71–80 of 468 posts
I’m pretty sure the reason for this is that they know that the day they switch over to GDPR compliance, their ad revenue from EU will take a nosedive, and they don’t want to throw away that revenue for the sake of being early.
Wouldn't Google be the data-controller in that case?
Google might still be allowed to do the personal tracking if they ever obtained consent from that user. Another reason why the AMP caching is bad for the web, I guess.
And from the user's perspective AMP articles would become even more appealing because they would never be bothered with consent popups.
GDPR articles seem to be getting some traction on HN as everyone is trying to figure out: "Do I need to do something for this? Is so, what?" For a recent project I read (and translated to plain english) [1] every single article in the GDPR legislation and for our purposes it can be summed up as: "Treat user data like names and emails as if they were credit card numbers" AKA: be paranoid about keeping them, encrypt th…
I’d add: Get (documented, active) permission of users to store and use their data, understand that permission is given only for a defined cause/usage (and not indefinitely for everything you right now might not even think of), be prepared to tell users what data you store about them, why and (briefly) how it is used. Be prepared to delete user data on request. Be prepared to show documentation on how you handle the (…
The alternative is to only collect data that is strictly necessary to provide the service. In that case GDPR allows you to collect the data even without explicitly given consent – according to GDPR in that case the user can reasonably expect the data to be necessary to provide the service. (This does not apply to sensitive personal data and biometric/genetic data – then you always need consent.)
Quoting GDPR:
"Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement." [1]
"Consent is presumed not to be freely given [...] if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance." [2]
[1] https://gdpr-info.eu/recitals/no-32/ [2] https://gdpr-info.eu/recitals/no-43/
Earlier quoted context omitted.
There's a very clear distinction: GDPR requires that consent is not a precondition for offering a service. Most cookie policies in practice are all or nothing: you either accept and continue, or you decline and cannot use the service/website. That is not allowed under GDPR.
Interesting. Which part of GDPR disallows the “decline and you cannot use the service” case?
"Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement [...]" [1]
"Consent is presumed not to be freely given [...] if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance." [2]
[1] https://gdpr-info.eu/recitals/no-32/ [2] https://gdpr-info.eu/recitals/no-43/
GDPR articles seem to be getting some traction on HN as everyone is trying to figure out: "Do I need to do something for this? Is so, what?" For a recent project I read (and translated to plain english) [1] every single article in the GDPR legislation and for our purposes it can be summed up as: "Treat user data like names and emails as if they were credit card numbers" AKA: be paranoid about keeping them, encrypt th…
If I have an IRC service that shows quotes from people and has 'last seen' functionality is that covered by GDPR? Some of the users are from EU countries, does that mean those features need to be turned off or have some sort of acceptance exchange with users? Would filtering out EU IP ranges be sufficient, or does this also apply to EU citizens traveling outside of the EU? The referenced page says that asking users t…
It's even bigger than that. It's been mentioned on HN before, but see the "GPDR Letter."[1] Anyone in the EU can send you such a letter, and you have 30 days to reply. Please confirm to me whether or not my personal data is being processed. If it is, please provide me with the categories of personal data you have about me in your files and databases. a. In particular, please tell me what you know about me in your inf…
If you send that letter, expect to receive a standard response/report of data with a form response that politely & legally amounts to “piss off”.
Large organizations have considerable resources set aside to make sure their “piss off” letter is legally defensible & GDPR compliant.
That letter is likely only a problem when selectively used by a malicious actor against a small organization. Frankly not the kind of org that is systematically tracking personal data.
No, outside of a few echo chambers, no one cares about privacy or knows what GDPR is. Until GDPR shows everyday on the evening news for weeks it will not be well-known, and there are many things more important to most people than online privacy. Heck, Cambridge Analytica was only a scandal because the "bad guy won".
It's even bigger than that. It's been mentioned on HN before, but see the "GPDR Letter."[1] Anyone in the EU can send you such a letter, and you have 30 days to reply. Please confirm to me whether or not my personal data is being processed. If it is, please provide me with the categories of personal data you have about me in your files and databases. a. In particular, please tell me what you know about me in your inf…
What's the process for authenticating who sent the letter? Seems like a potential new attack vector.
Earlier quoted context omitted.
Noob question How is that person-identitifying information? Seems like it's machine-identifying information. You can't tie it to a real-world name and email (which the top voted comment claims is the essence of GDPR).
You can tie such visit to a real person. For example, if this is a Facebook user, and your site includes resources from facebook.com, Facebook will know exactly which real person visited your site, and the user did not give you consent to share such info with Facebook.
They acquired your name, birthdate, address, etc. And they didn't aquire it through your website.
Calling IP address or screen size "person" identifying information seems a stretch to me.
It's even bigger than that. It's been mentioned on HN before, but see the "GPDR Letter."[1] Anyone in the EU can send you such a letter, and you have 30 days to reply. Please confirm to me whether or not my personal data is being processed. If it is, please provide me with the categories of personal data you have about me in your files and databases. a. In particular, please tell me what you know about me in your inf…
You should note that lots of what that letter suggest it has rights to, are not rights granted under GDPR. Or at least would be subject to legal clarification. If you send that letter, expect to receive a standard response/report of data with a form response that politely & legally amounts to “piss off”. Large organizations have considerable resources set aside to make sure their “piss off” letter is legally defensib…
These rights include:
* the right to be informed about what data is processed
* the right to access all data gathered about them
* the right to rectification of incorrect data
* the right to receive an export of the data in a common format
* the right to object, to have all data removed, and to restrict processing until further notice
GDPR also requires a data controller to respond within a month, and not charge any fee for this unless the requests are excessive (because they are repetitive). [2]