Apparently, HN might be violating GDPR according to the website
Also, the public sector matters a lot here: they can't risk to have the data going to the US when they are legally mandated to keep it in Europe. This demand already exists and won't go anywhere, leading to all kinds of services being re-engineered on european soil.
Eventually any company who doesn't respect their users privacy will probably be phased out by a european alternative - at least for the customers who care about that sort of thing. Europe made very clear that it does, but sure, time will tell what disrespecting that market segment will do to market shares.
Ask me how much I care whether my non-existent customers decide they don’t want to be my customer.
And I’ll ask you how in the world a visitor to my website is supposed to know or care whether my site is hosted in the US or EU. I’m not even 100% sure myself.
Pretty sure we'll see indicators for that in browsers in the foreseeable future. The internet will be a much more zoned-space in the future, so much seems obvious.
> You do realize the vast majority of websites don’t even have customers, right?
customer <- visitor
Now that I think about it, if an IP address is PII, and leaking PII outside of the EU is a violation, I wonder if any P2P network can be legal in the EU, since P2P networks leak IPs globally. How would IPFS or Bittorrent work?
A quick search shows that this is indeed an issue, and the most P2P networks don't support the necessary revocation of PII necessary. IEEE has an early access paper[0] about exactly this issue:
> To comply with the criteria of the European Union's General Data Protection Regulation, it is important to ensure that personal data can be completely removed by their owners. To improve the privacy and security of the P2P file-sharing system, we propose a revocable and monitorable P2P file-sharing system over a consortium blockchain to achieve revocation of files in the decentralized environment.
So, for everyone who said blockchain is a solution in search of a problem, I present GDPR-compliant P2P networks! I'm mostly kidding, my brief read through the abstract suggests this also requires a bunch of other heavy-handed measures, like securely verifying the P2P executable using Intel SGX. It's hard for me to imagine such a system gaining any sort of widespread use, but I've been wrong before.
The EU says it is illegal for anybody in the world to use Google Fonts. Guess how many people outside the EU care what the EU says they can and can’t do on their website. How many millions of websites are there using Google Fonts right now? How many were there last week? How many will there be next week? That tells you everything you need to know.
Total and utter horeshit, and you are fully aware of it.
btw when you factory farm animals 10 high and they live their entire lives covered in the faeces from the 9 layers of chickens above is actually a good idea to give them a wash and disinfect them.
1. GDPR is an EU law that claims to apply to every single website in the world, mandating certain things regarding PII.
2. A court has now determined that using Google Fonts on a site will make it noncompliant with GDPR.
3. Thus, any site that currently uses Google Fonts is currently in violation of that EU law called GDPR.
If you are objecting to #3, please explain why it doesn't follow from 1 & 2.
Regardless, when you say I'm intentionally and knowingly spreading "horseshit," it's completely untrue and uncalled for. An apology would be nice.
Yes
> that claims
laws claim nothing
> to apply to every single website in the world,
No non nein no no no no no
> mandating certain things regarding PII
well 2 out of 4 aint bad
> 2. A court has now determined that using Google Fonts on a site will make it noncompliant with GDPR.
Sure thing.
> 3. Thus,
I sense a wild extrapolation inbound....
> any site that currently uses Google Fonts is currently in violation of that EU law called GDPR.
No, any site that currently uses Google Fonts AND IS HOSTED IN OR VIEWED FROM THE EU is currently in violation of that EU law called GDPR.
GDPR is not international law, its not a global law, its not Europe telling the US what to do, its actually not about you at all. On the other hand, if you would like to do business with europe, we have some things we would like you to do, if you do not wish to do them, you are free (we all know americans love their freedom fries) to not do any of the things we require and stay out of our jurisdiction.
If you have a website in the US, and a person in the US visits it, unlike your repeated claims - the EU neither wants nor needs nor considers it to be anything to do with anything that they give the slightest of shits about. You, me and the brick wall all know this to be true.
So you’ve confirmed that it applies to every website in the world. I don’t see how I can put a website up without being affected by GDPR. If I am affected the moment I put a site up, then it applies to every site.
The internet is worldwide by default. I have no ability to prohibit people in the EU from seeing my site.
Yes
> So you’ve confirmed that it applies to every website in the world.
Here we go again
> I don’t see how I can put a website up without being affected by GDPR.
