Hacker News Reader

Comment by sbov | Hacker News Reader

The comparison is disingenuous. The internet makes anything you build automatically global. You're blasting software engineers for not knowing worldwide regulations. How many New York lawyers know the regulations of France? How many local UK construction companies know the building codes of Japan? None.

Knowing all regulations in the world for any given industry would be a full time job. The people you seem to be implying exist do not exist.

View on HN

> How many local UK construction companies know the building codes of Japan? None.

If those local UK construction companies want to do business in Japan they'll have to know the building codes of Japan.

But seriously, the GDPR standardize the body law for the whole Europe. That makes thing easier for devs.

The comparison doesn't hold up when developers create solutions that in breach with the regulation of the city and country they live in.

> How many New York lawyers know the regulations of France?

New York lawyers who do business in France do.

If you're accepting ~dollars~ euros to place French ads on your pages targeting French customers, seems reasonable to know the relevant French regulations.

It's a bit more strict than that. If I have customers in France, this affects me, no matter how many, no matter if it's one dude in Florida who happens to also be French. The reach is absurd.

Is the reach more absurd than what US court claim?

The worst transgressions of US courts shouldn’t be the standard we aim for.

Fair point!

"no matter if it's one dude in Florida who happens to also be French."

That's not true.

Is he a French citizen? My understanding is that GDPR applies to you (in theory) if you have any EU citizens as customers.

Am I misunderstanding? Why is this incorrect?

Yes, that's incorrect, unless you are an EU business yourself. If not, you are only subject if your customers are in the EU. And more, "the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established" is not enough to show that you're targeting customers in the EU.

https://gdpr-info.eu/recitals/no-23/

Thanks for that reference! Really helpful.

You don’t need to make money off Europeans to be targeted by the GDPR - you just need to have data about Europeans.

That's pretty disingenuous as it seems impossible to "make money off Europeans" without having any data about them.

So, the GDPR is doing you a favour by forcing you to think in advance "who will my users be?". So far web applications were "accidentally" global, now you have to be more careful and deliberate. Which is a good thing.

Ah yes, digital isolationism and segregated networks are great. Have we given up on the idea of the internet being a force for global human interaction? Are vague and impotent privacy protections more important?

I live in EU. -> Are vague and impotent privacy protections more important ? More important than "global human interaction" ? Yes, in my opinion. "Global human interaction" doesn't mean it should be the Far-West gold rush. It aims at fair and equal human interactions with the respect for the freedom of each single human on Earth. Freedom means equality for all, and to ensure more equality, we created laws. Laws are not perfect, but sometime they are the only tool we have. Laws are not fixed in stone, they can be improved over-time. Essentially we want global human interaction with respect of individuals.

I assume GDPR would only impact you if you operate a business from European locations, right? Not like they can enforce their laws on my small business run from the other side of the planet.

So long as my country isn't willing to extradite me, I don't really care what their laws are and I will adamantly refuse to comply with them as they're entirely irrelevant to me.

Your reasoning sounds like an easy excuse to not bother looking at any regulations period. Because knowing every single regulation is too onerous and you probably know all your local ones intuitively, right?

Don't slurp up data worldwide, then. If you don't do that, you're fine. If you do business you'd better know the law of your target audience, isn't it?

How does one avoid people making web requests originating in Europe from reaching your servers else where?

The obvious answer is by geographically identifying them by IP. Which GDPR makes pains to point out is personal data.

So you don't store data from that IP? How is this a problem? And that's perfectly compliant with the GDPR.

It seems you can't be bothered to not store data.

You don’t see the humor (at least) of a privacy regulation requiring me to learn more about the consumers hitting the site? Previously they were so private I knew nothing but an IP.

Now I’m instrumenting my systems with geo lookup databases which usually also include much more fine grained data (such as home/business) than that.

In any case, your original point was to just not interact with those people, which requires active filtering and isn’t the same thing as saying ‘just don’t watch that tv show’ in that it demands actions on my part due to behaviors and preferences on someone else’s.

There is no active filtering required if you don't store anything. I don't understand why this is so hard to grasp.

You can learn as much as you want as long as you don't store it or provide that information to a third party.

I believe our industry has too long gotten away with a "store everything" mentality. I have zero sympathy for web sites which slurp up everything from their visitors.

Reply on news.ycombinator.com