Ask HN: How do you GDPR for your small side projects? • Hacker News Board

Re: Ask HN: How do you GDPR for your small side projects?

#51

Post by mattbgates » Tue, May 01, 2018, 7:33 PM UTC

Sohcahtoa82 wrote: post #41

mattbgates wrote: post #26

All the most important data that shouldn't be for my eyes -- is 256-bit encrypted as it gets entered into any database. All passwords and most user-inputted data is encrypted. Stripe takes care of the payment information which I don't store, but I do keep the expiration date in my database which usually cannot be used to identify anything. Definitely trying to be more GDPR-compliant as I take privacy and security ver…

> All passwords [...] is encrypted. Hopefully you're storing encrypted hashes and not simply encrypting passwords.

Is there another way to store them? Ha. All the hacks of major companies got me paranoid.

Re: Ask HN: How do you GDPR for your small side projects?

#52

Post by spiralx » Wed, May 02, 2018, 10:37 AM UTC

dangrossman wrote: post #45

matthewmacleod wrote: post #43

It's not too tricky, fortunately! 1. Stop collecting any data you don't need. If you don't collect it, it's not an issue! 2. Have a way for users to access their data or request it be deleted. This can be a manual process. 3. Make sure you gain explicit consent for any data you capture from users, and explain why you are using it. 4. Make sure any data you capture is stored securely using industry best practices. 5.…

> Stop collecting any data you don't need. If you don't collect it, it's not an issue! That's trickier than it sounds. If you embed a copy of jQuery on your page hosted by a CDN, you're collecting and sending personal data to the CDN. Do you have consent for that? Same with web fonts, icon fonts, javascript libraries, social media follow/share buttons, analytics tags, etc you embed in the tags. Every time your page i…

> If you embed a copy of jQuery on your page hosted by a CDN, you're collecting and sending personal data to the CDN. Do you have consent for that?

You're not collecting anything there, so it's nothing to do with the GDPR - it might impact the CDN, but it's unlikely without them tying your IP to other personally identifying information. Analytics would be, because that's personal data you are collecting, so you'd need to ask permission for that.

Re: Ask HN: How do you GDPR for your small side projects?

#53

Post by spiralx » Wed, May 02, 2018, 10:47 AM UTC

Obi_Juan_Kenobi wrote: post #38

Can someone clarify what exactly is the legal liability that comes from GDPR? My very basic understanding is that countries set up SAs (supervisory authorities) to deal with complaints, and have the legal power to sanction and so forth. So is it only the SA that can take action against you? If someone wanted to harass you, must they complain through the SA, or can they bring a civil suit based on the GDPR?

> So is it only the SA that can take action against you?

Yes.

> If someone wanted to harass you, must they complain through the SA, ...

Yes. There are also provisions for handling malicious requests to access personal data:

https://ico.org.uk/for-organisations/guide-to-the-general-da...

> ... or can they bring a civil suit based on the GDPR?

Nope.

Re: Ask HN: How do you GDPR for your small side projects?

#54

Post by cdjk » Wed, May 02, 2018, 3:18 PM UTC

dx034 wrote: post #46

cdjk wrote: post #24

Earlier quoted context omitted.

Do you set cookies that are not functionally required for the site to operate? Have to allow opt-in and opt-out of those cookies. Adsense cookies almost certainly fall into this bucket. Do you set cookies that are required? Need to identify them and inform the user. Server logs? You probably have ip addresses. Despite what us nerds think the EU considers them personal data.

Thanks for the answer. The only cookies are adsense and those are functionally required to run the site (as it's the only revenue stream). I already use a cookie banner for that. I run the site behind cloudflare and don't store X-Forwarded-For IP, the analytics software I use immediately anonymizes them before storing them. So I should be fine I hope.

Functional for GDPR does not take into account revenue from my understanding. You’d need a fallback ad solution that doesn’t rely on cookie targeting for users who don’t opt in.

Isn’t GDPR fun?