Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Publishers Haven't Realized How Big a Deal GDPR Is

baekdal.com

Post reply on HN
Print view View original

401–410 of 468 posts

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#401

Post by TeMPOraL »

merinowool wrote: post #389
TeMPOraL wrote: post #319

Earlier quoted context omitted.

Unless your PII workflow is bonkers, you should be able to respond to those letters in mostly automated fashion. I mean, you do handle your data in mostly universal way, instead of randomly copying pieces of your database to random parties? Right?

How do you automate checking if person requesting the data is the person claims to be. How do you automate reading an email and giving meaningful response?

I admit I'm not sure how the verification part is supposed to look like. For the rest, I assume that if you have a standardized data flow (and don't randomly resell people to different parties), you could automate the part that writes responses, and only have humans read the original mail and check appropriate checkboxes to generate a standardized reply covering all the relevant points.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#402

Post by ardacinar »

zimpenfish wrote: post #400
ardacinar wrote: post #397

IP adresses being protected as personal data has an interesting side effect. You can't be compliant under both EU GDPR and Turkish internet security laws (probably shared by a lot of oppressive and semi-oppressive regimes). That law states you have to keep the poster IP address of every post on the site and turn them over on court order. Obviously, as with every law in Turkey, the enforcement is very subjective (for…

> You can't be compliant under both EU GDPR and Turkish internet security laws [...] states you have to keep the poster IP address of every post on the site GDPR does have specific exemptions for holding/processing data per legal requirements.

Yes there' a 'justice' exemption/loophole in GDPR but I don't think "we're still saving the IP addresses anyway in case a court requests it" argument would fly.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#403

Post by [deleted] »

detaro wrote: post #231
return0 wrote: post #182

Earlier quoted context omitted.

> This should have been a brower-based implementation globally that every site must adhere to. This. if EU actually cared enough, they 'd go to the browser vendors to enforce some basic prompts on tracking and forms, and it would be better than gdpr because it would work for everyone from day 1. This law will bring a few more prompts and not much else (because most services can be provided with slight changes like ha…

Or the tech industry could decide that'd be useful to have and implement it. They could put it in a HTTP header with a nice name, maybe "do not track", and don't bother people activating that with tracking or prompts. Oh wait... How many websites are doing that? How many choose "let's bother our users" over respecting their stated preference?

[deleted]

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#404

Post by [deleted] »

detaro wrote: post #231
return0 wrote: post #182

Earlier quoted context omitted.

> This should have been a brower-based implementation globally that every site must adhere to. This. if EU actually cared enough, they 'd go to the browser vendors to enforce some basic prompts on tracking and forms, and it would be better than gdpr because it would work for everyone from day 1. This law will bring a few more prompts and not much else (because most services can be provided with slight changes like ha…

Or the tech industry could decide that'd be useful to have and implement it. They could put it in a HTTP header with a nice name, maybe "do not track", and don't bother people activating that with tracking or prompts. Oh wait... How many websites are doing that? How many choose "let's bother our users" over respecting their stated preference?

[deleted]

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#405

Post by TeMPOraL »

guelo wrote: post #363
TeMPOraL wrote: post #306

Earlier quoted context omitted.

> First it was the completely useless cookie notifications It was useless in the sense it was trying to play nice. It was a gentle call for the industry to self-regulate. The only problem with that law was how naïve it was. Go ahead and block the whole European IP range. See if we care.

You do care. Everytime some web service is US only there's endless ranting from Europeans about it.

That's because, most of the time, a service is US-only because of some bullshit reason like exclusive region-locking deals or MAFIAA copyright terrorism. I don't think that "this service is unavailable in your country because your law doesn't let us sell your private data to the highest bidder" is going to induce that much ranting.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#407

Post by krageon »

guelo wrote: post #363
TeMPOraL wrote: post #306

Earlier quoted context omitted.

> First it was the completely useless cookie notifications It was useless in the sense it was trying to play nice. It was a gentle call for the industry to self-regulate. The only problem with that law was how naïve it was. Go ahead and block the whole European IP range. See if we care.

You do care. Everytime some web service is US only there's endless ranting from Europeans about it.

Once blocking by US websites becomes a little more widespread there will be EU alternatives to fill the gaps. Normally I'm not a huge fan of such solutions, but if the alternative is exposing myself to the wild west of unregulated selling of my personal data that is the US I'll learn to live with it.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#408

Post by Silhouette »

ryandrake wrote: post #212
Silhouette wrote: post #161

Earlier quoted context omitted.

Unfortunately even if you're already handling personal data responsibly, the GDPR still also requires that you be able to provide various documented policies to your regulator on demand, still contains lots of ambiguity about how far subject rights can go in practice, still imposes obligations to include lots of extra detail in privacy policies or otherwise provide lots of information and active warnings to data subj…

How about, “Our documented policy is to not collect personal information from users at all.” Assuming it’s true, wouldn’t that be compliant?

Presumably it would, but since approximately 0% of businesses that actually do anything could make such a statement truthfully, that doesn't help very much.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#409

Post by krageon »

merinowool wrote: post #253
dmix wrote: post #82

Earlier quoted context omitted.

> That letter is likely only a problem when selectively used by a malicious actor against a small organization. Which is what is so annoying and economically destructive about regulations like these that are broadly applied to all companies, especially on the internet where single person companies are very popular. They are designed in a vindictive way against large companies like Facebook or major online retailers w…

> The western economic environment countinually gets more and more structured favouring large firms, encouraging large scale merging, which usually generates the type of large oligopoly companies who most often does the things that cause regulations to get created, then imposed on smaller firms. This is where socialism differs from communism - in socialism you have big privately owned companies, whereas in communism…

While I agree with your opinion about the GDPR, your analysis of Europe is otherwise plainly wrong. You would be aware of this if you actually followed EU politics (there is currently a strong trend towards right-wing / center politics. Left-leaning parties are moderately out of favour), which you definitely do not have to do. Just try not to spread misinformation on the internet: There is plenty of it to go around already.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#410

Post by Silhouette »

ryandrake wrote: post #248
kasey_junk wrote: post #223

Earlier quoted context omitted.

GDPR also expands what is personal data to include things that are collected as a matter of course such as IP address. You likely have a reason to log that data but GDPR requires that you document it. Further it reaches into your business even if you aren’t trying to do business in the EU, as EU citizens can come to your site without your control. There is a lot to like with GDPR but it absolutely is expansive & easy…

Maybe these things shouldn’t be collected as a matter of course. Should web servers log client IP addresses by default? Why? Does my mail server need to log email addresses of incoming mail by default? “Logging all the things” as default behavior really needs to be a thing of the past. If anyone wants to get their feet wet in open source, there are thousands of high profile projects out there that could use a patch t…

“Logging all the things” as default behavior really needs to be a thing of the past.

Maybe, but logging useful things is reasonable. We investigate problems with our systems using server logs. We diagnose various security threats, fraud risks and ToS violations using server logs.

We're generally respectful of users' privacy, but we also have a legitimate interest in knowing how our systems are being used and preventing people from doing bad things with them. Those legitimate interests may take precedence over a visitor's right to privacy in some cases, in the same way that you can't tell a government to forget your criminal record or a bank to forget that you owe them money.

Post reply on HN