Hacker News Reader

Comment by fxtentacle | Hacker News Reader

I believe the authorities are correct here.

Shopify is sending all personal data to CloudFlare, CloudFront (Amazon) and Fastly, so 3 US companies. They could sign so-called "data processing agreements" where they promise to safeguard personal data. But the Shopify FAQ explicitly states that they are unwilling to do so.

As the result, Shopify is legally considered to not be processing data under the instructions of the shop owner, because they didn't sign the processing agreement. Instead, Shopify is legally considered to be the owner of the user data. And that's a problem with EU clients because they are a US company working with US CDNs.

Still, all of this could easily be rectified by Shopify if they would just care enough to sign the correct paperwork.

View on HN

As the author showed the volume of business and revenue in Germany is tiny, there may be not worth the effort for Shopify to do it. It may be the correct business decision.

The differences in laws and requirements by country is one of the biggest factors to consider when providing international services of any sort.

I believe that's misleading, because while not many sellers are located in Germany, this affects any Shopify shop who sells to customers anywhere in the EU. So I'd estimate roughly 30% of their revenue might be affected.

But of course, Shopify can just push this responsibility onto their customers, meaning the shop owners. That's what they currently do.

This affects the entire EU. I try to hammer it into people's heads here in NL. Using US-based cloud services if you touch PII is a huge risk as they're all getting like crazed addicts fighting over their next high PII-high.

It's the way the EU can protect their own tech industry.

While this is true, it is too easy. The privacy angle lives in the minds of Europeans, while US people seem to care a lot less.

Agree it is both but it is very palatable in the local population to implement rules to shutout foreign competition. Easy political points.

> The privacy angle lives in the minds of Europeans

without data, it’s hard to make this argument. what we know for sure is that bureaucrats fully support the privacy angle. but from my anecdotal real life experience almost no one cares (another argument that without data cannot be generalised).

The "bureaucrats" are elected officials so if people weren't in favour of it, they would stop electing MEPs that vote in favour of it.

That’s a naïve view of how politics and elections work.

When has any democracy worked even remotely like that? There are countless issues politicians must take a position on, you won't agree with all of them. So you prioritize. Or you just vote party line, which is by far what most people do.

US people certainly care about their privacy however there aren't any strong institutions left in the US anymore (outside of the Military) and the political system in the US give a choice between two corporate-owned parties.

No need to be overly cynical, the privacy aspects are popular and a good enough reason by themselves to have these regulations.

Yeah, not letting startups use any kind of US companies is a great way to protect your tech industry. Right now, there's a trend towards hosting on the edge—cloudflare workers, deno deploy, fly.io–european companies can't use any of this. And as far as I know, there are no european alternatives.

I never said it was a smart idea but if you don't understand technology (i.e. majority of politicians/public) it might seem like a great protectionist idea. The simple idea the politicians believe is protect our privacy by forcing big tech companies to change for our benefit -- if they don't our own population will build the technology. Win win in their eyes.

Protection through indirect tariffs?

The thing is - it isn't. Where is the EU-based top tier cloud player? One to compete with Google/Microsoft/Amazon?

There is a huge EU project which in theory is trying to build those competitors - Gaia-X - but as is typical with such projects the results have been poor. Looks to me like a lot of the money was wasted on "blockchain" scam projects.

The thing is - there is real significant potential in the EU for some of the existing large colocation/VPS provides to become just that only the EU's own implementation has failed.

Disagree. Privacy is a human right. It protects people's mental and economic wellbeing. Further, it can save millions of lives. Or, if you prefer, lack of privacy can lead to millions of deaths.

> As the author showed the volume of business and revenue in Germany is tiny, there may be not worth the effort for Shopify to do it. It may be the correct business decision.

The issue is with European regulations. The lawsuit was in Germany because that’s how legal systems work around here, but the sticking points are very likely to be present in national laws across the EU. So, ultimately it won’t be about the German market, but about the EU.

Each EU country does seem to have a different approach to the GDPR though. Germany's one is known for being particularly hard line, whereas the UK (not in EU but still follows GDPR) is known for being more pragmatic.

I don't know how that affects lawsuits though. I'm guessing if you have any customers in Germany, then someone could take you to court in Germany, but I'm not sure...

I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly).

