Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

571–580 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#571

Post by bcheung »

4ndrewl wrote: post #517
ars wrote: post #497

Earlier quoted context omitted.

It's not so easy. Someone buys a book. Transaction is recorded, and now we know total book sales. Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. There's ways around it, obviously. But they are not easy. Much easier to just mark as deleted. Another example: Threaded conversation - someone deletes their post, and oops all the replies are now orphaned.

More GDPR strawmen. If a user requests deletion, assign anyYassociated entities (eg purchases, conversations etc) to an anonymous user. Or, keep the original user record and just blank all of the fields. You've had two years to think about these problems.

What about if you need to report any payouts made to an individual as required by a tax authority? How are you also supposed to delete all their information and be in compliance with tax law? You can't say, "I paid 12,152.00" in 2018.

Edit:

Ok, looks like there is a clause for these scenarios:

"However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information, for COMPLIANCE WITH A LEGAL OBLIGATION, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims."

Then there's:

"It should not apply where processing is based on a legal ground other than consent or contract. By its very nature, that right should not be exercised against controllers processing personal data in the exercise of their public duties. It should therefore not apply where the processing of the personal data is necessary for compliance with a legal obligation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of an official authority vested in the controller."

And, in terms of technical burden at least it seems like they try to alleviate it somewhat...

"The data subject's right to transmit or receive personal data concerning him or her should not create an obligation for the controllers to adopt or maintain processing systems which are technically compatible"

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#572

Post by Silhouette »

hk__2 wrote: post #475
tomc1985 wrote: post #455

Earlier quoted context omitted.

I don't think it applies to individuals and noncommercial activity, though I have heard anecdotal reports of european cops hassling people shooting pictures on mobile phones

> I don't think it applies to individuals and noncommercial activity Why would these be unaffected? You have to comply with GDPR as soon as you start processing personal data.

That's not entirely true. Article 2 defines the scope in various respects, and categories such as "by a natural person in the course of a purely personal or household activity" are specifically not within that scope.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#573

Post by stemuk »

codexon wrote: post #544
yzmtf2008 wrote: post #512

Earlier quoted context omitted.

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

Merely setting a delete flag is not compliant with the GDPR, that's why a cascading delete is necessary. Any programmer worth their salt knows mass random deletes and updates are extremely inefficient.

Wouldn't it be possible to just delete the 'idetifiabel' parts in the database in order to be GDPR compliant?

If you for instance save all the user data like user preferences under a random userId, and then delete the personal data (such as email address, name etc.) associated with the userId I would expect this to be GDPR complaint without having to do a cascading delete.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#574

Post by datamingle »

gerdesj wrote: post #506
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

I'm a Brit. I am the MD of a small IT company. I have two partners and 20 employees. We started in 2000. We turn over about £1.5Mpa. We sell our services to people and organisations. Our backups are now smaller these days (thanks to GDPR). I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR. There is no way on earth that the EU as a whole has looked on your…

How do you handle developer computers with possible client data on them, even semi-anonymized? Or when communicating issues on the live server, you might transfer client information to other stake holders to debug issue. Are you tracking that communication. Where does the communication data reside, perhaps on a server outside of the EU?

There is a lot of complications that arise if you think about the second order/third order consequences of the law.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#575

Post by jedberg »

genericone wrote: post #547
jedberg wrote: post #534

But this wouldn't even work, because it applies to all EU citizens, regardless of geography.

This is a great point actually... the GDPR law specifically applies to holders of EU passports. If your website clearly disallows EU citizens, ie: a popup stating "You are not authorized to access this website if you are, or plan to become within the next 2 years, an EU citizen", are you being compliant with GDPR? Or is there simply no way to be GDPR compliant if you store any personally identifiable data? I won't ge…

If you don't do any business in the EU, while you may technically fall under the law, it would be nearly impossible to prosecute you for it.

But the moment you try to access the EU market....

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#576

Post by Sir_Substance »

jeremyt wrote: post #543
4ndrewl wrote: post #517

Earlier quoted context omitted.

More GDPR strawmen. If a user requests deletion, assign anyYassociated entities (eg purchases, conversations etc) to an anonymous user. Or, keep the original user record and just blank all of the fields. You've had two years to think about these problems.

It’s only a strawman if you assume that everybody knows the right way to do everything. There was nobody around when I did my start up to tell me how to do all of this stuff.

The entire point of GDPR is that it creates a set of requirements, and allows you to make decisions in your professional judgement to fill those requirements. This is no different to how management in any software company will present business requirements for the software you are to make, and request that you decide the technical implementation. That's your job if you're a developer.

As long as you're confident enough in your PII solution to be willing to present it in front of other software developers who have been called as expert witnesses and declare that it meets the GDPR requirements, you can pick any "right way" you like to meet those requirements.

If you think it's an unreasonable burden to have to make PII handling solutions that are robust enough that you can honestly defend them in court if challenged, maybe you shouldn't be handling PII. Like, at all.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#577

Post by mintplant »

manigandham wrote: post #554
Barrin92 wrote: post #550

Earlier quoted context omitted.

Tired of the eternal startup excuse to justify bad behaviour when it comes to protection of consumer privacy. If it is impossible for some startups to respect strong privacy practices maybe we simply don't need those startups. This 'startupism' is almost an ideology. No mechanical engineer would complain about safety regulation just because it means that they cannot start a business in their garage. In other industri…

Also tired of people thinking that a company not wanting a rule means they were intending to do the exact the opposite of that rule, especially given said rule is incredibly vague and designed to be applied "on principle". Fortunately for all of us, safety regulation is actually very specific in requirements.

Upthread we have the claim that "most early-stage startups use the... best practice of 'delete=1'," pretending to delete user data while actually retaining it. So, the exact opposite of the rule.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#578

Post by lox »

mbob88 wrote: post #538
yzmtf2008 wrote: post #512

Earlier quoted context omitted.

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

>properly handling sensitive information But the thing is that GDPR affects all PII not just sensitive one so your random small useless app/blog/game/forum that has some personally identifiable but harmless and unimportant data stored is now under the same restrictions like your email or FB data.

Like, say, a personality quiz on Facebook?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#579

Post by codazoda »

I run a simple personal blog. I make a meager $200 a year or so from targetted ads on that blog. I have Adsense and Analytics collecting what they collect. My stats have IP's, countries, browsers, OS's, list of pages a visitor looked at, etc. I look through the info on occassion to decide which random rambling I wrote that I should improve or update on the site. This is a hobby but it has expenses and income so it's effectively a business.

At $200 a year there's no point spending even a few hours to figure out if I need to ensure GDPR compliance in the first place much less to do so. No point in figureing out how to erase users if I should ever be asked to, etc.

Last night I tried to log into AdSense and turn off targetted ads because I figure that handles most of my risk and is one of the evils people seem to be trying to kill. I couldn't find the option, only found old articles about it "coming soon" on Google, and got nowhere in a half hour or so.

Are there any limits to the sizes of companies that have to deal with this? Blocking EU might be the only real option I have (although some say that's not even enough).

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#580

Post by dansanuf »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

Not to mention all the backups of said databases. Imagine sitautions where you’ve got tape backups stored in vaults or places like AWS Glacier. It’s the stuff of ops nightmares.
Post reply on HN