Publishers Haven't Realized How Big a Deal GDPR Is • Hacker News Board

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#151

Post by ryanlol » Sun, Apr 08, 2018, 8:14 PM UTC

riantogo wrote: post #67

tcd wrote: post #5

Earlier quoted context omitted.

Why would you feel bad for them? They have had 2 years to prepare for this, hopefully a few fines here and there will make people realise this _is_ a big deal and they can't just ignore it. About time too, I really really hope this has an incredible profound impact on privacy and the EU will demonstrate this is a law people _must_ abide by.

Maybe the next version of GDPR will tighten the screws and take it all the way to the end user. You install some app and share your contacts with it? Pony up 10% of your annual income. You forgot your phone in a cab? That is putting everyone who has ever emailed you at risk. 15% of your annual income as fine for your carelessness. Would you still support it? Such sweeping laws require a lot of thought and debate. It…

>Would you still support it?

Omg. Yes. This is better than the stuff in my wildest dreams.

Fining people for bad opsec is a tremendous idea!

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#152

Post by gingerlime » Sun, Apr 08, 2018, 8:14 PM UTC

molf wrote: post #127

jasonkostempski wrote: post #108

Earlier quoted context omitted.

Is there anything stopping these letters from being abused like DMCA Takedowns? Just one of these look like they'd tie up a human worker for days. How much personal information are you going to have to provide to ask for such data? Especially for ".. provide me with a copy .." Does any of this apply to "anonymized" data?

You can charge reasonable administrative fees or refuse to act if the request is "manifestly unfounded or excessive, in particular because of their repetitive character". [1] [1] https://gdpr-info.eu/art-12-gdpr/

Is a single request like this from a single individual excessive or repetitive though??

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#153

Post by ptype » Sun, Apr 08, 2018, 8:16 PM UTC

detaro wrote: post #141

ptype wrote: post #139

Earlier quoted context omitted.

To be clear, I am only talking about the interpretation of the regulation, not my own considerations. The article made it sound like IP addresses are always personal data. My point is that, if I run a website and keep generic nginx log files, is it really personable data with regards to my website? Yes, the ISP can link that IP address back to a person, but if that person came to me as the website administrator and a…

Yes, it is. That you don't necessarily have the ability to make that connection doesn't matter, although if it turns out you have it of course makes matters worse. (This also isn't new under GDPR, current european law interpretation already supports this. See http://curia.europa.eu/juris/document/document.jsf?text=&doc... for the court decision firmly establishing this: Since the visitors provider has the data, and w…

Well actually this analysis by White & Case of the same case[1], seems to suggest that it may not be (paragraph “impact on businesses”) personal data if the business has no means of linking the addresses to users.

[1] https://www.whitecase.com/publications/alert/court-confirms-...

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#154

Post by Mooty » Sun, Apr 08, 2018, 8:16 PM UTC

If anyone is searching a MOOC to comply his work with GDPR, this one was really concise and complete : https://bluelearning.fr/formation/rgpd/

PS : Ask for English version, they can do an English version, they did one for us.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#155

Post by guiambros » Sun, Apr 08, 2018, 8:18 PM UTC

eyeareque wrote: post #132

Animats wrote: post #64

It's even bigger than that. It's been mentioned on HN before, but see the "GPDR Letter."[1] Anyone in the EU can send you such a letter, and you have 30 days to reply. Please confirm to me whether or not my personal data is being processed. If it is, please provide me with the categories of personal data you have about me in your files and databases. a. In particular, please tell me what you know about me in your inf…

I dream of the day that I can ask various companies to delete every piece of data they have about me.

I dream of the day that I can discover the various companies who have any data about me...

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#156

Post by gingerlime » Sun, Apr 08, 2018, 8:18 PM UTC

Grollicus wrote: post #123

drchiu wrote: post #81

Earlier quoted context omitted.

Precisely this. Once you’ve dealt with sensitive data where authentication is required (real life, signatures with witnesses and all), the surface area for attack when it comes to data request is huge if the burden to reply is based simply on an email. Sending an email request is practically free with automation, which provides a nice way for phishers to know where targets store their information. Anyone know of how…

Im Germany you generally need to send a real letter (or a fax) and it needs to contain your signature. "Authentication" for this is provided by harsh penalties on signature forgeries. Also, you'd only get one single data point and everything really sensitive has address data and they will* send their response to a known address.

If all information you have about a person is their email (and usage data) then this won’t make a difference though... The GDPR considers even an IP address personal data, even if you have no way to correlate it with a real person. So where does this leave you if you have to respond?

Imagine I’m sending a request for information from a given IP address, requesting all the personal information you hold on that IP. I kinda proved that I’m using this IP and it’s part of my private data... but providing all information on this IP is likely to leak data on other people and there’s no way legitimate the requester

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#157

Post by rimliu » Sun, Apr 08, 2018, 8:18 PM UTC

rossdavidh wrote: post #135

In fact, I think the author is underestimating the impact, right here: "Of course, making this change will have a dramatic impact on your revenue for single-visit traffic, because you basically have to design your ad model to work completely differently from how it works today." No, it will basically make a newsmedia site unprofitable. I think it is the EU that has not fully thought this through. Most of the news ind…

  > No, it will basically make a newsmedia site unprofitable.

Good. We don't need that much "news" anyway. And I think my need would be more than covered by national TV which is sponsored by taxpayers money and BBC, which also has no advertising. There really won't be much of the value lost if we won't have sensationalized and invented news any more.

Another point to consider is that need for news or just for some brain filler: I am puzzled by appareant inability of many today to be alone and in silence. As if then some thought that they cannot be comfortable with start to be loud enough to be heard.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#158

Post by weinzierl » Sun, Apr 08, 2018, 8:19 PM UTC

pspeter3 wrote: post #36

Does this mean every site will need to ask permission for Google Analytics?

I researched this and didn't find a conclusive answer yet. What I found out is:

The original plan was for both the GDPR and the ePrivacy Regulation [1] (not to be confused with the ePrivacy Direcive) to come into effect on 25 May 2018. The ePrivacy Regulation would have had a special exemption for analytics cookies. If that would have been enough to not require consent for Google Analytics I do not know.

Now the ePrivacy Regulation is delayed but the GDPR is not. I didn't find a lot of information about what that means for the time after 25 May 2018. The following is from German sources (primarily e-recht24.de [2]) and is only from a German perspective.

Google's terms [3] in accordance with German law currently require consent in the case of AdSense but not for Google Analytics. According to [2] this is in obvious conflict with current EU law but the EU Commission denies that.

e-recht24.de [2] is careful to avoid a clear statement about the situation after 25 May but from my understanding they hint that the situation will not change. German law is already in conflict with EU law and this fact is ignored by all parties. The GDPR will not change that situation.

[1] https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_...

[2] https://www.e-recht24.de/artikel/datenschutz/8451-hinweispfl...

[3] https://www.google.com/about/company/user-consent-policy.htm...

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#159

Post by akvadrako » Sun, Apr 08, 2018, 8:19 PM UTC

mgiannopoulos wrote: post #83

The author claims that for one-time visitors you're not supposed to have any 3rd-party tracking code but uses Google Analytics which Ghostery counts as a tracking code. How's that going to work out for practically every site in the world?

Hopefully this castrates Google Analytics so much it's useless and goes away.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#160

Post by _pRwn_ » Sun, Apr 08, 2018, 8:21 PM UTC

as a Kraut: if you start now, you're practically too late. It will be interesting to see which major corporation will face the fine of 20 million Euro or 4% of annual turnover the first.