Re:GDPR compliance as a service
by niko001 on Thursday May 03, 2018 @09:18PM
(#16991472)
Not a joke :). GDPR Shield as a product is GDPR compliant. Customers sign a data processor agreement with the service. It anonymizes IP addresses, they aren't transferred to any other third-party provider and aren't stored.
[ Parent
| on HN ]
But like I mentioned on Indie Hackers, your customers still have their own logs that need to be GDPR-compliant, which defeats the whole purpose. The page that requests your JS still has to be sent by a server, which will likely log the EU citizen’s IP. And then there’s the case where the EU citizen is using a VPN server in the US...
Maybe, but it's clear that your company doesn't specifically target its services at individuals in the EU. Your company is actually using active measure to not do that.
sure but just handling ip addresses in your access logs is a whole lot easier than changing your entire site to comply with GDPR. major reduction in surface area
But if your JavaScript is inserted into your customers site, then the initial request that loads their site the first time + your script will be logged on their servers just like any other HTTP request.
Re:GDPR compliance as a service
by reificator on Thursday May 03, 2018 @09:47PM
(#16991610)
And if your site loads their Javascript to block anyone from the EU from visiting, then it's clear that you're not targeting customers in the EU.
You're still gathering the data on every request. And since all requests go to the site anyway (to load the JS) you might as well just put a text saying, "nothing to see here for EU citizens"—that'd be a lot cheaper than buying this silly service and it would send the same signal.
This service isn't blocking requests to your site, it's just showing the visitors different content after the fact.
Niko, your implementation may not be right like others have mentioned (in that it triggers GDPR on your customers), but I fully support this methodology.
If it helps, I use AppEngine for my App which already provides geolocation information in the IP and my app blocks it the moment it receives the request. Users will only see a re-direction to a notice relating to GDPR and what they'll need to do if they still want to access the site.
Thanks! You're right, there are many ways to achieve this goal, I just wanted to provide a drop-in solution that's independent of the infrastructure.
You might as well be selling an image saying "EU customers go away!" With regards to GDPR compliance it's just as good in that, at best, you're showing intent not to serve EU customers (yet you still don't actually block requests, you just serve them different content and log all the same data).