Hacker News Reader

Comment by fcbrooklyn | Hacker News Reader

It is impossible to sell raw-milk cheese in the United States. Are French cheese makers overreacting by simply choosing not to do business here rather than change their centuries-old production techniques? It is illegal to sell kinder eggs in the US, because of some law that involves children accidentally swallowing toys. Is Kinder overreacting by refusing to sell those candies here? You cannot buy Bovril in the US, because of a panic about mad cow disease from 20 years ago. Are the manufacturers of bovril overreacting by refusing to create a separate production facility that uses only beef sourced from outside the UK? Compliance with laws outside your primary market has a cost, and potentially a benefit. Every business, large or small, is going to do that cost-benefit analysis, and make their own decisions. As an american I can hardly blame the Kinder people for failing to provide me with convenient access to chocolate eggs containing plastic toys. It's my government, and the laws they've put in place that have had that effect.

View on HN

Thank you for making a coherent argument. You are missing one point I think: if not for those regulations those companies would love to do business. They are forbidden from doing business, this guy sees the law and runs off without even trying to become compliant. That's a different thing. There is no way that Kinder could be compliant with US law in such a way that they would not be exposed to what - to EU sensibilities - amount to exorbitant damage claims.

Similar arguments apply to the other examples you use, I see your point and there are valid reasons to not enter a certain market because of the legal climate there but the point I am trying to make is that the OP has not raise any valid point at all other than 'I don't want to comply'. And that's fine by me but then don't bother dressing it up in a bunch of made up requirements.

Bovril could easily comply. They would simply have to open a manufacturing facility that did not use UK beef. The French cheese makers could sort of comply, by pasteurizing their milk. Kinder, I admit, has a more difficult problem, and has, in fact attempted to comply, by creating a completely different product with the same name.

Ah yes, "simply" open a manufacturing facility.

There will be a cost involved. And presumably there will be some benefits that result. Those are precisely the parameters of OP's decision.

"The French cheese makers could sort of comply, by pasteurizing their milk"

And why should the French cripple a delicious and traditional product, which is gladly gobbled up by millions of happy consumers to sell their product in the US?

Because otherwise they can’t sell it there. Their country, their rules. A French cheese maker doesn’t get to dictate the rules abroad. Take it or leave it.

It seems to me that French and other European cheese makers are much more interested in protecting the integrity of their product than opening up the US market for it.

You mean, exactly what we are doing right now, causing all kind of outrage in France ? Funny you should bring that up, because it's a very hot topic currently :-D

Kinder is an amusing example, since they decided to offer a compliant variant of their product in the US.

https://www.today.com/food/kinder-joy-chocolate-eggs-are-com...

Yes. Rather a step back from the original offering isn't it? If I'm being honest, I couldn't give a damn about the kinder eggs prohibition, as I am not a child, and I do not have children. The Bovril issue is by far my biggest personal concern, although I'd really like to be able to buy raw milk cheese.

There are states in the US where you can buy raw milk cheese legally. You just can't do it through interstate commerce, but for example it can be done in person at farmer's markets with cash. New York is one such state, I dunno about the other major tech hub states.

They did that in a rather smart way, too, by diverging it enough from the original that they could sell it elsewhere as a new thing.

I mean, it never really took off here, very few people prefer it over the original, but better than not being able to sell it outside of the US at all.

Kinder is a great example actually on how a company adjusted their product. Now I believe in all markets (even beyond USA) the product is safer and less dangerous for kids to get injured.

Actually, I'm pretty sure they still stick the toys inside the eggs everywhere except the US. Perhaps a European can correct me on this assumption.

EDIT: Turns out the US-style kinder eggs are indeed available outside the US.

I've seen this variety sold in Poland

https://www.candywarehouse.com/assets/item/regular/kinder-jo...

But I'm not sure it's typical.

Yeah. That's the US version also, not sure how common it is outside US.

In Canada they definitely still put toys in the eggs. http://www.ferrero.ca/our-brands/kinder-surprise/moments-of-...

http://fortune.com/2017/05/22/kinder-egg-usa-debut/

Toy is also in US version but different design

I’m in Canada and can confirm that the toy-in-the-egg version was always sold here. As far as I know, this hasn’t changed. E.g. http://www.canada.com/life/Kinder+Surprises+Banned/2353187/s...

