Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why are law documents (GDPR) so difficult to understand?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 85 posts

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#41

Post by dc2 »

eldavido wrote: post #23

This might sound a little mean, and I don't mean it to be this way, but this is a really naive viewpoint. Look at any profession -- accounting for instance -- and they have all sorts of stuff like this. As an example, there's a concept in accounting of "materiality" - basically, something that's big enough to matter. Materiality is what lets fortune 500 companies present their financial statements rounded to the near…

I do understand this.

I am just wondering what happens when there is a vested interest in attacking or suppressing the company involved.

For example, if a company becomes unpopular on social media and by "public opinion" (such as Facebook right now), a court can feel pressured into a slanted decision. Given that so much is now based on opinion, what defense does the company have?

It seems that if someone had the intention to nail a company on GDPR as a PR attack, regardless of the amount of effort the company put in, they almost certainly could.

(I don't work for Facebook)

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#42

Post by Kalium »

GDPR is basically written as something to be hashed out in court. The question is not "Are you compliant?". The question is "Can you use what you've done to tell a convincing story that you're compliant enough that you shouldn't be punished after a breach? When someone at the regulator's office might be looking to make their career over the corpse of your company?".

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#43

Post by Thespian2 »

As others have said, the law isn't a technical spec. it describes what you should do, not how you should do it. The concept of "due care" http://www.businessdictionary.com/definition/due-care.html

comes in to play here. GDPR, at its core, is about legally requiring businesses to care for customer data. It gives customers increased control over how their data is used, and how it should be protected.

In answer to OP's question "how do I know it is appropriate," as a first pass, how would you feel if your most important personal data were being treated that way? As a developer, if that makes you uncomfortable, that's probably a warning sign.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#44

Post by jonahbenton »

michaelbuckbee wrote: post #30

FWIW I recently attempted to translate literally the entirety of the GDPR into Plain English (albeit for a technical audience). It's at: https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... In general I think legislatures putting out goals/guidelines instead of detailed specifications is a feature not a bug. Tech moves faster than they can possibly keep up with and to call out things down to the patchnote…

I'll second Michael's page, he has definitely provided a useful starting point.

The law itself is not written for engineers as an audience. Not even for non-specialist-data-protection-lawyers as an audience.

That said, as an engineer, I found a book targeted to non-specialist lawyers to be enormously helpful: Peter Carey's _Data Protection: A Practical Guide to UK and EU Law_: https://www.amazon.com/gp/product/B00VU5XJHK/ref=oh_aui_sear....

It's not cheap, but if understanding GDPR is a professional concern, consider it a resource for explaining the history and motivation for the requirements that Michael extracts.

In the wake of the data protection issues we're having here in the US, I would love to have a GDPR-influenced regime.

And for small business, it mostly just means- be careful and respectful of people's personal data- which can be done without it being a burden.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#45

Post by matthewmacleod »

evervevdww221 wrote: post #14
matthewmacleod wrote: post #9

I found this regulation put too much burden on small businesses. It's not. You are wrong. What if this law will be abused as a tactic to attack business competitions? Why would that happen? How do you understand this "security appropriateness" of the above text? How can you be sure your understanding is correct? You use your knowledge or regulation to read and make decisions. If you don't have the required experience…

What if this law will be abused as a tactic to attack business competitions? Why would that happen? > For example, Business A has a competitor startup B who has less resources to hire security consultant. Business A hence hired person C to register the service provided by B with a weak password and hire D to breach C's account. C claims that he has been hacked, so he brings startup B to court. B goes bankrupt because…

B goes bankrupt because it runs out of money to hire lawyers.

Right, that's like any other malicious lawsuit – i.e. this is totally irrelevant.

I'm self learned, garage based entrepreneur with $1000 in my bank to either buy food or hire a consultant, is that required experience?

Yes. If you don't have the knowledge or resources to correctly comply with appropriate regulation, then you should not be operating in a space. "I didn't know that I needed to keep raw and cooked meat separate" would not be a valid excuse in food prep; why would "I didn't know I needed to use a secure hash" a valid excuse for an engineer?

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#46

Post by kodablah »

Others are giving an optimistic interpretation. Here's my pessimistic one (at least in the GDPR's case): they want the wiggle room to subjectively apply these rules on companies they don't like. The intention may be valid, but with the boundaries vague you can bet that enforcement won't be uniform. It never is and history has shown how ambiguities in law can be bent for targeted application based on political will.

Also, most comments will say this is just how it has to be because the law cannot be very specific on highly technical matters. I believe that part is true, but it is not just how it has to be. The other option is the absence of the law and alternative measures to tackle this problem (e.g. education/awareness, encouragement of alternatives, public equivalents or assistance w/ caveats, etc, etc).

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#47

Post by yorwba »

evervevdww221 wrote: post #19

Also, is hackernews complied to GDPR? I didn't seem to see a "delete account" button? As I know GDPR asks that users' data can be deleted at anytime?

IANAL, but it's probably not compliant. http://www.ycombinator.com/legal/ even explicitly says that

Please note that we have no obligation to delete any of stories, favorites or comments listed in your profile or otherwise remove their association with your profile or username.

I presume this is based on the theory that European law can't be enforced against HN since it operates from California. On the other hand, it might be possible to convince a judge to take action against YC companies instead? Not sure.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#48

Post by noxToken »

eldavido wrote: post #23

This might sound a little mean, and I don't mean it to be this way, but this is a really naive viewpoint. Look at any profession -- accounting for instance -- and they have all sorts of stuff like this. As an example, there's a concept in accounting of "materiality" - basically, something that's big enough to matter. Materiality is what lets fortune 500 companies present their financial statements rounded to the near…

One thing I think a lot of people don't realize is that the more specific a law is, the more it becomes like a zero-tolerance policy. Allowing for ambiguity, as you said, allows for the law to be enforced with context.

A contrived example: I could try to look up some tax information on the IRS website. An error occurs, and the server spits out a bunch of log data not meant for the public. This data happens to contain sensitive URLs. I navigate to one, and it gives me unfettered access to the server. So long as I stop here and report it, I should be in the clear.

I don't. I look around a bit to see if I can help include additional details when I contact the proper person. I haven't actually done anything bad per se, but now I'm knowingly accessing a government computer system without proper authorization. A law with proper specificity would say that I should be jailed for looking around. Common sense says that though I should have close the tab, but I was only doing my best to help. And since I never did anything detrimental, I should be in the clear.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#49

Post by kodablah »

Tomte wrote: post #3

You don‘t really expect a law to specify which hash algorithm you‘re supposed to use, do you? The answer is simple: the law will stand for a long time, and legislators know their limits. Unlike many engineers, unfortunately. Having courts interpret laws, with help from experts, is not a bug, but a feature!

Mostly agree, but there's a middleground between the ambiguities OP raises and mandating a hash algorithm. Legislators sure do know their limits; they know that laws that are not narrowly scoped remove a lot of limits on the enforcers.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#50

Post by billconan »

kodablah wrote: post #46

Others are giving an optimistic interpretation. Here's my pessimistic one (at least in the GDPR's case): they want the wiggle room to subjectively apply these rules on companies they don't like. The intention may be valid, but with the boundaries vague you can bet that enforcement won't be uniform. It never is and history has shown how ambiguities in law can be bent for targeted application based on political will. A…

Really good points.
Post reply on HN