GDPR and Google Analytics • Hacker News Board

Re: GDPR and Google Analytics

#121

Post by smu » Tue, Jan 30, 2018, 4:01 PM UTC

Shoothe wrote: post #25

xxs wrote: post #15

Earlier quoted context omitted.

You don't need any personal data to conduct most of the business. I work in a place that would be beyond heavily affected by GDPR and I find the legislation a good change as companies should not hoard data they don't need - just in case... or just to sell.

Wouldn't you need personal data to accept payments? Or maybe a broker (like Stripe) would store these and the end business just a reference to payment.

In lawyers terms: a payment apparently is just a contract. So you can store the data needed for the payment under that legal basis.

IANAL

Re: GDPR and Google Analytics

#122

Post by cromwellian » Tue, Jan 30, 2018, 4:36 PM UTC

iddqd wrote: post #104

cromwellian wrote: post #102

Let’s all have a moment of silence for John Perry Barlow’s Declaration of Cyberspace Independence back when it was envisioned the internet would be a place where any entities could communicate or associate free of government control or censorship. Loads of people in here who support the concept of net neutrality which helps enable permissionless innovation by not imposing huge costs on those who publish or allowing o…

You can still set up a site and not have to worry about much, as long as you're not processing other peoples personally identifiable information without their explicit consent.

Or as long as nothing on my site insults the Thai king, or mentions the Armenian genocide, or Tiananmen Square?

There is a process for international regulations, we sign treaties like with copyright, and I get some legal representation in these regulations from my elected representatives. I didn’t elect the European Parliament. If you don’t like my website, don’t use it.

I mean, obviously you’d say that if you physically flew to the US and bought something in a store, those store only need to obey US regulations. Or if you ordered an international package and had it delivered.

So why do you think sending packets to my geographic location suddenly imposed restrictions on my sovereignty? Virtual goods require more regulations than physical ones?

Even if I agreed with the spirit of these regulations, the idea that you can force your local regulations on a global audience without negotiation opens up a real slippery slope.

By what ethical or legal argument are European regulations any more relevant to Chinese, Thai, or Turkish? Doesn’t Saudi Arabia have an equal right to claim you can’t run a site that slanders the prophet Mohammed and you have Saudi Citizens on your site?

Why are your regulations more relevant than anyone else’s? What if my country rules that running a web site is protected free speech?

Any kind of international regulation of the internet must be agreed to by international treaty.

Re: GDPR and Google Analytics

#123

Post by cromwellian » Tue, Jan 30, 2018, 4:51 PM UTC

smu wrote: post #118

iddqd wrote: post #117

Earlier quoted context omitted.

You can serve web content without storing the IP address of the user. If you need to use it for anonymous correlation of requests, you can hash it first.

In addition, you can store the IP address if you want to use it for infosec (such as, finding out who to block in case of a ddos attack). See https://gdpr-info.eu/recitals/no-49/ The recital also mentions "accidental events that compromise availability, integrity, authenticity,..." That seems to cover debugging for me. No need to ask for consent. To do certain analytics like page count, you don't need the IP, so that…

Most small web sites don’t have the resources for this. Many don’t even know if they will have analytics in the beginning, or info sec.

People tend to set up sites and just stash web logs in the beginning. They then learn later what their business needs are and may decide to post process their logs.

You're suggesting a new site pay all of these costs up front to comply with these regulations, you can’t time shift concerns by collecting data and deciding whether you need it later.

Granted, you could argue that this is bad practice anyway, but many startups work exactly like this, maximum logging early, dropping rention later after beta.

If you are not physically hosting in the EU, how many people want to even read the GDPR? A lot of sites don’t even know where their users are coming from until they run analytics.

Re: GDPR and Google Analytics

#124

Post by ecesena » Tue, Jan 30, 2018, 5:21 PM UTC

iddqd wrote: post #117

smhg wrote: post #110

Earlier quoted context omitted.

But then you don't consider the IP address personally identifiable information? The GDPR does.

You can serve web content without storing the IP address of the user. If you need to use it for anonymous correlation of requests, you can hash it first.

The IP space is so tiny that hashing doesn't make any difference.

In addition, watch out for logs. By default all web servers log requests with the IP address, and depending on what you do with these logs, the IP are there.

Re: GDPR and Google Analytics

#125

Post by smu » Tue, Jan 30, 2018, 5:57 PM UTC

cromwellian wrote: post #123

smu wrote: post #118

Earlier quoted context omitted.

In addition, you can store the IP address if you want to use it for infosec (such as, finding out who to block in case of a ddos attack). See https://gdpr-info.eu/recitals/no-49/ The recital also mentions "accidental events that compromise availability, integrity, authenticity,..." That seems to cover debugging for me. No need to ask for consent. To do certain analytics like page count, you don't need the IP, so that…

Most small web sites don’t have the resources for this. Many don’t even know if they will have analytics in the beginning, or info sec. People tend to set up sites and just stash web logs in the beginning. They then learn later what their business needs are and may decide to post process their logs. You're suggesting a new site pay all of these costs up front to comply with these regulations, you can’t time shift con…

Actually, I was trying to point out ways to not have to remove/prune your logs...

Re: GDPR and Google Analytics

#126

Post by cromwellian » Tue, Jan 30, 2018, 6:24 PM UTC

smu wrote: post #125

cromwellian wrote: post #123

Earlier quoted context omitted.

