction, so the question is what ECJ would rule. I wouldn’t bet my compliance strategy on the ECJ deciding that an EU resident opted out of GDPR by misstating their residency (intentionally or not). One can reasonably assume that ECJ would see requiring users to explicitly state their location as a mitigating factor, but not that it would eliminate the need to comply, nor the opportunity for EU litigation claiming the same.
Again, this is not legal advice, but I’ve actually read the GDPR and and been part of a large company working through how to comply with it.
Good question. An American court won’t enforce it, but any decent-sized entity is, for all practical purposes, subject to decisions by ECJ (and potentially by individual EU countries).
If an EU resident case is brought to ECJ, they’ll almost certainly have jurisdiction, so the question is what ECJ would rule. I wouldn’t bet my compliance strategy on the ECJ deciding that an EU resident opted out of GDPR by misstating their residency (intentionally or not). One can reasonably assume that ECJ would see requiring users to explicitly state their location as a mitigating factor, but not that it would eliminate the need to comply, nor the opportunity for EU litigation claiming the same.
Again, this is not legal advice, but I’ve actually read the GDPR and and been part of a large company working through how to comply with it.
How do you expect that the ECJ or individual EU countries would enforce their ruling against our hypothetical American company without the use of the American courts? I presume that if they're blocking the EU, then they have no revenue or assets there.
And how do you reconcile this with Facebook's public statement that they won't comply for those not covered? They obviously make money doing stuff that the GDPR prohibits; but they're target #1 and they even have EU presence, much more exposed than our hypothetical.
And how do you reconcile this with Facebook's public statement that they won't comply for those not covered? They obviously make money doing stuff that the GDPR prohibits; but they're target #1 and they even have EU presence, much more exposed than our hypothetical.
Disclaimer: This is not legal advice.
Yes, the lack of assets and revenue would make it difficult to collect. Exposure could include a staff member wanting to visit an EU country, the company trying to hire an EU-based remote contractor, or trying to get credit in the US.
That said, the reasoning is simpler: even if there's literally zero interaction with or exposure to the EU, by the time a complaint gets to litigation, the company's approach to GDPR has already failed. erely being party to a case in any court (let alone losing one) isn't a trivial matter -- it means at least consulting an attorney and thinking through the implications (like perhaps not being able to obtain an EU visa). A GDPR strategy which gets to that point, and relies on the inability to collect a judgment, has failed.
Facebook - really, FANG and a handful of other name-brand, global, consumer-facing companies - differ from most businesses in 2 ways:
1. They expect litigation, complaints, and article 17 erasure requests. There's no way to avoid it, just plan around it and minimize the impact. Their goal isn't no impact, it's no catastrophic impact.
2. They have teams of attorneys analyzing the risk and benefit of every decision. If they've decided (not) to do something, it's because they've accepted that the risks are worth the benefits, not necessarily because they think it's risk-free. Even most mid-market businesses don't have that luxury.
Note also that my original comment said that experts debate whether user-submitted location is sufficient. I explicitly didn't and don't claim that there's any certainty. There's no case law at all right now, so anyone who claims certainty about edge cases is making stuff up.
What is close to certain is that IP-based geocoding (ie, what this vendor provides) doesn't eliminate anywhere near all visitors from the EU, and thus doesn't eliminate the need to consider GDPR. Perhaps they decide to also add a user-submitted location dropdown to their signup form and accept the risks I just described, or decide to do nothing else and accept the risk of litigation from EU visitors who the geocoding doesn't identify. My core point is that the geocoding service pitches "Just block EU IPs and you're done," and that's not the case at all.
I think we're past the point where HN comments are adding value, so this will be my last comment in this thread.
Yes, the lack of assets and revenue would make it difficult to collect. Exposure could include a staff member wanting to visit an EU country, the company trying to hire an EU-based remote contractor, or trying to get credit in the US.
That said, the reasoning is simpler: even if there's literally zero interaction with or exposure to the EU, by the time a complaint gets to litigation, the company's approach to GDPR has already failed. erely being party to a case in any court (let alone losing one) isn't a trivial matter -- it means at least consulting an attorney and thinking through the implications (like perhaps not being able to obtain an EU visa). A GDPR strategy which gets to that point, and relies on the inability to collect a judgment, has failed.
Facebook - really, FANG and a handful of other name-brand, global, consumer-facing companies - differ from most businesses in 2 ways:
1. They expect litigation, complaints, and article 17 erasure requests. There's no way to avoid it, just plan around it and minimize the impact. Their goal isn't no impact, it's no catastrophic impact.
