Hacker News Reader

Comment by krageon | Hacker News Reader

> ridiculous conclusions

> - IP addresses are personally identifiable information

I really thought you were going to go in a different direction than this. This is very obvious and there's nothing ridiculous about it. To most people in the EU, an IP address gives a very high resolution to a person.

> That means it is non-compliant to host your website at e.g. AWS

Yes, this is correct. AWS, Azure and GCP cannot possibly be compliant. It's taking everyone a while to figure this out. There's nothing wrong with that, privacy-sensitive information should never touch the US. No US-based company can guarantee your privacy.

> effectively everyone is non-compliant.

This is of course hyperbole. If you don't log or track you are perfectly compliant in every case.

View on HN

> If you don't log or track you are perfectly compliant in every case.

But that is simply not true, right? If I host my website on AWS and 'log or track' nothing I am still not compliant. It's not about what I do as a website provider, it's effectively outlawing working with companies based in other jurisdictions.

> based in other jurisdictions.

Instead of this we can just say "the US" and only because of local laws and hyper-invasive corporate culture.

It's definitely 'other jurisdictions'. There's a (short) whitelist of countries that are deemed adequate, which you can find here: https://ec.europa.eu/info/law/law-topic/data-protection/inte...

To save you the click, it's Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom and Uruguay.

These are 14 countries.

You can use a provider from anywhere, as long as you know they do not track.

"The effect of such a decision is that personal data can flow from the EU (and Norway, Liechtenstein and Iceland) to that third country without any further safeguard being necessary."

operant words being "without any further safeguard".

Additionally, for data that's strictly needed for your business, you don't even need to ask consent, but you're responsible for keeping data safe.

It's weird how the whole "you need to keep your users' data safe and not collect more than is necessary" is such a controversial topic for some on HN.

> It's weird how the whole "you need to keep your users' data safe and not collect more than is necessary" is such a controversial topic for some on HN.

I think it stems from a long lawless time online where everyone was free to aggressively exploit everyone else. The fact that such behaviour is becoming frowned upon is something that we should expect will generate some friction. That said, I also find it hard to empathise with.

My impression was they can very much be compliant as long as they sign a contract with you that they only process data themselves in manner compliant with GDPR in the services you make available for EU citizens.

> If you don't log or track you are perfectly compliant in every case

The GDPR is not merely a list of bad things not to do. You must also hire people to carry out slow and expensive processes to continually demonstrate compliance, e.g., https://gdpr-info.eu/art-36-gdpr/.

Reply on news.ycombinator.com