Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

2018 reform of EU data protection rules

ec.europa.eu

Post reply on HN
Print view View original

91–100 of 150 posts

Re: 2018 reform of EU data protection rules

#91

Post by someguy2018 »

viraptor wrote: post #81
someguy2018 wrote: post #68

Earlier quoted context omitted.

Because I apparently need affirmative check-the-box consent before I can actually use those ad networks. I'm not doing anything shady: all the information I collect and why I collect it has always been in my privacy policy. But making people have to opt-in to see ads on the site is a big problem.

You can do non-targetted ads without explicit consent as far as I understand. You only need it for the extra personal information use. Sure it's a bit worse for the publishers. (But I'm happy with that)

Where would "non-targeted" ads even come from? How can you use an ad network or even run a standard ad server in a way that doesn't share at least the reader's IP Address?

Mom and pop publishers who don't have the resources or ability to staff their own ad sales team are going to be in trouble. The big players who can work around this obstacle are going to be fine. I'm not happy about this.

Re: 2018 reform of EU data protection rules

#92

Post by nils-m-holm »

nils-m-holm wrote: post #59
tobltobs wrote: post #22

Earlier quoted context omitted.

In Germany offenses against the GDPR can cause a "Abmahnung" which do not result in a fine but a charge. There a legions of filthy lawyers waiting for the 25.5.

This is a big problem here in Germany and might very well be a reason to shut down my site on 5/24.

Would the downvoters care to explain what offended them? Looking the other way does not help solve a problem.

Re: 2018 reform of EU data protection rules

#93

Post by grabeh »

akvadrako wrote: post #78
dbbk wrote: post #75

Earlier quoted context omitted.

Don't log ip addresses, or anonymise them.

How would you anonymise an IPv4 address? Hashing isn't enough, because that would be easy to brute force. And you can't create a table mapping IPs to anonymized-IPs, because then you are still storing them.

You could just remove parts of the IP address so it could no longer be used to identify a unique individual. For example, if you removed the last 3 digits, it could no longer be used on IP lookups (presumably), or an ISP would not be able to disclose the particular individual that is associated with the user account that the IP is linked to, because there is insufficient information available.

Here's Google's approach: https://support.google.com/analytics/answer/2763052?hl=en

Re: 2018 reform of EU data protection rules

#94

Post by grabeh »

cromulen wrote: post #62

Does anyone have an example of the "documentation of data processing activities"? Edit: Especially in the context of a company that does not handle/store customer data, but only employee info.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

The above link contains a sample Excel template with details of the various information a record of processing should contain. If you are only processing employee data this should be straightforward. It's a link to the ICO, the UK's data protection authority, but it should be useful regardless of where you are (assuming GDPR applies to you of course!).

Re: 2018 reform of EU data protection rules

#95

Post by teamhappy »

akvadrako wrote: post #78
dbbk wrote: post #75

Earlier quoted context omitted.

Don't log ip addresses, or anonymise them.

How would you anonymise an IPv4 address? Hashing isn't enough, because that would be easy to brute force. And you can't create a table mapping IPs to anonymized-IPs, because then you are still storing them.

Google Analytics drops the last octet IIRC. Hashing isn't anonymizing because the hash can later be used to re-identify a user. (See https://ec.europa.eu/info/law/law-topic/data-protection/refo...)

Re: 2018 reform of EU data protection rules

#96

Post by akvadrako »

grabeh wrote: post #93
akvadrako wrote: post #78

Earlier quoted context omitted.

How would you anonymise an IPv4 address? Hashing isn't enough, because that would be easy to brute force. And you can't create a table mapping IPs to anonymized-IPs, because then you are still storing them.

You could just remove parts of the IP address so it could no longer be used to identify a unique individual. For example, if you removed the last 3 digits, it could no longer be used on IP lookups (presumably), or an ISP would not be able to disclose the particular individual that is associated with the user account that the IP is linked to, because there is insufficient information available. Here's Google's approac…

Removing the last 3 digits would often uniquely identify a larger company or a city and if you only have 1 user from that city/company, those records would be easy to connect.

Maybe Google is hoping the EU will accept that balance of concerns, but it doesn't sound like it realises the spirit of the law.

Re: 2018 reform of EU data protection rules

#97

Post by lucio »

mattmanser wrote: post #41
Dayshine wrote: post #14

Enforcement factsheet: https://ec.europa.eu/commission/sites/beta-political/files/d... Pretty clearly primarily enforced by national regulatory agencies, who are the only ones who can apply fines . It mentions citizens taking companies to court, but https://ec.europa.eu/commission/sites/beta-political/files/d... says that's for monetary damages, not for fines. This is unchanged from previous laws. Can people stop fre…

Also: https://ec.europa.eu/info/law/law-topic/data-protection/refo... The authority must ensure that fines imposed in each individual case are effective, proportionate and dissuasive. It will take into account a number of factors such as the nature, gravity and duration of the infringement, its intentional or negligent character, any action taken to mitigate the damage suffered by individuals, the degree of cooperati…

There's a problem when "The authority must ensure...", i.e. when there's a lot of discretion granted to "The authority", that's because "The authority" will use any law available to try to silence or harm dangerous individuals when there are "hidden" political reason to do so.

Example: http://www.bbc.com/news/world-europe-39973864

An antidote to this potential abuse is to make laws scarce and highly specific and make judges apply laws in the most textual form possible.

Re: 2018 reform of EU data protection rules

#98

Post by Dayshine »

nils-m-holm wrote: post #92
nils-m-holm wrote: post #59

Earlier quoted context omitted.

This is a big problem here in Germany and might very well be a reason to shut down my site on 5/24.

Would the downvoters care to explain what offended them? Looking the other way does not help solve a problem.

Well, my immediate thoughts in response to that reply were:

"Why is some extra law specific to Germany relevant to my comment? This is a discussion about the GDPR, not about national data protection laws."

Re: 2018 reform of EU data protection rules

#99

Post by [deleted] »

frockington wrote: post #66
donohoe wrote: post #46

First, I am not a lawyer. I don't even play one on TV. The big question I keep hearing is; I'm in the US (or other non-EU country), does GDPR apply to my company or organization? The shortest possible answer is: Maybe :) The answer is: YES if your company has a physical or legal presence (like an office, employee, parent-company, subsidiary, etc.) in an EU country. The GDPR applies to you and you need to to start rea…

This is the same EU that turned a blind eye to VW and other companies blatantly lying to regulators. In terms of EU regulation NO is normally a safe bet as long as you are big enough. You think Germany is going to fine an automaker or Lux is going to fine a bank?

[deleted]

Re: 2018 reform of EU data protection rules

#100

Post by Angostura »

someguy2018 wrote: post #91
viraptor wrote: post #81

Earlier quoted context omitted.

You can do non-targetted ads without explicit consent as far as I understand. You only need it for the extra personal information use. Sure it's a bit worse for the publishers. (But I'm happy with that)

Where would "non-targeted" ads even come from? How can you use an ad network or even run a standard ad server in a way that doesn't share at least the reader's IP Address? Mom and pop publishers who don't have the resources or ability to staff their own ad sales team are going to be in trouble. The big players who can work around this obstacle are going to be fine. I'm not happy about this.

IP address is only personally identifable info if it is coupled with other info that links it to a real person.

Storing an IP address by itself and sharing it is not, by itself PII

Post reply on HN