GDPR: Removing Monal from the EU • Hacker News Board

Re: GDPR: Removing Monal from the EU

#261

Post by kingbirdy » Thu, May 17, 2018, 10:38 PM UTC

tomatotomato37 wrote: post #213

anonymouz wrote: post #124

Earlier quoted context omitted.

> But it's not "their" data. It's the webmaster's data. No > It rightfully belongs to the webmaster. No, you are completely wrong here. The basic point of the legislation (and other privacy legislation in the EU that came before GDPR) is that a users personal data absolutely does not belong to the someone else once collected.

I hate this binary choice between all or nothing Your personal info, username, account settings, marketing anayltics, etc. are definitley you're data and you should be free to have them deleted. The two year old IPs in a server log sitting in backup, or a chance occurrence of your username in a random call stack for some web exception is not your data, and you shouldn't force a business to have to dig through that mo…

You're not required to delete information from archival data such as backups

Re: GDPR: Removing Monal from the EU

#262

Post by noobiemcfoob » Thu, May 17, 2018, 10:40 PM UTC

danbruc wrote: post #255

While Monal is privacy focused, it is also free, open source and run by a single person — me. I simply do not have the resources or the time to jump through the regulatory hoops required by the EU. As a new and small construction company we simply don't have the resources to comply with all the building codes and the related paperwork. I just can't afford to meet all food safety requirements, I just want to provide f…

Your point is clear, but this is internet software all having to comply with the same regulations regardless of actual industry. I'm having to close my small construction company because the FDA passed harsher food safety requirements.

Re: GDPR: Removing Monal from the EU

#263

Post by GordonS » Thu, May 17, 2018, 10:41 PM UTC

jash123 wrote: post #72

elephant0xffff wrote: post #9

I don't really get it. So what's the burden for the developer here - he argues that the IP is PII (personally identifiable information), which is true, but I don't think it means you can't log IPs in general anymore? So is now every standard apache2 installation a non-compliant (illegal?) service, as it logs GETs? I don't think that's the case. //edit: It seems to be the case that you are ok if you do log-rotation an…

Essentially: yes, that is the case. (Source: I am a privacy lawyer with >10yrs experience.)

Might I hazard a guess that you are operating in the USA?

Re: GDPR: Removing Monal from the EU

#264

Post by fcbrooklyn » Thu, May 17, 2018, 10:42 PM UTC

danbruc wrote: post #255

While Monal is privacy focused, it is also free, open source and run by a single person — me. I simply do not have the resources or the time to jump through the regulatory hoops required by the EU. As a new and small construction company we simply don't have the resources to comply with all the building codes and the related paperwork. I just can't afford to meet all food safety requirements, I just want to provide f…

Your first two examples are cute, but your third has the unfortunate side effect of undercutting your argument. A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US, as long as it has the appropriate indicators (brake lights, turn indicators, headlights). There's a crazy subculture around building bikes that would never in a million years pass muster as production vehicles. (let's drop a chevy small block into a harley).

Re: GDPR: Removing Monal from the EU

#265

Post by rwcarlsen » Thu, May 17, 2018, 10:42 PM UTC

danbruc wrote: post #255

While Monal is privacy focused, it is also free, open source and run by a single person — me. I simply do not have the resources or the time to jump through the regulatory hoops required by the EU. As a new and small construction company we simply don't have the resources to comply with all the building codes and the related paperwork. I just can't afford to meet all food safety requirements, I just want to provide f…

No need to be snarky - you do have a good point that can stand on its own. However the issue is not black and white. And just because you think the GDPR is a step forward, some people disagree. Even the Monal guy might agree with you - he just doesn't think it is worth it. And why wouldn't we expect strictly enforced food safety regulations to prevent meals being shared? It might be worth it, but it doesn't mean there won't be collateral damage.

Re: GDPR: Removing Monal from the EU

#266

Post by kasey_junk » Thu, May 17, 2018, 10:43 PM UTC

edaemon wrote: post #247

kasey_junk wrote: post #236

Earlier quoted context omitted.

The GDPR faq disagrees: https://www.eugdpr.org/gdpr-faqs.html

It doesn't. It says: > Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, ... or a computer IP address. Emphasis mine. I said: > IPs don't count as long as you're collecting them for security purposes and don't have a way to identify a person using the IP.

You are making a claim to one of 2 things:

- the ip addresses never uniquely identify someone or

- you have a legitimate interest to collecting this data.

Neither provides carte blanche for collecting IP address.

Re: GDPR: Removing Monal from the EU

#267

Post by dageshi » Thu, May 17, 2018, 10:43 PM UTC

danbruc wrote: post #255

While Monal is privacy focused, it is also free, open source and run by a single person — me. I simply do not have the resources or the time to jump through the regulatory hoops required by the EU. As a new and small construction company we simply don't have the resources to comply with all the building codes and the related paperwork. I just can't afford to meet all food safety requirements, I just want to provide f…

He is meeting the required standards... by not having an EU users.

In doing that he's as equally compliant as any company who has jumped through the various GDPR hoops.

Re: GDPR: Removing Monal from the EU

#268

Post by matthewmacleod » Thu, May 17, 2018, 10:43 PM UTC

The overreaction to GDPR from US tech startups in particular surprised me at first. But my partner is a lawyer working on GDPR compliance for a variety of tech firms, and he explained that there's almost a historical cultural difference in terms of attitudes to ownership of personal data.

European regulation typically treats personal data as being the property of the person being identified; US tradition considers data generated by a company to the be the property of that company, not of the person.

This made the whole massive unnecessary panic by primarily US-based small companies much more understandable to me.

Re: GDPR: Removing Monal from the EU

#269

Post by GordonS » Thu, May 17, 2018, 10:43 PM UTC

Hamuko wrote: post #41

floatingatoll wrote: post #14

Earlier quoted context omitted.

That makes a valid point: You should open a bug with Apache to remove IP address and User-Agent from the default log formats, as they should not be logged by default or else GDPR issues arise.

You can log IP addresses if there is a legitimate use for them. You just need to ensure that they are protected and that you do not keep them for any longer than is necessary (= use logrotate).

As someone who both owns a small business and is a consumer, this seems completely reasonable to me.

The GDPR has really made me think about minimising the collection of data that I don't need - absolutely a good thing.

Re: GDPR: Removing Monal from the EU

#270

Post by ozim » Thu, May 17, 2018, 10:43 PM UTC

josecastillo wrote: post #246

This is going to sound crazy, but I spun up an instance of a simple open-source comments system[1] for a blog that I write, and I chickened out of deploying it because I wasn't sure if it complied with GDPR. I distrust Disqus over their ad-driven model and deep tracking of users, so for now I’m just doing without comments. Is it possible to self-host something that handles user data (name, comment, IP address) and co…

If you do it for hobby it is not a problem. For IP address if you don't store it indefinitely, like you can anonymise IP after a month. I think you store IP for spam protection, solving user issues, which is lawful basis so you can protect your good interest. Most important you are not passing it to some third party. Second you can always make consent checkbox.

DPO is required only if you really store race, religion, credit card data, health records. If you keep name and IP you do not need a DPO.

There is so much FUD about GDPR, it will pass after a year. Now compliance vendors are having part, a lot of champagne will be opened on May 25th.

In the end if you know, what data you have, why do you have it and who you share it with, it should be good enough.