Slashdot Mirror
New Service Blocks EU Users So Companies Can Save Thousands on GDPR Compliance (bleepingcomputer.com)
Catalin Cimpanu, reporting for BleepingComputer: A new service called GDPR Shield made the rounds last week and for all the wrong reasons. The service, advertised as a piece of JavaScript that webmasters embed on their sites, blocks EU-based users from accessing a website, just so the parent company won't have to deal with GDPR compliance. GDPR, or General Data Protection Regulation, is a new user and data privacy regulation slated to come into effect in the EU three weeks from now, on May 25, 2018.
The new regulation brings a wealth of protections to user privacy but is a nightmare for companies doing business in Europe. The reasons are plenty, but the humongous fines for failing to meet GDPR standards are at the top of the list for most companies ($24 million or 4% of a company's annual worldwide revenue -- whichever is higher). There's also the 72-hour deadline to reveal data breaches and the necessity of hiring a so-called "Data Protection Officer." Plus, GDPR also mandates that companies must inform users on what data they collected about them, allow them to review the data, and even let users delete the data from the company's servers if they so wish.
The new regulation brings a wealth of protections to user privacy but is a nightmare for companies doing business in Europe. The reasons are plenty, but the humongous fines for failing to meet GDPR standards are at the top of the list for most companies ($24 million or 4% of a company's annual worldwide revenue -- whichever is higher). There's also the 72-hour deadline to reveal data breaches and the necessity of hiring a so-called "Data Protection Officer." Plus, GDPR also mandates that companies must inform users on what data they collected about them, allow them to review the data, and even let users delete the data from the company's servers if they so wish.
geofencing is not exactly a new concept. At least it finally is being used for good (privacy protection) rather then for evil (arbitrary geographical media blocking)
A new service called GDPR Shield made the rounds last week and for all the wrong reasons. The service, advertised as a piece of JavaScript that webmasters embed on their sites, blocks EU-based users from accessing a website, just so the parent company won't have to deal with GDPR compliance.
This is just the type of service you would hope exists to make sure citizens can decide what levels of privacy they want and companies can decide what level of privacy they are willing to provide. For some time now we will see many stories of companies improving their privacy, companies pulling out of the EU market, and companies being fined by the EU. All are good and expected outcomes of rules such as the GDPR.
-- All that is necessary for the triumph of evil is that good men do nothing. -- Edmund Burke
Just like China has their own websites that comply with the great firewall we will have a world where large chunks of the internet will be GDPR walled. I expect most US companies will find it more profitable to block than comply.
We didn't find much trouble in compliance. Sure we had to write a few policies and work out a procedure for exporting and deleting data from our systems. We did not spend even 25k in work to pull this off. It was fairly trivial for companies that don't make a product out of consumers.
The way I see it as a European, it will mean that they where selling my data anyway, so that means they won't do that anymore. It also means they will not be able to do that for any of the other 350+MM Europeans.
This was also the intended reason for the law. It is as if Europe is saying "You are not allowed to take our data" and these websites are saying "Well, if that is the case, as punishment, we are not going to take your data."
Don't fight for your country, if your country does not fight for you.
As a EU resident, I don't mind if companies are choosing to block EU if they can't comply with privacy rules. I'd rather not do business with those companies.
I actually want this to happen. Forks are good at times and allow for improvements. Maybe the european internet can create something better than the american one.
Avantgarde Hebrew science fiction
This is for all the right reasons and there is nothing wrong with it.
Many businesses don't target foreign visitors, but get them anyway. Websites target local content (small businesses, retail locations, etc) that really gain no monetary benefit in showing their products to EU customers. Why deal with any compliance?
Keeping up with the laws of hundreds of foreign countries (and the states/provinces within them) is a full-time job. It's also very technical. A business in Canada or USA or any other country can either study EU legislation and adjust their web site for no real benefit (avoiding the risk of hefty fines) or just block the EU and move on with life.
Until countries unify their data protection and online laws for the greater good of society as a whole, this is the new state of the Internet. Focus on your own markets which makes you money, block everyone else. Saves risking non-compliance with foreign laws.
when you see the word 'Linux', drink!
Disclaimer: I've worked myself into GDPR details to shape my employer up for it.
GP is a little off on some details.
You have to *name* a Data Protectoin Officer. This can be anybody empowered to check compliance. Usually this is done by some administrative or IT specialist. Germany has had this for decades. No need for an extra hire.
