21–30 of 54 posts
Earlier quoted context omitted.
It's my understanding that an IP address is not personal info and that nobody can, say, make a GDPR request for information associated with an IP address. An IP address is not personally identifiable information.
Under GDPR's definition and recitals, IP addresses are most definitely personal data.
At first it was a joking response, but I know of a few businesses and people who after looking into it, quickly learned it was far easier and significantly cheaper to simply block EU users, or prevent EU signups or data inputs, or place them into a 'read only' type mode, rather than attempt to deal with the hassle.
If you have a project that doesn't allow users to enter any kind of information but simply displays ads (via Adsense), is that in scope for GDPR or is a proper Privacy Policy enough?
Do you set cookies that are required? Need to identify them and inform the user.
Server logs? You probably have ip addresses. Despite what us nerds think the EU considers them personal data.
Earlier quoted context omitted.
There are many such resources already. https://gdprchecklist.io/ https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... https://ico.org.uk/for-organisations/resources-and-support/d...
What's interesting is that I've had to meet many of those already for California's COPPA and previous privacy laws, so I'm quite confused at why people are acting like this is all brand new and never existed before... As an aside that checklist is misleading. Some of the requirements they list expressly don't apply to small businesses, for example you don't need a DPO unless you're over 250 employees.
https://gdpr-info.eu/art-37-gdpr/
Are you a large scale data processor of special categories of data as defined in Article 9? That includes data that can be used to determine racial or ethnic origin, health data, and data about sexual activity and orientation.
Large scale is helpfully not defined anywhere.
So if you run a site around a health condition or that lets people specify their sexual orientation some place you might need a DPO.
I'm sure I'll be shot by HN for this, but I'm not bothering. If a side project starts to gain traction then I'll look in to it, but if it's a small web app with a handful of users then sod it.
While I understand the sentiment this might be risky. Creating the required documentation after the fact should your project take off might not be possible in every case.
Earlier quoted context omitted.
Under GDPR's definition and recitals, IP addresses are most definitely personal data.
It seems that you're correct and it does indeed include IP addresses. Good catch.
Earlier quoted context omitted.
While I understand the sentiment this might be risky. Creating the required documentation after the fact should your project take off might not be possible in every case.
Oh to have this problem. Let me guess, your side project is multi-cloud replicated, CDN fronted, data center backed?
As soon as your side project processes and / or stores user data GDPR applies to you.
Good luck with providing the requisite documentation and data processing agreements if authorities ask for them and you didn’t prepare those in time.
I'm sure I'll be shot by HN for this, but I'm not bothering. If a side project starts to gain traction then I'll look in to it, but if it's a small web app with a handful of users then sod it.
While I understand the sentiment this might be risky. Creating the required documentation after the fact should your project take off might not be possible in every case.
Get the basics down, the documentation can follow. Get the basics wrong and it becomes painful.