Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

401–410 of 710 posts

Re: How GDPR Will Change The Way You Develop

#401

Post by x0x0 »

jopsen wrote: post #358
BjoernKW wrote: post #294

Earlier quoted context omitted.

In principle, yes. The intention behind and the principles outlined by the GDPR are good. However, the devil's in the details, specifically in how these principles are supposed to be implemented. Some of these details are not quite clear yet. It's almost impossible to navigate these issues without getting at least some basic legal advice and investing a fair bit of time. Unfortunately, as often is the case with EU re…

OPs point is that if you act responsibly in good faith you'll probably avoid any issues, and likely be warned before they target you for maximum fines :)

That's heavily dependent on the regulator in question, and there's 30-ish of them. Since American companies are very unlikely to have a lead regulator, you will need to comply with conflicting rulings from each. In half a dozen languages.

Re: How GDPR Will Change The Way You Develop

#402

Post by notyourday »

77pt77 wrote: post #396
notyourday wrote: post #380

Earlier quoted context omitted.

Good luck to EU trying to enforce it against JoeSchmoeLLC from PA

What if the owner is a citizen of a EU country? I'm genuinely curious.

Maybe they can do that, but that would require piercing corporate veil first which is costly. JoeSchmoeLLC is probably judgement proof. Any attempt to force it to comply would cost a boat load of money.

However, it is a lot more likely that the LLC is owned by those with no nexus to Europe it is extremely unlikely that EU can do anything to punish this company. Hell 99% of web forums have European users.

Maybe it will have teeth against Google/Facebook/Tinder/Match/etc because those companies actually have assets in Europe but it won't be effective against companies with no nexus.

Re: How GDPR Will Change The Way You Develop

#403

Post by x0x0 »

_o_ wrote: post #354
cortesoft wrote: post #340

Earlier quoted context omitted.

> Every complaint about it shows that you don't respect others and you dont care about them. And this is the reason it became legislation. Ok, that is just silly. This sounds so much like the 'Why do you want privacy if you have nothing to hide?' arguments. It is very reasonable to both have a company that handle customer data responsibly AND have issues with the GDPR. Imagine if every time you walked down the street…

Oh, so in construction business, you don't need to prove your plans are statically safe, you just build a bridge and no one cares until it colapses? Don't worry, you are far safer here, no one will ask you anything until it collapses. But after it does, you will need a proof it didn't happen becoase of you. That you did all you could. Is there something wrong?

Indeed, capturing IP addresses in logs is exactly like a bridge collapsing and killing people.

Re: How GDPR Will Change The Way You Develop

#404

Post by eadmund »

jacquesm wrote: post #382
eadmund wrote: post #345

Earlier quoted context omitted.

Some people may find that a valuable trade-off, because the alternative would be to permit their customers to demand that they rewrite their logs at any time. I, personally, believe that logs should be fundamentally append-only, and thus will not be doing business with EU subjects (since the GDPR requires that I delete records from my logs on demand).

Guess what? The EU agrees with you. That's why the recommendation is that you strip PII from your logs for everybody. That way they can still be append only and you won't have to do any rewriting. > I, personally, believe that logs should be fundamentally append-only, and thus will not be doing business with EU subjects (since the GDPR requires that I delete records from my logs on demand). That statement does not ho…

> That's why the recommendation is that you strip PII from your logs for everybody.

The problem is that IP addresses — a fundamental requirement for an acceptable network logging system — are considered PII.

If this were about things like names, dates of birth &c. then I'd be in full agreement. But considering an IP address personal information which must be deleted on demand is IMNSHO insane.

> That statement does not hold a lot of force without a link to your business and how big a %age of your turnover you are willing to throw out.

I'm just a guy, y'know? I'm not going to pretend that it would be easy or cheap for others to make the same decision. But it is easy & cheap for me.

Re: How GDPR Will Change The Way You Develop

#405

Post by oliwarner »

deif wrote: post #387
njl wrote: post #332

Earlier quoted context omitted.

