How the GDPR Will Disrupt Google and Facebook • Hacker News Board

Re: How the GDPR Will Disrupt Google and Facebook

#211

Post by Spivak » Thu, Aug 31, 2017, 2:58 AM UTC

taysic wrote: post #186

nvarsj wrote: post #95

Earlier quoted context omitted.

> it comes at a huge cost to tech companies Doesn't it just affect companies which rely heavily on lack of privacy for monetisation? I think that's sort of the point - that your business should not rely on tracking individuals and selling that information without their consent to gov/private bodies. It's obviously a huge change, since so many big tech players rely on this to make profits. But the internet will be a m…

"the application of the GDPR will prevent them from using these personal data for any further purpose unless the user permits." This seems incredibly broad from the article and would touch nearly every startup. Maybe there are limits on the businesses affected? Otherwise I'm not sure how one could formally define "rely heavily on lack of privacy for monetisation."

This law will affect everyone but it seems like it will devastate companies that have no monetization strategy other than collecting user data and either selling it or mining it for targeted ad placements.

https://unroll.me/ is a good example. They provide a free service to users but make money by leveraging their total access to your inbox to sell ad analyics and competitive intelligence.

Re: How the GDPR Will Disrupt Google and Facebook

#212

Post by Spivak » Thu, Aug 31, 2017, 3:01 AM UTC

spydum wrote: post #181

Slartie wrote: post #136

Earlier quoted context omitted.

> First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't like the content, but that is what the EU has ruled should happen. No, it is about deleting personal data attached to your user account, not "news articles". This thing intends to make the "delete my account" button to actually, you know, "delete my account", instead of fake-deleting i…

You missed the point: if I take an image backup of a disk and store it, even in encrypted format, and it contains John Doe's account, and he comes along and asks for his account deleted, I would have to purge not just my database record, but the backups images from the past as well. That invalidates ALL of my backups. It's not often practical to backup INDIVIDUAL users..

As long as you have clearly defined retention policies I don't think saying, "your account has been deleted. It will take 90 days for the deletion to filter though our backups. After that point all of your data will be gone forever" would go against the spirit of the law.

Re: How the GDPR Will Disrupt Google and Facebook

#213

Post by Spivak » Thu, Aug 31, 2017, 3:03 AM UTC

josephg wrote: post #203

FridgeSeal wrote: post #195

Earlier quoted context omitted.

This is not an unsolvable problem. Does your data not have a lifetime anyways? Do you really need to store everything forever? If you have system that just tracks changes and one that occasionally records full state, after you delete someone from prod you could simply overwrite old full-state backups with your new, post-deletion backup and update your change-only backups to replace data about that user with `deleted`…

There is also a pretty easy cryptographic solution for your offline backups: In your backup, encrypt each user's data using a per-user key (AES or something). The keys will be tiny, so you can store the keys in a hot database. When a user deletes their account, simply purge the user's key. Tada - like magic all of that user's data on your tape backups has turned into unreadable noise.

I think you're assuming that most companies roll their own backup systems. You're underestimating the number of companies for which their backup system is something like Windows Server Backup or Veeam which isn't doesn't have that kind of granularity.

Re: How the GDPR Will Disrupt Google and Facebook

#214

Post by occultist_throw » Thu, Aug 31, 2017, 3:05 AM UTC

cm2187 wrote: post #117

shadowtree wrote: post #32

And if you think GDPR is a toothless joke, let's take a look at the defined fine stucture. It is pretty simple, only 3 levels (strikes for the fellow Americans): Strike 1 - Stern warning letter Strike 2 - 2% of your TOTAL GLOBAL REVENUE Strike 3 - 4% of your TOTAL GLOBAL REVENUE (or 20mil EUR, whichever is higher) And now you know why GDPR is a board level topic. Keep in mind that the EU/US Safe Harbor agreement got…

> Keep in mind that the EU/US Safe Harbor agreement got axed due to a lawsuit of a single student from Vienna against Facebook. Almost every US supreme court decision come from a single guy challenging something. Are you suggesting that under a certain size, one shouldn't be allowed to sue in court?

I believe they were trying to make a point that it doesn't take a whole government, or a class of people to be wronged to change things in court.

It takes a single person whom was wronged. That's it.

Re: How the GDPR Will Disrupt Google and Facebook

#215

Post by A_No_Name_Mouse » Thu, Aug 31, 2017, 3:06 AM UTC

antoncohen wrote: post #94

I encourage a little more thought before cheering this on as a win. While GDPR isn't as ridiculous as the Cookie Law, it still shows that the EU/EC don't understand the technology they are trying to regulate, and it comes at a huge cost to tech companies. Take the right to be forgotten . First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't…

> Take the right to be forgotten. First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't like the content, but that is what the EU has ruled should happen.

That is not correct. The right to privacy is not an absolute right. It has to be balanced against other rights, such as the right to free press. In a normal news article case, free press would prevail.

> There is a good chance your little startup that isn't cash flow positive will have to spend $1 million of its VC money on becoming GDPR compliant.

I advise a lot of small customers to implement manual procedures to retrieve or delete data in case a request for it might be done. And to set up a basic privacy and security policy which they should have had already. This doesn't cost much.

> Except that controller must agree to every sub-processor you use.

This can be a generic agreement where the processor notifies the processor.

> Want to switch from AWS to GCP? You can only do it if all your customers agree.

