Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR: Removing Monal from the EU

monal.im

Post reply on HN
Print view View original

241–250 of 957 posts

Re: GDPR: Removing Monal from the EU

#241

Post by jimmaswell »

GordonS wrote: post #220
jimmaswell wrote: post #164

Earlier quoted context omitted.

"users don't get to put a leash on webmasters, it just allows the users to retain some degree of control over what the webmasters are allowed to do" I'll let that excerpt speak for itself. And yes, I'm arguing it's anyone's moral right to profit off information voluntarily entered into their website unless a specific agreement was made on the website to the contrary.

> And yes, I'm arguing it's anyone's moral right to profit off information voluntarily entered into their website unless a specific agreement was made on the website to the contrary Views like this are exactly why we need the GDPR. I find it utterly ridiculous - disgusting even - that you really believe you have the right to do whatever you want with someone else's personal information. When you provide an email addr…

And I find it equally disgusting that you think users' feelings are more important than webmasters' property rights.

Re: GDPR: Removing Monal from the EU

#242

Post by edaemon »

joering2 wrote: post #202
edaemon wrote: post #178

Earlier quoted context omitted.

That's only the case if you store personally identifiable information in your logs. IPs don't count as long as you're collecting them for security purposes and don't have a way to identify a person using the IP. Plus, if you rotate out your logs and clean them up regularly, you don't really need to worry about it. (That's what the EU lawyers at my work told us.) Database backups are only a problem if you save them fo…

I spent near to $10,000 in 6 lawyers 2 in usa 4 in different european countries and all wrote detailed report for me negating what you just said. IP is one of the most PII identifiable elements of an internet user. Exception is when you can prove such IP is a merely a proxy. please get some other lawyers opinion!!

Note that I didn't say IPs aren't PII; I said they don't count as long as you are collecting them for the specific purpose of security and don't have any way to identify the person using that IP. Pretty much by definition that is not PII.

That came from the legal departments from our German, UK, and French entities.

Re: GDPR: Removing Monal from the EU

#243

Post by eindiran »

tobltobs wrote: post #149
jimnotgym wrote: post #16

> I do not have the resources to hire a Data Protection Officer (DPO) or EU Representative as required by GDPR. A DPO is most certainly not required by all organisations[0], and I would be suprised if it applied to this project. I know lots of blogs are saying it is, but it is simply untrue. I'm not saying that this totally relieves the burden however. [0]: https://ico.org.uk/for-organisations/guide-to-the-general-da…

> most certainly not ... but it is simply untrue. Most certainly simply untrue?

There are two sentences there.

A lot of people are claiming that a DPO is required. GP is saying that a DPO is most certainly not required and that the claim [that a DPO is required] is simply untrue.

Re: GDPR: Removing Monal from the EU

#244

Post by matthewmacleod »

emilfihlman wrote: post #190
mnkypete wrote: post #5

There is so much misconception about GDPR. It is cleary directed at large data-tracking corps, not single person IM apps. Even if someone tries to "sue" you (which he can't, only report you to authorities), it first needs to go through many iterations where you can make your case. At the very least read this: https://privacylawblog.fieldfisher.com/2016/what-you-think-y...

So it's a law that's arbitrarily enforced? Kinda like giving limitless power to discriminate to someone? There is no misconception on GDPR: the idea is good, the implementation is horrible and retarded and it is lead by people who do not understand a single thing about technology.

No, you are wrong.

1. Enforcement is not arbitrary, but like all regulation the goal is compliance rather than punishment.

2. The idea is good, and the implementation is widely regarded as good by anybody familiar with data protection regulation.

3. Most of the panic seems to be from woefully misinformed US tech companies.

Re: GDPR: Removing Monal from the EU

#245

Post by rawfan »

nickpp wrote: post #166
lossolo wrote: post #150

Earlier quoted context omitted.

> Europe doesn’t have a stellar record when it comes to high tech startups. For many reasons. For many reasons indeed, this is broad topic and GDPR doesn't change anything if we are talking about big US players and their domination. None of them is getting out of EU. > And I am afraid GDPR has just added another one. I disagree, it's the other way around. Small single person companies/developers that will get out fro…

I fail to see how adding another onerous regulation makes the EU founder more likely to succeed where the US founder decided to give up.

