Facebook to change user terms, limiting effect of EU privacy law • Hacker News Board

Re: Facebook to change user terms, limiting effect of EU privacy law

#241

Post by pbhjpbhj » Thu, Apr 19, 2018, 11:33 AM UTC

morgante wrote: post #208

shawa_a_a wrote: post #198

Earlier quoted context omitted.

What aspects of the law are disastrous for startups? What startups might see as a "massive regulatory burden", I see it as, at long last, a means of finally holding irresponsible companies to account. The spirit of the law is really quite simple; my personal data is an extension of me, and if you want to store or process it, you need a legal basis for doing so, and need to be able to demonstrate this legal basis to m…

The scope of personal data is disastrously large and the guidance is fuzzy at best. Take, for example, my old blog. It has commenting enabled and a standard Apache config (where logs include IP addresses). If I want to comply with GDPR, I have to do a bunch of work around log rotation/encryption, provide tools for old commenters to go back and remove their information, and this is even the simple case that I'm not us…

IP addresses aren't PII. If you're capturing IP + real name, or similar (email + real name) then AIUI you'll need to tell people on request who you sell that info to and allow removal.

Assuming it's a personal blog then just don't capture any PII. Don't sell it, be prepared to delete a user's comments on request. Don't capture PII without informed consent.

Easy, no?

Re: Facebook to change user terms, limiting effect of EU privacy law

#242

Post by navaati » Thu, Apr 19, 2018, 11:33 AM UTC

patrickaljord wrote: post #190

rmc wrote: post #178

Earlier quoted context omitted.

> freedom to contract I think you'll find this libertarian "right to enter into any contract for anything" doesn't exist in EU law. The Charter of Fundamental Rights doesn't list it. It does list the right to protection of personal data.

Pretty sure Freedom of association is at least part of French constitution https://fr.wikipedia.org/wiki/D%C3%A9cision_Libert%C3%A9_d%2...

This is not about business associates, it's more about… think non-profits.

Re: Facebook to change user terms, limiting effect of EU privacy law

#243

Post by dogma1138 » Thu, Apr 19, 2018, 11:36 AM UTC

Spearchucker wrote: post #238

dogma1138 wrote: post #235

Earlier quoted context omitted.

DPA cares for local laws the GDPR does not trump local EU legislation. What court do you use to appeal a complaint or a fine? There are no processes at all for a non-EU entity to function within the GDPR and saying it’s not rocket science isn’t going to change that.

If the ICO (UK) issued a fine, you wouldn't appeal in Spain, would you? Because of course you respond to the DPA that issued the fine or complaint. Am I not understanding your question?

We’re not talking about EU companies or entities but non-EU ones.

In case of the EU you have your own local DPA other DPA local courts and high courts to appeal too and or work with.

As a non-EU entity you get nothing.

Re: Facebook to change user terms, limiting effect of EU privacy law

#244

Post by DanBC » Thu, Apr 19, 2018, 11:38 AM UTC

wastedhours wrote: post #237

rplnt wrote: post #230

Earlier quoted context omitted.

IP by itself is not considered private. It's only when you attach it to other identifying data. Anonymous comments are not covered with GDPR.

However, is it not thought that because the ISP keeps a log of dynamic IP addresses, these could (in theory) be matched to the IP address of anonymous comments, thus de-anonymise them?

No, because you need to take into account the effort needed to de-anonymise the IP address.

> > (26) The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

Re: Facebook to change user terms, limiting effect of EU privacy law

#245

Post by pbhjpbhj » Thu, Apr 19, 2018, 11:38 AM UTC

weddpros wrote: post #223

shawa_a_a wrote: post #198

Earlier quoted context omitted.

What aspects of the law are disastrous for startups? What startups might see as a "massive regulatory burden", I see it as, at long last, a means of finally holding irresponsible companies to account. The spirit of the law is really quite simple; my personal data is an extension of me, and if you want to store or process it, you need a legal basis for doing so, and need to be able to demonstrate this legal basis to m…

"perhaps you're not the kind of company the EU wants to be doing business with" Europeans want Facebook and Google and the rest, the EU doesn't. The EU != the europeans. So international startups must now care more about what the EU wants than what european customers want. That's wrong. In the meantime, european governments take measures that jeopardise private life, like putting black boxes at ISPs in France to watc…

People living in the EU absolutely want control of the gathering of their PII.

The only complaints I've seen about it are concerning people responsible for administrating data in companies.

GDPR represents an ideology of not giving corporations free reign to make profits at any human/social cost, but to reign them in and give people chance to consent rather than be data-raped.

