Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

131–140 of 710 posts

Re: How GDPR Will Change The Way You Develop

#131

Post by jlg23 »

the_mitsuhiko wrote: post #120
aeorgnoieang wrote: post #73

Earlier quoted context omitted.

I thought that was needlessly snarky. I'm pretty sure other fields rely on lawyers to know the relevant legal landscape just like we do.

> I'm pretty sure other fields rely on lawyers to know the relevant legal landscape just like we do. I have plenty of friends and relatives who work in construction or architecture and knowing the building codes and everything related to it is something you learn at university, update every year and is something every person involved in planning and constructing a building is aware of. Lawyers only get involved if a…

Construction workers and architects don't tend to work internationally. If they do, they hire lawyers to sort out legal requirements for them before they even sign a contract.

Re: How GDPR Will Change The Way You Develop

#132

Post by x0x0 »

Azeralthefallen wrote: post #100

I am curious, if you offered a service that allowed users to post their own data to your service. How do you protect against customers posting data that violates the GDPR. I.e. peoples personal information being posted in plaintext? Is this type of case covered by the GDPR? Also how are things like access logs supposed to handled according to the GDPR? Our software records all requests made to our API, they log your…

The GDPR defines two types of companies: processors and controllers. The crucial distinction is (roughly) if a company makes decisions. Someone performing targeting or operating a website is probably a controller, whereas AWS, who makes no decisions and just follows directions, is a processor.

If you don't want to be a processor, the best thing to do is probably in your contracts disallow usage of your service for anything containing GDPR covered personal data.

As for access logs, those will be some mixture of the two bases offered in the GDPR. Some will be required by legitimate interests (such as those collected for legal requirements) and some will be subject to consent. This is a complex discussion.

Re: How GDPR Will Change The Way You Develop

#133

Post by mfoy_ »

aeorgnoieang wrote: post #90
mfoy_ wrote: post #81

Earlier quoted context omitted.

No. Professionals in engineering or the trades have to know the regulations that govern their industry and abide by them. What many SVers call "innovation", other industries would call "reckless". How embarrassing for us! EDIT: In terms of regulation, we're practically chiropractors.

A lot of what you might call 'avoiding recklessness' is demonstrably bad for some people so it's not clear that the current tradeoffs are optimal . And it's not at all obvious that, overall, regulation does much more than protect incumbents in a given field or industry at the expense of everyone else. Based on my own experience, I've 'known' about regulations that governed the industries with which I've worked. I'm n…

If we want to accept that privacy is important and valuable then we need to accept that it is not okay for our industry to continue to do what it has been doing.

I challenge you to give me an example of some "demonstrably bad" effect caused by "avoiding recklessness" that isn't the direct result of shirking responsibility.

To go along with your devil's advocate argument: I could argue that "taking extra measures to ensure the security of sensitive data" would have been "demonstrably bad" for Equifax. But don't you agree that it was extremely irresponsible of them to not do that?

Re: How GDPR Will Change The Way You Develop

#134

Post by whack »

Suppose you were a small startup based in America, accepting online payments from users/advertisers using American platforms or financial institutions. Suppose you make no effort to comply with GPDR - what realistic consequences can you face?

I suspect that this is the kind of thing which larger/established companies would worry about. If you're a seed/series-A startup, it seems like you have far more important things to focus on, because there's nothing that the EU can realistically do to you anyway.

Re: How GDPR Will Change The Way You Develop

#135

Post by x0x0 »

setra wrote: post #52

In this article the author states: "The latter definition is important for developers. It includes things like IP addresses, mobile device IDs, browser fingerprints, RFID tags, MAC addresses, cookies, telemetry, user account IDs, and any other form of system-generated data which identifies a natural person.". This information does NOT automatically qualify as personal data. Information being unique is not the same as…

cookies is about the only thing in there that may not qualify as personal data as defined by the gdpr.

Re: How GDPR Will Change The Way You Develop

#136

Post by robin_reala »

aleksei wrote: post #31
Tomte wrote: post #13

Earlier quoted context omitted.

Yes, if you're not willing to comply, that's exactly what you should do. OTOH it just shows your remaining customers that you're willing to do shitty things to them, as long as America is trailing in privacy legislation.

Geoblocking IPs is not a solution, unless you're willing to let some people slip through and block people who you don't need to block. Also, not everyone connecting from a EU country is a citizen thereof.

GDPR doesn’t just apply to citizens of EU countries, it also applies to residents and potentially people just passing through (e.g. changing flights at an EU hub).

Re: How GDPR Will Change The Way You Develop

#137

Post by x0x0 »

tempodox wrote: post #108

I built an app that displays geolocations of tweets on an OpenStreetMap. That data is publicly available from Twitter and users share their location willingly, I presume. Will an app like that become illegal, as far as European tweeters are concerned?

It's unclear. The GDPR definitely covers personal data even if publicly available, so just because you grabbed it from twitter doesn't make it kosher.

That said, realistically, I'd have a hard time imagining you would have too much difficulty as long as you allowed people to delete their data upon request. If they post something to twitter, the obvious intent is to make it very public.

Re: How GDPR Will Change The Way You Develop

#138

Post by Radim »

dominotw wrote: post #114
lmkg wrote: post #91

Earlier quoted context omitted.

> ...they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). > What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! The GDPR says when you collect data, you have to tell the user what you intend to use it for. "Minimization" applies within the context of those stated uses. So if your business purpose is to m…

my company seems to be going on a encrypt everything spree. I am not sure how GDPR requires encryption. Can you be GDPR complaint ( in theory) with zero encryption?

Of course—if you don't store personal data (trivially).

In fact, encryption (security) is mostly orthogonal to how you track and handle personal and sensitive data (privacy protection). You could encrypt everything and still be wildly GDPR non-compliant, if the encrypted information you're storing lacks clear purpose and explicit consent.

Re: How GDPR Will Change The Way You Develop

#139

Post by the_mitsuhiko »

jlg23 wrote: post #131
the_mitsuhiko wrote: post #120

Earlier quoted context omitted.

> I'm pretty sure other fields rely on lawyers to know the relevant legal landscape just like we do. I have plenty of friends and relatives who work in construction or architecture and knowing the building codes and everything related to it is something you learn at university, update every year and is something every person involved in planning and constructing a building is aware of. Lawyers only get involved if a…

Construction workers and architects don't tend to work internationally. If they do, they hire lawyers to sort out legal requirements for them before they even sign a contract.

The same should be true for most software companies going forward. The approach to just assume it's the obligation of the user to ensure compliance won't work for much longer.

Re: How GDPR Will Change The Way You Develop

#140

Post by TheCoelacanth »

aeorgnoieang wrote: post #58

What's troubling to me is that it's very unclear what specifically is required. I know the linked post isn't legal advice, but in the page about 'privacy by design' linked to by the origin link, they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! Can a…

What is specifically required is pretty clear:

You must provide the user with a detailed description of what personal data of theirs you are collecting, who you are sharing it with and what your business purpose for collecting it is, and if the data is something that you need their consent to collect, you get their explicit consent to collect that data and you must let them opt-out of providing that consent without preventing them from doing business with you.

Post reply on HN