Hacker News Reader

Comment by logronoide | Hacker News Reader

I'm the author of the post, and yes: blocking 500 million geolocated people is crazy. That's not the spirit of the law.

I just wrote the post because if you want to overkill and you are lazy, you can follow our recipe to 'implement' GDPR. I just wanted to be sarcastic and also show how easy to implement Cloudworkers + Apility.io.

View on HN

On the contrary, if you are running a business where 99% of your customers are outside of the EU, its totally rational versus opening yourself up to massive liability.

You need to purge that 1% customer data though. If you're accepting EU citizens data through any channel - another business, them using a VPN, via smoke signals, you need to comply.

If it is while the customer is in the EU.

If the customer joins your Japanese site while in Japan, its governed under Japanese law, not EU law. Your citizenship is irrelevant.

Do you have a source for this? Would love for this to be true but there's so much disinformation out there.

Yeah, no, please stop this FUD.

You need to comply with the laws of the jurisdiction you operate in. If you don't operate in the EU (and having a presence on a global communication network does not qualify), EU laws are not applicable.

The onus is on concerned EU citizens to stick to .eu domains with a feel-good GDPR-VERIFIED banner if they are so inclined, not on the rest of the world to bend over.

As a non-EU business, I will pay my GDPR "fines" right after I'm done paying my Iran and North Korea issued fines. Cheers!

This, ladies and gentlemen, is exactly why the GDPR is needed.

For comedic effect?

Seriously though, I made no comment on the law itself so I'm not sure what your point is. Most reasonable people would agree it's a good law in spirit, and I wish I had some of those protections where I live.

But the notion that it can be enforced on non-EU entities is ludicrous.

Blocking 500 million geolocated people is crazy. That's not the spirit of the law.

No crazier than thinking you have to comply if you have no connection to the EU.

If you have no connection with EU why do you collect personal data from the EU citizens? If you don't collect why worry?

What do "collect" mean. Its too broad to comply.

They keep sending it to me. Apparently, even asking them not to and trying to block them is not enough for some people.

Just to be clear, I treat all my users fairly and protect their data, and I am not intentionally targeting any EU users with anything I do online.

You have a responsibility to your users, be they EU or not. The fact you consider "they keep sending it to me" means that you are not considering the whole privacy issue. This data is not yours to do with as you please. Yes they send it to you -- but you are listening, You are the active party here. There is a duty to protect your users data.

The question I was answering was why my company is collecting this data. We have email subscribers from the EU because...they subscribed to our email list. We don't advertise in the EU, we have no EU-specific languages or currency on any of our projects, etc. But EU users still want to subscribe to our content, visit our site, etc. So we're "collecting their info" because they voluntarily send it to us and we're not specifically trying to block them. Perhaps we should.

We're not compliant with the letter of the law of GDPR (and according to some it doesn't apply to us at all due to the above), but we treat all user data seriously, regardless of where they come from. If that's not good enough, then people can stop visiting / subscribing / purchasing, or the EU can try to levy a fine and collect it. I'm not particularly worried about either scenario.

I have a responsibility to treat users in a way that I consider fair, which includes protecting data such that it doesn't get used in a way that I wouldn't want my data used, or that a person who is more sensitive than me wouldn't want their data used.

I do not agree that I have any sort of implicit responsibility to treat my users in a way that an EU bureaucrat deems fair.

Your post was really hilarious. It's the first funny thing I've seen about GDPR, which among other things has unexploited potential for humor.

Best hope there are no people using VPN’s

You should consider making this a bit clearer in the beginning. There is already a lot confusion about GDPR lately and people could take your post seriously. As pointed out by others already, geo-blocking isn’t a proper way to become GDPR compliant.

Reply on news.ycombinator.com