Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

151–160 of 710 posts

Re: How GDPR Will Change The Way You Develop

#151

Post by woolvalley »

pjc50 wrote: post #96
aeorgnoieang wrote: post #58

What's troubling to me is that it's very unclear what specifically is required. I know the linked post isn't legal advice, but in the page about 'privacy by design' linked to by the origin link, they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! Can a…

> What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! You decide, based on context and consent. I think consent now needs to be non-blanket. > That's a really unsettling description of a law I know it's not ideal, but it's far from the only vague area. The law of negligence is very important to anyone running a business and is almost entirely caselaw, for example. It's also a…

A good chunk of europe isn't common law, how much does case law apply in these cases? In those countries the statute matters a lot more.

Re: How GDPR Will Change The Way You Develop

#152

Post by PeterisP »

msla wrote: post #95
lmkg wrote: post #91

Earlier quoted context omitted.

> ...they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). > What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! The GDPR says when you collect data, you have to tell the user what you intend to use it for. "Minimization" applies within the context of those stated uses. So if your business purpose is to m…

> The GDPR says when you collect data, you have to tell the user what you intend to use it for. Then that part is worthless, just another click-through "agreement" practically nobody reads. That part won't change anything. > So if your business purpose is to mail something to the customer, full physical address is OK to collect. If your business purpose is to help them find a nearby store location, you may be expecte…

The fines are up to €20 million, or 4% annual global turnover – whichever is higher.

Of course, paying the fine doesn't mean that you can continue with the action - it'd also likely involve imposing a temporary or permanent ban on data processing and ordering the rectification, restriction or erasure of data gathered unlawfully.

Re: How GDPR Will Change The Way You Develop

#153

Post by Radim »

aeorgnoieang wrote: post #58

What's troubling to me is that it's very unclear what specifically is required. I know the linked post isn't legal advice, but in the page about 'privacy by design' linked to by the origin link, they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! Can a…

> What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so!

Elizabeth Denham, UK's information commissioner in charge of data protection enforcement, had this to say:

"Having larger fines is useful but I think fundamentally what I'm saying is it's scaremongering to suggest that we're going to be making early examples of organisations that breach the law or that fining a top whack is going to become the norm. Our office will be more lenient on companies that have shown awareness of the GDPR and tried to implement it, when compared to those that haven't made any effort."

In other words, the compliance decision is not in your hands, but there's a promise of certain lenience. At least to start with.

A practical trouble is that once a company reaches a certain size, they no longer even know what data they have, never mind why. Do we already store personal data? Where? Is it important data such as "names + credit cards", or some god-forgotten IP addresses in a log? Email archives and attachments? How about GoogleDrive and SharePoint? Then, do we redact it, or delete it? How? How do we answer Subject Access Requests?

We've built a product to help companies take care of the most common "private data" cases (https://gdpr-tools.eu), but we're not fooling ourselves that we've solved "personal data". Or that the task is even solvable. That whole space is very much in turmoil and how hard the GDPR whip will get cracked remains to be seen.

Funnily, one of the common fears that clients have is not about the general public. It comes from disgruntled employees ratting on the company. Employees know best where personal data is stored (and often no one else in the company does), so they can really do some surgical damage by reporting their employer to the "authorities".

Re: How GDPR Will Change The Way You Develop

#154

Post by number6 »

kelnos wrote: post #110
jlnthws wrote: post #86

Earlier quoted context omitted.

So nice to see progress in privacy but please someone explains how GDPR will help EU startups! GDPR is inevitably going to hinder any new company forced to abide by it. So the next Uber/Wechat will first flourish in US/China/Russia and then come to the EU, not the other way around. Entrepreneurs / investors also want their time & money to be used to build value first rather than solve yet another accidental complexit…

I wouldn't say marginal, but it is a lot easier to implement GDPR if you do it up-front, from day one. If you start off with a policy of just not collecting or storing information unless you've made a conscious decision that you really do need it, that's a huge start. From there, you your main obligations are to ensure that any personal data you do collect can be deleted at a reasonably granular level, and that you d…

The GDPR is not that far from existing laws in the EU. So EU company have a headstart

Re: How GDPR Will Change The Way You Develop

#155

Post by woolvalley »

everdev wrote: post #102
Azeralthefallen wrote: post #100

I am curious, if you offered a service that allowed users to post their own data to your service. How do you protect against customers posting data that violates the GDPR. I.e. peoples personal information being posted in plaintext? Is this type of case covered by the GDPR? Also how are things like access logs supposed to handled according to the GDPR? Our software records all requests made to our API, they log your…

Typically, privacy violations are instances where the user has not consented to sharing the information. In the scenario you describe, if someone willingly posts their own personal information they have forfeited their right to privacy. The law is meant to protect people from companies rather than people from themselves.

