How the GDPR Will Disrupt Google and Facebook • Hacker News Board

Re: How the GDPR Will Disrupt Google and Facebook

#311

Post by MarkMc » Thu, Aug 31, 2017, 11:19 AM UTC

josephg wrote: post #242

MarkMc wrote: post #217

Earlier quoted context omitted.

This makes me very nervous about data loss. If I accidentally wipe the hot database then I've effectively deleted all my backups. It also makes corporate ramsomware attacks much easier.

So keep a backup of your hot database in S3 or something, and make a workflow by which you can periodically update it. Or make a write-only backup of your encryption keys every day and only keep the backups for a week (or a month, or whatever the legal requirement is). Complying with this requirement will require us as an industry to make some changes to how we store user data. But the amount of work each company nee…

> make a write-only backup of your encryption keys every day and only keep the backups for a week (or a month, or whatever the legal requirement is).

A month would be better than a week, but it still allows a situation where the wrong user account is accidentally deleted and the mistake is not noticed for a more than month.

I think the best approach is for the EU regulation to give the company 90 days to delete the user's data. The company can then just have a cron job to delete older backups. Simple.

Re: How the GDPR Will Disrupt Google and Facebook

#312

Post by logicchains » Thu, Aug 31, 2017, 1:58 PM UTC

majewsky wrote: post #282

logicchains wrote: post #232

Earlier quoted context omitted.

>If you give away freedom for economic gain, you don't deserve either one. What gives you the right to deny others the right to trade their personal information as they see fit?

You make it sound as though the majority of Facebook users were making a conscious decision to trade personal information, whereas the usual thought process is "it's free! and everyone's doing it!".

Most people simply don't care. It constantly surprises me how paranoid people in the technology community are about their social interaction and browsing data.

Re: How the GDPR Will Disrupt Google and Facebook

#313

Post by closeparen » Thu, Aug 31, 2017, 2:14 PM UTC

josephg wrote: post #203

FridgeSeal wrote: post #195

Earlier quoted context omitted.

This is not an unsolvable problem. Does your data not have a lifetime anyways? Do you really need to store everything forever? If you have system that just tracks changes and one that occasionally records full state, after you delete someone from prod you could simply overwrite old full-state backups with your new, post-deletion backup and update your change-only backups to replace data about that user with `deleted`…

There is also a pretty easy cryptographic solution for your offline backups: In your backup, encrypt each user's data using a per-user key (AES or something). The keys will be tiny, so you can store the keys in a hot database. When a user deletes their account, simply purge the user's key. Tada - like magic all of that user's data on your tape backups has turned into unreadable noise.

Now you have to apply the same solution recursively to the keys database.

Re: How the GDPR Will Disrupt Google and Facebook

#314

Post by ionised » Thu, Aug 31, 2017, 2:20 PM UTC

logicchains wrote: post #232

kartan wrote: post #63

Earlier quoted context omitted.

> We as European businessmen were and still are unable to generate the same kind of innovation as the US Tracking people around the internet. To follow them everywhere they go and save their personal information, their political ideology, etc. It is not innovation, that's just stepping over personal rights. > I don't think it is about ethics, it is about control. Yes. About giving back control of citizen privacy to t…

>If you give away freedom for economic gain, you don't deserve either one. What gives you the right to deny others the right to trade their personal information as they see fit?

New laws.

What gives you the right to decide that corporations are free to use my personal information for whatever they please?

Re: How the GDPR Will Disrupt Google and Facebook

#315

Post by ionised » Thu, Aug 31, 2017, 2:22 PM UTC

wolco wrote: post #99

Sir_Substance wrote: post #90

Earlier quoted context omitted.

>We as European businessmen were and still are unable to generate the same kind of innovation as the US I don't want US innovation. Thanks for the offer.

Does that mean you avoid services like facebook or google? Many of those innovations are based on data collection and using that to make customer segments to sell targeted ads. Without that model you may be asked to pay a few dollars or see additional ads that are more likely to be less interesting.

I avoid them like I avoid a wildfire. Have done for nearly 5 years after I came to terms with the scale of the data collection they were performing.

Re: How the GDPR Will Disrupt Google and Facebook

#316

Post by [deleted] » Thu, Aug 31, 2017, 2:26 PM UTC

bflesch wrote: post #57

the_mitsuhiko wrote: post #52

Earlier quoted context omitted.