You don't have to spend thousands or millions. You just need to have a proper setup and due diligence in place. The new thing is that you need to document procedures in a standardized manner. The big difference between the law that come in on 25.4.2018 is that someone could only sue you if he was damaged and only if he could prove a data breach of critical personal data. The fines up to this point also were laughable.
Now anyone involved, including customers, can ask how data is handled and the authorities and others have the right to review documentation of your SOPs for data protection. Also you're in for big trouble with massive fines (up to 4% of global anual revenue) if you're careless with data and aren't willing to comply with the GDPR.
In short: If you have your IT in order GDPR compliance isn't that much of a big deal.
Documentation is, but compliance is not.
If however your IT is shit, then you're in for trouble if they come for you. Big time. ... Can't really complain about that actually.
Since they *will* eventually come for you *and* most companies (online *and* brick and mortar) IT setups are somewhere between disorganized shite and abysmal, companies would rather opt out than go through the hassle of complying. Which means only companies with proper procedures and due diligence in their IT will remain doing business in the EU.
Thus endeth some real-world details on GDPR.
You're welcome.
We suffer more in our imagination than in reality. - Seneca
While trusting users to load and execute Javascript is hopelessly naive (any company relying on this to avoid huge fines, is about to pay some huge fines) how is wanting to avoid huge fines the "wrong reasons?"
This is shockingly stupid implementation, not stupid motivation.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
If you don't want to have to deal with the laws of a certain country, should have the right to not do business inside that country.
Of course, that leaves a big underserved market. In less than 4 years someone will come along and serve them, while abiding by the laws they hate.
Which could very well lead to those companies losing world wide market share as those new, privacy conscience companies expand out of their underserved market into the general world wide marketplace.
As for the laws they are trying to avoid? We need them in our country.
excitingthingstodo.blogspot.com
The trouble is, actually being in compliance isn't enough. You have to be able to afford the lawyers to defend against the accusations, even when they're completely invalid. All you've done is reduce your risk; you haven't eliminated it.
A one person shop does not need a DPO:
(Source: GDPR FAQ)
Unless that one person shop does engage in large scale processing of sensitive personal data, of course, but then they either have enough revenue to afford a DPO, or they are a shady 'ethicul biznizman' (aka spammer).
"I know I will be modded down for this": where's the option '-1, Asking for it'?
Yep. Now we can only hope that more markets follow in their footsteps and make it impossible for such sites to stay in business at all. It's not like compliance is hard - just stop recording information about your visitors. Unless of course your business model depends on spying on your visitors, in which case good riddance.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
If the short-bus version actually respects people's privacy instead of spying on visitors, then maybe we need more short buses.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
Not necessarily. Treaties and a general good relationship with the EU means they could have US courts enforce judgment. Currently, the US is not under treaty to enforce the GDPR, but that could easily change.
People you do business with don't have to be sitting in the EU when they visit your site for you to be liable.
... as long as they are EU citizens.
A EU citizen sitting in Starbucks in the US is equally as protected as if they were sitting in France.
Also, if you stored the shipping label to let's say...send them a package to their vacation home in Iowa, you're still liable
If all you do is Geo-fence, you're already not going to make it.
They aren't protected AT ALL. Unless you want to try to invade the US to enforce your rules, you can call all the cops you want, file some diplomatic grievances, quote some EU law, and they will laugh at you.
EU people are always on about the US trying to police the world. Well, this is the EU trying to enforce their laws globally. We tell the Chinese to piss off and they have *real* power. The EU is a bunch of backwater corrupotocrats trying to replicate the USSR who have no power whatsoever, and depend on us for both endless streams of money and for subsidizing their defense (in some cases because we don't trust them to have any power themselves, Germany being a repeat offender). You have NO control and the people that are currently paying their fines are doing it semi-voluntarily - it's extortion and designed to be.
If push comes to shove, US companies will tell you to piss off and there's not one damn thing you can do about it.
Comment removed based on user account deletion
While you can block based on IP, this doesn't address EU citizens living abroad in non-EU countries like the US. GDPR applies to all EU citizens regardless of location.
The point is that geo-fencing is a misguided attempt to avoid liability since a user can be outside the EU and still be protected by the law.
You argue that the law might be unenforceable for companies not having a legal presence in the EU, but assuming this to be correct, it makes the geo-fencing even more useless: why geo-fencing away users when by your assumption you can ignore EU liabilities anyway?