Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook urged to make GDPR its “baseline standard” globally

techcrunch.com

Post reply on HN
Print view View original

161–170 of 236 posts

Re: Facebook urged to make GDPR its “baseline standard” globally

#161

Post by jumpkick »

leesalminen wrote: post #115
maaaats wrote: post #62

Earlier quoted context omitted.

Read about what GDPR actually entails. Following it should be simple for a new player.

What about deleting data in backups for an EU resident who submitted a request for data deletion? If a company is using mysqldump or equivalent it seems difficult to just drop certain records from those .sql files.

Have a reasonable retention policy on these backups. Backups are a "legitimate business interest" and you don't need to purge "right to be forgotten" requests from your backups if you stick to a reasonable and publicly-documented retention policy. This is advice that I've received from counsel. However, I am not a lawyer, and this in no way should be taken as legal advice.

Re: Facebook urged to make GDPR its “baseline standard” globally

#162

Post by wtfstatists »

decebalus1 wrote: post #154
taylorswift_ wrote: post #76

Earlier quoted context omitted.

can social media kill you though? I mean all this talk of regulating social networks is under the assumption that it's something you need to have. I would argue that safe shelter is a true human need, but posting cat gifs or pictures of drunken escapades or political musings does not seem equally comparable and thus I do not see how regulation does anything other than hamper competition.

> can social media kill you though? Yeah, it can and it did. Not only did the Ashley Madison leak led to a few deaths, check out what happens in countries where homosexuality is punished by death when private information goes public...

The States killed those people not Ashley-Madison.

Re: Facebook urged to make GDPR its “baseline standard” globally

#163

Post by kwhitefoot »

JumpCrisscross wrote: post #64
adtac wrote: post #46

Earlier quoted context omitted.

How is the country/continent of origin of a regulation that is entirely in your best interest of any relevance?

> How is the country/continent of origin of a regulation that is entirely in your best interest of any relevance? Laws carry their culture. GDPR is, from an American perspective, an overworked mess designed to support a big bureaucracy. This side of the Atlantic, we'd do something slimmer, more reliant on privately-funded cases (and regulatory complaints) versus public ombudsmen, and better attuned to start-ups’ need…

How many pages are there in your tax code?

Re: Facebook urged to make GDPR its “baseline standard” globally

#164

Post by methodover »

JumpCrisscross wrote: post #39
sakabaro wrote: post #33

Earlier quoted context omitted.

Yes, both are infringing 1st amendment. It’s not because GDPR seems more acceptable than it’s not built on bad premises.

> both are infringing 1st amendment The First Amendment protects you from the government. Facebook censoring you is not prohibited by the First Amendment. More broadly, I don’t see how GDPR interferes with one’s right to lawful political speech.

He means that both China and the EU (with the GDPR) infringe on freedom of speech.

Re: Facebook urged to make GDPR its “baseline standard” globally

#165

Post by Kalium »

lucideer wrote: post #158
Kalium wrote: post #134

Earlier quoted context omitted.

> 3. You can avoid doing if you want. If you are doing this, you're signing up to take on this additional burden of informing your users. Consider this when making this decision. This is the only bullet in the list that is in any way burdensome as you will need to update this text in your automated response whenever you take on 3rd-parties (if at all). Pretty much everyone is going to. Google Analytics, Zendesk, Sale…

> Pretty much everyone is going to [...] even AWS qualifies... I worded this badly. This is optional on a case by case basis , i.e. there's a cost-benefit to using each 3rd-party, and this burden is worth considering for each. It's still not a massively onerous burden tbh if you do use a lot of 3rd parties. > And "detail all your security measures". Which, for a small company that doesn't have an InfoSec group, proba…

> I worded this badly. This is optional on a case by case basis, i.e. there's a cost-benefit to using each 3rd-party, and this burden is worth considering for each. It's still not a massively onerous burden tbh if you do use a lot of 3rd parties.

I'm up close and personal with a vendor assurance process right now. It's often a non-trivial amount of time for any given vendor.

> I'm sorry but if you're really defending companies with no competent security measures in place, regardless of size, I think you're in the wrong forum here. If you are a commercial entity of any size there should be moral hazard in ignoring security of your users' personal data.