2. They have teams of attorneys analyzing the risk and benefit of every decision. If they've decided (not) to do something, it's because they've accepted that the risks are worth the benefits, not necessarily because they think it's risk-free. Even most mid-market businesses don't have that luxury.
Note also that my original comment said that experts debate whether user-submitted location is sufficient. I explicitly didn't and don't claim that there's any certainty. There's no case law at all right now, so anyone who claims certainty about edge cases is making stuff up.
What is close to certain is that IP-based geocoding (ie, what this vendor provides) doesn't eliminate anywhere near all visitors from the EU, and thus doesn't eliminate the need to consider GDPR. Perhaps they decide to also add a user-submitted location dropdown to their signup form and accept the risks I just described, or decide to do nothing else and accept the risk of litigation from EU visitors who the geocoding doesn't identify. My core point is that the geocoding service pitches "Just block EU IPs and you're done," and that's not the case at all.
I think we're past the point where HN comments are adding value, so this will be my last comment in this thread.
I don't mean to endorse any strategy of blocking the EU, and I certainly don't mean to endorse the advertised service. I do think you overestimate the importance of the EU to many Americans' views and lives.
The Americans that you interact with--here or otherwise--are a disproportionately cosmopolitan sample, simply by the fact that they're talking to you. A lot of people in this country have no desire to do business in the EU. They have no desire to visit. Any regulatory action against them would reconfirm all their worst thoughts about "foreigners", and otherwise not change their lives. If they read what you wrote above, then they'd take away nothing, beyond maybe that your legal system is so terrible that no one knows what the laws are.
And really, does this kind of extraterritoriality feel like a good idea to you? Roughly two hundred countries exist. Can you imagine a world where each of them tried to enforce rules of similar complexity to the GDPR against every human alive (because remember, I might be a lying North Korean)? Would you comply with every country's rules? Or would you decide what set of countries mattered to you, and write the rest off as enemy territory? I'm pretty sure the answer is the latter. I expect that many Americans will do the same here, and that their set will not include the EU.
I agree with the high-level goals of the GDPR, and with increased privacy regulation in general. I'm disturbed to see how quickly people will take the position that "every website is subject to the laws of every country" when it serves an end goal they agree with. Do you think the UK could export its super-injunctions (court orders enforcing censorship) by the same mechanism? If not, on what legal basis?
I understand that you don't intend to comment further. I'm interested to discuss with anyone who thinks this kind of extraterritoriality is a good idea, and to understand what countries and what laws you think this should extend to.
The Americans that you interact with--here or otherwise--are a disproportionately cosmopolitan sample, simply by the fact that they're talking to you. A lot of people in this country have no desire to do business in the EU. They have no desire to visit. Any regulatory action against them would reconfirm all their worst thoughts about "foreigners", and otherwise not change their lives. If they read what you wrote above, then they'd take away nothing, beyond maybe that your legal system is so terrible that no one knows what the laws are.
And really, does this kind of extraterritoriality feel like a good idea to you? Roughly two hundred countries exist. Can you imagine a world where each of them tried to enforce rules of similar complexity to the GDPR against every human alive (because remember, I might be a lying North Korean)? Would you comply with every country's rules? Or would you decide what set of countries mattered to you, and write the rest off as enemy territory? I'm pretty sure the answer is the latter. I expect that many Americans will do the same here, and that their set will not include the EU.
I agree with the high-level goals of the GDPR, and with increased privacy regulation in general. I'm disturbed to see how quickly people will take the position that "every website is subject to the laws of every country" when it serves an end goal they agree with. Do you think the UK could export its super-injunctions (court orders enforcing censorship) by the same mechanism? If not, on what legal basis?
I understand that you don't intend to comment further. I'm interested to discuss with anyone who thinks this kind of extraterritoriality is a good idea, and to understand what countries and what laws you think this should extend to.
The more I look into this, the shadier it seems.
They're selling at a whooping $79/month, a single php script that does not even check any sort of authentication or API key, and only does a dumb lookup against a GeoIP database : https://gdpr-shield.io/check.php
And this is called by this tiny javascript script https://code.gdpr-shield.io/script.js that just.. displays an overlay div when you're in the EU. Smells like scam when you're willing to sell a whole product that can be coded in 20 minutes for up to $1000 a year.
