Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

191–200 of 710 posts

Re: How GDPR Will Change The Way You Develop

#191

Post by jacquesm »

tlrobinson wrote: post #181
debt wrote: post #167

Earlier quoted context omitted.

If you have a customer from the EU, you must comply with GPDR. Full stop. Also, if any component of your cloud ecosystem(AWS, GCS, etc.) are based in the EU, you must comply with GPDR. Which in today's world means almost everyone is affected by this. Make sure those "American" platforms you speak have every single component of their infrastructure based physically in America. The whole thing may be difficult to enfor…

So what's the definition of "customer from the EU"?

In the typical web/e-commerce context someone whose IP address geolocates to an EU based end point or someone who lists their delivery address as inside the union.

Re: How GDPR Will Change The Way You Develop

#192

Post by jacquesm »

_o_ wrote: post #189

One more interesting thought. If you are using ad provider/tracker/data reseler X/... located in USA which is GDPR compliant and is doing bussiness with EU, and you are feeding them with toxic information you didn't get consent for, the EU can pick on them. As you have damaged their bussiness they can sue you. In USA.

This is not a very realistic scenario. Every ad network has extensive scrubbing on their input side to ensure they do not ingest doctored data.

Re: How GDPR Will Change The Way You Develop

#193

Post by woolvalley »

wglb wrote: post #174
woolvalley wrote: post #165

Will the GDPR eventually make bitcoin or other immutable public distributed databases illegal in the EU? Do you have default judgements on thousands john doe node operators around the world? Will EU ISPs be required to censor any kind of blockchain node eventually when someone has a GDPR complaint for that network? Will we arrest teenagers for running ethereum miners on their gaming computers after all of this?

Will any information that enables identification of the individual (or the other ancillary information spelled out in the article and regulations) be in the blockchain? If not, doesn't sound like it. Here is one way to think of this. Any EU citizen has a "right to be forgotten". If there is nothing in your records to identify that person, the you don't need to provide that ability.

You can insert random text into bitcoin, which can include private info: https://www.reddit.com/r/btc/comments/49pp3n/eli5_how_to_emb...

There are also blockchain style social networks such as steem that create things that are like reddit: https://steem.io / https://steemit.com . Again, freeform public text blobs that can have private info.

If you create any censorship resistant publishing software, lets say to report on human rights violations in some sort of dictatorship, you also create something that can be used to violate the GDPR.

Re: How GDPR Will Change The Way You Develop

#194

Post by grier »

wglb wrote: post #174
woolvalley wrote: post #165

Will the GDPR eventually make bitcoin or other immutable public distributed databases illegal in the EU? Do you have default judgements on thousands john doe node operators around the world? Will EU ISPs be required to censor any kind of blockchain node eventually when someone has a GDPR complaint for that network? Will we arrest teenagers for running ethereum miners on their gaming computers after all of this?

Will any information that enables identification of the individual (or the other ancillary information spelled out in the article and regulations) be in the blockchain? If not, doesn't sound like it. Here is one way to think of this. Any EU citizen has a "right to be forgotten". If there is nothing in your records to identify that person, the you don't need to provide that ability.

The requirements that GDPR imposes on development and data handling are much more broad than the right to be forgotten.

https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

Re: How GDPR Will Change The Way You Develop

#195

Post by _o_ »

jacquesm wrote: post #192
_o_ wrote: post #189

One more interesting thought. If you are using ad provider/tracker/data reseler X/... located in USA which is GDPR compliant and is doing bussiness with EU, and you are feeding them with toxic information you didn't get consent for, the EU can pick on them. As you have damaged their bussiness they can sue you. In USA.

This is not a very realistic scenario. Every ad network has extensive scrubbing on their input side to ensure they do not ingest doctored data.

I am more into USA state of thinking, money justifies everything. So I have mentioned it as a bussiness model. ;)

Re: How GDPR Will Change The Way You Develop

#196

Post by epicide »

PeterisP wrote: post #168
epicide wrote: post #130

Earlier quoted context omitted.

> You aren't doing business unless you're accepting payments/selling/shipping things to people in the EU. I wonder how ads play into all this. E.g. are people who watch an ad on YouTube considered YouTube customers? Are they considered customers of the ad company? My concern is that we will see more (non-EU) companies implement something where users "pay" for services/features by watching ads. I do also wonder how it…

The simple answer to that is that the advertisers pay you to show ads to EU users because they want to get money from EU users; so these advertisers are/have to be GDPR compliant, especially if they're using user information to target ads, and they'll have to be sure that this user information is legal for them to use. The advertising networks are clearly doing business in EU as they're getting paid by these advertis…

> advertisers pay you to show ads to EU users because they want to get money from EU users; so these advertisers are/have to be GDPR compliant

This is the part I'm not sure is true.

Sure, if the ad agency's company motto is "delivering ads to EU users since XXXX", they obviously have to be compliant, but what if they are a US-based ad agency and none of the companies selling them ad space are in the EU? How many layers does one need to circumvent this?

Re: How GDPR Will Change The Way You Develop

#197

Post by ahoka »

Jakob wrote: post #159
tekism wrote: post #148

This is a bit confusing, I have a website and I log IP addresses in my web server log and I use google analytics, what do I need to do?

The legal ramifications of storing IP addresses didn’t change with GDPR. You should already have them anonymized since they count as personal data: Google Analytics ( https://developers.google.com/analytics/devguides/collection... ): ga('set', 'anonymizeIp', true); Web server (here nginx, https://stackoverflow.com/a/45405406 ): map $remote_addr $remote_addr_anon { ~(?P \d+\.\d+\.\d+)\. $ip.0; ~(?P [^:]+:[^:]+): $ip::…

You can also irreversibly hash sensitive data it so you can still use it for debugging.

Re: How GDPR Will Change The Way You Develop

#199

Post by TomMarius »

jacquesm wrote: post #191
tlrobinson wrote: post #181

Earlier quoted context omitted.

So what's the definition of "customer from the EU"?

In the typical web/e-commerce context someone whose IP address geolocates to an EU based end point or someone who lists their delivery address as inside the union.

The problem is that the law applies to them even if they use a proxy. If they report/sue you afterwards, you might be looking at a huge amount of trouble.

Re: How GDPR Will Change The Way You Develop

#200

Post by woolvalley »

the_mitsuhiko wrote: post #139
jlg23 wrote: post #131

Earlier quoted context omitted.

Construction workers and architects don't tend to work internationally. If they do, they hire lawyers to sort out legal requirements for them before they even sign a contract.

The same should be true for most software companies going forward. The approach to just assume it's the obligation of the user to ensure compliance won't work for much longer.

Imagine the EU made a law requiring every country in the world follow their building codes whenever an EU citizen enters one of their buildings, even if the building was made before the law was created. And if you don't comply, they will fine you millions of dollars.

McDonalds goes and retrofits all of their buildings in the world because they have shops in the EU at great cost. Some pizza shop that does delivery in the USA, and the owners go on vacation once in a while in Europe? ‍️They probably are not even aware of it.

That is what the GDPR is in a nutshell.

Post reply on HN