Your joe blogger using somesmallwordpresshosting.com and you have a freeform comments page. People post 'private' comments of others. Who is responsible for what? How the fuck do you know if its of an 'EU citizen' if that isn't made obvious? Can you get fined literal millions because you fucked up some detail for your blog newsletter's email list?

Re: How GDPR Will Change The Way You Develop

#156

Post by justonepost »

aeorgnoieang wrote: post #58

What's troubling to me is that it's very unclear what specifically is required. I know the linked post isn't legal advice, but in the page about 'privacy by design' linked to by the origin link, they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! Can a…

Agreed, if that page is accurate, than basically it was all very best effort, except some things about requiring consent.

Re: How GDPR Will Change The Way You Develop

#157

Post by estel »

whack wrote: post #134

Suppose you were a small startup based in America, accepting online payments from users/advertisers using American platforms or financial institutions. Suppose you make no effort to comply with GPDR - what realistic consequences can you face? I suspect that this is the kind of thing which larger/established companies would worry about. If you're a seed/series-A startup, it seems like you have far more important thing…

If your company is not targeting the EU as a market you are out of scope of GDPR.

If you explicitly accept Sterling/Euros, provide localisations for EU countries, talk explicitly about your EU shipping options etc. then you would probably be seen as accommodating the EU market and might find yourself in scope.

Re: How GDPR Will Change The Way You Develop

#158

Post by grabeh »

reynoldsbd wrote: post #55
ryandrake wrote: post #35

Earlier quoted context omitted.

I would (maybe naively) think that the cost of GDPR compliance would be small if your company is already safeguarding user data and respecting user privacy. If a company’s cost is “staggering“ doesn’t that say a lot about its existing privacy practices?

Definitely not true. GDPR significantly broadens the types of data subject to legal requirements. Whereas yesterday I only had to protect PII and content, now even telemetry and performance data becomes subject to new rules. This is a huge problem for an org that relies on huge amounts of such data to keep our product running and uses systems which were never built with these new rules and classifications in mind. Fu…

I think the main issue that I see is that whilst GDPR doesn't massively expand the scope of what is personal data beyond that under existing data protection law, it does expand the territorial reach of data protection law.

US companies who previously had the narrow scope of PII to handle, now have to consider the much broader scope of 'personal data'. I am sure that for lots of US companies providing services to EU citizens/residents that will definitely represent a substantial burden.

Even for EU companies, the reality is that many will have previously taken a view that the size of potential fines was not high enough to warrant giving certain matters that much attention or at least spend money on areas they considered more important. For example, if I have a choice between implementing additional security measures to protect my network versus building functionality to delete on command, many companies will have gone with the former.

On retention, my view is that if you consider it necessary to retain information for purposes of auditing/security, and have made that clear in your contract with the client (who would then should make that clear in their privacy notice if they don't already have a general caveat around that), then the right to delete under Art 17 does not kick in because Art 17(1)(a) is not engaged. Also, dependent on the grounds on which you are looking to retain Art 17(3) gives a controller a clear ground to retain.

Also the right to erasure is one that will generally be directed at the controller. The controller would then flow down that request to a processor but that is where the contractual protections would come in, which in my experience, most clients are generally willing to accept.

Re: How GDPR Will Change The Way You Develop

#159

Post by Jakob »

tekism wrote: post #148

This is a bit confusing, I have a website and I log IP addresses in my web server log and I use google analytics, what do I need to do?

The legal ramifications of storing IP addresses didn’t change with GDPR. You should already have them anonymized since they count as personal data:

Google Analytics (https://developers.google.com/analytics/devguides/collection...):

  ga('set', 'anonymizeIp', true);
Web server (here nginx, https://stackoverflow.com/a/45405406):

  map $remote_addr $remote_addr_anon {
    ~(?P\d+\.\d+\.\d+)\.    $ip.0;
    ~(?P[^:]+:[^:]+):       $ip::;
    default                     0.0.0.0;
  }
Only if you store more data about your customers/users you need to act further.

Re: How GDPR Will Change The Way You Develop

#160

Post by PeterisP »

tempodox wrote: post #108

I built an app that displays geolocations of tweets on an OpenStreetMap. That data is publicly available from Twitter and users share their location willingly, I presume. Will an app like that become illegal, as far as European tweeters are concerned?

For your particular scenario, the main impact of GDPR would be not on your actions but on Twitter obtaining the data (which is personal information at the tweet level) and distributing it publicly to third parties like you.

I don't see any clear restrictions for you, but perhaps GDPR will result in your data source becoming unavailable.

Post reply on HN