They're selling at a whooping $79/month, a single php script that does not even check any sort of authentication or API key, and only does a dumb lookup against a GeoIP database : https://gdpr-shield.io/check.php
And this is called by this tiny javascript script https://code.gdpr-shield.io/script.js that just.. displays an overlay div when you're in the EU. Smells like scam when you're willing to sell a whole product that can be coded in 20 minutes for up to $1000 a year.
The pricing is actually cheaper than "bare" geolocation APIs, which don't do the blocking-part. Have a look at https://ipstack.com/product for example.
If you get a quote from an experienced data protection lawyer for GDPR compliance, GDPR Shield will be an order of magnitude cheaper in the long run. There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to collect fees for small mistakes in your privacy policy.
You're making assumptions about how the service works, which happen to be wrong. Even if they were true, the time it takes to develop something isn't a measure of the value it provides.
If you get a quote from an experienced data protection lawyer for GDPR compliance, GDPR Shield will be an order of magnitude cheaper in the long run. There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to collect fees for small mistakes in your privacy policy.
You're making assumptions about how the service works, which happen to be wrong. Even if they were true, the time it takes to develop something isn't a measure of the value it provides.
>There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to collect fees for small mistakes in your privacy policy.
What do you base that assesment on? GDPR mostly just consolidates multiple privacy laws into one.
What do you base that assesment on? GDPR mostly just consolidates multiple privacy laws into one.
> There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to collect fees for small mistakes in your privacy policy
I get that you're trying to sell your 'service', but that's just pure FUD.
What exactly could 'predatory law firms' sue you for? Not complying with the letter of the GDPR? The GDPR is for EU authorities to take action where deemed necessary - not law firms.
I get that you're trying to sell your 'service', but that's just pure FUD.
What exactly could 'predatory law firms' sue you for? Not complying with the letter of the GDPR? The GDPR is for EU authorities to take action where deemed necessary - not law firms.
"The European Union's new GDPR (General Data Protection Regulation), which takes effect on 25th May 2018, creates uncertainty and risk for website owners. It applies to businesses world-wide, because it protects all users accessing your site from the EU, regardless of where your business is located. GDPR threatens website owners with fines of 4% of turnover or €20 million (whichever is higher). If you don't have an in-house legal team, complying with the law requires you to consult with a lawyer specializing in data protection law. In addition, you're at risk of vindictive reporting from no-win-no-fee legal firms."
Total, unmitigated FUD.
Total, unmitigated FUD.
Thought this was a joke SaaS offering, but inputting google.com as the domain and a burner card, it's real [0].
[0] https://judge.sh/3Bc2E0GR.png
[0] https://judge.sh/3Bc2E0GR.png
-
'a' and 'm' are assigned to in the body of the function. Having them as arguments that aren't provided (and thus initially set to undefined) just ensures that they can be assigned to without 'var', saving a character or two.
JavaScript doesn't break if you don't supply all arguments in a function call.
[deleted]
Anyone can expand on what "vindictive reporting from no-win-no-fee legal firms" would exactly consist of?
If an EU citizen believes that their personally identifiable information was obtained without their consent, the EU GDPR allows firms to do an audit on the company. The citizen who filed the complaint would enlist help from a no-win-no-fee legal firm, meaning, if they don't win (with infractions being $10 million minimum), the citizen, who is now a client of the firm, would not be out any money. If they do win, most likely the firm would make a windfall after carving out their share of the proceeds.
Wait! I was under the impression that fines due to GDPR are just that, fines. They are paid to the government, not individuals. At most, getting fined due to non-compliance can suggest that if individuals bring civil lawsuits against the company, they may win and be awarded damages, the amount of which depends on how much damages they can prove they have incurred as a result of misuse of their data, not statutory amounts. Is that not the case? Is the fine actually paid to the individuals?
Or are your suggesting that some patriotic legal firms would do all the legwork for free so that the government treasury would get a boost?
Or are your suggesting that some patriotic legal firms would do all the legwork for free so that the government treasury would get a boost?
Yes, your understanding is completely correct. Only EU member states can levy fines under the GDPR, and it's likely few will have any interest in trying to fine small businesses. Lawsuits are possible, but only for damages, and good luck showing any damages from a minor technical violation by a small SaaS tool. And without any prospect of large damages from a deep-pocketed defendant, good luck finding a law firm willing to work on contingency.
The whole thing is FUD, although mad props to the people behind the linked service for making a play at profiting from it.