Looks like this now http://fortune.com/2017/05/22/kinder-egg-usa-debut/

I have seen this outside of US also (pretty sure it was doing a Europe trip)

it's just a different product, which shares almost nothing with the original, and is simply sold besides it outside the US.

They marketed it as a new thing beside the original here in Germany.

Most people seem to prefer the original, though. They lost a lot of charm by going from toy+edible+tinfoil to plastic+toy+plastic+edible+plastic spoon+plastic.

The new one is even more sweet and rich than the eggs (more like a dessert than a snack) and harder to eat for a young child, so not surprising.

Yup, Kinder Eggs have toys inside in the UK

Is safety a real concern here? I would have never viewed Kinder Eggs as dangerous in any way.

I haven't found a single case of a child getting hurt in Germany. Only news reports about them being unhealthy (big surprise).

I really don't think, it got safer.

It takes some special talent, even as an adult, to take such a big bite off of a classic Kinder egg that you'd have any chance of accidentally swallowing the plastic capsule or somehow else hurting yourself on it.

And with the new egg, I'd be concerned that my kids swallowed that plastic spoon. Like, that's something they actively have to put into their mouth and it's not as interesting as the toy for them to be motivated to not swallow it.

It's also small enough for them to realistically pull this off.

>this guy sees the law and runs off without even trying to become compliant

This guy quite clearly states that he doesn't have resources to become compliant, while it is too risky to make a mistake here.

There are fans of GDPR on this website, who prefer to ignore the fact that the compliance has its cost, and added to that still unknown risks of practical interpretation of legislation which also have their cost. But these are real life things.

GDPR compliance takes resources. I would say for a small business it takes about 1 or 2 days. Not hard work but tedious. In the end you will have around 5 documents that will show your processes, what you do to keep data save, a plan how you deal with questions from customers and regulators, that you trained your employees and that you choose your subs carefully.

Essentially that's it.

I am no lawyer but I am a CPO.

Pro tip: Speak with the regulators they are on your side.

I guess you are EU-based, unlike the guy whose text we are debating here.

Yes - I guess having an EU contact is something not easy to come by on the other hand there might soon be a service for it.

I guess an XMPP Server could be considered a communication service an could be subject not to the GDPR but to regulations concerning ISPs and Phone companies.

I respect his right to do whatever he would like with his own hobby, but we should be clear that the guy is stating he doesn’t have the resources, based on a series of misunderstandings.

So, for example, he says he is required to appoint a DPO.

The U.K. Information Commissioner has this to say:

>Do we need to appoint a Data Protection Officer?

A> Under the GDPR, you must appoint a DPO if:

> you are a public authority (except for courts acting in their judicial capacity);

> your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking);

> * or your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences.

That's the UK's interpretation of GDPR. What about France or Poland, or any of the other countries?

I suppose it depends where in Europe he would like to visit

I'm not seeing any interpretation being done here, but judge for yourself. Here is what the GDPR actually says (Art. 37 Designation of the data protection officer):

> (1) The controller and the processor shall designate a data protection officer in any case where:

> a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;

> b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or

> c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10.

There's no "UK Interpretation", this is the whole point of the EU. The rules apply across the block.

EU law doesn't work like that. Each country has to pass their own local law to enforce the GDPR. For the UK that was the Data Protection Bill 2017.

From wikipedia:

The GDPR replaces the 1995 Data Protection Directive.[4] Because the GDPR is a regulation, not a directive, it does not require national governments to pass any enabling legislation and is directly binding and applicable.[5]

So, no local laws. It's a regulation.

Only for the sake of correctness/completeness: GDPR does allow member states to adjust certain details to bring them in line with local regulations (see Chapter 9). These are explicit opening clauses though that must not basically weaken or augment GDPR.

It's more complex than that. Different countries might pass different laws about interpretation, and both are valid until there's an ECJ decision.

It's an EU Regulation, which under EU law the local courts have a duty to enforce. Local courts and laws will be dealing with all the details unless a case is appealed to ECJ.

To say that local courts and laws will have no influence is complete rubbish.

I'm not sure why people are downvoting this so hard: https://webcache.googleusercontent.com/search?q=cache:eMV5_l...

That's the UK's straight-forward unequivocal explanation of the rules. Where there is room for interpretation or uncertainty, the ICO is very good at pointing this out. It doesn't here.

As poisan42 points out - it echoes the words in the actual article, directly.

Bottom line, he doesn't need a DPO.

And "large scale" means how many records in DB? How many users? Or records per day?

