Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google and Facebook accused of breaking GDPR laws

bbc.com

Post reply on HN
Print view View original

41–50 of 384 posts

Re: Google and Facebook accused of breaking GDPR laws

#41

Post by lexs »

rebelde wrote: post #27
quohM0Ho wrote: post #12

Earlier quoted context omitted.

The easiest way to comply is to not collect any PII. That is only a problem for companies that make data collection their core business.

IP addresses are PII, as defined in the law. Every website you visit gets your IP. HN has yours now, and now had a headache to deal with.

You can store IP addresses for security reasons and then delete them when not needed anymore and would be compliant. https://gdpr-info.eu/recitals/no-49/

Also you don't have to log the IPs if you don't need them...

Re: Google and Facebook accused of breaking GDPR laws

#42

Post by bjl »

lordlarm wrote: post #19

The 'loophole' here would be the definition of 'legitimate intrests', where businesses can defend not giving users a choice in many of these matters due to the activity being critical for the service to work or the business to survive. I.e. Facebook _could_ argue that users would have to have their data collected and analysed, as this would enable them to sell ads which in turn is their core interest. Another example…

Actually 'my business model depends on it' isn't a legitimate interest. That clause only applies when the service itself relies on it (a real-time maps service requiring location data, for example).

Re: Google and Facebook accused of breaking GDPR laws

#43

Post by JorgeGT »

rebelde wrote: post #27
quohM0Ho wrote: post #12

Earlier quoted context omitted.

The easiest way to comply is to not collect any PII. That is only a problem for companies that make data collection their core business.

IP addresses are PII, as defined in the law. Every website you visit gets your IP. HN has yours now, and now had a headache to deal with.

Every website you visit can elect not to store IP addresses. In fact if you had German users their IPs were already protected, it's just that nobody cared to comply with individual EU member's privacy laws until they combined their weight into GDPR: https://blog.philippklaus.de/2011/05/modify-apache-logging-t...

Re: Google and Facebook accused of breaking GDPR laws

#44

Post by peteretep »

rebelde wrote: post #27
quohM0Ho wrote: post #12

Earlier quoted context omitted.

The easiest way to comply is to not collect any PII. That is only a problem for companies that make data collection their core business.

IP addresses are PII, as defined in the law. Every website you visit gets your IP. HN has yours now, and now had a headache to deal with.

> IP addresses are PII, as defined in the law.

No, that's far from fucking clear, but appears to have been repeated over and over and over again.

Re: Google and Facebook accused of breaking GDPR laws

#45

Post by platelminto »

narrator wrote: post #9

I am trying to think what the secondary consequences of GDPR are going to be. If any user can see their data on any service than any government can quickly plug-in to access all user data on any service. This is like NSA Prism for everything. If a user can export their data easily from any service, they can easily resell their own data for money to services that seek to monetize that data. They could even rent out th…

The assumption you're making with most of your points is that, currently, data is only safe from governments/hackers because its not readily available to users, and for some reason it being not easily accessible by users means its safer (correct me if I'm reading what you're saying wrong).

I don't think making the data more available to users means it's now inherently less safe - actually, it could be argued that having all the data in one place makes it easier to protect ('Keep all your eggs in one basket, and put that basket in Fort Knox'). Additionally, if PII isn't stored securely enough, as it should, and that data gets breached, the company is at fault - again, which it should. Making these companies more liable incentivises them to take their security more seriously, which I think is good.

(I also trust my government, but that's a separate argument)

Re: Google and Facebook accused of breaking GDPR laws

#46

Post by neffy »

lloydsparkes wrote: post #38

I am reading through the complaints, The first one: https://noyb.eu/wp-content/uploads/2018/05/complaint-android... The User sets up a "new" (non Google) phone, and isn't given an option to decline consent to Googles ToS. Now how does this work with a physical product? It needs to be compliant on the 25th of May 2018, but the version of Android may be old and not updated (given its Android). Even if there was an upda…

Companies have had two years to get their act sorted out on this.

Re: Google and Facebook accused of breaking GDPR laws

#47

Post by TallGuyShort »

mikekchar wrote: post #22

My big problem with this is that the complaints are too quick (unless Google, Facebook, et al are stupid, which I don't think they are). First you have to make a request to see what they are using the data for. Then you can complain that it is being used for the wrong things. Unless the aforementioned companies are blatantly saying "We're sharing your data for targeted advertising without consent", then I think we ha…

Isn't the tracking a claim they make to advertisers, and can I opt out without declining the entire ToS?

Re: Google and Facebook accused of breaking GDPR laws

#48

Post by rinze »

zerostar07 wrote: post #23
ckastner wrote: post #6

> "The GDPR explicitly allows any data processing that is strictly necessary for the service - but using the data additionally for advertisement or to sell it on needs the users' free opt-in consent" This is the key point. As the saying goes, on Facebook, you aren't the customer, you are the product. The GDPR just changed this -- rightfully, in my opinion.

yeah but now the product is not free.

It wasn't before either. You were just paying with a different currency.

Re: Google and Facebook accused of breaking GDPR laws

#49

Post by mrweasel »

VMG wrote: post #14
quohM0Ho wrote: post #12

Earlier quoted context omitted.

The easiest way to comply is to not collect any PII. That is only a problem for companies that make data collection their core business.

or anyone who has a public httpd with default log settings

I was actually looking for a way to configure something like filebeat to replace IPs with country codes, before shipping the logs of to a central logging server.

On the face of it, it was more trouble than I could be bothered to deal with at the time, but now I may have to take another look.

Re: Google and Facebook accused of breaking GDPR laws

#50

Post by peteretep »

VMG wrote: post #30
dboreham wrote: post #18

Earlier quoted context omitted.

Default logging settings retain log files forever?

I don't know how long you are allowed to store PII under GDPR (I'm not a lawyer) This article indicates that default settings are problematic: https://www.ctrl.blog/entry/gdpr-web-server-logs > All of these logs contains personal information by default under the new regulation. IP addresses are specifically defined as personal data per Article 4, Point 1; and Recital 49. The logs can also contain usernames if your we…

> Article 4, Point 1

Article 4 Point 1 is:

> (1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

It is very far from clear that that covers IP addresses, which tend to be recycled, and would need a police warrant + actual evidence to then map to a specific human

> and Recital 49

http://www.privacy-regulation.eu/en/r49.htm

Failing to see the relevance

Post reply on HN