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

Only without consent from the user. Previously it was an ethically grey area to be logging IP addresses anyway. If you are preventing malicious use, then that is allowed as long as you are not using that data outside of the bounds of the user's consent. If, however, a company is storing IP addresses to identify users without their consent and are found to be specifically targeting them without their consent, then tha…

You appear to be suggesting that "intent" defines the shape of law here, but I really don't think that's the case.

By my reading, information becomes personal —and therefore subject to GDPR— when it can be used to identify people. If you've got login timestamps, IP addresses and user records, for legitimate reasons, any other logging that includes IPs is tainted because it takes anybody with that data two minutes to munge them together.

Intent, and actual business use-case play second fiddle to the worst-case, or "what could that data be used for?".

Re: How GDPR Will Change The Way You Develop

#406

Post by wila »

notyourday wrote: post #380
77pt77 wrote: post #287

Earlier quoted context omitted.

> The only thing that GDPR wants from you is to handle others data with same RESPECT as you handle yours. Plus a minimum of 20M€ fine in case they don't think your "common sense" is good enough. For a one man shop that is not working under the legal protection an LLC or equivalent provides, this can be deadly!

Good luck to EU trying to enforce it against JoeSchmoeLLC from PA

Not really a problem for EU if JoeSchmoeLLC is really treating this as not a law for them. US and pretty much every country in the EU have excellent extradition agreements. [0]

[0] https://en.wikipedia.org/wiki/List_of_United_States_extradit...

Re: How GDPR Will Change The Way You Develop

#407

Post by x0x0 »

shkkmo wrote: post #261
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

Can you point me to a definitive source as to what websites that have access log that include IP addresses (which is pretty much everyone) have to do to be compliant? If there are steps that must be taken, who has to taken them? I've been looking, and I have found a bunch of contradictory explanations. My best guess is that if you have a disclaimer that says you log IP addresses for security purposes, you can keep yo…

HAHAHAHA, there is no such guide.

Again, the GDPR isn't really a set of rules per say. It's some rules (eg on consent), plus some frameworks (legitimate interest balancing test). The country-specific privacy orgs are figuring out the balancing tests and are promising final guidance, like, totes any day now. Meanwhile, the deadline is 25 May.

Re: How GDPR Will Change The Way You Develop

#408

Post by confounded »

njl wrote: post #332
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

Of all the wonderful things that we're capable of as technologists, I think we can figure out a way to strip raw-IP addresses from log-files once we don't need them any more.

I'll need to figure out to handle this on the data I'm responsible for at the moment. It's boring and it doesn't help the product, but it's not supposed to. In idlewords' terms, I feel like I'm finally purging toxic waste: http://idlewords.com/talks/haunted_by_data.htm

Re: How GDPR Will Change The Way You Develop

#409

Post by blibble »

allendoerfer wrote: post #218
trothamel wrote: post #4

"The extraterritorial nature of these two frameworks..." I've noticed that this is something the EU has tried to do lately, to just sort of push their regulations on the rest of the world. I don't see what sort of authority they'd have to impose this on citizens of other countries. I wonder if Europe pushes the issue, if this will be treated like libel tourism, where US citizens and companies without a Eurpoean nexus…

If you have ever opened a bank account in Europe, you have come across a checkbox, where you have to specify that you are not an American citizen. The US pushes their regulations on companies outside their jurisdiction, too.

the result for banking is that European banks refuse to let Americans open bank accounts

depending on the levels enforcement I suspect the same will be true of many popular online services for GDPR: you check the "EU citizen" checkbox and you're banned

Re: How GDPR Will Change The Way You Develop

#410

Post by x0x0 »

Radim wrote: post #153
aeorgnoieang wrote: post #58

What's troubling to me is that it's very unclear what specifically is required. I know the linked post isn't legal advice, but in the page about 'privacy by design' linked to by the origin link, they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! Can a…

> What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! Elizabeth Denham, UK's information commissioner in charge of data protection enforcement, had this to say: "Having larger fines is useful but I think fundamentally what I'm saying is it's scaremongering to suggest that we're going to be making early examples of organisations that breach the law or that fining a top whack i…

Except that's precisely 1/28 of the regulators to which you are subject if you are an American company and, therefore, most likely don't have a lead regulator.
Post reply on HN