Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

311–320 of 710 posts

Re: How GDPR Will Change The Way You Develop

#311

Post by pdkl95 »

Jakob wrote: post #159
tekism wrote: post #148

This is a bit confusing, I have a website and I log IP addresses in my web server log and I use google analytics, what do I need to do?

The legal ramifications of storing IP addresses didn’t change with GDPR. You should already have them anonymized since they count as personal data: Google Analytics ( https://developers.google.com/analytics/devguides/collection... ): ga('set', 'anonymizeIp', true); Web server (here nginx, https://stackoverflow.com/a/45405406 ): map $remote_addr $remote_addr_anon { ~(?P \d+\.\d+\.\d+)\. $ip.0; ~(?P [^:]+:[^:]+): $ip::…

> ga('set', 'anonymizeIp', true);

Note that this doesn't actually provide any useful anonymization. That feature is a placebo designed to give minimal compliance with privacy policies and pre-GDPR data protection requirements.

https://news.ycombinator.com/item?id=13639921

Re: How GDPR Will Change The Way You Develop

#312

Post by _o_ »

huwdiprose wrote: post #309
77pt77 wrote: post #287

Earlier quoted context omitted.

> The only thing that GDPR wants from you is to handle others data with same RESPECT as you handle yours. Plus a minimum of 20M€ fine in case they don't think your "common sense" is good enough. For a one man shop that is not working under the legal protection an LLC or equivalent provides, this can be deadly!

€20mil is the maximum, and there are lower tiers for lesser infractions. That is a figure used to bring non-European companies who wish to trade in the EEA but not comply to the negotiating table. We rarely see the largest tier of fines here in the UK, I'd expect little to change there too. Reputational damage should be a focus of anyone concerned with risk here.

Not really true :) $20mil or 4% global revenue whichever is higher. $20mil is nothing for ggl/fb/...

This time EU did it right, I doubt some small local shop will ever get max punishment but the % of global revenue is on the other side still something that can bite global corporations.

Re: How GDPR Will Change The Way You Develop

#313

Post by calcifer »

Romanulus wrote: post #306
calcifer wrote: post #266

Earlier quoted context omitted.

> The problem is you are required to prove that you follow the rules Yes, because the "just don't do creepy shit" approach to privacy didn't go so well. If the carrot doesn't work, the stick comes out.

Isn't this, like, the cornerstone of bad reasoning; acting/enforcing on a few one-offs?

What do you mean one-offs? Pretty much every company with an engineer on staff is collecting as much data as they can with zero regard to the user's expectations of privacy. The regulation exists to stop an epidemic, not to act on a few one-offs.

Re: How GDPR Will Change The Way You Develop

#314

Post by prewett »

jacquesm wrote: post #203
TomMarius wrote: post #199

Earlier quoted context omitted.

The problem is that the law applies to them even if they use a proxy. If they report/sue you afterwards, you might be looking at a huge amount of trouble.

Yes, but like with all this stuff: Your intent to comply with the law carries a lot more weight than actual compliance in edge cases.

That's not very comforting when your goal is avoid having unforeseen problems like being arrested on your European vacation due to violating a law that doesn't apply to your country but you still violated because it applies to all EU citizens regardless of their geographical location.

Re: How GDPR Will Change The Way You Develop

#315

Post by amarkov »

Spearchucker wrote: post #299
amarkov wrote: post #282

Earlier quoted context omitted.

I'm not sure what you mean by "holes". It seems like it's a fundamental and intended feature of the GDPR that you can't achieve compliance-by-default. You have to explicitly audit every interaction between every system you have, to ensure that either no personal information is present or the interaction complies with GDPR standards.

" ...you have to explicitly audit every interaction between every system... " But would you though? If you're a large co. you'd have a configuration management system where you just pull the specs/data rather than do an audit. If you're a small co. you'd know already, and if not you'd just go look. Right? My experience is that anyone complaining about the amount of work GDPR is causing is a. not compliant anyway (and…

Not right; you can't just review the specs of each system. It's very easy to accidentally combine compliant systems in a way that isn't compliant.

Just to pick one example I've seen in practice, system A might have an integration bug causing system B to periodically emit error logs, containing data which system A knows is personal but system B does not.

