361–370 of 388 posts
Earlier quoted context omitted.
Google Analytics isn't usually used as a revenue stream, but instead for analytics and telemetry.
One motivation for doing analytics/telemetry is being able to set optimal price points, etc. For example, i f 80% of your user population uses your app daily, it is more attractive to switch to a subscription model than if most people use it very irregularly.
Earlier quoted context omitted.
As Jacques and me as well have said; that simply means panic and it is not needed. You maybe do not live in the EU but the letter of the law is not such a thing here as it might be in the US (and although punishment is harsher and often far harsher than it is here, US also looks at intent). The EU is not going to punish any company that has the intent to offer its users privacy under this law, but made some mistakes…
That's the recipe for political enforcement of draconian laws. It's especially dangerous for big foreign american companies which are perfect for politicians to demagogue about. I would not bet the business on any extra-legal grace from their beuracracy.
Earlier quoted context omitted.
Have you received genuine legal advice that recommended that you shut down business instead of continuing to work towards compliance? The agencies that can enforce the GPDR want you to be compliant, not to fine you... If you're actually working towards compliance past evidence shows they won't fine you.
I've heard this line a lot, but even as a government loving liberal it doesn't sound very compelling to me. The law says, comply or face fines up to 4% of global revenue. It doesn't say, "make a best effort to comply, or face fines up to 4% of global revenue." I'm very reluctant to trust people who can fine me for that much money that they won't do so. This is especially the case because it appears to some of us fore…
>2When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:
> any action taken by the controller or processor to mitigate the damage suffered by data subjects;
>the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;
>the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement;
>where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures;
>any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.
So, a whole bunch of very explicit things that are to be used when deciding if whether to impose a fine (at all).
Earlier quoted context omitted.
i don't follow, do you mean that's a possible scenario? That's the last thing you need to worry about yet. I expect first random emails from hackers demanding coins for 'not reporting you' in the first awkward month.
the weirdest scenario is if people inadvertently leak medical data on a unsolicited email. "I've a motor impairment do your hotel have accessible rooms?" say you have your hosted email system, now you're in a huge mess. people downvoting this should really hear a lawyer about gdpr.
Earlier quoted context omitted.
I don't agree, but at least I understand where you're coming from. Here is the stasis of our dispute: > I would argue most of these things make the world a better place not a worse place. And that people should be able to choose how they want to pay for those services. I'm not convinced any of the apps we pay for in data really improve our lives. The price we pay in control over our identity and our information usual…
I'm not convinced any of the apps we pay for in data really improve our lives. The price we pay in control over our identity and our information usually outweighs the benefits. Hundreds of millions of Google and Facebook users disagree. If you ask people what Google does with the data they collect, a large percentage both incorrectly believe that they directly sell it to advertisers (rather than just using it for ad…
Earlier quoted context omitted.
That's the recipe for political enforcement of draconian laws. It's especially dangerous for big foreign american companies which are perfect for politicians to demagogue about. I would not bet the business on any extra-legal grace from their beuracracy.
"political enforcement of draconian laws"... like: how the US use their extra-territorial law to fine US Business's competitors (banks, industry...) ? ;-) It's funny to see how the US way of mixing law and business is terrifying when others may use it too, no? Anyway: it hasn't been how Europe worked until now, so relax. French Regulator said, for example, that it won't enforce strictly the regulation ... because...…
Your argument seems to be that a police state where the authorities have a lighter touch is preferable. That's obviously true compared to a draconian police state, but it's a police state either way.
Earlier quoted context omitted.
I think there's a very specific motivator behind people who build tech with the intent to sell, and that motivator doesn't cover every reason behind other people who build tech. If I want to start a project and think, "cool, if this works out, i'll sell it 6 months from now so it can actually do cool stuff", I'm just not going to work on that project at all. Honestly though, I would _love_ to live in a world where yo…
> Honestly though, I would _love_ to live in a world where you could walk into my home and install your 'adtreckr' eye tracking cameras on my TV. What you're describing is "trust", and I think the amount of it that each person has (for people in general, but also for companies) is a big influence in how they view GDPR (and other regulations that some might argue are unnecessary). Obviously, we're very far away from t…
"Owning" data about yourself is a very strange concept to me.
Earlier quoted context omitted.
> Other thoughts aside, if they wanted to stop doing business in the EU, how should they? Erase everything.
I suppose for most thinking rationally, it seems like "stop doing business in the EU" is different than "make it like you've never done business in the EU". Taken to its conclusion, which Instapaper surely won't, it's not going to be easy to punish a business that has cut ties with the EU because of what they collected before. Granted it appears that with the law, like its predecessors, practicality of reasonable enf…
When you're told the highway near your house has a new speedlimit you can either obey the speed limit, use a detour (which will still be slower on account of it being longer) or you can take your car off the road in huff.
The first one is the only solution that makes sense.
Earlier quoted context omitted.
"Only a tiny fraction of the companies avoiding EU traffic due to GDPR have any intention of “doing shady stuff with your data”." Says who? If they weren't doing shady stuff, they wouldn't be pulling out of the EU. The excuses of being complex are just that, excuses.
Says who? Says anyone with common sense. What percentage of sites do you think employ data scientists or would even know where to go to sell your data? Most sites do nothing more than throw GA on their website, and maybe some Adsense. You people decided to paint that as something evil. That’s your decision to make, but just understand that most of the rest of the world wants no part of $20M potential fines and will s…
Earlier quoted context omitted.
> IPs combined with other user data could be PII. 1) Bob signs up for a service and is logged 2) Bob than asks for his account to be deleted. Account details are deleted, but the ip logs are retained. 3) Bob signs back up for a new account allowing the data processor to make the link from his new account to his ip old logs with the first account. This seems like a likely violation, if so you would have to treat ip ad…
The personal information here is the IP-Bob tuple, not the IP on its own. Bob might as well be assigned a new address from DHCP on a daily basis. His friends might be using his address. He might have used the address of some public network in the first place. All or these are pretty likely scenarios. The IP is only interesting given the context of who uses it and when, so as to separate Bob from Alice, and Bob's favo…
It depends on Bob using DHCP, that his DHCP switches often enough, and there are enough people on the same network that the link can not be made.
The above is not always true, other mitigating factors are not always true. Which seems to make some of IP logs personal information. Or at least you are safest if you treat it that way.
I am basing some of my reasoning off an article that I was pointed to earlier: https://www.whitecase.com/publications/alert/court-confirms-...
Where, to my understanding, IP address are considered personal information only if you can link it to some other identifying info.
I think a regulator is unlikely to go after a company for not deleting IP logs in the current climate. As far as I can tell GDPR gives them the power to however.
Until there is some case/enforcement history it is understandable if people are cautious.