Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

381–390 of 710 posts

Re: How GDPR Will Change The Way You Develop

#381

Post by SahAssar »

boredatwork wrote: post #325
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

Sure I delete files that I don't like, but I don't typically rewrite all my old backups to purge them from there too.

A file does not really exist unless it is backuped, and it's not really deleted unless it is not backuped.

Re: How GDPR Will Change The Way You Develop

#382

Post by jacquesm »

eadmund wrote: post #345
jacquesm wrote: post #183

Earlier quoted context omitted.

The collective economic effect of that will be massive. Please do. And realize that you are ceding the single largest market to your competition.

Some people may find that a valuable trade-off, because the alternative would be to permit their customers to demand that they rewrite their logs at any time. I, personally, believe that logs should be fundamentally append-only, and thus will not be doing business with EU subjects (since the GDPR requires that I delete records from my logs on demand).

Guess what? The EU agrees with you. That's why the recommendation is that you strip PII from your logs for everybody. That way they can still be append only and you won't have to do any rewriting.

> I, personally, believe that logs should be fundamentally append-only, and thus will not be doing business with EU subjects (since the GDPR requires that I delete records from my logs on demand).

That statement does not hold a lot of force without a link to your business and how big a %age of your turnover you are willing to throw out.

Re: How GDPR Will Change The Way You Develop

#383

Post by musage »

njl wrote: post #332
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

> a continuous drag on developing new technologies

Any and all of them? Because of anonymized IP addresses in server logs? I wouldn't even buy that when it comes to the web, but certainly not to mention talking about computers and software in general, or even "tech in general", whatever that would be.

Re: How GDPR Will Change The Way You Develop

#384

Post by SahAssar »

freeone3000 wrote: post #338
calcifer wrote: post #313

Earlier quoted context omitted.

What do you mean one-offs? Pretty much every company with an engineer on staff is collecting as much data as they can with zero regard to the user's expectations of privacy. The regulation exists to stop an epidemic, not to act on a few one-offs.

If the user wanted privacy, they wouldn't be giving data to our services. It's a bit ridiculous to punish us for keeping what users freely give us.

It's not given freely unless consent is given, which in most cases it isn't.

Re: How GDPR Will Change The Way You Develop

#385

Post by jacquesm »

danieltillett wrote: post #372
jacquesm wrote: post #333

Earlier quoted context omitted.

I've read most of it and I disagree that it has been written badly. As laws come it is accessible, has some pretty clearly defined goals and it is for the most part something you could easily comply with.

Yes the first 90% is reasonable, it is the last 10% that is a nightmare. I comply with the general intent (always have), but the law as currently written is near impossible to comply with. My feeling is this will be realised by the EU and a more rational set of guidelines will emerge.

Acting in good faith is the best protection you can have. In your case if there are parts that you can not comply with I would note these as clearly as possible and disclose those specifically to customers and why you can't comply with them. And another thing you could do is to get yourself a $500/hour lawyer specializing in privacy for an hour or two to tell you what to do on a sheet of letterhead.

Re: How GDPR Will Change The Way You Develop

#386

Post by e12e »

danieltillett wrote: post #379
e12e wrote: post #305

Earlier quoted context omitted.

You might be a good candidate for storing aggregated (anonymized) data. [ed: incidentally you're kinda sorta in the area GDPR wants to combat: "it'd be nice to know what x want to buy next, and where - for logistical and marketing purposes. Why can't we just store a full profile of everything x does, where and when?]

The problem becomes if you make a mistake or aggregate in the wrong way you end up losing the ability to do later analysis. If I had thrown out my logs I would have provided my customers with a worse experience. I am supportive of the intent of the GDPR and we have always gone out of our way to minimise the data we collect, but as currently written the law has a whole lot of very negative downstream effects. Really t…

Re: "Where usage growth was coming from" sounds like the kind of things a log of performance data pr server might also answer.

Can't argue with the fact that storing less and corner grained data will make certain ad hoc queries harder.

That's kinda the point.

Re: How GDPR Will Change The Way You Develop

#387

Post by deif »

njl wrote: post #332
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

Only without consent from the user. Previously it was an ethically grey area to be logging IP addresses anyway. If you are preventing malicious use, then that is allowed as long as you are not using that data outside of the bounds of the user's consent.

If, however, a company is storing IP addresses to identify users without their consent and are found to be specifically targeting them without their consent, then that is a misuse of data.

You are right that companies will be paying for this for a long time and it does take effort to comply, but if that's what it takes to protect user data, increase security across the board to prevent data breaches and kill off the players that never should be in the business to begin with then I'm all for it.

Re: How GDPR Will Change The Way You Develop

#389

Post by AnimalMuppet »

ryandrake wrote: post #35
reynoldsbd wrote: post #11

Earlier quoted context omitted.

Absolutely! Anybody who does business in Europe or even has users in Europe is subject to this law. The amount of effort being put into GDPR compliance within my organization is just staggering. It really makes me think about these kind of laws from a new perspective, because they cost businesses so much to implement. (I'm not saying whether GDPR is right or wrong! Just that it's expensive.)

I would (maybe naively) think that the cost of GDPR compliance would be small if your company is already safeguarding user data and respecting user privacy. If a company’s cost is “staggering“ doesn’t that say a lot about its existing privacy practices?

From the article, the thing that jumped out at me was documenting it all. Sure, your processes may be perfectly pristine. Where's your document that shows that you considered everything? Don't forget to include development processes. And don't forget to update your documentation when your processes change.

Changing the processes may not be hard, if you're doing things close to right to begin with. Complying with the documentation requirements? That's going to be painful.

Re: How GDPR Will Change The Way You Develop

#390

Post by jacquesm »

Silhouette wrote: post #355
madez wrote: post #351

Earlier quoted context omitted.

It might be that the EU willingly rejects certain business. Maybe, if you aren't GDPR compliant, you are not wanted by the EU.

That would be a plausible theory if the EU even realised that many thousands of these smaller businesses exist, but as we learned with the VAT mess, they literally didn't.

Yes, the VAT mess definitely does not deserve the beauty prize but with the MOSS it is actually manageable. I've done it for a couple of years and as long as your IPSP cooperates it shouldn't be more than 15 minutes of work per quarter.
Post reply on HN