How is knowing and writing down what your actually do with user data (and employee data, btw) and who is responsible an onerous regulation?

In a world where lots of small shitty businesses (and some bigger ones) don't care what happens to your personal data it's long overdue for this being finally regulated.

Re: GDPR: Removing Monal from the EU

#246

Post by josecastillo »

This is going to sound crazy, but I spun up an instance of a simple open-source comments system[1] for a blog that I write, and I chickened out of deploying it because I wasn't sure if it complied with GDPR. I distrust Disqus over their ad-driven model and deep tracking of users, so for now I’m just doing without comments.

Is it possible to self-host something that handles user data (name, comment, IP address) and comply with this regulation? What if there's more data, federated data? Can one just spin up an instance of Friendica, for example, or are there additional steps required for compliance? I'm honestly not sure anymore.

[1]: https://posativ.org/isso/

Re: GDPR: Removing Monal from the EU

#247

Post by edaemon »

kasey_junk wrote: post #236
edaemon wrote: post #178

Earlier quoted context omitted.

That's only the case if you store personally identifiable information in your logs. IPs don't count as long as you're collecting them for security purposes and don't have a way to identify a person using the IP. Plus, if you rotate out your logs and clean them up regularly, you don't really need to worry about it. (That's what the EU lawyers at my work told us.) Database backups are only a problem if you save them fo…

The GDPR faq disagrees: https://www.eugdpr.org/gdpr-faqs.html

It doesn't. It says:

> Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, ... or a computer IP address.

Emphasis mine.

I said:

> IPs don't count as long as you're collecting them for security purposes and don't have a way to identify a person using the IP.

Re: GDPR: Removing Monal from the EU

#248

Post by raverbashing »

joering2 wrote: post #202
edaemon wrote: post #178

Earlier quoted context omitted.

That's only the case if you store personally identifiable information in your logs. IPs don't count as long as you're collecting them for security purposes and don't have a way to identify a person using the IP. Plus, if you rotate out your logs and clean them up regularly, you don't really need to worry about it. (That's what the EU lawyers at my work told us.) Database backups are only a problem if you save them fo…

I spent near to $10,000 in 6 lawyers 2 in usa 4 in different european countries and all wrote detailed report for me negating what you just said. IP is one of the most PII identifiable elements of an internet user. Exception is when you can prove such IP is a merely a proxy. please get some other lawyers opinion!!

Here's your problem, you have 6 lawyers.

If you're too worried about this, remove the last octet from the IP or and/or it with a mask. And especially don't associate the IP with the user (by default you can't find out who's the user only by IP).

Re: GDPR: Removing Monal from the EU

#249

Post by matthewmacleod »

jbob2000 wrote: post #15
mnkypete wrote: post #5

There is so much misconception about GDPR. It is cleary directed at large data-tracking corps, not single person IM apps. Even if someone tries to "sue" you (which he can't, only report you to authorities), it first needs to go through many iterations where you can make your case. At the very least read this: https://privacylawblog.fieldfisher.com/2016/what-you-think-y...

When it's a one man show, you can't afford these kinds of unknowns. And by afford, I don't just mean monetary, I also mean mental costs, like your mind spinning at night wondering of the ways you might be harmed, or the ways you might develop a solution to the problem, etc.

No. Compliance with GDPR for a small company is relatively straightforward if you aren't doing anything shady with private data. It's not even an unknown.

Re: GDPR: Removing Monal from the EU

#250

Post by lovich »

donatj wrote: post #203
joering2 wrote: post #194

Earlier quoted context omitted.

> The mere act of pulling all my database backups from glacier at once would cost enough to force me to just shut down my personal projects. Okay: when you were writing this, you must been either drunk, you forgot how easy it is to find your projects via your HN profile and general googling, or you simply don’t have a single enemy out there who is waiting to hurt you/your business. I hope all of it together!!

My only still active side project to which this applies isn't open for public registration yet, and I fully intend to completely block the EU before going live.

If you don't have any revenue or nexus in the EU, what are they going to do to you whether or not you block them?

They aren't a global superpower who will or can invade your country to enforce their laws

Post reply on HN