Not true, you do however need to be able to tell customers what companies receive their data. Which can be quite a challenge with sub-sub-subcontractors.

Want to use try out a new metrics or logging service? If it will have any PII you can't do it without customer (controller) permission.

Not true if the processing agreement contains a clause that instructs processor to perform metrics or logging. Customer consent is often not needed unless it has big impact on their privacy. Consent is only one of the legal grounds.

> You will basically need to hire full-time compliance officers to deal with this. The big tech companies already have compliance officers, but GDPR is so massively invasive to businesses that even small companies now need compliance officers.

If this were true I'd be a lot busier. It would be wise if companies assign the responsibility for privacy and security, but it doesn't always need to be a full time job with a level background.

Re: How the GDPR Will Disrupt Google and Facebook

#216

Post by Spivak » Thu, Aug 31, 2017, 3:10 AM UTC

cbr wrote: post #159

antoncohen wrote: post #94

I encourage a little more thought before cheering this on as a win. While GDPR isn't as ridiculous as the Cookie Law, it still shows that the EU/EC don't understand the technology they are trying to regulate, and it comes at a huge cost to tech companies. Take the right to be forgotten . First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't…

If you follow GDPR strictly you would need to be able to purge the data from your backups. Now most backups are considered immutable, so you aren't going to do that Encrypt with a user-specific key, and destroy that key to drop all backups concerning that user.

This only applies to home grown backup systems. If all you're doing are VM backups of your SQL database there's 0% chance you have the granularity to delete a single user.

"Then don't do that"

Sure, but now you actually have an imposition because the ability to do this kind of thing can't be done on any commercially available backup system.

Re: How the GDPR Will Disrupt Google and Facebook

#217

Post by MarkMc » Thu, Aug 31, 2017, 3:19 AM UTC

josephg wrote: post #203

FridgeSeal wrote: post #195

Earlier quoted context omitted.

This is not an unsolvable problem. Does your data not have a lifetime anyways? Do you really need to store everything forever? If you have system that just tracks changes and one that occasionally records full state, after you delete someone from prod you could simply overwrite old full-state backups with your new, post-deletion backup and update your change-only backups to replace data about that user with `deleted`…

There is also a pretty easy cryptographic solution for your offline backups: In your backup, encrypt each user's data using a per-user key (AES or something). The keys will be tiny, so you can store the keys in a hot database. When a user deletes their account, simply purge the user's key. Tada - like magic all of that user's data on your tape backups has turned into unreadable noise.

This makes me very nervous about data loss. If I accidentally wipe the hot database then I've effectively deleted all my backups. It also makes corporate ramsomware attacks much easier.

Re: How the GDPR Will Disrupt Google and Facebook

#218

Post by aninhumer » Thu, Aug 31, 2017, 3:30 AM UTC

scythe wrote: post #178

antoncohen wrote: post #127

Earlier quoted context omitted.

It isn't that simple. When people think about these privacy laws that is what they think about, some evil corporation tracking tons of private info. The company I work for has no ads. It does no analytics on personal info. It does nothing you would care about. What it is is a SasS product for businesses. We aren't the controller, so we don't need permission from end users, our customers need to get permission from th…

>The company I work for has no ads. It does no analytics on personal info. It does nothing you would care about. What it is is a SasS product for businesses. We aren't the controller, so we don't need permission from end users, our customers need to get permission from their customers. But end users can ask our customer (the controller) to delete data, and our customer can ask us (the processor) to delete it. So you…

Based on what they said, it sounds like they store personal info on behalf of their business clients, but don't look at it themselves. Their point is that this law still requires them to implement the granularity to delete individual records so their clients can be compliant.

(I don't think it absolves them of any responsibility to implement privacy measures, but it does at least make sense.)

Re: How the GDPR Will Disrupt Google and Facebook

#219

Post by MarkMc » Thu, Aug 31, 2017, 3:31 AM UTC

Spivak wrote: post #212

spydum wrote: post #181

Earlier quoted context omitted.

You missed the point: if I take an image backup of a disk and store it, even in encrypted format, and it contains John Doe's account, and he comes along and asks for his account deleted, I would have to purge not just my database record, but the backups images from the past as well. That invalidates ALL of my backups. It's not often practical to backup INDIVIDUAL users..

As long as you have clearly defined retention policies I don't think saying, "your account has been deleted. It will take 90 days for the deletion to filter though our backups. After that point all of your data will be gone forever" would go against the spirit of the law.

I really hope this approach is acceptable to the EU authorities.

Re: How the GDPR Will Disrupt Google and Facebook

#220

Post by taysic » Thu, Aug 31, 2017, 3:52 AM UTC

Spivak wrote: post #211

taysic wrote: post #186

Earlier quoted context omitted.

"the application of the GDPR will prevent them from using these personal data for any further purpose unless the user permits." This seems incredibly broad from the article and would touch nearly every startup. Maybe there are limits on the businesses affected? Otherwise I'm not sure how one could formally define "rely heavily on lack of privacy for monetisation."

This law will affect everyone but it seems like it will devastate companies that have no monetization strategy other than collecting user data and either selling it or mining it for targeted ad placements. https://unroll.me/ is a good example. They provide a free service to users but make money by leveraging their total access to your inbox to sell ad analyics and competitive intelligence.

It could also devastate small companies at an early stage which need to dedicate resources to get into compliance rather than building their product.

It might hurt the bad players but it really depends on how readable the text will be to the average user. If it's going to be a checkbox it will likely not do much.