Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

111–120 of 710 posts

Re: How GDPR Will Change The Way You Develop

#111

Post by paulsutter »

Azeralthefallen wrote: post #100

I am curious, if you offered a service that allowed users to post their own data to your service. How do you protect against customers posting data that violates the GDPR. I.e. peoples personal information being posted in plaintext? Is this type of case covered by the GDPR? Also how are things like access logs supposed to handled according to the GDPR? Our software records all requests made to our API, they log your…

It should be very clear to the user how the data will be used and shared. If a hotel asks for free-form feedback, it shouldn't magically post the response as a review, under the user's name, on a public site, for example.

Re: How GDPR Will Change The Way You Develop

#113

Post by kelnos »

aidos wrote: post #107

How are people planning on implementing GDPR at the DB level? What about DB backups?

With a documented data retention and deletion policy. You don't need to keep your DB backups forever, and a request to delete someone's data comes with some reasonable amount of leeway as to how long it takes you to delete it. Obviously you can't drag that out for a year, but from what I've been hearing, a month or two isn't unreasonable.

If you're doing DB backups daily, expiring backups after a month (or even, say, two weeks), should be no problem and not an operational risk at all.

Re: How GDPR Will Change The Way You Develop

#114

Post by dominotw »

lmkg wrote: post #91
aeorgnoieang wrote: post #58

What's troubling to me is that it's very unclear what specifically is required. I know the linked post isn't legal advice, but in the page about 'privacy by design' linked to by the origin link, they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! Can a…

> ...they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). > What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! The GDPR says when you collect data, you have to tell the user what you intend to use it for. "Minimization" applies within the context of those stated uses. So if your business purpose is to m…

my company seems to be going on a encrypt everything spree. I am not sure how GDPR requires encryption.

Can you be GDPR complaint ( in theory) with zero encryption?

Re: How GDPR Will Change The Way You Develop

#115

Post by s73v3r_ »

tempodox wrote: post #108

I built an app that displays geolocations of tweets on an OpenStreetMap. That data is publicly available from Twitter and users share their location willingly, I presume. Will an app like that become illegal, as far as European tweeters are concerned?

What? Of course not. This law doesn't make apps "illegal".

What the law does is put regulations around what kind of personal data you can collect and store from your users, require you to explain what you're doing with that data, and allow your users to opt out of having that data collected.

Re: How GDPR Will Change The Way You Develop

#116

Post by jcadam »

aidos wrote: post #107

How are people planning on implementing GDPR at the DB level? What about DB backups?

Purging a user's data is probably a matter of writing a short SQL/Python/Bash script for most databases (don't forget the audit tables, though it kind of defeats the purpose of audit tables, but whatever). It's something I'd only do on request (I'd expect it to be a rare occurrence), certainly not going to automate that sort of thing.

I'm not about to go risk corrupting my backups trying to scrub old customer data out of them. Perhaps only keep the last X days of backups and let the paranoid customer's data attrit out naturally?

Re: How GDPR Will Change The Way You Develop

#117

Post by kelnos »

ryandrake wrote: post #67
lmkg wrote: post #62

Earlier quoted context omitted.

I presume you're talking about things like informing users how their data might be used, storing user data securely, and not selling it to third parties. That sort of stuff is relatively easy. The GDPR imposes some new requirements that were not previously part of any privacy best-practices that I'm aware of, and that create some system complexity. Chief among these is the right for users to retract consent after it…

Thanks for the details! I can see how this could get costly for complex systems. As a user though I would think all those things you listed would be existing privacy best practices but I guess that’s being way too optimistic. Scary what companies are currently getting away with, too but not surprising.

I think you're right in that those things would be (or should be) considered "privacy best practices", but, unfortunately, most companies don't have "following privacy best practices" all that high on their list of priorities.

It's not even malicious; in the absence of regulation to the contrary, companies -- especially companies still in search of a revenue model -- have an incentive to collect as much information as possible.

Re: How GDPR Will Change The Way You Develop

#118

Post by AndrewKemendo »

I've been digging into GDPR for the last year or so and the major conclusion I came away with was that, in effect, it is a massive effort to educate the population about data collection and processing online while also beefing up guarantees for data security.

As in, it's not illegal to to do most of the same things we do now with data, however we now need to educate our users on what data we are using and exactly how we are using it, in a way that is understandable to the average user.

With all due respect to the average user, I cannot fathom how anyone doing anything with user data more complicated than a basic record will explain it simply enough to be in compliance.

Re: How GDPR Will Change The Way You Develop

#119

Post by s73v3r_ »

reynoldsbd wrote: post #11
faitswulff wrote: post #5

Does anyone know of US companies implementing GDPR compliance?

Absolutely! Anybody who does business in Europe or even has users in Europe is subject to this law. The amount of effort being put into GDPR compliance within my organization is just staggering. It really makes me think about these kind of laws from a new perspective, because they cost businesses so much to implement. (I'm not saying whether GDPR is right or wrong! Just that it's expensive.)

Yeah, but is it expensive because of how you were set up before? In other words, if you weren't set up to be so cavalier with user's data before, would it be as expensive now?

Re: How GDPR Will Change The Way You Develop

#120

Post by the_mitsuhiko »

aeorgnoieang wrote: post #73
mfoy_ wrote: post #44

>GDPR will require developers to know the legal and policy landscape of their profession. (This has been the norm for other fields for centuries: how embarrassing for us.) Favourite takeaway.

I thought that was needlessly snarky. I'm pretty sure other fields rely on lawyers to know the relevant legal landscape just like we do.

> I'm pretty sure other fields rely on lawyers to know the relevant legal landscape just like we do.

I have plenty of friends and relatives who work in construction or architecture and knowing the building codes and everything related to it is something you learn at university, update every year and is something every person involved in planning and constructing a building is aware of. Lawyers only get involved if a building fails.

Post reply on HN