Monal is an XMPP client running on user's iOS devices. Is that person even running an XMPP server for those users?

These are excellent questions that you will have to have shown you've considered if you get audited. If there's disagreement with the regulator, you'll come together to resolve it, and then may need to appoint one.

Well, so it's undefined, at least until practice of legal application establishes. Undefined means risk, and stopping serving EU is a meaningful mitigation, if your profits don't compensate you for all the hassle. Where's "overreaction“ then?

I guess if you have to ask that question you are not a large scale.

I don't think an argument of such kind would stand in your communication with regulators, or (especially) in courts.

This is "what will you do if the lightning strikes you" thinking. Only about less probable things.

I'm not sure I understand your point. Do you mean “they won't catch you"?

They won't even manage to precisely decide what actually means 'large' let alone if it applies to you specifically, before you die of old age.

The above statement will apply to everybody or nearly everybody (still not you).

Why have you isolated one element from a multiple element sentence:

* core activities * require * large scale * regular * systematic

If you tick all those other boxes, but are concerned that your processing may be teetering on the boundary of 'large scale', I would be cautious and assume your liable.

All repeatable processes are systematic, almost the whole IT goes into the category. And "core" is undefined too.

I agree that it is safer to imply you're liable.

A UK privacy attorney I know considered 20k records (individuals) to be large scale. I haven't seen much helpful guidance. The WP29 guidance I've read only gives examples at the very extremes of large and small so not too helpful. Practical guidelines will evolve over time.

Perhaps more important, dpo is just another hat - if he's ceo,cfo,cto - he can be dpo too?

There are limitations, namely:

"There must not be a conflict of interest between the duties of the individual as a DPO and her other duties, if any."

Specifically they recommend against also being the data controller. I.e. you shouldn't be responsible both for handling personal data and verifying compliance of said handling.

No, because you wouldn't be independent enough. A CFO or a CTO would tell its board things are okay because it isn't in its interest to do otherwise.

That's why some independent DPO jobs are appearing.

But the DPO is a small cog in the machine. Updating the processes is the most time and resource consuming regarding the GDPR.

You are correct as to a DPO, but if he is, say in the US, and subject to GDPR, he must have an EU Representative, who by all indications would be liable for his violations. That's a significant burden if not a practical impossibility for most in his position. Also, if he's transferring personal data from the EU to the US directly from individuals, his only practical way of making that transfer compliant is likely to be privacy shield certified which is not cost free (although he could maybe rely on consent as a derogation, but relying on that has risk). I can think of many things like this that have, if not a hard cost, then a definite cost in time and resources to comply including keeping up with compliance. Could easily be not worth the effort for a single individual.

Well many of us find it completely normal to spend days on having a good security, setting up HTTPS, encrypting content to protect privacy. I wonder why GDPR seems so different, it's just more of the same, just less technical.

Exactly. It will take a while before standards and best practices form, but they will.

I guess I am a fan of GDPR, certainly compliance to anything has a cost. I personally don't find the costs of GDPR compliance onerous unless you have already built up lots of non compliant systems that now need to be fixed, in which case the free ride is over. Anyway, this guy is pulling out of the EU but if he allows anyone from the EU to use his service from a non-EU location anyway he would be risking non-compliance.

no. gdpr applies only to people in the eu. if you are an eu person in canada it does not apply to you.

you're right, it seems a few people have been making the same mistake about eu citizens that I've made.

I'm not following your distinction. The only difference seems to be timing.

Case 1: CompanyA is already doing business in CountryB. CountryB changes regulations. CompanyA pulls out of CountryB because of regulations

Case 2: CountryB has regulations. CompanyA choose not to do business in CountryB because of regulations

am I missing something?

Except EU has always (well, Sweden since 1973) had regulation, if you would gave followed that, you would not have to change much in most cases. Just write some documents and smaller changes.

They're not forbidden to so business, they're forbidden to so business unless they adapt their product or practices. I'd say that is pretty much the same as this case?

But in this case this is not even a business. It is a zero-revenue open-source project. It seems to me that only very well-funded charities are allowed to run web services now.

P.S. I sincerely hope my country gets out of this ASAP.

> It is impossible to sell raw-milk cheese in the United States.

I've bought plenty of raw mil cheeses (domestic and imported) in the US.

http://www.realrawmilkfacts.com/raw-milk-regulations says: "In 1987, the FDA mandated pasteurization of all milk and milk products for human consumption, effectively banning the shipment of raw milk in interstate commerce with the exception of cheese made from raw milk, provided the cheese has been aged a minimum of 60 days and is clearly labeled as unpasteurized."

