Publishers Haven't Realized How Big a Deal GDPR Is • Hacker News Board

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#131

Post by denzil_correa » Sun, Apr 08, 2018, 7:47 PM UTC

mstolpm wrote: post #21

michaelbuckbee wrote: post #14

GDPR articles seem to be getting some traction on HN as everyone is trying to figure out: "Do I need to do something for this? Is so, what?" For a recent project I read (and translated to plain english) [1] every single article in the GDPR legislation and for our purposes it can be summed up as: "Treat user data like names and emails as if they were credit card numbers" AKA: be paranoid about keeping them, encrypt th…

I’d add: Get (documented, active) permission of users to store and use their data, understand that permission is given only for a defined cause/usage (and not indefinitely for everything you right now might not even think of), be prepared to tell users what data you store about them, why and (briefly) how it is used. Be prepared to delete user data on request. Be prepared to show documentation on how you handle the (…

Also called "Informed Consent"

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#132

Post by eyeareque » Sun, Apr 08, 2018, 7:48 PM UTC

Animats wrote: post #64

It's even bigger than that. It's been mentioned on HN before, but see the "GPDR Letter."[1] Anyone in the EU can send you such a letter, and you have 30 days to reply. Please confirm to me whether or not my personal data is being processed. If it is, please provide me with the categories of personal data you have about me in your files and databases. a. In particular, please tell me what you know about me in your inf…

I dream of the day that I can ask various companies to delete every piece of data they have about me.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#133

Post by molf » Sun, Apr 08, 2018, 7:48 PM UTC

martin-adams wrote: post #114

pspeter3 wrote: post #36

Does this mean every site will need to ask permission for Google Analytics?

A very good question which I don't know the answer. But what I do know is that since IP addresses are considered personal information, then you can tell the GA script to anonymise it. https://support.google.com/analytics/answer/2763052?hl=en Of course, that doesn't stop that IP address becoming aware to the GA servers, but they should stop it being used further down the line. I suspect it's similar to using a CDN whe…

This is true, but you also must engage in a GDPR contract with Google Analytics. I believe they have recently added this as a feature somewhere.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#134

Post by kasey_junk » Sun, Apr 08, 2018, 7:48 PM UTC

molf wrote: post #122

kasey_junk wrote: post #107

Earlier quoted context omitted.

I’m not a GDPR lawyer or auditer, do nothing in this reply should be seen as advice. My general feel is that if he didn’t cite a specific article it was on purpose. He took implications or broad interpretations for anything not explicitly cited. A couple that jump out immediately are the requests for server locality information, retention periods & specifics about security policies are the ones that are likely to get…

That's all neatly laid out in article 13. [1] I'm not a lawyer but having extensively studied all of GDPR recently I'm afraid the letter seems legit. If there's any error it will be a minor one. [1] https://gdpr-info.eu/art-13-gdpr/

Article 13, to my reading, provides no basis for requiring locality information or security policies. The retention declarations I’ve seen have been legal niceties that don’t answer the question in a way that makes it clear what the retention policy is.

I’m not suggesting that the letter won’t get a response. I’m suggesting there isn’t anything in it that would cause a large organization to send any different a response than if they got a letter written in crayon that said “gives us the GDPR data”.

In that way it’s not a “nightmare” letter. It’s the default thing you pay lawyers for.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#135

Post by rossdavidh » Sun, Apr 08, 2018, 7:51 PM UTC

In fact, I think the author is underestimating the impact, right here: "Of course, making this change will have a dramatic impact on your revenue for single-visit traffic, because you basically have to design your ad model to work completely differently from how it works today."

