Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR: Removing Monal from the EU

monal.im

Post reply on HN
Print view View original

821–830 of 957 posts

Re: GDPR: Removing Monal from the EU

#821

Post by jdietrich »

fcbrooklyn wrote: post #424
jacquesm wrote: post #273

This is a ridiculous over-reaction based on an extremely shallow interpretation of the GDPR. If you are running a small business and you feel that you won't be able to operate your business because of the GDPR consider all those other laws that you have to be in compliance with as well. If that's your attitude towards legal compliance then you should probably shut your business down completely rather than to hope tha…

It is impossible to sell raw-milk cheese in the United States. Are French cheese makers overreacting by simply choosing not to do business here rather than change their centuries-old production techniques? It is illegal to sell kinder eggs in the US, because of some law that involves children accidentally swallowing toys. Is Kinder overreacting by refusing to sell those candies here? You cannot buy Bovril in the US,…

>Is Kinder overreacting by refusing to sell those candies here?

Kinder make a different version of the Kinder Egg specifically to comply with US law.

https://www.kinder.com/us/en/kinder-joy

>Are the manufacturers of bovril overreacting by refusing to create a separate production facility that uses only beef sourced from outside the UK?

Bovril was briefly made without any beef content because of the BSE issue.

https://web.archive.org/web/20071201114613/http://www.unilev...

Re: GDPR: Removing Monal from the EU

#822

Post by scaryclam »

jesdjkeujjuju wrote: post #745
jtl999 wrote: post #389

Earlier quoted context omitted.

`tail /var/log/nginx/access.log` Oops. Also the section of the GDPR that talks about pseudonymization using a token how should my user DB table be GDPR compliant? Contains ID (primary key), username, password hash, email, etc and the ID is also in other DB tables for obvious reasons (such as user posts/actions).

I think it can simply be GDPR compliant if you inform your users that you are saving that data in your database, and they give you the explicit OK to do to. Explicit consent meaning they tick a checkbox saying "I understand that page x is saving the data y in a database and I am OK with it". If you have a site where users can make posts, I'd say they pretty much give you consent by signing up. IANAL, though.

The consent has to be explicit. Of course, you can always just require consent in order to sign up. Just as long as it's clear what's going on and you can remove/anonymise the data if the user decides to revoke their consent and leave the service.

Re: GDPR: Removing Monal from the EU

#823

Post by drdaeman »

_petronius wrote: post #751
repolfx wrote: post #720

Earlier quoted context omitted.

They struggle with it for the same reason people on the political left always struggle to understand why some people oppose new regulations: the question of whether and how to regulate commercial activities is always a proxy for deeper underlying differences in how people view the world. GDPR is just a proxy fight between the left and the right and is showing all the same characteristics. Consider adventured's siblin…

You're bringing your US-American assumptions about politics and left vs right into the context of European politics where they are a poor fit. The world is not Democrats vs Republicans. There is no GDPR debate or fight: it's done, it was done six years ago, and the only people pushing back are American companies who are unhappy that Europeans don't want their data hoovered up by corporations they have no control or o…

Sorry, but do you want to say that EU has no left and right in politics (parent post did not mention Democrats or Republicans)? Or that everyone in the EU is unanimously happy with GDPR? Seriously, if a law's getting applied only after a long while it's passed - it's not unheard of to have a debate as people start to actually care.

Maybe I'm wrong, but I think that parent example is not US-specific at all and is applicable to just about any country where there are people that learn toward different beliefs (that "direct consequence of your assumptions about human nature" part of the post)

The assumptions may be wrong, but that was generally constructive.

Re: GDPR: Removing Monal from the EU

#824

Post by pavelludiq »

nickpp wrote: post #63
jimnotgym wrote: post #30

Earlier quoted context omitted.

Please take the assurance from the 'horses mouth' instead. The ICO is the UK body responsible for policing this. Their site is simple and in plain English. https://ico.org.uk/for-organisations/guide-to-the-general-da...

UK is not the only country that can sue you under GDPR. What if Bulgaria decides 20 million sound pretty good?