The whole thing is FUD, although mad props to the people behind the linked service for making a play at profiting from it.
I don't have a lot of actual information on this, but the buzz in my privacy professional listservs is that EU courts have been VERY expansive about what constitutes "damage" in related legal spheres, and that those of us coming from a US legal background should not rely on our instincts about what kinds of damage could actually create a cause of action worth suing over.
No. EU courts tend to define damage conservatively, and people suing for damage normally have to demonstrate actual financial losses.
But it's irrelevant here, because the law isn't based on damages.
But it's irrelevant here, because the law isn't based on damages.
Cease and desist letters from predatory law firms are a very real thing, even in Europe. In Germany, entire law firms have been established for the sole purpose of collecting out-of-court settlement fees for small mistakes in websites' legal notices, which they find using automated searches: http://transblawg.eu/2003/10/13/u-s-comment-on-impressumgerm...
GDPR will give them new ammunition on a European scale.
GDPR will give them new ammunition on a European scale.
No, some firm will ask you to pay $100,000 as private settlement because you make a mistake, or else they'll will have to seek remedy by filing a complaint on the EU courts, potentially costing you around 10M
But unlike copyright trolls, the law firm in question can't guarantee that paying the protection money will actually protect you from being reported, so there isn't the same incentive to pay. A protection racket only works if the mafia monopolizes the threat, otherwise any random thug could destroy their business.
> with infractions being $10 million minimum
Stop talking nonsense. It is up to $10 million or 2% of revenue.
https://www.gdpreu.org/compliance/fines-and-penalties/
And so for most websites the fine would be significantly smaller than what lawyers typically earn to litigate.
Hence your entire "no win no fee" premise falls completely apart.
Stop talking nonsense. It is up to $10 million or 2% of revenue.
https://www.gdpreu.org/compliance/fines-and-penalties/
And so for most websites the fine would be significantly smaller than what lawyers typically earn to litigate.
Hence your entire "no win no fee" premise falls completely apart.
Both amounts are lower bounds. "No win no fee" falls apart because the lawyers don't get a fee for a fine collected by the government, not because the fine is too small.
> with infractions being $10 million minimum)
FFS, this is a maximum, not minimum.
FFS, this is a maximum, not minimum.
Fines are up to $10 million or 2%, but it can go up to $20 million or 4% of annual global revenue, whichever is higher. That percent, whichever is higher is the key. Facebook's 2017 revenue was ~40.7 Billion. Four percent of that amount isis ~1.6 billion
You said 2 things:
> if they don't win (with infractions being $10 million minimum
But all of the numbers you give are the maximum possible fines. The actual fines imposed by the regulators will always bee smaller than that.
You also said:
> The citizen who filed the complaint would enlist help from a no-win-no-fee legal firm,
That's not how the fines work. They're fines, paid to the regulator. They're not compensation paid to the victim. There's no payout for no-win-no-fee solicitors, and so they're not going to get involved.
> if they don't win (with infractions being $10 million minimum
But all of the numbers you give are the maximum possible fines. The actual fines imposed by the regulators will always bee smaller than that.
You also said:
> The citizen who filed the complaint would enlist help from a no-win-no-fee legal firm,
That's not how the fines work. They're fines, paid to the regulator. They're not compensation paid to the victim. There's no payout for no-win-no-fee solicitors, and so they're not going to get involved.
Law firms who proactively investigate infringing companies, then sell their service to citizens willing to sue. As an incentive for the potential customer, they agree to only charge if they win.
That's not how GDPR is enforced.
It's enforced by a regulator. The fines are fines, not compensation, and the fines go to the regulator.
There's no route for a private citizen to hire a lawyer and sue.
It's enforced by a regulator. The fines are fines, not compensation, and the fines go to the regulator.
There's no route for a private citizen to hire a lawyer and sue.
I wonder if you can do something like this directly in Cloudflare.
you could use cloudflare IP geolocation to block EU countries based on the Cf-Ipcountry header they provide. Though just by checking their IP I think you may need to comply with gdpr
Is just checking IP with no other personal information a violation of GDPR? Particularly if that IP is not retained in a database (just temporarily in production logs)? Asking for a friend...
If you don't keep it around and only use it to block traffic then I don't see which parts of the GDPR would cause any problem.
IPs may be personal data but if you don't store it there is no problem.
IPs may be personal data but if you don't store it there is no problem.