No, it will basically make a newsmedia site unprofitable. I think it is the EU that has not fully thought this through. Most of the news industry is already sickly, financially, and they mostly have no model other than advertising (with a very few exceptions). The reason all this data got collected, was to try to make the advertising valuable enough that they could sell it. It may be that it never really worked, but it sure won't work without it. I think either the EU will backtrack on this once they see that Google and Facebook can easily force people to consent (because people consider those websites too valuable to do without), but most other advertising-supported media cannot; or they will see that the long-term impact of this is that it accelerates the current death spiral of newsmedia, as all ad spending goes to Google and Facebook and almost no one else.

I leave it as an open question as to whether this would be a good or bad thing.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#136

Post by molf » Sun, Apr 08, 2018, 7:52 PM UTC

pspeter3 wrote: post #36

Does this mean every site will need to ask permission for Google Analytics?

Google has been working on making Google Analytics GDPR compliant, but you must actively change some settings to pseudonymize collected data and also sign/accept a GDPR contract with them. Also you must make sure to not explicitly add any personal data to GA. For example avoid sending any user names, email addresses, ip addresses, or any form data to Google Analytics as part of event data.

I don't have an overview of all steps required but provided you do this then GA should still be allowed to be used without explicit user permission.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#137

Post by zerotolerance » Sun, Apr 08, 2018, 7:54 PM UTC

adamnemecek wrote: post #2

Can’t say i feel bad for them.

So, we should all be monitoring all legal changes for every Internet connected country? Is PRC's great firewall a good thing? Because that is where things like GDPR will push the rest of us. The easiest way to comply with this murky EU regulation is to block the EU... especially since we cannot deny service on a case-by-case basis.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#138

Post by molf » Sun, Apr 08, 2018, 7:54 PM UTC

return0 wrote: post #113

So the entire web that depends on ads is doomed, google and fb. will now keep 100% of advertising revenue, and european users will start receiving 2nd-rate service (if at all) , because they are unmonetizable. I think the article has too much FUD

You can show ads without needlessly collecting personal data.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#139

Post by ptype » Sun, Apr 08, 2018, 7:55 PM UTC

CydeWeys wrote: post #110

ptype wrote: post #91

I’m not convinced IP addresses are automatically personal data. Granted, they CAN be personal data, if they can be linked to a specific person. But assuming I just keep generic log files, and that I would not in a subject access request be able to tell someone the IP addresses that the user has used, is it really personal data? Also, it is not clear to me what other laws require in terms of keeping log files. It is p…

It doesn't matter what you consider IP addresses to be, it matters what European regulatory authorities consider them to be. And yes, many IP addresses can be linked to a specific person. I don't doubt that, by being logged in to Google, Facebook, and a bunch of other services, and by having an ISP that provides a unique IP address per subscriber, that the majority of sites out there that use 3rd party tracking know…

To be clear, I am only talking about the interpretation of the regulation, not my own considerations.

The article made it sound like IP addresses are always personal data. My point is that, if I run a website and keep generic nginx log files, is it really personable data with regards to my website?

Yes, the ISP can link that IP address back to a person, but if that person came to me as the website administrator and asked for all data held for that person, I would actually not be able to make the connection.

Re: Publishers Haven't Realized How Big a Deal GDPR Is

#140

Post by ptype » Sun, Apr 08, 2018, 7:57 PM UTC

molf wrote: post #130

ptype wrote: post #91

I’m not convinced IP addresses are automatically personal data. Granted, they CAN be personal data, if they can be linked to a specific person. But assuming I just keep generic log files, and that I would not in a subject access request be able to tell someone the IP addresses that the user has used, is it really personal data? Also, it is not clear to me what other laws require in terms of keeping log files. It is p…

GDPR defines "personal data" as "any information relating to an identified or identifiable natural person". [1] The GDPR definition of personal data is VERY broad, and it includes things like: * name, email, date of birth, etc (probably no surprise here) * any user behaviour (what you look at, what you click on) * uploaded content (what you write, your uploaded avatar etc) * ip addresses, device ids * beliefs, ethnic…

If I can make a connection between an IP address and a person, yes then it is personal data, no doubt.