Could you expand on how you think it's (solely?) ideology? What's bad about informed consent wrt PII?

Re: Facebook to change user terms, limiting effect of EU privacy law

#246

Post by DanBC » Thu, Apr 19, 2018, 11:40 AM UTC

morgante wrote: post #204

Drakim wrote: post #203

Earlier quoted context omitted.

It's pretty crazy to me that people can feel this way after things like the Equifax breach. Equifax was sitting on all that data that people didn't even know they were included in, and probably didn't even WANT Equifax to possess. But that's just business as usual, businesses are allowed to do things we consider morally wrong because that's just how things work. And the second a law springs up that helps out the litt…

You're using a non sequitur. Equifax is of course a massive data processor which should be regulated. Choosing to instead regulate every single person who even accidentally has an IP address in their logs somewhere is the overreach. This helps massive corporations (who can afford to comply) and hurts small businesses which cannot.

> Choosing to instead regulate every single person who even accidentally has an IP address in their logs somewhere is the overreach.

It doesn't help your argument when you misrepresent the truth like this.

There's absolutely no requirement for every individual who accidentally has an IP address in their logs to comply with GDPR.

Re: Facebook to change user terms, limiting effect of EU privacy law

#247

Post by wastedhours » Thu, Apr 19, 2018, 11:42 AM UTC

mikekchar wrote: post #152

charlesdm wrote: post #140

Earlier quoted context omitted.

> If you just say, "Oh I have consent" then the user can withdraw consent. If you actually needed that information (like the user's name!) then you are absolutely screwed. Well, only screwed if they want to keep their account? I can assume that resulting in Facebook closing down your account. All in all, I doubt millions of people will request data under the GDPR. But I guess the fines are significant enough to worry…

The really, really, really awesome thing about GDPR is that you can't deny service because someone wants to opt out of sharing their data. You actually have to keep their account active and make it work somehow. If you can't, then you are libel for a really huge penalty. I can't add enough smileys to that, so you will just have to imagine them.

Is that not only the case for consent as legal basis though? If you're signing up to a service, then surely they can use fulfilment of a contract (with some very expensive lawyers drafting some nice ToS language), or legitimate interests (i.e. argue that a social network relies on real names etc to function)?

I see this turning into an in-app clicking contest though soon, a card comes up in the app with a little description, a cutesy graphic, and a "Consent" "No Consent" box to click before you can get to the newsfeed.

Re: Facebook to change user terms, limiting effect of EU privacy law

#248

Post by pbhjpbhj » Thu, Apr 19, 2018, 11:43 AM UTC

tobltobs wrote: post #222

mpfundstein wrote: post #215

Earlier quoted context omitted.

I never really felt the need to store ips actually

You might not, but your webserver did. Or did you change the logging configuration of your webserver to not store or obfuscate IPs in the past?

This law suggests a shift to assuming no consent for gathering of PII, only gathering data when you have informed consent and a justifiable business need.

In the case of web servers I can't see a problem with not recording IP if you're also gathering PII; or asking for permission in the PII submission; or say dropping the last digits from a dotted-quad as a default.

Re: Facebook to change user terms, limiting effect of EU privacy law

#249

Post by pbhjpbhj » Thu, Apr 19, 2018, 11:46 AM UTC

morgante wrote: post #202

philipps wrote: post #196

Earlier quoted context omitted.

In light of recent revelations about the way social media companies treat their users’ data and privacy, strong regulation is not “overreach” but “overdue”.

The law could have easily been tailored to target large social media companies. Instead it applies to everyone , including tiny businesses who accidentally have one European visitor. I'm strongly considering simply taking down all my old blogs/sites because it's far too much work to deal with GDPR for anything less than a medium-sized business.

What PII are you gathering? Can't you just remove those fields, add a consent field, drop old PII from your DBs?

I imagine most CMS will have the option to do that at update?

Re: Facebook to change user terms, limiting effect of EU privacy law

#250

Post by pbhjpbhj » Thu, Apr 19, 2018, 11:50 AM UTC

dogma1138 wrote: post #243

Spearchucker wrote: post #238

Earlier quoted context omitted.

If the ICO (UK) issued a fine, you wouldn't appeal in Spain, would you? Because of course you respond to the DPA that issued the fine or complaint. Am I not understanding your question?

We’re not talking about EU companies or entities but non-EU ones. In case of the EU you have your own local DPA other DPA local courts and high courts to appeal too and or work with. As a non-EU entity you get nothing.

You get the courts that the person you're servicing uses. Like when you sell to someone in a particular country and have to abide by their sales and tax laws.