How GDPR Will Change The Way You Develop • Hacker News Board

Re: How GDPR Will Change The Way You Develop

#461

Post by chasb » Wed, Feb 28, 2018, 12:59 AM UTC

GDPR has a lot of parallels to HIPAA and SOC 2. Many developers here have worked with companies subject to HIPAA, or that do SOC 2 reporting.

One big difference is that the material scope of GDPR is so extremely broad: it regulates any PII that can be touched by EU law. That's important because it means that all of your SaaS vendors that touch this data may be in scope, not just your hosting stack. If you're marketing or selling in the EU, your entire growth/CRM/customer success stack will be regulated. If you have EU employees or contractors, all of their HR data is covered. I'm not sure if most companies realize this. It may be less of a problem for B2B, we'll see.

Questions to ask yourself: What is the scope of GDPR personal data across your business? Are you marketing in Europe? Are you selling into Europe? What business processes touch that data?

Re: How GDPR Will Change The Way You Develop

#462

Post by klokoman » Wed, Feb 28, 2018, 1:09 AM UTC

Unable to direct attack freedom of expression, the spread of informations and small business, the EU developed another bureacratic layer on top all the bureaucratic layers already in effect. This layer is pretty hard to comply with, and requires a lawyer always on retaneir for peace of mind, ensuring that publishing online is de facto reserved to few players. Every other interpretation of the law is naive, just like with the cookie law, if they really wanted to stop the abuses of the big players they could have done so. Instead they're ruining normal people, because that's the real objective.

Re: How GDPR Will Change The Way You Develop

#463

Post by michaelmrose » Wed, Feb 28, 2018, 1:12 AM UTC

bkor wrote: post #437

Silhouette wrote: post #326

Earlier quoted context omitted.

We've been careful about what data we collect since day one, long before the GDPR was an issue. We're not doing anything shady with the data we do have, and we actively avoid questionable practices particularly around marketing, where we have ethical problems with being intrusive or compromising people's privacy regardless of any legal constraints. And yet having read the GDPR and much commentary about it, we're stil…

> What matters most about laws is what they actually say. Intent, as has been demonstrated countless times, is secondary. That's different per legal system. In some the text is more relevant. In various others the intend behind the law is very much relevant. I highly suggest to not follow your advice!!

The parent comment is saying we shouldn't rely on the intent of implementors of the law for our continued well being.

Pattern: propose easily misused overly broad law. When people express concern claim that the law is only to deal with problem foo and would never be used to do what it says in plain language. Proceed to do what it says you are allowed to do.

It could possibly be expressed as don't accept intent and goodwill in place of plainly expressed limits on government or regulatory power.

Re: How GDPR Will Change The Way You Develop

#464

Post by klokoman » Wed, Feb 28, 2018, 1:14 AM UTC

77pt77 wrote: post #369

_o_ wrote: post #312

Earlier quoted context omitted.

Not really true :) $20mil or 4% global revenue whichever is higher. $20mil is nothing for ggl/fb/... This time EU did it right, I doubt some small local shop will ever get max punishment but the % of global revenue is on the other side still something that can bite global corporations.

> I doubt some small local shop will ever get max punishment Why? It's selective prosecution, plain and simple. These things have a history of being selectively used to punish institutions for other reasons that are not easy to do using the law To the people downvoting, imagine the following scenario: Website promotes ideas the EU finds problematic. The EU wants to silence it but can't because of free-speech laws or…

Nobody believes the legislators have ill intent. Then they find themselves ruined but waking up then is hard too.

Re: How GDPR Will Change The Way You Develop

#465

Post by 77pt77 » Wed, Feb 28, 2018, 1:17 AM UTC

klokoman wrote: post #464

77pt77 wrote: post #369

Earlier quoted context omitted.

> I doubt some small local shop will ever get max punishment Why? It's selective prosecution, plain and simple. These things have a history of being selectively used to punish institutions for other reasons that are not easy to do using the law To the people downvoting, imagine the following scenario: Website promotes ideas the EU finds problematic. The EU wants to silence it but can't because of free-speech laws or…

Nobody believes the legislators have ill intent. Then they find themselves ruined but waking up then is hard too.

What this law means is that I'll never do any business, even freelance, without being shielded by an LLC.

Re: How GDPR Will Change The Way You Develop

#466

Post by 77pt77 » Wed, Feb 28, 2018, 1:20 AM UTC

jakeogh wrote: post #456

wila wrote: post #406

Earlier quoted context omitted.

Not really a problem for EU if JoeSchmoeLLC is really treating this as not a law for them. US and pretty much every country in the EU have excellent extradition agreements. [0] [0] https://en.wikipedia.org/wiki/List_of_United_States_extradit...

Extradition for what? Violating EU law? I do that almost every second of every day. PA is not subject to EU law whatsoever.

It's even stranger than that.

These laws have to be implemented in each of the member countries, so you'd be violating the law of one of those countries.

Re: How GDPR Will Change The Way You Develop

#467

Post by jakeogh » Wed, Feb 28, 2018, 1:21 AM UTC

The US withdrawing from the TPP was a (very) good thing: https://www.taylorwessing.com/globaldatahub/article-the-tpp-...

The EU's war on memory is concerning. It will be used as cover for their social engineers. Misinformation campaign didn't work out? Ah, delete it!

Re: How GDPR Will Change The Way You Develop

#468

Post by hanoz » Wed, Feb 28, 2018, 1:24 AM UTC

Diederich wrote: post #394

njl wrote: post #332

Earlier quoted context omitted.

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

> A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. Can you expand on that?

IP addresses are deemed personally identifiable information. All web servers log these by default - before asking users for permission to do so - and are therefore, bafflingly, about to become illegal.

Re: How GDPR Will Change The Way You Develop

#469

Post by klokoman » Wed, Feb 28, 2018, 1:24 AM UTC

77pt77 wrote: post #465

klokoman wrote: post #464

Earlier quoted context omitted.

Nobody believes the legislators have ill intent. Then they find themselves ruined but waking up then is hard too.

What this law means is that I'll never do any business, even freelance, without being shielded by an LLC.

Not just business, even information websites are affected. This is the most vicious attack against freedom of speech the EU ever pulled off.

Re: How GDPR Will Change The Way You Develop

#470

Post by danieltillett » Wed, Feb 28, 2018, 1:24 AM UTC

e12e wrote: post #386

danieltillett wrote: post #379

Earlier quoted context omitted.

The problem becomes if you make a mistake or aggregate in the wrong way you end up losing the ability to do later analysis. If I had thrown out my logs I would have provided my customers with a worse experience. I am supportive of the intent of the GDPR and we have always gone out of our way to minimise the data we collect, but as currently written the law has a whole lot of very negative downstream effects. Really t…

Re: "Where usage growth was coming from" sounds like the kind of things a log of performance data pr server might also answer. Can't argue with the fact that storing less and corner grained data will make certain ad hoc queries harder. That's kinda the point.

Performance data is not going to tell me where the users are located.

Yes it was only because I had the logs was I able to do this analysis. The issue is not over these sort of analyses which I am sure nobody would object to, but that GDPR casts such a wide net.