Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR: Removing Monal from the EU

monal.im

Post reply on HN
Print view View original

951–957 of 957 posts

Re: GDPR: Removing Monal from the EU

#951

Post by nicbou »

linker3000 wrote: post #699
tokyodude wrote: post #679

Earlier quoted context omitted.

> Indeed, this did not drop out of the sky. It has been in the works for years. VOGON CAPTAIN: [On Speakers] People of Earth your attention please. This is Prostectic Vogon Jeltz of the Galactic Hyperspace Planet Council. As you no doubt will be aware, the plans for the development of the outlying regions of the western spiral arm of the galaxy require the building of a hyperspace express route through your star syst…

Yeah, but the analogy is not good... * We've known about the GDPR for around 2 years. * The GDPR text, national regulators' comments, industry opinion, sample docs and a plethora of free resources have been readily accessible on the Internet for about the same length of time. Having worked on the GDPR docs for a medium-sized business that builds learning management systems for corporate customers (about 100 live syst…

I can't speak for you, but I only heard about GDPR 6 months or so ago, like most people outside of Hacker News. Most small businesses only heard about it in the last 6 weeks.

Sure, the regulation was there, but nobody talked about it, and it's unreasonable to expect people to magically learn about EU regulations, especially if they don't live in the EU.

Re: GDPR: Removing Monal from the EU

#952

Post by nicbou »

grepnork wrote: post #328
zitterbewegung wrote: post #309

Earlier quoted context omitted.

Businesses hate regulation and uncertainty because it just adds to their costs. Large companies just eat the cost. For small businesses it’s practically impossible to be in compliance for all laws. But if the risk of not being compliant is too high and the reward is too low then they will choose this.

Having spent this week doing compliance for my small business customers, the cost is not zero but it's really not much at all - I've done full compliance for six companies and it cost less than £250 each (one of those clients is a large NGO). This guy doesn't like regulation and is playing to the crowd for sympathy.

> I've done full compliance for six companies and it cost less than £250 each

What about your salary?

Re: GDPR: Removing Monal from the EU

#953

Post by erichocean »

zaarn wrote: post #700
_o_ wrote: post #680

Earlier quoted context omitted.

The only problem I see here is needing data based on contract obligations, I have seen lots of sites packing the data collection into privacy policy or some shady contract, thinking that this is legitimate interest. But legitimate interest is actually the hardest part of GDPR, even if most people think it is a workaround. If you can provide the service without some personal data (not due to financial claims) you can'…

There is only two ways of legitimate interest that I considered for my service; "security" and "better user experience". The data collected under the former is simply the IP and a timestamp in webserver and app logs, usually purged within 7 days and then any user data included in backups, purged after 3 months. "better user experience" is not really personal data but I included it anyways; browser type (mozilla/edge/…

I'm pretty sure you have to ask for consent for both of those.

Re: GDPR: Removing Monal from the EU

#954

Post by DanBC »

erichocean wrote: post #953
zaarn wrote: post #700

Earlier quoted context omitted.

There is only two ways of legitimate interest that I considered for my service; "security" and "better user experience". The data collected under the former is simply the IP and a timestamp in webserver and app logs, usually purged within 7 days and then any user data included in backups, purged after 3 months. "better user experience" is not really personal data but I included it anyways; browser type (mozilla/edge/…

I'm pretty sure you have to ask for consent for both of those.

Why do you think "legitimate interests" isn't enough?

https://gdpr-info.eu/art-6-gdpr/

> processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Re: GDPR: Removing Monal from the EU

#955

Post by erichocean »

DanBC wrote: post #954
erichocean wrote: post #953

Earlier quoted context omitted.

I'm pretty sure you have to ask for consent for both of those.

Why do you think "legitimate interests" isn't enough? https://gdpr-info.eu/art-6-gdpr/ > processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Let me put it this way: if I found out this guy was using my IP address and machine config to do analytics and perform "security" checks, I'd report him to my regulator. Dead serious.

"Analytics" is not what his company is for, ergo, using my Personal Data to do analytics isn't okay. He sure as hell isn't doing it for my benefit. I'm also not hiring him for security, so the same reasoning applies: he doesn't get to store my IP address in his logs without asking.

And when I say "no" to his opt-in modal, he'll still have to provide me non-degraded service. The fact that he can do so is yet another indicator that the data collection is not a legitimate interest.

Re: GDPR: Removing Monal from the EU

#956

Post by DanBC »

erichocean wrote: post #955
DanBC wrote: post #954

Earlier quoted context omitted.

Why do you think "legitimate interests" isn't enough? https://gdpr-info.eu/art-6-gdpr/ > processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Let me put it this way: if I found out this guy was using my IP address and machine config to do analytics and perform "security" checks, I'd report him to my regulator. Dead serious. "Analytics" is not what his company is for, ergo, using my Personal Data to do analytics isn't okay. He sure as hell isn't doing it for my benefit. I'm also not hiring him for security, so the same reasoning applies: he doesn't get to s…

The security of their network is a legitimate interest. The regulator would see that alone as sufficient reason to gather data, especially if that data is mostly discarded 7 days later.

Re: GDPR: Removing Monal from the EU

#957

Post by erichocean »

DanBC wrote: post #956
erichocean wrote: post #955

Earlier quoted context omitted.

Let me put it this way: if I found out this guy was using my IP address and machine config to do analytics and perform "security" checks, I'd report him to my regulator. Dead serious. "Analytics" is not what his company is for, ergo, using my Personal Data to do analytics isn't okay. He sure as hell isn't doing it for my benefit. I'm also not hiring him for security, so the same reasoning applies: he doesn't get to s…

The security of their network is a legitimate interest. The regulator would see that alone as sufficient reason to gather data, especially if that data is mostly discarded 7 days later.

No. They could start looking at IPs once they actually had a security problem, but there's no way in hell they "need" to write my IP address hither and yon to protect their network.

Look, you can definitely discover and monitor for problems by simply hashing IPs and storing the hash instead. Once you've detected a potential problem (say, a lot of requests from the same hash), only then do you have a "legitimate business need" to record the actual IP addresses and do some short-term analysis of the situation.

The spirit of the law is simple: if you don't absolutely need to store personal data, DON'T. Just don't. Store something else. Or just drop the data into /dev/null. Saying that you'll delete soon the personal-data-you-don't-need isn't sufficient.

And really, if this is the way GDPR compliance is going to go, "muh security" is quickly going to gain the reputation as the bullshit reason shady people trot out who want to disobey the law. People who actually care about security should push back on that strongly.

Post reply on HN