Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

281–290 of 710 posts

Re: How GDPR Will Change The Way You Develop

#281

Post by shkkmo »

lostcolony wrote: post #43
trothamel wrote: post #21

Earlier quoted context omitted.

There's a big difference between "in the EU" and "with people who reside in the EU". When I come to the EU to do business, sure, I'll comply with their laws. But it's very different to expect people who live outside the EU to respect EU laws, just because someone from the EU happens to choose to visit their website. I don't see this as any different than if someone in the EU was to visit a convenience store in the US…

For the same reason that downloading a song is different than stealing with a CD. Digital stuff is innately different. You aren't doing business unless you're accepting payments/selling/shipping things to people in the EU. And as with any law, if you're sufficiently small fry the EU isn't going to care about you until you actually screw up. Don't accept euros as currency. Don't offer to ship to EU nations. Done. If y…

> You aren't doing business unless you're accepting payments/selling/shipping things to people in the EU.

This is false.

If you offer a free product and one of the companies you publicly list as a user has a presence in the EU, then you need to be compliant.

If your signup page has been localized to Estonian, you also probably need to be compliant.

"Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union."

Re: How GDPR Will Change The Way You Develop

#282

Post by amarkov »

_o_ wrote: post #225
amelius wrote: post #220

Earlier quoted context omitted.

Yeah, but isn't it possible to trivially and inadvertently combine a bunch of systems S1 ... Sn which are all respecting the GDPR into a new system which doesn't?

We will see, new regulation is coming after GDPR and I bet they will plug the missing holes there. There was a cookie law that everyone circumvented. Now the same people are complaining about GDPR. The next round is going to put even more restrictions, and the regulation is going to be blamed. But the ones to be blamed are the ones who abuse it.

I'm not sure what you mean by "holes". It seems like it's a fundamental and intended feature of the GDPR that you can't achieve compliance-by-default. You have to explicitly audit every interaction between every system you have, to ensure that either no personal information is present or the interaction complies with GDPR standards.

Re: How GDPR Will Change The Way You Develop

#283

Post by gnud »

jcadam wrote: post #149
the_mitsuhiko wrote: post #122

Earlier quoted context omitted.

> I am curious, if you offered a service that allowed users to post their own data to your service. How do you protect against customers posting data that violates the GDPR. I.e. peoples personal information being posted in plaintext? You ensure that those users have a way to delete the data again.

I'd actually considered implementing a "soft delete" function for my service (knowledge management SaaS), out of fear that a user would accidentally delete something important. Now with GDPR pending, I think I won't. I'll just leave my 'no sh*t delete' function in place. If I get a request to restore any data I can say, "Sorry, the Europeans made me burn your data when you unwittingly clicked the red 'delete' button…

If you purge soft-deleted records after (say) 2 months, and don't use those records for anything unless they are undeleted by the users request, I don't think that should cause any problems with GDPR.

Of course, IANAL.

Re: How GDPR Will Change The Way You Develop

#284

Post by the_mitsuhiko »

TomMarius wrote: post #264
the_mitsuhiko wrote: post #240

Earlier quoted context omitted.

> Lets say your visiting the USA as an EU citizen and you get a pizza delivery from a local small pizza shop If that pizza store has no relation to the EU then there is no legal ground by which the GDPR could become relevant. There is no treaty which would establish some sory of leverage here. //EDIT: which btw is unlike FATCA for which there actually are bilateral agreements.

That's how it should be. Sadly the EU is taking a very different approach of trying to set laws for the whole world based on very unclear (and definitely unprecedented) requirements. It's true that they will have no jurisdiction over the pizza guy - just until he comes to the EU or to an allied country. Another comment talks about how it's very likely that GDPR will be a requirement of trade deals.

Even then not. The territorial scope in Article 3 of the GDPR is not that far reaching. It applies to processors with establishment in the EU, non union data processors who perform a service to data subjects in the union or the case of the pizza guy:

> 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

So unless there is a treaty that puts GDPR into scope, the pizza guy is fine.