Re: How GDPR Will Change The Way You Develop

#316

Post by x0x0 »

draugadrotten wrote: post #253
x0x0 wrote: post #137

Earlier quoted context omitted.

It's unclear. The GDPR definitely covers personal data even if publicly available , so just because you grabbed it from twitter doesn't make it kosher. That said, realistically, I'd have a hard time imagining you would have too much difficulty as long as you allowed people to delete their data upon request. If they post something to twitter, the obvious intent is to make it very public.

For a real life example, there is a group of people that collect Facebook posts and process them through a ML filter which judges if the post contains hate speech, and if it does, it reports the post to the police, supposedly after manual review. Does this processing comply with GDPR? I'm pretty sure none of the people would allow this processing to take place if they were asked for permission.

My best guess is they will be able to shut this down hard, unless there is some alternative processing basis to be leaned on. See (6)1 for a list of potential bases.

So no. Not GDPR compliant in the slightest.

Re: How GDPR Will Change The Way You Develop

#317

Post by Silhouette »

the_mitsuhiko wrote: post #290
shkkmo wrote: post #261

Earlier quoted context omitted.

Can you point me to a definitive source as to what websites that have access log that include IP addresses (which is pretty much everyone) have to do to be compliant? If there are steps that must be taken, who has to taken them? I've been looking, and I have found a bunch of contradictory explanations. My best guess is that if you have a disclaimer that says you log IP addresses for security purposes, you can keep yo…

The biggest question is: why do you need indefinite amounts of IP addresses logged? You don't even need to ask yourself if it's compliant or not by just not doing it. The usefulness of ip addresses that old is very limited.

The usefulness of ip addresses that old is very limited.

Either the old IP addresses can be tied to a specific individual, which means they are potentially useful for legitimate security purposes such as helping to identify someone who has previously tried to scam you, or they can't, in which case what is the risk of keeping them around anyway?

Re: How GDPR Will Change The Way You Develop

#318

Post by prewett »

jacquesm wrote: post #259
woolvalley wrote: post #251

Earlier quoted context omitted.

Does the EU have any other extra-territoral law as far reaching as the GDPR? Or any other extra-territoral law? A business shipping something to the EU doesn't count. The only other extra-territorial laws I know of currently is FATCA and the FCPA, which are from the USA.

The GDPR is not an extra-territorial law. It merely concerns itself with EU citizens.

If the law applies outside the EU (for instance, if EU citizens travel to a non-EU country), then it is an extra-territorial law. As far as I understand the discussion here (which may or may not correspond with the actual law), the GDPR goes with the person. Wherever an EU citize goes, that EU citizen must be able to be forgotten, despite if the location they are in is outside EU jurisdiction. That is practically the definition of extra-territorial.

Now, would an EU court rule that someone who kept permanent records of an EU citizen be violating the GDPR if the business has no EU presence? In the American system (imagining if the US passed a GDPR and prosecuted a non-US citizen), no, because the government would not have standing to sue: the violation took place outside of US sovereignty. If the EU takes a similar approach, then the law is not extra-territorial in enforcement, otherwise it is.

Re: How GDPR Will Change The Way You Develop

#319

Post by the_mitsuhiko »

Silhouette wrote: post #317
the_mitsuhiko wrote: post #290

Earlier quoted context omitted.

The biggest question is: why do you need indefinite amounts of IP addresses logged? You don't even need to ask yourself if it's compliant or not by just not doing it. The usefulness of ip addresses that old is very limited.

The usefulness of ip addresses that old is very limited. Either the old IP addresses can be tied to a specific individual, which means they are potentially useful for legitimate security purposes such as helping to identify someone who has previously tried to scam you, or they can't, in which case what is the risk of keeping them around anyway?

> in which case what is the risk of keeping them around anyway?

GDPR wants you to think differently about it: if you want to keep data, ensure that you actually need it. Do not treat data as an asset but as a liability.

Re: How GDPR Will Change The Way You Develop

#320

Post by kuschku »

shkkmo wrote: post #222

Does this make Apache access logs illegal? 1) There isn't any way to "opt-in" to them 2) You would need to have a tool to remove every entry for an IP address when requested?

If you store the full IP address forever, that’s already today illegal if you have German users.

Hashing (only useful for IPv6) or truncating is recommended.

Post reply on HN