Most small web sites don’t have the resources for this. Many don’t even know if they will have analytics in the beginning, or info sec. People tend to set up sites and just stash web logs in the beginning. They then learn later what their business needs are and may decide to post process their logs. You're suggesting a new site pay all of these costs up front to comply with these regulations, you can’t time shift con…

Actually, I was trying to point out ways to not have to remove/prune your logs...

Right but these days, if you rent a cloud hosted docker container with say, nginx or httpd, you'll get HTTP logs via fluentd with full IP address information, and a lot of people will push these into storage like S3 or GCP buckets for analysis later.

If you say, use a point-and-click installation of Wordpress on AWS/GCP/Azure, you're going to get IP logs being held. I'm just pointing out that the regulations impose a lot of costs and expose people to huge risks.

I mean, can I be held liable if I use an open source downstream dependency from npm or Maven, and it just so happens to have debug logs that are storing info, and I didn't know about this logging cause I didn't audit every line of code from a downstream dependency?

For large companies, this isn't going to be a problem, but the entire open source ecosystem operates on a system that for the most part, you aren't exposed to legal liability by them, except in cases like patent violations or copyright infringement, but now there's a huge cognitive burden being levied on top by a massively complicated new regulatory framework.

Re: GDPR and Google Analytics

#127

Post by jshen » Tue, Jan 30, 2018, 6:59 PM UTC

beberlei wrote: post #64

jshen wrote: post #47

Earlier quoted context omitted.

Maybe I’m misunderstanding GDPR, can you explain how tracking your users through logs is OK within the GDPR, but Google Analytics isn’t Ok.

Logfiles are necessary to operate a service securely and guarantee quality of service. This is one form of implicit consent that users are giving you without you having to ask them for it. But Storing IP addresses for each access indefinitely (> some days) is the problem. If you rotate the files into a version where IP addresses are without the last part after a few days, then this is considered pseudonymous data and…

Local log files are not automatically compliant by my reading of the GDPR, but IANAL. My understanding is that PII is a huge risk, regardless of it being local or with a vendor, and you aren't allowed to track things that you aren't actively using for some business process. Many default log formats have data that people don't actively use, which seems to be a violation of GDPR even for local files.

Again, IANAL.

Re: GDPR and Google Analytics

#128

Post by jshen » Tue, Jan 30, 2018, 7:00 PM UTC

microtonal wrote: post #99

jshen wrote: post #47

Earlier quoted context omitted.

Maybe I’m misunderstanding GDPR, can you explain how tracking your users through logs is OK within the GDPR, but Google Analytics isn’t Ok.

IANAL, so this is not legal advise! First: I think it is ethically better, because you are not giving your user's data to a large company that builds profiles of your users for their own purposes. Second: if you pass the data to an analytics company, you share responsibility in ensuring that that data is processed according to the GDPR. Article 83 states on imposing/determining fines: the degree of responsibility of…

I still don't see how local files are by default compliant with the GDPR. I get that you prefer it from an ethical point of view, but that's unrelated to the specifics of the GDPR.

Re: GDPR and Google Analytics

#129

Post by xxs » Tue, Jan 30, 2018, 9:33 PM UTC

ysv2 wrote: post #92

hvidgaard wrote: post #72

Earlier quoted context omitted.

If you want to do business with EU citizens, you have to follow EU law. Before the internet, you had to open a shop here, or send your goods over the border. The only thing that has changed is the fact that you provide a virtual service over the internet.

No, if I want to have a physical presence in the EU I have to follow EU law. But if I'm residing entirely in another country, and EU citizens want to do business with me over the internet, I could care less what EU law says. And no amount of whining on this thread will change the fact that the EU has no leverage over me.

>I could care less what EU law says You need a way to sell to EU (if you wish to do business there).

Digital services (say from US) do require EU VAT registration. If you don't have that and your country has tax agreement with the EU (or some countries from EU), there is a risk to be prosecuted. It won't happen if you get like 1000 customers in each country of the EU (as the latter has no global tax organization like IRS).

Keep in mind also that if you have too much unexplained income your own tax authorities can investigate the case, incl. anti money laundering.

Bottomline is: it's rather hard to sell services (lest goods), in cases where you non-compliant with the laws. Internet is not a magic wand.

Re: GDPR and Google Analytics

#130

Post by kazagistar » Sun, Feb 04, 2018, 8:29 AM UTC

RutZap wrote: post #112

Speaking of GDPR, I, like many others, am a little bit confused. I've read parts of the legislation but not all of it, so perhaps somebody here can help me out. Moving towards slightly more delicate issues (compared to tracking someones browsing habits), in relation to the right to be forgotten, if I make a request to Equifax and Experian to remove all personal identifiable information they hold about me, will this a…

(This response is quite late, but hopefully it helps at least a bit.)

1. All third parties that a site might pass information to must be listed.

2. The site is responsible for ensuring all the third parties it passes information to support a way to delete that information. So if you ask them to delete something, they have to forward that request to third parties, who then have to delete what was provided by that site. The site is liable, so they have to make sure they have contracts covering this with any third parties they would pass the information to.

3. The deleted information by the third party only has to be the information from that site, not every site.

4. There are a number of exceptions specifically involving things like baking, especially if you have a legal, signed contract that obviously cannot be erased with the click of a button. So specifically in the case of Equifax and Experian, its unclear.

5. I am not a lawyer, disregard everything I said lololol.