Hacker News Reader

Comment by kmeisthax | Hacker News Reader

The product cannot be adapted as the concern is specifically that Google can be legally compelled to violate GDPR. Schrems II is very explicit that EU companies cannot send data to the US for as long as the US CLOUD Act is on the books.

"Banning Google Analytics" actually downplays it. Even Google Fonts is actually illegal now; and it will continue to be illegal until the US does the smart thing and copypastes GDPR into local law.

View on HN

So really every website, even HN, that doesn't shard all EU data away in a separate EU datacenter (if they aren't already based in the EU) is illegal?

No.

Correct. Also note that IP address are counted as PII, so even sending an IP address (as required by any TCP/IP request) to a US-located or US-controlled server is illegal without getting consent beforehand.

I'm not sure that's how it works. Couple of things (IANAL):

1. I don't think ip address alone constitutes PII but needs to be combined with other data to be applicable

2. Even if it were, I would imagine it falls under article 6 provisions where ip is required information to fulfill a contract which in case of HN as an example means delivering the web page to the browser

> 1. I don't think ip address alone constitutes PII but needs to be combined with other data to be applicable

According to courts just the IP is considered enough:

The decision says IP addresses represent personal data because it's theoretically possible to identify the person associated with an IP address, and that it's irrelevant whether the website or Google has actually done so.[1]

[1]https://www.theregister.com/2022/01/31/website_fine_google_f...

Of course this was a case where sending the IP to Google was not necessary to operate the site, as self hosting the fonts was an option.

Yes, but that's not using the site, that's logging the IP.

> even sending an IP address (as required by any TCP/IP request) to a US-located or US-controlled server is illegal

Nope. Having the IP for making a TCP/IP connection is a technical requirement, one of the exceptions of GDPR (this also applies for logging, etc as long as you don't keep it forever, etc)

Let's not make up requirements where they don't exist

That is not true. IP addresses are explicitly stated as personal data. That they are a technical requirement for a connection only has repercussions on how you are allowed to store and process this data and the consent you need to get from the user for your data processing.

You are not allowed to send IP addresses (even if they are a technical requirement for connection set up) to companies under US government control before you get full consent from the EU user.

The "technical requirement" exception (to process data without consent) only applies to GDPR complaint data processors which US companies can't be because of the Cloud Act.

https://ec.europa.eu/info/law/law-topic/data-protection/refo...

There is a huge difference between using your IP address in the course of the technical implementation of the IP protocol and the subsequent logging and re-transmission of that address to others, effectively you are agreeing with the GP while starting your comment with 'that is not true'. It is true. And you confirmed it.

From what I understand the legal exception to process personal data without consent is written down in Article 6 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph b)

"(1) Processing shall be lawful only if and to the extent that at least one of the following applies: (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;"

This is ok for GDPR complaint data processors. The reason why US companies can't be GDPR complaint is because of Article 5 and the conflict with the Cloud Act: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph f)

"(1) Personal data shall be: (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)."

It doesn't even matter if you asked for consent or have other reasons to process the data (Article 6) if you are not complying with Article 5.

Since there is no way to give your consent without accessing the server this argument is moot.

No. This part of the rules only applies to EU businesses. If an EU citizen deals with a US business, the US business still has to follow GDPR, but not the export rules. EU businesses do have to follow said rules.

Only if they are storing personal data (including IP addresses).

HN doesn't use Google analytics AFAIK and they don't have any of my personal data, not even my real name. So it's not as much of an impact.

~~You register with email, so they definitely do have personal information.~~

Edit: you don't have to register with email, so I was wrong. My bad.

Email can be personal information but does not have to be, and no, you don't have to register with an email at all for HN, that's just nonsense, and your own account is pretty much proof of this.

The US isn't going to copy and paste any foreign laws and codify them as US law. So it is likely the EU and US will have to forge a different path or the EU can ban everything.

I think it's quite clear by now that the US never codifies any laws that didn't originate nationally, not even if they are international accords or treaties. A US signature on an international treaty is basically worthless.

The Mickey Mouse Protection Act says otherwise

Reply on news.ycombinator.com