Not really sure as well but from https://www.gdpreu.org/the-regulation/key-concepts/personal-... personal data seems to include "online identifiers", further defines online identifiers as "Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifier"
[deleted]
Another site going with the light grey on white text theme. What happened to the accessibility binge everyone was on a few years back :(
I think this is actually good for privacy. We will know that companies using this service don't care about privacy, even for non-european users.
We could then can design a tool detecting the use of this service and notifying the user "this service doesn't care about your personal data".
We could then can design a tool detecting the use of this service and notifying the user "this service doesn't care about your personal data".
"God Damn Protection Racket"
[deleted]
This appears to be Javscript based... Assuming then that it works on the client side, I wonder how long it will take for someone to release a browser plugin to bypass it.
That's of course possible, but shouldn't matter: When you make a reasonable effort to block access to EU users, EU citizens aren't covered under GDPR if they take active measures (through a browser plugin, for example) to circumvent the ban:
"This won't apply to every U.S. business — just the ones that are knowingly, and actively, conducting business in the EU. In this vein, EU courts have the discretionary ability to determine if a U.S. company was purposely collecting EU resident data and subverting GDPR compliance. So, in some cases, the inadvertent collection of personal data will be forgiven if it is found to have been occasional and "unlikely to result in a risk to the rights and freedoms of natural persons."
(from https://community.spiceworks.com/topic/2007530-how-the-eu-ca... )
(from https://community.spiceworks.com/topic/2007530-how-the-eu-ca... )
[deleted]
Argh. Just sent a note to a game company I did some work for that they need to be aware of this.
Might have to shut off access to the game for the EU.
Dammit.
Might have to shut off access to the game for the EU.
Dammit.
Are European TOR users protected under GDPR? What about VPN users? Seems like IP-based services might be tricky.
Is there some example page I can look at to see if this even works?
You spelled "avoidance" wrong...
lol
fqdn registered on 2018-04-24?
gmafb
here:
Domain Name: GDPR-SHIELD.IO Registry Domain ID: D503300000096633167-LRMS Registrar WHOIS Server: Registrar URL: https://www.gandi.net/whois Updated Date: 2018-04-24T15:25:22Z Creation Date: 2018-04-24T15:25:19Z Registry Expiry Date: 2019-04-24T15:25:19Z Registrar Registration Expiration Date: Registrar: Gandi SAS Registrar IANA ID: 81 Registrar Abuse Contact Email: [email protected] Registrar Abuse Contact Phone: +33.170377661 Reseller: Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited Registrant Name: Nikolaus Fischer Registrant Organization: InnoWire UG (haftungsbeschrankt) Name Server: NS-86-B.GANDI.NET Name Server: NS-78-C.GANDI.NET Name Server: NS-61-A.GANDI.NET DNSSEC: unsigned URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/ >>> Last update of WHOIS database: 2018-05-04T01:38:30Z <<<
For more information on Whois status codes, please visit https://icann.org/epp
×××@@@@xxx The value for the Created field will show domain age. No serious offering was erected 1 month before open season begins. lmao.
Domain Name: GDPR-SHIELD.IO Registry Domain ID: D503300000096633167-LRMS Registrar WHOIS Server: Registrar URL: https://www.gandi.net/whois Updated Date: 2018-04-24T15:25:22Z Creation Date: 2018-04-24T15:25:19Z Registry Expiry Date: 2019-04-24T15:25:19Z Registrar Registration Expiration Date: Registrar: Gandi SAS Registrar IANA ID: 81 Registrar Abuse Contact Email: [email protected] Registrar Abuse Contact Phone: +33.170377661 Reseller: Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited Registrant Name: Nikolaus Fischer Registrant Organization: InnoWire UG (haftungsbeschrankt) Name Server: NS-86-B.GANDI.NET Name Server: NS-78-C.GANDI.NET Name Server: NS-61-A.GANDI.NET DNSSEC: unsigned URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/ >>> Last update of WHOIS database: 2018-05-04T01:38:30Z <<<
For more information on Whois status codes, please visit https://icann.org/epp
×××@@@@xxx The value for the Created field will show domain age. No serious offering was erected 1 month before open season begins. lmao.
perhaps Nick is giving us a hint with his last name?
See, the problem here is that you actually have to send an HTTP request to the site that's trying to block you, then you load it along with their JavaScript which then blocks you, but at that point the initial request(s) has already been logged and now they have to comply with the GDPR.
I refuse to believe this is not a joke.