Re: How GDPR Will Change The Way You Develop

#285

Post by [deleted] »

woolvalley wrote: post #226
the_mitsuhiko wrote: post #215

Earlier quoted context omitted.

> Imagine the EU made a law requiring every country in the world follow their building codes whenever an EU citizen enters one of their buildings You are reaching. I give you a better example: it does not matter where a building part is being produced, if it ends up in a building in Europe it needs to be up to the local building codes and to the regulations of the single market.

You think I am reaching, but the GDPR does act this way. Lets say your visiting the USA as an EU citizen and you get a pizza delivery from a local small pizza shop. They put your name and delivery address in their computer in an MS Access database that makes stickers, emails the delivery guy's gmail account and a person delivers a pizza to you. They have no idea your an EU citizen and they just put enough information…

[deleted]

Re: How GDPR Will Change The Way You Develop

#286

Post by calcifer »

jandrewrogers wrote: post #182
aidos wrote: post #107

How are people planning on implementing GDPR at the DB level? What about DB backups?

This is a great question that unfortunately doesn't have a good answer. Ignoring the question of backups, GDPR's requirements have the implication of imposing a workload on database engines that, in most modern architectures, is either pathologically expensive or not currently possible. Some companies are approaching this from a "best effort" standpoint rather than conforming to the spirit of the regulation because t…

Sorry if this sounds snarky, but you have written 3 whole paragraphs without saying what exactly the problem is.

Re: How GDPR Will Change The Way You Develop

#287

Post by 77pt77 »

_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

> The only thing that GDPR wants from you is to handle others data with same RESPECT as you handle yours.

Plus a minimum of 20M€ fine in case they don't think your "common sense" is good enough.

For a one man shop that is not working under the legal protection an LLC or equivalent provides, this can be deadly!

Re: How GDPR Will Change The Way You Develop

#288

Post by the_mitsuhiko »

woolvalley wrote: post #247
the_mitsuhiko wrote: post #240

Earlier quoted context omitted.

> Lets say your visiting the USA as an EU citizen and you get a pizza delivery from a local small pizza shop If that pizza store has no relation to the EU then there is no legal ground by which the GDPR could become relevant. There is no treaty which would establish some sory of leverage here. //EDIT: which btw is unlike FATCA for which there actually are bilateral agreements.

You don't need a treaty to enforce the law, you just need a pizza shop owner who likes to vacation in europe sometimes. You carry out the default judgement if they ever arrive in the EU. The GDPR explicitly has a very global scope because it is targeting companies in and out of the EU. I wouldn't really have much of a problem with the GDPR if it had some small business and non-eu business exceptions. It doesn't and r…

> You don't need a treaty to enforce the law

The law itself does not even put itself into scope. You either need a treaty (Article 3, paragraph 3) or the data subject or processing is in the union.

Re: How GDPR Will Change The Way You Develop

#289

Post by danieltillett »

jacquesm wrote: post #187
debt wrote: post #184

Earlier quoted context omitted.

He'd be exposed to increased risk by not complying(lawsuits, criminal action, etc.). It's based on his risk tolerance, the problem is it's hard to quantify at this point.

Based on a pretty thorough bit of search I can confidently say that no small (or even mid sized) US company has ever been fined or any executives detained or extradited because of breaking an EU law that would have not normally resulted in a criminal conviction. The EU tends to go after the larger entities and tends to fine rather than arrest.

The history of laws suggest that to rely on non-enforcement of a law is not wise. The GDPR is a good idea that has been written badly.

Re: How GDPR Will Change The Way You Develop

#290

Post by the_mitsuhiko »

shkkmo wrote: post #261
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

Can you point me to a definitive source as to what websites that have access log that include IP addresses (which is pretty much everyone) have to do to be compliant? If there are steps that must be taken, who has to taken them? I've been looking, and I have found a bunch of contradictory explanations. My best guess is that if you have a disclaimer that says you log IP addresses for security purposes, you can keep yo…

The biggest question is: why do you need indefinite amounts of IP addresses logged? You don't even need to ask yourself if it's compliant or not by just not doing it. The usefulness of ip addresses that old is very limited.
Post reply on HN