Dont serve it into the EU. So we have firmly established it does not apply to every site in the entire galaxy.
> If I am affected the moment I put a site up, then it applies to every site.
It doesnt apply if you dont serve it into the EU, so no it doesnt apply to every site in the entire galaxy.
> The internet is worldwide by default.
The default is 0.0.0.0 - the default is also unencrypted - the default is no password - the default is a lot of things that nobody in the world would do.
> I have no ability to prohibit people in the EU from seeing my site.
So you have the ability to publish a site, but not the ability to control that site, why am I not shocked. A bit like having a car and blaming everyone for not getting out of the way when you use it.
And somehow I'm an idiot because I expect 99.99999% of websites, including my own, to be available anywhere in the world?
Go live in China if you like Great Firewalls so much.
wtf is the philosophy of the web? Is this the laws of the internet? I dont live on the internet so the internet doest have jurisdiction over me.
> It's called the "internet" because everybody is interconnected on it.
internet - 1970s (denoting a computer network connecting two or more smaller networks): from inter- ‘reciprocal, mutual’ + network. So no, thats not why its called the internet.
> It's called the "World Wide Web" because when you post, it's available to the whole world.
Its like the world series of baseball then? it was actually called mesh first. Its called the world wide web now because tbl came up with that name for the first browser program to browse the mesh which for years only existed in europe.
> Go live in China if you like Great Firewalls so much.
So now you are now saying you dont expect 99.99999% of websites, including my own, to be available anywhere in the world. Why only 99.99999%? You want to exclude some? Which in particular? Why? Who gets to decide?
You are proposing a bizarre situation whereby no country would have control over their own laws, if something is illegal in the US, say child porn, you just go to a website from a country where it is legal (and somehow that is legal now??). Somehow you seem to suggest it is a moral obligation that it be available to the entire world as well for fear of falling foul of the philosophy of the internet.
LOL
Have fun on your little power trip. And good luck with it. Let me know once just 5% of the websites available in the EU stop using Google fonts. Lol
GDPR only applies if you specifically target EU citizens, are in the EU, are an EU citizen, make any money from the EU, etc.
Generally, GDPR prohibits the transfers of personal data from the European Union to a country that does not meet the same privacy protection standards as those provided by the European Union. Due to a lack of uniform privacy laws that provide significant privacy rights to individuals and the surveillance of United States intelligence agencies, the European Union has long held that the United States does not provide adequate privacy protections to individuals.
It seems like e.g. the US CLOUD act requires US businesses to provide their agencies access to any data, whether that data is hosted in the US or not. IANAL but this looks to me like even if Google uses EU based servers to host fonts, they would still be required to provide PII to US agencies.
There are other non-EU countries in the world with GDPR compatible regulations.
Edit: Also the more I read about the GDPR (and the CLOUD act), the more I'm in favor of it.
https://www.enforcementtracker.com/ "... is an overview of fines and penalties which data protection authorities within the EU have imposed under the EU [GDPR]"
If I'm understanding your point, it's more along the lines of: "Lots of people are looking into this sort of thing, and we can aggregate resources about their findings." This makes sense to me, but wasn't what I was intending to critique.
Here's an amusing 320k euro fine https://ico.org.uk/media/action-weve-taken/enforcement-notic...
On 24 July 2018 the MHRA had executed a search warrant at the premises of
Doorstep Dispensaree under the Human Medicines Regulations. In
the course of its search, the MHRA discovered, stored in a rear
courtyard, 47 crates, 2 disposal bags and 1 cardboard box full of
documents containing personal data. MHRA estimated
approximately 500,000 documents but cannot estimate the
number of data subjects.
MHRA have inspected the crates and the information contains:
a. Names
b. Addresses
c. Dates of Birth
d. NHS Numbers
e. Medical Information
f. Prescriptions
The dates on the documents range from January 2016 - June 2018.
The documents were not secure and they were not marked as
confidential waste. Some of the documents were soaking wet,
indicating that they had been stored in this way for some time.
Edit: to be clear, the violation type here seems to have been "Insufficient technical and organisational measures to ensure information security"
The GDPR applies to processing of data of individuals located in the EU/EEU and states the rights of these "data subjects". If your business violates the GDPR and wishes to also operate within the European Economic Area, it could face fines and penalties.