As many cheeses are aged more than 60 days, the ban on "raw-milk cheeses" is basically an urban myth.

Oh it's real enough, since there are also plenty of cheeses which are aged under 60 days and not traditionally pasteurized. It's also relevant for making yogurt and butter in traditional ways, though one can start with pasteurized and get an okay enough result.

But as I said in another reply to the parent poster, there are states which allow raw milk products in intrastate (but not interstate) commerce.

[Edit: Wow my text got mangled by autocorrect. Fixed so that it makes sense now!]

Unlike your examples, GDPR bans neither messenger apps nor Monal in particular.

Indeed. And the prohibition on raw milk does not ban cheese. Many cheeses from France are still available, because they do not involve raw milk. The EU has passed a law, perhaps it is a worthwhile law. This is one of the consequences. The ban on raw milk in cheese making exists thanks to (presumably) the best intentions, and the end result is that there are many cheeses I would like to buy, that I cannot. An American (unlike me) who supports such a ban rejoices in the fact that we are protected from these dangerous french cheeses. Perhaps you rejoice that you are protected from the dangerous GDPR non-compliant Monal.

Running further with a bad analogy doesn't make the analogy any better or more relevant to the GP comment.

Apologies, I genuinely don't understand this critique.

GDRP doesn't ban the milk from which messengers are churned at the messenger mills either.

Still in the dark mate. I'm sorry, maybe it's me, maybe it's you, but we seem to be speaking a different language.

It's you. The original comment says 'The author of Monal misunderstands/misrepresents the regulation and is throwing a silly tizzy'. To which you say 'some laws ban some things. also, cheese is made of milk'. These things are true but not related to the GDRP or messengers.

> the prohibition on raw milk does not ban cheese.

It bans "raw-milk cheese", which is a distinct kind of product, not one way of many to make a particular product ("cheese"). If you ban raw milk, you ban certain types of product entirely, and there is no workaround.

It would be like saying a prohibition on planes does not ban automobiles, and after all, both are a kind of vehicle. True, but not really relevant.

Back to the GDPR case, it's closer to a producer of pasteurized-milk-cheese saying they are going to get out of the cheese business altogether because of the ban on raw-milk-cheese, and labeling their cheese as such and documenting however briefly that the cheese is made out of pasteurized milk is just too much effort, and they are afraid of being sued by people claiming it is raw-milk-cheese.

Whatever.

No analogy is perfect. In this case, there are questions that legitimately have no definitive answer (like what is "large scale"), so it is more like the cheese maker genuinely doesn't know whether their milk would be audited as raw-milk or not, and even if they consult with a lawyer they still don't have confidence that they would know.

If you read the article, you would find out that this is the essence basically.

"As GDPR approaches, I get the impression that it is an end of an era for the internet. The days of someone making something, putting it on the internet and offering it to the world seem to be over. "

And this particular thing GDPR ruins pretty goddamn well.

Bullshit. That era existed before everything was analyzed and monetized and PII was packaged and sold as a commodity. GDPR ruins invasion of privacy for profit.

and open source.

Nothing about open source depends on invasion of privacy, unless what you’re open sourcing is data mining the public, in which case... blow.

I have good news for you about kinder eggs: they're no longer banned.[1] There's a store in Harvard Square that has about twenty different kinds. Sadly, they appear to be all licensed stuff now.

https://www.npr.org/2017/05/26/530257536/after-being-banned-...

>Is Kinder overreacting by refusing to sell those candies here?

Kinder make a different version of the Kinder Egg specifically to comply with US law.

https://www.kinder.com/us/en/kinder-joy

>Are the manufacturers of bovril overreacting by refusing to create a separate production facility that uses only beef sourced from outside the UK?

Bovril was briefly made without any beef content because of the BSE issue.

https://web.archive.org/web/20071201114613/http://www.unilev...

> It is impossible to sell raw-milk cheese in the United States

No, it's not, but it is legally imposible to import them, and trade them in interstate commerce (many—I think still a majority—of states allow raw milk and raw milk products, though the FDA prohibits most directly and sets standards which effectively prohibit the rest in interstate commerce, including foreign imports.)

Not that that really changes the point you are illustrating.

Reply on news.ycombinator.com