Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

politico.eu

Post reply on HN
Print view View original

181–190 of 190 posts

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#181

Post by razakel »

milesrout wrote: post #174
razakel wrote: post #171

Earlier quoted context omitted.

European law has established various rights regarding data concerning an individual since 1981.

Thankfully European statutes don't have anything to do with what words actually mean in the English language and don't override basic logic. The idea that you have the right to control eg. my opinions about you, just because they happen to concern you, is fundamentally contrary to the most basic right we all have: freedom of expression. The cornerstone of civil and political rights.

[flagged]

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#182

Post by EGreg »

schnubbidubb wrote: post #89
Gud wrote: post #86

Earlier quoted context omitted.

Are cookie banners really a requirement in that case? I think as long as you don’t share the data with a third party you’re in the clear?

Matomo for example has an explanation how to gather data without having to display a banner: https://matomo.org/faq/new-to-piwik/how-do-i-use-matomo-anal...

If you have first-party session cookies that can last for weeks or years, are they considered “tracking cookies”?

Because true session-expiry times on cookies SUCK BADLY: https://stackoverflow.com/questions/4132095/when-does-a-cook...

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#183

Post by EGreg »

cbeach wrote: post #178
awiesenhofer wrote: post #132

Earlier quoted context omitted.

No, you dont! Only if you use third party services to do that or collect data thats not essential to your business. Its just coloquially called a "Cookie Banner", but the laws DONT require you to put up one as soon as you set one cookie!

It does if the cookie contains any uuid that might be linkable to a user's identity (which is obviously necessary if you want to perform rudimentary self-hosted analytics on unique user visits)

Only if it is a “tracking cookie”, and lasts for more than one day. But how do they define these terms ??

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#184

Post by bigbadfeline »

m463 wrote: post #145
bigbadfeline wrote: post #114

Earlier quoted context omitted.

> Peace is a lie, there is only passion. Lie is Truth... sure, sure. > Through passion, I gain strength. Weakness is Strength Sounds like a 1984 sequel from 1939.

Seems to be the Sith Code :)

Oops... thanks.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#185

Post by snowwrestler »

jdlshore wrote: post #120
snowwrestler wrote: post #39

Earlier quoted context omitted.

I spent months implementing GDPR compliance with a set of EU-based lawyers. Most businesses are not actually GDPR compliant, even to this day. I assume this is a big reason the EU is willing to take another look at what is required for compliance.

I think you’re confusing the ePrivacy Directive, which regulates cookies, and the GDPR, which regulates PII.

Practically speaking, if you’re running a website, you can’t implement compliance with the ePrivacy Directive without also considering GDPR, and vice versa.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#186

Post by [deleted] »

schrototo wrote: post #40
snowwrestler wrote: post #22

Earlier quoted context omitted.

You are required to have a cookie banner if you use cookies, and you have to use cookies or an equivalent technology to persist state in a logged-in website (like HN). To pre-empt the typical reply, yes you must serve a cookie banner even if you are only using functional cookies.

This is simply not correct. You absolutely DO NOT need to obtain consent for strictly necessary first-party session cookies (such as would be used by an online shopping cart, for example, or to maintain a persistent login) [1]. [1] https://gdpr.eu/cookies/

[deleted]

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#187

Post by snowwrestler »

amiga386 wrote: post #62
snowwrestler wrote: post #22

Earlier quoted context omitted.

You are required to have a cookie banner if you use cookies, and you have to use cookies or an equivalent technology to persist state in a logged-in website (like HN). To pre-empt the typical reply, yes you must serve a cookie banner even if you are only using functional cookies.

This is definitely not the case. https://eur-lex.europa.eu/eli/reg/2016/679/oj You are required to OBTAIN CONSENT from people you want to process the personal data of. Their consent must be INFORMED by telling them who you are and what you intend to do with their data. Their consent must be FREELY GIVEN and can be WITHDRAWN at any time. That's what's at stake; not the cookies/state themselves, but how you intend to p…

Please take a close look at the cookie banner that loads on the page you linked. It says:

> This site uses cookies. Visit our cookies policy page or click the link in any footer for more information and to change your preferences.

And then there are two buttons: "Accept all cookies" and "Accept only essential cookies".

The banner is doing two things. 1) It is notifying you that the site uses cookies. 2) It is requesting your consent for non-essential cookies.

Think about this for a moment, why is it doing both things? Why doesn't it just say "Do you consent to non-essential cookies? Yes | No"? Do you think this website added an extra sentence to their banner just for fun?

If you want to use essential cookies, you don't need to ask for consent. That is true. But you do still need to inform the visitor that you are setting cookies. Just as this banner does in its first sentence.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#188

Post by snowwrestler »

schrototo wrote: post #40
snowwrestler wrote: post #22

Earlier quoted context omitted.

You are required to have a cookie banner if you use cookies, and you have to use cookies or an equivalent technology to persist state in a logged-in website (like HN). To pre-empt the typical reply, yes you must serve a cookie banner even if you are only using functional cookies.

This is simply not correct. You absolutely DO NOT need to obtain consent for strictly necessary first-party session cookies (such as would be used by an online shopping cart, for example, or to maintain a persistent login) [1]. [1] https://gdpr.eu/cookies/

I didn't say "obtain consent," I said serve a cookie banner. If you are only setting essential cookies, the banner can just say "This site is using cookies," with no opt-out or preferences button. But it does need to appear.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#189

Post by snowwrestler »

otherme123 wrote: post #36
davedx wrote: post #26

Earlier quoted context omitted.

No. You really don't. Come on, burden of proof, show us where the GDPR says functional cookies require a banner?

How do you interpret this about strictly necessary cookies, from gdpr.eu? > While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user. To me, it reads as you need some kind of banner/page explaining them. What you don't need is consent to store them.

This is correct.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#190

Post by kuschku »

superkuh wrote: post #117
AndrewStephens wrote: post #100

Earlier quoted context omitted.

Why do you store your webserver's logs? My reading of the GDPR (I am not a lawyer) is that it strongly encourages site owners to store the very minimum amount of data about visitors - something that I wholeheartedly agree with. Server logs are useful for debugging the site but also contain potentially identifying information (IP addresses) so I have my site delete them after 48 hours. User submitted comments are obvi…

I read the logs with my human eyes manually because I am interested in learning about the web and internet. In fact today I found a whole new useful search engine because I saw it's spider in my logs. 64.62.202.82 "GET /library/Math/Mathematical%20Methods%20for%20Physicists_%20A%20concise%20introduction_%20Tai%20L%20Chow_%202000.pdf -" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Centurybot/1.0; +h…

Then keep your logs for 14 days, and remove IPs from them after 48h.

Tools for that exist, you don't keep unnecessary data, and you're in the clear.

Post reply on HN