> The data protection authority justified this with the fact that US authorities could access personal data (probably primarily the IP address) for criminal purposes on the basis of the CLOUD Act, among other things. This occurs regardless of whether data is stored on servers in the USA or Europe.

I have to imagine the particular bureaucrats the author was dealing with are somehow wrong here? Otherwise this implies that a European business cannot use basically any American software (directly or even indirectly, like this case), even if that software fully conforms with processing and storing all data in Europe. The fact that American authorities could coerce any American company into turning data over, even if it’s stored in Europe, is enough?

> I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly).

From what I can tell, Shopify itself uses Cloudflare, so your domain that is connected to Shopify is passing all the traffic through Cloudflare, e.g. one of the other examples in the screenshot: https://www.distortedpeople.com/

The site is on CF (and it sets like 10 cookies, including tracking cookies, pre consent, so any dreams of compliance are gone either way), and, as far as I can tell, that's the case with all Shopify shops (but I've only ever looked into that from an outsider's perspective, maybe that's optional).

The article quotes Shopify explicitly saying otherwise.

Maybe they're doing something special on checkout? The main sites (including their own) are obviously using CF as a CDN not just for static assets, but for document requests as well.

This doesn't matter, EU sites have been getting fined for some time now for using CDNs like this, most popularly Google Fonts.

Regulators focusing on the important stuff once again.

I guess if you fear Quantum inserts it might have some privacy/security gains.

You are allowed to dismiss your right to privacy is you so desire but the majority of EU citizens have decided not to.

We've actually never been asked. Some unelected bureaucrats decided "for our own good".

They're elected representative. You were asked in the most official way possible, with elections.

Both in your national election which then decided the government which chose your country EU representative for the council and commission, which then created the law and decided to put it to a vote and where your government had a direct veto right, and in the European election where you elected the parliament that voted on the GDPR.

I recommend you inform yourself on the institution that govern you and how you can influence them, you seem to be deeply uneducated about them.

None of the representatives I voted for got elected.

No candidate had on her proposal list "hunt and close cookie consent dialogs on the web forever".

I recommend you go out on the street and find out how real governing in the EU works, you seem to be deeply idealistic about it. It’s important, it could be why the next brexit happens.

It is correct that the CLOUD Act complicates things, the issue is that servers located within the EU operated by American companies have some form of remote access to the hypervisor, meaning US intelligence agencies can compel these companies to hand over data and encryption keys for the data, even if it's physically located within the EU/EEA.

Before the Schrems II judgement[0] by the European Court of Justice, companies in the US could use the EU-US Privacy Shield[1] to ensure adequate protection of EU personal data. The Privacy Shield agreement replaced and improved upon it's predecessor, the Safe Harbor agreement, which was invalidated by the Schrems 1 case.

Transfers between the EU and US can still be legal, as long as standard contractual clauses (SCC), although this requires more effort after the Schrems II case than before. Companies are now required to verify the privacy protection in the recipient country in order to use the SCCs.

The first source provided gives insight into what is required by US companies to comply with GDPR when tranferring personal data to third countries. As an anecdote, a guest lecturer for a masters course I took this semester mentioned in passing that transfers to the US are almost as bad as transferring personal data into China.

[0]: https://www.gdprsummary.com/schrems-ii/

[1]: https://www.gdprsummary.com/gdpr-definitions/privacy-shield/

Instead, Shopify is legally considered to be the owner of the user data

As I see it, Shopify's role in this situation is more likely to be considered a data fence: because of the lack of processing agreement, they're not allowed to process any data (more accurately, the shop owner is not allowed to give them access to any data). The data that they do have through services they provide is illegally obtained; that doesn't mean they suddenly own that data.

Shopify is a Canadian company, does this change anything?

I don't think that matters - what matters is where the processing servers are. And if they are using CloudFront etc, they are sending data to the US.

But those 3 US companies all signed the safe heaven agreement, AFAIK.

Agreements mean nothing because the problem is with US law, which these companies cannot countermand.

The Safe Harbor Agreement was invalidated by the Schrems I case in 2015. The Schrems II case from 2020 invalidated the EU-US Privacy Shield Agreement.

In addition, the physical location of the servers do not change anything when the company operating those servers is American. They still need to comply with the CLOUD Act, even to the point of pulling data and encryption keys from servers based in the EU.

Reply on news.ycombinator.com