I'm sorry, I worded this badly. I'm saying that small startups have a tendency to prioritize getting a product working and seeing if it's worth investing heavily in before standing up a strong information security unit. You're absolutely, completely, 100% correct that there should be incentives to be very careful with user data.

I think it's possible to see where some people might find the level of expense and expertise required to be appropriately careful somewhat scary. I can even see where some people might decide to not create a social media startup to challenge Facebook because of this fear.

Re: Facebook urged to make GDPR its “baseline standard” globally

#166

Post by richardwhiuk »

AnthonyMouse wrote: post #160
EpicEng wrote: post #106

Earlier quoted context omitted.

I don't think GDPR compliance is as onerous as you seem to think it is, but even if it were, would it matter? We don't give special provisions to start ups writing safety critical code or developing new health care technology, why would this be any different? There's nothing inherently wrong with a high bar to entry if that bar exists for a very good reason. If it were hard to break into this space due to regulation…

> We don't give special provisions to start ups writing safety critical code or developing new health care technology, why would this be any different? Safety critical code and health care technology are life and death situations. It's also important to understand that the regulations in those sectors have destroyed (or deterred) an incredibly large number of startups, and the net lives saved as a result is quite lik…

That's a very optimistic view.

It's fairly clear that giving away people's data without any care is unsafe.

Re: Facebook urged to make GDPR its “baseline standard” globally

#167

Post by chc »

amelius wrote: post #142
tzs wrote: post #52

Earlier quoted context omitted.

Roughly: def GDPR_applies(company, person): if in_EU(person): return True if in_EU(company): return True return False There are various conditions, limitations, and exceptions that make the above not fully accurate, but its a good first approximation. You can read the actual text of the territorial scope rule here [1]. Edit: slightly less rough, but still quite rough: def GDPR_applies(company, person): if in_EU(compa…

Ok, what if a EU resident goes on a holiday in the US? Will all their data now be open to malicious treatment for the duration of the trip? Or only the data they enter/view during the trip?

You're still a resident of your home country while you're on vacation, so failing to cover any of that data would appear to be a breach of GDPR.

Re: Facebook urged to make GDPR its “baseline standard” globally

#168

Post by richardwhiuk »

Karishma55 wrote: post #141

As an Indian citizen I would like to oppose this pseudo colonising attempt. EU is anyways a basket case bureaucracy and most member nations are considering leaving EU, Britain having left it already. I see not reason and logic to the fact that nations who have not opted in into this be subjected to laws that are essentially created by no-skin-in-the-game bureaucrats. Such attempts should be opposed at all costs. (I k…

1 out of 28 is not most, and that was on a knife edge vote.

Re: Facebook urged to make GDPR its “baseline standard” globally

#169

Post by chc »

AnthonyMouse wrote: post #160
EpicEng wrote: post #106

Earlier quoted context omitted.

I don't think GDPR compliance is as onerous as you seem to think it is, but even if it were, would it matter? We don't give special provisions to start ups writing safety critical code or developing new health care technology, why would this be any different? There's nothing inherently wrong with a high bar to entry if that bar exists for a very good reason. If it were hard to break into this space due to regulation…

> We don't give special provisions to start ups writing safety critical code or developing new health care technology, why would this be any different? Safety critical code and health care technology are life and death situations. It's also important to understand that the regulations in those sectors have destroyed (or deterred) an incredibly large number of startups, and the net lives saved as a result is quite lik…

People's personal info can be a matter of life or death too. If yours isn't, you can count yourself fortunate.

Re: Facebook urged to make GDPR its “baseline standard” globally

#170

Post by isostatic »

sakabaro wrote: post #11
maxxxxx wrote: post #4

Earlier quoted context omitted.

You probably should explain this statement.

I agree with parent. GDPR is a threat to freedom of speech while not changing much in term of privacy as worst actors is governements themselves. Edward Snowden revalations are 100x worse than whatever worse FB scenario you are picking. GDPR sets a bad precedent with local laws impacting foreign businesses. In this logic, why Chinese speech laws shouldn’t apply to EU and US companies if GDPR applies globally?

> GDPR sets a bad precedent with local laws impacting foreign businesses.

The U.S. set that precedent 2 decades ago with the DMCA.

Don't like it? Then don't deal with EU citizens and residents. Don't like that? Fine, just don't go to the EU, or have any assets in the EU.

Post reply on HN