GDPR – A Practical Guide for Developers (2017) • Hacker News Board

Re: GDPR – A Practical Guide for Developers (2017)

#181

Post by antaviana » Sun, Mar 04, 2018, 1:49 AM UTC

For example, imagine you only collect an email at sign up (no name, no country) and you state in your EULA that you might use the email to send onboarding information or commercial communications (promotions, newsletter) that can be opted out.

If you do not have any means to know the country where the owner of the email is located, how do you ensure the right of non-EU citizens to receive the commercial communications they have agreed to receive in your EULA unless they opt out later?

If you do not collect your user country for privacy reasons (I would be wary to sign up for a trial of a service who wants to know my citizenship), how can you prevent EU citizens from using your product?

Re: GDPR – A Practical Guide for Developers (2017)

#182

Post by x0x0 » Sun, Mar 04, 2018, 2:15 AM UTC

nawitus wrote: post #150

AlphaSite wrote: post #138

Earlier quoted context omitted.

Every country has a slightly different implementation of the directive, so I don't think the EU will have a single example to give.

However, GDPR is a regulation, not a directive. I haven't seen that countries pass their own implementation of it.

Each country-specific privacy org gets leeway around rules like legitimate interest.

Re: GDPR – A Practical Guide for Developers (2017)

#183

Post by nihonde » Sun, Mar 04, 2018, 2:17 AM UTC

This strikes me as all very pie-in-the-sky. I understand the law, and the policies that it serves, but the article assumes that a company has a single, centralized data source that you can just put some hand-waving “if then statements” around to limit access, and that supports perfect cascading of data from the user down so we can just implement a few checkboxes to configure, etc. It sounds like good stuff, but that’s not how things work in the real world, where half your users trade Excel output, and can’t be bothered to log their interactions with third parties. I’m not saying that they shouldn’t do it, but they won’t.

Re: GDPR – A Practical Guide for Developers (2017)

#184

Post by antaviana » Sun, Mar 04, 2018, 2:18 AM UTC

EwanToo wrote: post #67

powvans wrote: post #55

Earlier quoted context omitted.

Dear diary, today I had a discussion on HN with tajen. Will HN support erasing your comment history if you ask?

If you're a European citizen, in a couple of months they'll legally have to (assuming they don't want to just ignore any European court judgements, which is possible but risky). I believe you can already delete your account and comments though?

So what is the procedure going to be exactly? Will HN request the user to send over a photo of their national ID card or password to prove EU citiznship and then proceed to delete comments and data?

Re: GDPR – A Practical Guide for Developers (2017)

#185

Post by cinquemb » Sun, Mar 04, 2018, 4:40 AM UTC

5_minutes wrote: post #133

This is basically developed to protect users from big abusive companies such as Facebook, Google, Twitter and big marketing agencies. But it really is overkill for the local restaurant that wants to mail their customers. Using a bazooka to kill some flies.

It's worse than that, because GDPR in of itself, will not technically stop useds from inadvertently blasting data to any service

Decentralized services that EU citizens use will be even less in compliance as data is shared and copied between nodes by default. Sure block a few servers by spending more resources to find/go through the legal moves than it will take for a dozen more to pop up… see torrent sites/software and how people are monetizing such, because that will be the future… laws like GDPR only make such even more attractive.

And lets just set aside that nation state actors that are routinely compromised will still collect this data that will leak on to the internet… lol

These laws are analogous to those that were against the printing press… fighting the tide of reality where it's easier to do nothing than to contort something to fit a luddites dream of personal privacy provided by the state mandates (on top of building a functional product), without having to do anything oneself to protect ones interest, in the age of deep packet inspection, 0day-exploit-exfil-as-a-service, and metadata drone strikes.

Would be more effective to just make it law that users have to plug a black box onto their devices/networks so it can just filter non GDPR colored bytes lol

Re: GDPR – A Practical Guide for Developers (2017)

#186

Post by [deleted] » Sun, Mar 04, 2018, 4:46 AM UTC

geocar wrote: post #176

Silhouette wrote: post #157

Earlier quoted context omitted.

