Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

121–130 of 710 posts

Re: How GDPR Will Change The Way You Develop

#121

Post by grabeh »

dominotw wrote: post #114
lmkg wrote: post #91

Earlier quoted context omitted.

> ...they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). > What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! The GDPR says when you collect data, you have to tell the user what you intend to use it for. "Minimization" applies within the context of those stated uses. So if your business purpose is to m…

my company seems to be going on a encrypt everything spree. I am not sure how GDPR requires encryption. Can you be GDPR complaint ( in theory) with zero encryption?

The GDPR, as with existing EU data protection law requires technical & organisational measures in place to protect data. The GDPR specifically calls out (Article 32 if you're interested) encryption as one measure that entities should consider in determining whether their technical & organisational measures are fit for purpose.

Generally speaking, encryption is an obvious choice when it comes to measures designed to protect user data.

Re: How GDPR Will Change The Way You Develop

#122

Post by the_mitsuhiko »

Azeralthefallen wrote: post #100

I am curious, if you offered a service that allowed users to post their own data to your service. How do you protect against customers posting data that violates the GDPR. I.e. peoples personal information being posted in plaintext? Is this type of case covered by the GDPR? Also how are things like access logs supposed to handled according to the GDPR? Our software records all requests made to our API, they log your…

> I am curious, if you offered a service that allowed users to post their own data to your service. How do you protect against customers posting data that violates the GDPR. I.e. peoples personal information being posted in plaintext?

You ensure that those users have a way to delete the data again.

Re: How GDPR Will Change The Way You Develop

#123

Post by s73v3r_ »

sb8244 wrote: post #45
ryandrake wrote: post #35

Earlier quoted context omitted.

I would (maybe naively) think that the cost of GDPR compliance would be small if your company is already safeguarding user data and respecting user privacy. If a company’s cost is “staggering“ doesn’t that say a lot about its existing privacy practices?

I'm not sure. I think this is a very absolutist and probably naive way to look at it, frankly. For a simple example, let's say you use an immutable data store. What do you do if a customer wants every info about them redacted, but you did something like store their IP, name, or email. All common things. Now you must build mutability into your store and all assumptions that used to be made can be removed. This is just…

Right, but you had assumptions built into your data store before, namely that you could keep all info about someone for eternity, and that you'd never have to correct it.

Re: How GDPR Will Change The Way You Develop

#125

Post by s73v3r_ »

mfoy_ wrote: post #29

This article is all very well and good, my only concern is that, imagine in a few years someone wants to find the list of all the laws and regulations and frameworks and whatnot that they need to comply with to run a truly international website... where would they find that information?

Same place you'd go for any questions about the law: an expert. Just like if you thought you had cancer, you'd go see a doctor.

Re: How GDPR Will Change The Way You Develop

#126

Post by x0x0 »

realbarack wrote: post #104
Azeralthefallen wrote: post #100

I am curious, if you offered a service that allowed users to post their own data to your service. How do you protect against customers posting data that violates the GDPR. I.e. peoples personal information being posted in plaintext? Is this type of case covered by the GDPR? Also how are things like access logs supposed to handled according to the GDPR? Our software records all requests made to our API, they log your…

I am not a lawyer nor a security expert but we've decided at the place where I work that unstructured fields which are unlikely to contain personal data—but might in edge cases where a user chooses to enter it—don't fall under the GDPR purview. An extreme example of this is in hosted email—if Alice writes an email to bob@gmail.com with some of Charlie's personal information, it would be absurd if Charlie could ask Go…

I have to guess this is why gmail stopped (or at least announced stopping) personalized targeting: the difficulty of deciding if anyone on the email is subject to GDPR.

Re: How GDPR Will Change The Way You Develop

#128

Post by kelnos »

mfoy_ wrote: post #29

This article is all very well and good, my only concern is that, imagine in a few years someone wants to find the list of all the laws and regulations and frameworks and whatnot that they need to comply with to run a truly international website... where would they find that information?

I think that problem will in some ways solve itself.

Ideally you want to consult with a lawyer to ensure you're in compliance. Certainly that's what we're doing where I work (we have dedicated in-house legal staff dedicated to privacy issues who have been taking point on this), but when you're smaller that can be prohibitively expensive.

Within a couple years, though, I expect any serious commercial or open source platform available that deals with data to have GDPR-related features. It's already starting to happen, and hopefully GDPR compliance won't be something you have to go out of your way to do; it'll just be a normal part of doing business that everyone understands.

The transition period will likely be rocky, and it's my hope that the EU will be initially lenient dealing with honest mistakes that companies work to quickly fix once discovered.

Re: How GDPR Will Change The Way You Develop

#129

Post by robin_reala »

lmkg wrote: post #105
msla wrote: post #95

Earlier quoted context omitted.

> The GDPR says when you collect data, you have to tell the user what you intend to use it for. Then that part is worthless, just another click-through "agreement" practically nobody reads. That part won't change anything. > So if your business purpose is to mail something to the customer, full physical address is OK to collect. If your business purpose is to help them find a nearby store location, you may be expecte…

> Then that part is worthless GDPR requires that the use cases be itemized, and the user can opt out of each one individually. So if the user opts out of receiving a mailing but not the store locator, you have to manage how much data you collect about that person. I agree that for the most part this will just be another click-through like the cookie law was, but companies will be required to accommodate those minorit…

Almost, it requires the users to actively opt in rather than opt-out.

Re: How GDPR Will Change The Way You Develop

#130

Post by epicide »

lostcolony wrote: post #43
trothamel wrote: post #21

Earlier quoted context omitted.

There's a big difference between "in the EU" and "with people who reside in the EU". When I come to the EU to do business, sure, I'll comply with their laws. But it's very different to expect people who live outside the EU to respect EU laws, just because someone from the EU happens to choose to visit their website. I don't see this as any different than if someone in the EU was to visit a convenience store in the US…

For the same reason that downloading a song is different than stealing with a CD. Digital stuff is innately different. You aren't doing business unless you're accepting payments/selling/shipping things to people in the EU. And as with any law, if you're sufficiently small fry the EU isn't going to care about you until you actually screw up. Don't accept euros as currency. Don't offer to ship to EU nations. Done. If y…

> You aren't doing business unless you're accepting payments/selling/shipping things to people in the EU.

I wonder how ads play into all this. E.g. are people who watch an ad on YouTube considered YouTube customers? Are they considered customers of the ad company?

My concern is that we will see more (non-EU) companies implement something where users "pay" for services/features by watching ads. I do also wonder how it then affects the ad companies if they collect personal information about the user. Does the user count as a "customer" if the ad company is the one paying?

Post reply on HN