Hacker News Reader

Comment by colechristensen | Hacker News Reader

You and your business are crossing borders when you serve traffic to foreign customers, and are thus party to their laws.

No I'm not a lawyer, but if you really never intend to have any customers in Europe you'll probably be fine (ask a lawyer, not the Internet) but if you do or might then you're playing a game with whether or not you'll be caught or if the consequences will be more advantageous than mitigating them.

America projects it's laws worldwide with the global financial system and anything with even a remote connection to the states is a poison pill that is used to prosecute behavior which is almost exclusively outside its borders. Other legal entities can do the same, but to a lesser extent.

View on HN

> You and your business are crossing borders when you serve traffic

I’d argue that if the request originates outside my country, the customer has crossed the border with the intent to bring the content back to their country

I'd definitely put the onus on them. It's pretty insane that even routing and logs will cause issues because of a law on their side.

I agree there, but also there is the perspective that the consumer of the content did not ask your server to take their data for analytics purposes. So it goes both ways

I understand that, but even without analytics, it wouldn't conform simply because it's hosted in the US and the IP can be stored there.

The way routing works, you can't prevent the IP from going to the US if it's just hosted there.

AFAIK the IP from requests doesn't necessarily need to be logged or stored anywhere, does it? Perhaps this comes from my lack of understanding of GDPR but I thought the issue was from storage where it could be retrieved or shared

The problem is that the US CLOUD act compels US companies to provide data access to US agencies, regardless of where the data flows. It could even be servers on EU soil. EU courts hold that these kind of acts violate the data rights of individuals located in the EU.

well, it seems that the EU has already decided that is not going to be the interpretation they will accept so argue away.

There are also thousands of different analogies like yours that one might choose that would put the benefit on the EU side, for example, someone might argue your website is like a product and as such is open to all sorts of regulations and taxes when it gets 'imported'.

The result of this argument is that every company can easily make themselves immune to all laws and regulation by setting up shells across borders.

As long as they don't register users, accept payments, etc - just serve content - I'm okay with this interpretation.

And if they, keep records of unregistered users, track their behavior, and sell that data or use it to make business decisions?

As long as they do it on their site, not third-party ones or via third-party ones, then also ok.

I'm not sure GDPR applies if they're not using any third party services. That's the thing with GDPR compliance, if you're already doing things right it doesn't really change anything, you don't even need to ask about cookies (because cookies are actually ok under GDPR if they're used the way they were originally intended.)

Sounds good to me; I'd like to take advantage of something like that one of these days.

It's not actually about serving traffic across borders, it's about what you collect. If you collect PII, according to EU courts, you are responsible for it and will be held responsible if you plan to do business in the EU.

Reply on news.ycombinator.com