Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

71–80 of 710 posts

Re: How GDPR Will Change The Way You Develop

#71

Post by ryandrake »

reynoldsbd wrote: post #64
ryandrake wrote: post #49

Earlier quoted context omitted.

I just find it hard to believe that the law is a significant cost to companies already doing the right thing. Sure, there is a non zero cost to ensuring your existing practices are lawful, which everyone must pay. But companies already in compliance shouldnt have to modify or create anything. The companies that have to spend significant coin are the ones who are not already complying.

This is incredibly false. When you change the law, you can't assume that people who are currently in compliance will continue to be.

To use a silly extreme: if a new law came out that said I couldn’t yell profanities at my customers, I’m already compliant.

Re: How GDPR Will Change The Way You Develop

#72

Post by aeorgnoieang »

robin_reala wrote: post #69
aeorgnoieang wrote: post #58

What's troubling to me is that it's very unclear what specifically is required. I know the linked post isn't legal advice, but in the page about 'privacy by design' linked to by the origin link, they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! Can a…

> Can any site just 'do an end run around' the law by requiring their users to agree to allow them to collect whatever data they collect now or that they've already collected? No: a consent from a user must be for granular information with a specific listed purpose.

How granular? Every field? Every character? Every bit?

Re: How GDPR Will Change The Way You Develop

#73

Post by aeorgnoieang »

mfoy_ wrote: post #44

>GDPR will require developers to know the legal and policy landscape of their profession. (This has been the norm for other fields for centuries: how embarrassing for us.) Favourite takeaway.

I thought that was needlessly snarky. I'm pretty sure other fields rely on lawyers to know the relevant legal landscape just like we do.

Re: How GDPR Will Change The Way You Develop

#74

Post by nemetroid »

lostcolony wrote: post #43
trothamel wrote: post #21

Earlier quoted context omitted.

There's a big difference between "in the EU" and "with people who reside in the EU". When I come to the EU to do business, sure, I'll comply with their laws. But it's very different to expect people who live outside the EU to respect EU laws, just because someone from the EU happens to choose to visit their website. I don't see this as any different than if someone in the EU was to visit a convenience store in the US…

For the same reason that downloading a song is different than stealing with a CD. Digital stuff is innately different. You aren't doing business unless you're accepting payments/selling/shipping things to people in the EU. And as with any law, if you're sufficiently small fry the EU isn't going to care about you until you actually screw up. Don't accept euros as currency. Don't offer to ship to EU nations. Done. If y…

> Don't accept euros as currency.

I see multiple comments mentioning this. Do American banks restrict which currencies your credit card can be charged in? As far as I've been able to tell, my bank lets me pay in any currency I'd like, and they will convert the amount to SEK before charging my account.

Re: How GDPR Will Change The Way You Develop

#75

Post by reynoldsbd »

ryandrake wrote: post #71
reynoldsbd wrote: post #64

Earlier quoted context omitted.

This is incredibly false. When you change the law, you can't assume that people who are currently in compliance will continue to be.

To use a silly extreme: if a new law came out that said I couldn’t yell profanities at my customers, I’m already compliant.

Counterexample: comedy central now has to work to redact all noncompliant programming.

Best practices are funny because context and history are important. Actual regulation is not so forgiving.

Re: How GDPR Will Change The Way You Develop

#76

Post by wastedhours »

aeorgnoieang wrote: post #58

What's troubling to me is that it's very unclear what specifically is required. I know the linked post isn't legal advice, but in the page about 'privacy by design' linked to by the origin link, they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! Can a…

This is one of the things that's bothered me with it - in a similar vein to VATMOSS, GDPR will probably have more of a burden on smaller businesses, whereas larger business will have the development/consultant resource to get it right, and have those larger law firms to provide that "extra context" to brush things under the carpet if something goes awry.

The ICO seems reasonable, so hopefully they won't crush a small software shop for fucking up on something, but they're going to want to go after some people to send a message at some point. I'd guess you'd want to check that professional indemnity insurance policy, just in case.

It is, of course, all down to context. You need to show that you at least took the guidance seriously and tried to mitigate things. A notice of "collect ALL THE THINGS" won't fly, as you're basically admitting you're not prepared to consider it.

I think you're right on the social media sharing thing, it should be fairly well handled by the OAuth notices from most networks (I'd have guessed - "allow this app to post on my behalf" counts as consent?), but yeah, can't be taken as a given. IANAL, of course.

Re: How GDPR Will Change The Way You Develop

#77

Post by setra »

robin_reala wrote: post #66
setra wrote: post #52

In this article the author states: "The latter definition is important for developers. It includes things like IP addresses, mobile device IDs, browser fingerprints, RFID tags, MAC addresses, cookies, telemetry, user account IDs, and any other form of system-generated data which identifies a natural person.". This information does NOT automatically qualify as personal data. Information being unique is not the same as…

Are you mixing up ‘personal data’ and ‘personally identifiable information’ (a US legal concept that differs from the EU definition of personal data)?

No, I am simply using shortened text not the USA PII legal concept. GDPR has many more restrictions than the USA concept of PII.

Re: How GDPR Will Change The Way You Develop

#78

Post by [deleted] »

robin_reala wrote: post #66
setra wrote: post #52

In this article the author states: "The latter definition is important for developers. It includes things like IP addresses, mobile device IDs, browser fingerprints, RFID tags, MAC addresses, cookies, telemetry, user account IDs, and any other form of system-generated data which identifies a natural person.". This information does NOT automatically qualify as personal data. Information being unique is not the same as…

Are you mixing up ‘personal data’ and ‘personally identifiable information’ (a US legal concept that differs from the EU definition of personal data)?

[deleted]

Re: How GDPR Will Change The Way You Develop

#79

Post by _o_ »

Feniks wrote: post #41
_o_ wrote: post #17

I will show you another case, company that isnt "bitching" over laws that are good for all humans not just EU and does the right thing, you know backblaze, right? "The changes that are being made by companies such as Backblaze to comply with GDPR will almost certainly apply to customers from all countries. And that’s a good thing. The protections afforded to EU citizens by GDPR are something all users of our service…

Everyone is freaking out. If GDPR is a success Americans may want it too. The same happened with Steam refunds.

But that is good, right?

Re: How GDPR Will Change The Way You Develop

#80

Post by fencepost »

teeray wrote: post #15
breakingcups wrote: post #9

Earlier quoted context omitted.

It's quite simple. If you want to do business in the EU or with people who reside in the EU, you need to comply with the EU's regulations. Don't like it? Don't do business in/with the EU. Then you're free to ignore their frameworks, rules and regulations. They are not trying to "impose their regulations on the rest of the world", they're trying to protect the privacy of their inhabitants. That this leads to measures…

If a business decides to opt-out of doing business with the EU as a result, what measures do they need to take? Would a banner asking "Are you an EU citizen? Yes/No" suffice? Or would we have to use some kind of Geo IP tool? How would that defend against EU citizens using a VPN or Tor, and what would a business's liability be in that case?

You might need to add something to your terms asking the lines of users certifying that they are not EU residents or citizens and agree to not move to any EU country, and if they do any of those things they agree to indemnify you for any legal expenses or fines resulting from that.

Completely unenforceable though.

Post reply on HN