New Service Blocks EU Users So Companies Can Save Thousands on GDPR Compliance (bleepingcomputer.com)

Catalin Cimpanu, reporting for BleepingComputer: A new service called GDPR Shield made the rounds last week and for all the wrong reasons. The service, advertised as a piece of JavaScript that webmasters embed on their sites, blocks EU-based users from accessing a website, just so the parent company won't have to deal with GDPR compliance. GDPR, or General Data Protection Regulation, is a new user and data privacy regulation slated to come into effect in the EU three weeks from now, on May 25, 2018.

The new regulation brings a wealth of protections to user privacy but is a nightmare for companies doing business in Europe. The reasons are plenty, but the humongous fines for failing to meet GDPR standards are at the top of the list for most companies ($24 million or 4% of a company's annual worldwide revenue -- whichever is higher). There's also the 72-hour deadline to reveal data breaches and the necessity of hiring a so-called "Data Protection Officer." Plus, GDPR also mandates that companies must inform users on what data they collected about them, allow them to review the data, and even let users delete the data from the company's servers if they so wish.

Comments

Nothing "new" here

[Dorianny]

geofencing is not exactly a new concept. At least it finally is being used for good (privacy protection) rather then for evil (arbitrary geographical media blocking)

Re:Nothing "new" here

[OzPeter]

for good (privacy protection)

Good is rather relative here: it's purpose here is evading privacy protection.

It's not so much as evading privacy restrictions as locking out users for which privacy protections have been mandated.

If anything you could use it as an indication to ether do or refuse to do business with a company based on what side of the GDPR fence you want to be.

Re:Nothing "new" here

[Anonymous Coward]

It is definitely good. A Mom and Pop shop in the states selling homemade soap can't afford to have a DPO or respond to GDPR letters from hell. As per the GDPR law, even if a place doesn't do business in the EU, if an EU resident visits a site, the site has to comply.

Not every website is a multi-billion dollar operation that can spend the cash on this stuff.

So, they get blocked. $9 a month is cheap insurance compared to running afoul of the EU.

Re:Nothing "new" here

[mvdwege]

Tell me, what of my personal data beyond billing and shipping data for my most recent order would a Mom and Pop shop need?

This is the usual right-wing talking point about 'onerous regulation' and it is bullshit. It is not about the small businesses, unless they are merely a bait-and-switch operation trying to gain my data to sell it on to unscrupulous marketeers. It is about massive corporations that want to be free to pillage my life for their profits, and there is always an idiot falling for their 'but think of the poor small businessmen' shtick.

Re:Nothing "new" here

[Mascot]

It is definitely good. A Mom and Pop shop in the states selling homemade soap can't afford to have a DPO

Good thing they wouldn't need one, then. There are criteria for when you'd need one (e.g. your business is mass storage or processing of personal data), and the odds of a tiny shop meeting any of them would be extremely slim. Heck, we're a multinational company and we don't need one. For that matter, there's no requirement to _hire_ someone, it's a role that could be assigned to any employee with sufficient knowledge of privacy laws and best practice.

if an EU resident visits a site, the site has to comply.

Not quite. If your site collects personal data about a EU resident, the site has to comply. If your site does not collect personal data, GDPR does not apply.

Re:Nothing "new" here

[BronsCon]

even if a place doesn't do business in the EU, if an EU resident visits a site, the site has to comply.

And they can kiss my ass as far as enforcement.

Re:Nothing "new" here

[Anonymous Coward]

and there is always an idiot falling for their 'but think of the poor small businessmen' shtick

With any luck Slashdot will adopt this service and you will be cut off.

Re:Nothing "new" here

[rsborg]

Tell me, what of my personal data beyond billing and shipping data for my most recent order would a Mom and Pop shop need?

This is the usual right-wing talking point about 'onerous regulation' and it is bullshit. It is not about the small businesses, unless they are merely a bait-and-switch operation trying to gain my data to sell it on to unscrupulous marketeers. It is about massive corporations that want to be free to pillage my life for their profits, and there is always an idiot falling for their 'but think of the poor small businessmen' shtick.

I think it was a pipe dream to think that GDPR would cause big corps to change how they do business in the US. It's clearly too profitable to let go of that sweet precious data.

However, if there were such a small shop that inadervtently took customers (and their personal info for shipping or order fulfillment) from EU and then got a GDPR request (perhaps automated by some legal-bot), they might be best positioned to just avoid those customers in the first place.

Re:EU needs to be careful...

[religionofpeas]

As a EU resident, I don't mind if companies are choosing to block EU if they can't comply with privacy rules. I'd rather not do business with those companies.

Re:GDPR will fragment the internet

[JaredOfEuropa]

It depends on how onerous the GDPR really is. The biggest one is the requirement to have a Data Protection Officer, but this is required "only for those controllers and processors whose core activities consist of processing operations which require regular and systematic monitoring of data subjects on a large scale or of special categories of data or data relating to criminal convictions and offences." For the rest it is pretty basic stuff: you need to be aware of the rules, and prepared to take action e.g. in case of a data leak. A lot of it really is common sense stuff, that is if you're a conscientious operator.

The big companies will have no trouble complying, paying lip service or working around the rules. The smaller companies might at first decide to forget about Europe. This happened with a couple of smaller service providers when the EU VAT rules were changed: I got a few notices that such-and-such company was no longer able to provide their service in Europe. However they probably looked at the amount of business they were getting from Europe, had another look at the rules and found them not that hard to comply with, and removed the block.

Brilliant idea

[gurps_npc]

If you don't want to have to deal with the laws of a certain country, should have the right to not do business inside that country.

Of course, that leaves a big underserved market. In less than 4 years someone will come along and serve them, while abiding by the laws they hate.

Which could very well lead to those companies losing world wide market share as those new, privacy conscience companies expand out of their underserved market into the general world wide marketplace.

As for the laws they are trying to avoid? We need them in our country.

Re:EU needs to be careful...

[Immerman]

If the short-bus version actually respects people's privacy instead of spying on visitors, then maybe we need more short buses.

Re:Seems like the right reasons to me

[ranton]

I run a website with worldwide audience. I've also never been to Europe. Tell me why I should comply or face fines to a jurisdiction I've never been to?

You are servicing their citizens while they reside in their country, so you should follow their laws. Just because the Internet makes it so easy to reach those customers doesn't mean you should be able to ignore their laws.

Re:Seems like the right reasons to me

[Archangel Michael]

Okay, so what you're saying is that in a world wide economics, I have to comply with often mutually excusive rules and laws. I must do this in this jurisdiction, and I am forbidden to do the same thing in another. Good one.