With that money you can bribe every cop my country 100 times over. I wouldn't worry about it :p

Re: GDPR: Removing Monal from the EU

#825

Post by iamnothere »

jacquesm wrote: post #305
zerostar07 wrote: post #299

Earlier quoted context omitted.

You can be respective of privacy without complying with GDPR. It requires a lot more than simply being privacy-conscious. (E.g. I don't think Hacker News is doing anything unethical even though they blatantly violate GDPR) > Legal compliance is a requirement for any business You are required to comply with the laws of your country, not those of other countries.

If you are not doing anything shady, if you have your house in order security wise and if you do not collect data that you have no use for you are 95% there. The remainder will maybe require consultation with a lawyer for an hour or two if you want to play it safe but you could also simply wait for a few months to see how it all plays out. If you are respectful of other people's privacy then there is very little chan…

> Imagine the rest of the world reacting to the DMCA this way which has far wider scope and effect.

That would have been a wonderful thing to see. The DMCA has had a chilling effect on speech worldwide, and has created difficult barriers for small businesses to deal with if they want to host user-created content.

I think you unintentionally made your opponent's point!

Re: GDPR: Removing Monal from the EU

#826

Post by kingofhdds »

Angostura wrote: post #815
kingofhdds wrote: post #767

Earlier quoted context omitted.

And "large scale" means how many records in DB? How many users? Or records per day?

Why have you isolated one element from a multiple element sentence: If * core activities * require * large scale * regular * systematic If you tick all those other boxes, but are concerned that your processing may be teetering on the boundary of 'large scale', I would be cautious and assume your liable.

All repeatable processes are systematic, almost the whole IT goes into the category. And "core" is undefined too.

I agree that it is safer to imply you're liable.

Re: GDPR: Removing Monal from the EU

#827

Post by lewiseason »

amurgul wrote: post #677

You CANNOT, by any means, consider an IP address to be "personal data". You cannot say "I don't want my IP to lay around in a database somewhere" because ... IT IS NOT YOUR IP. An IP address is used to uniquely identify a device on a network, not a person. This device can be (and usually is) a router, a proxy, a server of some kind, a corporate computer, a public computer and so on. Not to mention the fact that a dev…

What GDPR says about this is:

> [A]n identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

I think the principle is that since an IP address could be used to identify you, it is considered personal data.

Re: GDPR: Removing Monal from the EU

#828

Post by Silhouette »

henrikschroder wrote: post #768
mikekchar wrote: post #657

Earlier quoted context omitted.

I think the parent's reply is a good one. We could probably debate some of the finer points, but I think when we get some time to see how it all shakes out in the end we'll have a better vantage point. But to answer your question about the right to erasure, here is the law: https://gdpr-info.eu/art-17-gdpr/ I can't find it right now (and I have to get back to work), but there is a reasonableness requirement for reque…

I think the UK agency had some text on erasure and backups, and it basically boiled down to this: If a data subject requests their data to be erased, you should remove their data from active systems so that it is no longer being processed, but you don't have to remove it from backups or other passive systems. You should however store some sort of marker so that if you need to restore data from backups, the data subje…

Neither the UK nor the EU previously had any general provision for a right to erasure. At EU level, considerable waves were made when the "right to be forgotten" ruling was issued, but that came from a court that was considering a specific case.

Re: GDPR: Removing Monal from the EU

#829

Post by emilfihlman »

danbruc wrote: post #255

While Monal is privacy focused, it is also free, open source and run by a single person — me. I simply do not have the resources or the time to jump through the regulatory hoops required by the EU. As a new and small construction company we simply don't have the resources to comply with all the building codes and the related paperwork. I just can't afford to meet all food safety requirements, I just want to provide f…

This is not even remotely in the same realm.

Re: GDPR: Removing Monal from the EU

#830

Post by midasz »

hanspeter wrote: post #816
consp wrote: post #716

Earlier quoted context omitted.

Also, needing to have a DPO is not difficult since he already has one employee, himself. It's not ISO2700x, you don't need to fiddle around with rights in small businesses to make sure it fits the narrow perspective of a standardization and exclusiveness.

The DPO cannot be himself.

Source?
Post reply on HN