Live data from Hacker News

GDPR – A Practical Guide for Developers (2017)

techblog.bozho.net

21–30 of 202 posts

Re: GDPR – A Practical Guide for Developers (2017)

#21

Lets say I have a bookmark file which contain list of urls. It is associated with one user account. Its likely associated with one person but I cannot identify that person. There is no other information associated with the user account. Is the bookmark file personal data ?

In general, it's probably even sensitive personal data. A list of URLs can potentially identify a person's religious beliefs, sexual orientation, political views etc.

Re: GDPR – A Practical Guide for Developers (2017)

#22

Lets say I have a bookmark file which contain list of urls. It is associated with one user account. Its likely associated with one person but I cannot identify that person. There is no other information associated with the user account. Is the bookmark file personal data ?

Another way to phrase this question is “what use is the bookmark file without a user to use it?”

I don’t think there’s anything wrong with storing anonymous data: a log of bookmarked urls for instance. So long as there’s no way to trace back who they belong to if that person wants to be forgotten.

Re: GDPR – A Practical Guide for Developers (2017)

#23

I really don't understand how this is going to work in practice for small side projects with a single part-time developer. How are they supposed to afford implementing all these changes, none of which seem trivial or even practical for your standard little PHP site? So if I run a forum as a side project, what are my options? 1) Spend all free time over the next few months adding these features and neglect any other w…

Don't store a bunch of personally identifiable data and you don't have to do any of this.

We have seen what this laissez faire attitude to "capture everything, delete never" has done. Trust has been supremely squandered so at this point I don't think anyone is particularly inclined to believe when someones cries wolf.

Re: GDPR – A Practical Guide for Developers (2017)

#24

I really don't understand how this is going to work in practice for small side projects with a single part-time developer. How are they supposed to afford implementing all these changes, none of which seem trivial or even practical for your standard little PHP site? So if I run a forum as a side project, what are my options? 1) Spend all free time over the next few months adding these features and neglect any other w…

Small side project means small data too, easy to manually sort out gdpr requests as need arises. No need to automate everything.

Re: GDPR – A Practical Guide for Developers (2017)

#25

I really don't understand how this is going to work in practice for small side projects with a single part-time developer. How are they supposed to afford implementing all these changes, none of which seem trivial or even practical for your standard little PHP site? So if I run a forum as a side project, what are my options? 1) Spend all free time over the next few months adding these features and neglect any other w…

One man shop here...

Cloudfront forwards country information to your origin servers in AWS. My plan was to not do business or display content in European countries until an easy solution to GDPR enables me to quickly meet it's criteria. Certainly libraries will crop up helping to ease the burden of the regulation for smaller operations.

Though... I'm not quite sure what happens when a European citizen uses VPN to spoof a non-GDPR country to gain access to my site, provides me their personal data, then requests to be forgotten. Would it be relevant that I intended my site _not_ to be used in Europe and the user in question circumvented my attempts not to do business in Europe? My bet is that it wouldn't. * Shrug *

> 2) Ignore the GDPR and hope nobody complains.

> 3) Shut down the side project.

Basically, I'm implementing a hybrid of #2 and #3 by not letting European users into my system until I know I can comply with GDPR cheaply and easily.

Re: GDPR – A Practical Guide for Developers (2017)

#26
God damn it EU, all these regulations make it impossible for small companies, indie developers to cope with all the bureaucracy.

The VAT for digital products, now the GDPR.

10 more years of regulation and you will spend 90% of the time working on implementing legal requirements and 10% on the actual product.

Re: GDPR – A Practical Guide for Developers (2017)

#27

I really don't understand how this is going to work in practice for small side projects with a single part-time developer. How are they supposed to afford implementing all these changes, none of which seem trivial or even practical for your standard little PHP site? So if I run a forum as a side project, what are my options? 1) Spend all free time over the next few months adding these features and neglect any other w…

It looks like the maximum fine is 4% of annual revenue... seems like the regulation has no teeth if you have no revenue. IANAL and could be totally wrong.

To your point about small companies, I agree, it feels onerous.

What irks me about the right to be forgotten is that it directly counters my right to remember things. Should a shop keeper be allowed to record their observations about who enters their store each day? If they maintain a physical guest book in their brick and mortar store, does a visitor have a right to be erased from that book?

Re: GDPR – A Practical Guide for Developers (2017)

#28
post #26

God damn it EU, all these regulations make it impossible for small companies, indie developers to cope with all the bureaucracy. The VAT for digital products, now the GDPR. 10 more years of regulation and you will spend 90% of the time working on implementing legal requirements and 10% on the actual product.

GDPR—while vastly different to what has become the defacto standard practice in most companies—is largely simple, basic, common decency and common sense. My very tiny startup won't have any problems complying because we've actually given a smidgen of consideration to our users' privacy up until now.

In fact, I foresee it being a much greater tax on large corporations: the work in GDPR is not compliance—that's relatively easy once you have procedures in place—the real work is converting existing non-compliant systems to bring them into compliance. This is going to be much easier for those maintaining relatively small, simpler systems, and easiest of all for brand new startups.

Re: GDPR – A Practical Guide for Developers (2017)

#29

Does this apply to internal software like Slack and Github provided by an employer to an employee? e.g. An ex-employee requests that all their identifiable data be deleted from all communication and systems of their former employer. That seems like a problem for institutional knowledge transfer. Will the employer have to adhere to that request?

How is identifiable data important for institutional knowledge transfer?

I can imagine scenarios where it would be important to know who worked on something.

For example, using git blame I might learn someone was heavily involved with a project or feature. Then I might look on our internal Wiki for old posts which include discussions explaining why certain design decisions were made.

Re: GDPR – A Practical Guide for Developers (2017)

#30
post #26

God damn it EU, all these regulations make it impossible for small companies, indie developers to cope with all the bureaucracy. The VAT for digital products, now the GDPR. 10 more years of regulation and you will spend 90% of the time working on implementing legal requirements and 10% on the actual product.

[deleted]
Post reply on HN