Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why are law documents (GDPR) so difficult to understand?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 85 posts

Ask HN: Why are law documents (GDPR) so difficult to understand?

#1

Post by evervevdww221 »

As much as I want to comply to GDPR, I think its articles difficult to understand, like many other law documents.

https://gdpr-info.eu/

As an engineer, I found it is very difficult to translate from the regulation text to code, to actual implementation.

Taking the following statement as an example:

https://gdpr-info.eu/art-5-gdpr/

>>>

(Personal data shall be) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

===

"In a manner". In what manner?

What's "appropriate security" and "appropriate technical measures"? How to interpret it? There seems to be much flexibility?

Every website has some security measures to protect data to certain degree. How do I know if that's "appropriate" or enough to meet GDPR?

Do I need symmetric encryption? Or Do I need asymmetric encryption? Which kind of crypto hash is considered "appropriate"? What if I use a database which is insecure by flaws, but I don't know or don't have the technical strength to know it? What if encryption on my backend caused performance penalty? What if I run a hosted, non-profit BBS based on certain open source BBS program that might be insecure? Should I patch the server with OS Update JKB8948, which is known to fix a security hole but opens another? is it an "appropriate measure"?

I found this regulation put too much burden on small businesses. Just to understand this GDPR text may require consulting cost. What if this law will be abused as a tactic to attack business competitions? I'm worried.

How do you understand this "security appropriateness" of the above text? How can you be sure your understanding is correct?

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#2

Post by aurizon »

Lawyers wished to create a 'walled garden' for their knowledge and methods. Doctors do the same and the churches also did it. These people charge fees for access to this knowledge and do not want easy access to the general public.

recent advances in AI endanger many jobs at law firms and medical practices and may result in fewer jobs - at law firms at least. I expect the medical and legal lobbyists will bribe our elected criminals to limit this. It has already made it hard for new lawyers to get any jobs at all.https://www.nytimes.com/2015/08/25/opinion/too-many-law-stud...

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#3

Post by Tomte »

You don‘t really expect a law to specify which hash algorithm you‘re supposed to use, do you?

The answer is simple: the law will stand for a long time, and legislators know their limits. Unlike many engineers, unfortunately.

Having courts interpret laws, with help from experts, is not a bug, but a feature!

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#4

Post by matthewmacleod »

aurizon wrote: post #2

Lawyers wished to create a 'walled garden' for their knowledge and methods. Doctors do the same and the churches also did it. These people charge fees for access to this knowledge and do not want easy access to the general public. recent advances in AI endanger many jobs at law firms and medical practices and may result in fewer jobs - at law firms at least. I expect the medical and legal lobbyists will bribe our ele…

This is utter nonsense and you have no basis for stating any of it.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#5

Post by Cthulhu_ »

That's up to you - what techniques do you know that allows you to process personal data which ensures it's secure? It's a law, not a specification or an implementation detail.

More general, it's difficult to understand because it's in legalese, which is aimed at people that studied it for years - it's the English programming language. And like code, there's lots of holes in it that it doesn't cover, despite lots of manyears of effort.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#6

Post by josaka »

For the same reason the control problem is so hard in AI. It's difficult to anticipate how intelligent agents will behave in a reasonably complex environment. To address this challenge, some legal propositions are intended to be clear cut rules, but many are intended to kick the can down the road with less than clear language to be interpreted with the benefit of specific scenarios at hand and experience.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#7

Post by kuschku »

EU law is written so it can apply for many decades – when the precursor of the GDPR was written (1995), MD5 was considered secure.

So, you should expect the "appropriate" part to mean the current state of the art to keep something secure.

An "appropriate" hashing algorithm today would be bcrypt, scrypt, or potentially still a salted SHA512 with many rounds.

An "appropriate" protection against unauthorised access would probably be a strict permissions setup in your AWS rules, proper firewalling, and potentially at-rest encryption.

An "appropriate" encryption would be AES 256 GCM.

"Appropriate" always just refers to the current state of the art for what is considered secure.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#8

Post by chomp »

Regulations like this usually draw from other sources for inspiration. So if your company is subject to other regulations (like PCI-DSS), then these really vague sentences start to seem more concrete.

1.) Make sure your software has all vendor-supplied patches.

2.) When personal data is being processed, keep it in RAM.

3.) When personal data is at rest, ensure that it's on a locked-down system and safe. Encryption at rest is called out in GDPR, but it's not required. (The definition of "locked-down" can fill a couple paragraphs, but consider it like SOX - only give access to employees that need it as part of their job title. Block off all access for everyone else - network, physical, logins).

4.) Make sure that all systems that store/receive/transmit personal data are audited and logged, and do not give out access to people unless they absolutely require it. (Anonymize data for BI, developers, business reports when able)

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#9

Post by matthewmacleod »

I found this regulation put too much burden on small businesses.

It's not. You are wrong.

What if this law will be abused as a tactic to attack business competitions?

Why would that happen?

How do you understand this "security appropriateness" of the above text? How can you be sure your understanding is correct?

You use your knowledge or regulation to read and make decisions. If you don't have the required experience, you hire a consultant or a lawyer. Just like you do when complying with any other piece of legislation.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#10

Post by misthop »

Legislators don't (and shouldn't imho) get into the specifics of how an industry should abide by the laws they make. That makes the law flexible for the future. In the US, at least, if you were brought up on charges of violation, they would use the reasonable person test. That means that a reasonable person in your position (with the expected knowledge of the industry/field/underlying tech) would have done it in the way you did. The reasonable. person in hashed out by the jury based on testimony by experts on both sides of the case. Basically if you are using best practices, you should be ok. Qualification: I am a non-practicing attorney
Post reply on HN