Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

301–310 of 710 posts

Re: How GDPR Will Change The Way You Develop

#301

Post by danieltillett »

e12e wrote: post #274
shkkmo wrote: post #261

Earlier quoted context omitted.

Can you point me to a definitive source as to what websites that have access log that include IP addresses (which is pretty much everyone) have to do to be compliant? If there are steps that must be taken, who has to taken them? I've been looking, and I have found a bunch of contradictory explanations. My best guess is that if you have a disclaimer that says you log IP addresses for security purposes, you can keep yo…

Quit storing ips unless you are legally obliged to do so (audit trial, mandated surveillance, like that other EU directive...). Generally security audit purposes will likely let you keep logs for "reasonable time" (weeks). Beyond that, why store them?

You know for things like being able to do analysis. For example, last week I wanted to know where to locate our next local server and so needed to know where the usage growth was coming from. I happen to noticed that the usage over the last few weeks was quite different to the historical data. If I only had 2 weeks of data I would have made our service worse for our customers.

Re: How GDPR Will Change The Way You Develop

#302

Post by ebcode »

wglb wrote: post #174
woolvalley wrote: post #165

Will the GDPR eventually make bitcoin or other immutable public distributed databases illegal in the EU? Do you have default judgements on thousands john doe node operators around the world? Will EU ISPs be required to censor any kind of blockchain node eventually when someone has a GDPR complaint for that network? Will we arrest teenagers for running ethereum miners on their gaming computers after all of this?

Will any information that enables identification of the individual (or the other ancillary information spelled out in the article and regulations) be in the blockchain? If not, doesn't sound like it. Here is one way to think of this. Any EU citizen has a "right to be forgotten". If there is nothing in your records to identify that person, the you don't need to provide that ability.

OK, but what the parent is suggesting is that someone might store someone's personally identifiable information on "the blockchain", thus making the entire bitcoin network in violation of GDPR. It's a fairly on-point criticism, IMO.

Re: How GDPR Will Change The Way You Develop

#303

Post by magic-chicken »

mfoy_ wrote: post #268
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

Software development needs some sort of Iron Ring ( https://en.wikipedia.org/wiki/Iron_Ring ) to remind us to be humble.

As you can see in the article, it already exists in Canada. Some engineering schools like École de technologie supérieure (ÉTS) offers a 4 year Software Engineering program that enable you to become a member of the Ordre des ingénieurs du Québec. It's a self-regulatory body that governs Quebec's professional engineers. There is a ceremony where they give you an iron ring, mostly to remind you to be humble and to always consider the public interest first when making decisions. Can software engineers become P.E. in the U.S ?

Re: How GDPR Will Change The Way You Develop

#304

Post by 77pt77 »

havkom wrote: post #273
shkkmo wrote: post #261

Earlier quoted context omitted.

Can you point me to a definitive source as to what websites that have access log that include IP addresses (which is pretty much everyone) have to do to be compliant? If there are steps that must be taken, who has to taken them? I've been looking, and I have found a bunch of contradictory explanations. My best guess is that if you have a disclaimer that says you log IP addresses for security purposes, you can keep yo…

Sounds like you have a legitimate interest in logging IP addresses for security purposes, it is an effective measure and that your legitimate interest on balance outweighs the interests of the data subject. If that is the case you could probably rely on the “legal basis” called legitimate interest and do not need consent or anything like that. Do: - Make a link to a privacy policy clearly accessible (eg on your websi…

> Sounds like you have a legitimate interest in logging IP addresses for security purposes

European legislation demands this in fact. You have to keep the logs for a few months.

Re: How GDPR Will Change The Way You Develop

#305

Post by e12e »

danieltillett wrote: post #301
e12e wrote: post #274

Earlier quoted context omitted.

Quit storing ips unless you are legally obliged to do so (audit trial, mandated surveillance, like that other EU directive...). Generally security audit purposes will likely let you keep logs for "reasonable time" (weeks). Beyond that, why store them?