You keep mentioning how you're consulting on this issue at the moment and claiming that those of us more cautious than you just don't understand how European law works. Would you mind sharing a little more to justify that authority -- what qualifications do you have that we don't, what sorts of business are you consulting with and how much is compliance (including your advice) costing them, and why is your interpreta…

Hi Silhouette, I'm not claiming anyone more cautious than me doesn't understand how European law works. That's just silly. I also don't know what qualifications I have that you don't. What qualifications do you have? The sorts of business I am consulting to are sales and marketing agencies based in the US. As an SME I work with their in-house council to help them understand what the business is doing. I also help def…

[deleted]

Re: GDPR – A Practical Guide for Developers (2017)

#187

Post by Sylos » Sun, Mar 04, 2018, 4:58 AM UTC

tajen wrote: post #115

What happens if your service lets users manage their own customers’ data? I mean, for a product such as Airtables, FieldBookApp, Sharepoint Forms or, simply, Google Forms: Are we, cloud app providers, supposed to ensure our users don’t put PII data in the spreadsheets, and if they do, are we supposed to manage their users’ consent and process their users’ requests for edition and deletion? At the extreme, what should…

In that case, your customer is the "controller" and you're the "data processor". The whole GDPR is written with such B2B relationships in mind.

Chapter 4 is specifically all about that. Article 28 specifies the situation for the data processor: https://gdpr-info.eu/art-28-gdpr/

And well, basically your customer has to tell you all of these things in the contract. (Article 28 Section 3)

Furthermore, if you yourself want to pass that data on to another data processor, you have to notify the controller of that and tell that data processor those things that the controller specified in the contract, too.

It's also in the responsibility of the controller to select data processors that implement "appropriate technical and organisational measures".

That's a term that you should also find plenty of literature and discussions on. The GDPR specifies somewhat in its recitals: https://gdpr-info.eu/recitals/no-78/

And you might also want to get certified that you are GDPR-compliant, just to make it trivial for customers to see that you can implement those appropriate organizational and technical measures.

Re: GDPR – A Practical Guide for Developers (2017)

#188

Post by Xylakant » Sun, Mar 04, 2018, 5:14 AM UTC

nokcha wrote: post #180

Xylakant wrote: post #140

Earlier quoted context omitted.

How would the judgement be quashed by american courts? No american court has jurisdiction over European courts. For an entity without presence or business in Europe, enforcing a european court decision might be a problem, but that’s a different matter. I’m sure the EU will find a way if the sum is sufficiently high.

Sorry, I was sloppy in saying that the judgment itself would be quashed. What I meant is that any attempt to enforce the judgment would be quashed. Since (by assumption) the defendant doesn't any assets in Europe to pay the fine, enforcing the judgment would require going after the defendant's assets located in the US. American courts will typically enforce foreign judgments from 'friendly' jurisdictions, but if the…

Sure, but these are two entirely different matters. Having an open, unenforced judgment against you might lead to complications, for example if the defendant happens to travel to the EU. It’s unlikely that a minor fine will be enforced by snatching the defendant at the airport, but it could at least legally an option.

Or the defendant may later open up a German subsidiary or plan on selling to a company with a german subsidiary. Things would get complicated in those cases.

So it’s important to be somewhat precise here - no enforcement doesn’t equal squashed judgment.

Re: GDPR – A Practical Guide for Developers (2017)

#189

Post by scrollaway » Sun, Mar 04, 2018, 6:34 AM UTC

pkaye wrote: post #171

bkanber wrote: post #155

Earlier quoted context omitted.

If you service any users in the EU or process any personal information of EU citizens, you must comply with GDPR.

What will they do if you don't comply?

Warn you, help you, or fine you, just like they would an eu business.

Re: GDPR – A Practical Guide for Developers (2017)

#190

Post by scrollaway » Sun, Mar 04, 2018, 6:46 AM UTC

zavi wrote: post #174

Practical guide to developers - build your product in the US then expand to Indo-Pacific. Don't bother with rolling out to Europe. AI is the future of business & healthcare, which, due to inherent need for data, is incompatible with anti-data sharing laws such as GDPR. Population is rapidly aging in Europe (47.1 year old average in Germany, 42.9 in EU), so might as well set your business up for the long term by pivot…

This is the worst advice in this thread. Not only do you lose the European market for no good reason and on logic you might hear from moon landing conspiracy theorists, but you don't even solve your issue as you will still have European users no matter what. People do travel.