> I see this as yet another tax on (European) startups who have to invest even more resources into regulatory compliance. This also affects American companies and the degree it affects you primarily depends on how much of your business model was depending on you doing nefarious things with customer data.

Of course this affects american companies, as the whole thing is primarily designed as a weapon for the EU against US dominance in the consumer space. The big problem for the EU is that consumers actually choose the best product in a free market (the internet of free services), and they overwhelmingly decided to use the US-based options. All the framing as "nefarious" is propaganda, consumers choose freely the option…

[deleted]

Re: How the GDPR Will Disrupt Google and Facebook

#317

Post by dangerface » Thu, Aug 31, 2017, 2:29 PM UTC

antoncohen wrote: post #94

I encourage a little more thought before cheering this on as a win. While GDPR isn't as ridiculous as the Cookie Law, it still shows that the EU/EC don't understand the technology they are trying to regulate, and it comes at a huge cost to tech companies. Take the right to be forgotten . First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't…

"the right to be forgotten" This is already in EU data protection law where data needs to be forgotten after its relevancy and a cool down period, it considers and covers things like your example.

"purge the data from your backups" Again you should already be doing this if you do business with the EU or you are breaking the law.

"Do you have the ability to retrieve everything you know about a specific user" Again this is already in the EU data protection law you should already be able to do this or you have been breaking the law.

Im not a lawyer so take this all with a pinch of salt this is just stuff I need to know as an EU developer. Sure it might be slightly more work for US tech companies but I can't be arsed is not a valid reason to break the law. If you think it will cost to much then don't do it, there are plenty of EU companies that do.

Re: How the GDPR Will Disrupt Google and Facebook

#318

Post by closeparen » Thu, Aug 31, 2017, 2:32 PM UTC

ubernostrum wrote: post #107

antoncohen wrote: post #94

I encourage a little more thought before cheering this on as a win. While GDPR isn't as ridiculous as the Cookie Law, it still shows that the EU/EC don't understand the technology they are trying to regulate, and it comes at a huge cost to tech companies. Take the right to be forgotten . First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't…

First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't like the content I think a lot of EU people (I'm not one) would disagree with you here. The notions of privacy and of the goals of the criminal-justice system in several parts of Europe are radically different from the notions your "common sense" position is based on, which means that wh…

It may surprise some HN readers that 1984 was in fact not about a lack of pricacy, but about the government's ability to edit the past. Privacy had a minor role next to the ability to redefine the truth. This is a deeply scary thing. I hope the gleefully self-righteous dystopia builders in this thread get to suffer the full pain of the "right to edit other people's memories" world they are building.

Re: How the GDPR Will Disrupt Google and Facebook

#319

Post by raugustinus » Thu, Aug 31, 2017, 2:40 PM UTC

mbroncano wrote: post #171

raugustinus wrote: post #122

Earlier quoted context omitted.

That's like a 50+ word sentence. I do hate these legal shenanigans. If you can't write it in plain English is not worth the bytes taken.

You can argue against the chosen font type, and it'd be still irrelevant. Most educated adults are able to read sentences longer than a few words. For the rest, trust your representatives.

It's not about people being able to read it. It's about trying to be intellectual. Long sentences are usually prone to interpretation. There is no value in making sentences this long. But that's just my opinion.

Re: How the GDPR Will Disrupt Google and Facebook

#320

Post by closeparen » Thu, Aug 31, 2017, 2:49 PM UTC

nvarsj wrote: post #95

antoncohen wrote: post #94

I encourage a little more thought before cheering this on as a win. While GDPR isn't as ridiculous as the Cookie Law, it still shows that the EU/EC don't understand the technology they are trying to regulate, and it comes at a huge cost to tech companies. Take the right to be forgotten . First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't…

> it comes at a huge cost to tech companies Doesn't it just affect companies which rely heavily on lack of privacy for monetisation? I think that's sort of the point - that your business should not rely on tracking individuals and selling that information without their consent to gov/private bodies. It's obviously a huge change, since so many big tech players rely on this to make profits. But the internet will be a m…

Doesn't it affect everyone with a user account system, storage of user-generated data, error logging, usage and performance metrics, etc?

HN itself is illegal under EU regulations because you can't delete old comments, and we know that the admins know how many RPS they are getting but I haven't specifically opted in to using records of my HTTP requests for traffic monitoring.