You know for things like being able to do analysis. For example, last week I wanted to know where to locate our next local server and so needed to know where the usage growth was coming from. I happen to noticed that the usage over the last few weeks was quite different to the historical data. If I only had 2 weeks of data I would have made our service worse for our customers.

You might be a good candidate for storing aggregated (anonymized) data.

[ed: incidentally you're kinda sorta in the area GDPR wants to combat: "it'd be nice to know what x want to buy next, and where - for logistical and marketing purposes. Why can't we just store a full profile of everything x does, where and when?]

Re: How GDPR Will Change The Way You Develop

#306

Post by Romanulus »

calcifer wrote: post #266
f137 wrote: post #252

Earlier quoted context omitted.

The problem is you are required to prove that you follow the rules, which would take your effort and your money. This is a "guilty until you prove you are not" thing.

> The problem is you are required to prove that you follow the rules Yes, because the "just don't do creepy shit" approach to privacy didn't go so well. If the carrot doesn't work, the stick comes out.

Isn't this, like, the cornerstone of bad reasoning; acting/enforcing on a few one-offs?

Re: How GDPR Will Change The Way You Develop

#307

Post by ebcode »

woolvalley wrote: post #165

Will the GDPR eventually make bitcoin or other immutable public distributed databases illegal in the EU? Do you have default judgements on thousands john doe node operators around the world? Will EU ISPs be required to censor any kind of blockchain node eventually when someone has a GDPR complaint for that network? Will we arrest teenagers for running ethereum miners on their gaming computers after all of this?

You've raised a really good point with this. Honestly, the whole "right to be forgotten" thing is utter BS. Might as well call it "the memory hole act". Or better yet, "the right to silence the opposition".

Re: How GDPR Will Change The Way You Develop

#308

Post by wang_li »

TomMarius wrote: post #199
jacquesm wrote: post #191

Earlier quoted context omitted.

In the typical web/e-commerce context someone whose IP address geolocates to an EU based end point or someone who lists their delivery address as inside the union.

The problem is that the law applies to them even if they use a proxy. If they report/sue you afterwards, you might be looking at a huge amount of trouble.

People will just add a checkbox that the customer must check to complete the transaction:

[] I affirm that I an not an EU citizen.

Re: How GDPR Will Change The Way You Develop

#309

Post by huwdiprose »

77pt77 wrote: post #287
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

> The only thing that GDPR wants from you is to handle others data with same RESPECT as you handle yours. Plus a minimum of 20M€ fine in case they don't think your "common sense" is good enough. For a one man shop that is not working under the legal protection an LLC or equivalent provides, this can be deadly!

€20mil is the maximum, and there are lower tiers for lesser infractions.

That is a figure used to bring non-European companies who wish to trade in the EEA but not comply to the negotiating table.

We rarely see the largest tier of fines here in the UK, I'd expect little to change there too.

Reputational damage should be a focus of anyone concerned with risk here.

Re: How GDPR Will Change The Way You Develop

#310

Post by Silhouette »

jacquesm wrote: post #183
Sevii wrote: post #164

Earlier quoted context omitted.

Explicitly banning Eurozone citizens from using the service is the easiest solution I have thought of.

The collective economic effect of that will be massive. Please do. And realize that you are ceding the single largest market to your competition.

The collective economic effect of that will be massive. Please do. And realize that you are ceding the single largest market to your competition.

That doesn't necessarily follow.

For example, EU but non-UK customers represent only a small fraction of the user base for one of my businesses. With hindsight, we would have done better to exclude those customers entirely, avoid spending time and money complying with ever-more-onerous EU rules, and invest that time and money in growing our business in more lucrative markets instead.

It is entirely possible for the EU to make itself so unattractive as a market that this will be the case for others too. Indeed several of the near-future measures it is already working on may have exactly that effect. The saddest part is that those running the EU have so little idea about how small business works that they don't even realise they're doing it.

Post reply on HN