Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

271–280 of 710 posts

Re: How GDPR Will Change The Way You Develop

#271

Post by Silhouette »

shkkmo wrote: post #261
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

Can you point me to a definitive source as to what websites that have access log that include IP addresses (which is pretty much everyone) have to do to be compliant? If there are steps that must be taken, who has to taken them? I've been looking, and I have found a bunch of contradictory explanations. My best guess is that if you have a disclaimer that says you log IP addresses for security purposes, you can keep yo…

Backups of various kinds are in a similar position.

The reason GDPR is a bad law is that its real effect is so ambiguous.

Read literally, it imposes significant burdens on data controllers, particularly because of things like the right to erasure. Those burdens may be disproportionate particularly for smaller organisations that only handle a limited amount of data in the first place.

The alternative, which I've noticed GDPR's defenders tend to favour as understanding has grown, is something to the effect that regulators won't actually enforce the rules in a draconian fashion and will only go after serious infringement in practice. But that's a dangerous position to adopt in legal matters, because ultimately it means if you go too far in complying when others don't then you are at a disadvantage, but if you don't go far enough then you are subject to being punished at any time, and there is no objective standard for how far we're talking about either way.

Re: How GDPR Will Change The Way You Develop

#272

Post by gnud »

wglb wrote: post #190
Radim wrote: post #138

Earlier quoted context omitted.

Of course—if you don't store personal data (trivially). In fact, encryption (security) is mostly orthogonal to how you track and handle personal and sensitive data (privacy protection). You could encrypt everything and still be wildly GDPR non-compliant, if the encrypted information you're storing lacks clear purpose and explicit consent.

To further emphasize your point You could encrypt everything and still be wildly GDPR non-compliant , we need to be able to respond to a request by each and every individual user to delete the information that they no longer wish us to carry.

... unless you actually need that data (billing for past services, keeping records as required by law, etc).

Re: How GDPR Will Change The Way You Develop

#273

Post by havkom »

shkkmo wrote: post #261
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

Can you point me to a definitive source as to what websites that have access log that include IP addresses (which is pretty much everyone) have to do to be compliant? If there are steps that must be taken, who has to taken them? I've been looking, and I have found a bunch of contradictory explanations. My best guess is that if you have a disclaimer that says you log IP addresses for security purposes, you can keep yo…

Sounds like you have a legitimate interest in logging IP addresses for security purposes, it is an effective measure and that your legitimate interest on balance outweighs the interests of the data subject. If that is the case you could probably rely on the “legal basis” called legitimate interest and do not need consent or anything like that. Do:

- Make a link to a privacy policy clearly accessible (eg on your website footer) and make sure it contains all of the required elements of information (see Article 13)

- Do not store the data longer than reasonable

- Do not worry too much about logs/backups etc as long as what you do is reasonable and you do have a reasonable delete schedule - no lawyers I have met seems to worry about this.

- Worry instead about for what purposes you actually use data you collect (what other orgs do you share data with, why, what do you do with the data that produces an effect on the data subject (eg marketing) etc)

Re: How GDPR Will Change The Way You Develop

#274

Post by e12e »

shkkmo wrote: post #261
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

Can you point me to a definitive source as to what websites that have access log that include IP addresses (which is pretty much everyone) have to do to be compliant? If there are steps that must be taken, who has to taken them? I've been looking, and I have found a bunch of contradictory explanations. My best guess is that if you have a disclaimer that says you log IP addresses for security purposes, you can keep yo…

Quit storing ips unless you are legally obliged to do so (audit trial, mandated surveillance, like that other EU directive...). Generally security audit purposes will likely let you keep logs for "reasonable time" (weeks).

Beyond that, why store them?

Re: How GDPR Will Change The Way You Develop

#276

Post by shkkmo »

lostcolony wrote: post #246
nemetroid wrote: post #74

Earlier quoted context omitted.

> Don't accept euros as currency. I see multiple comments mentioning this. Do American banks restrict which currencies your credit card can be charged in? As far as I've been able to tell, my bank lets me pay in any currency I'd like, and they will convert the amount to SEK before charging my account.

Don't offer shipping options to the EU. If dealing with digital products, allow people to purchase without creating an account, or require them to select a country as part of account creation (and prevent those selecting the EU, or don't make it an option). If the bank processes the payment, but you've collected no information, you can't run afoul of the law (since you have no information).

> If the bank processes the payment, but you've collected no information, you can't run afoul of the law (since you have no information).

Don't have server logs with IP addresses? Don't collect an email for the user to use to log in? Don't receive customer support recieve from these users?

Re: How GDPR Will Change The Way You Develop

#277

Post by danieltillett »

77pt77 wrote: post #269

How would this be enforceable for companies that have their headquarters only in the USA even if they have european users? Will this also apply for citizens of a EU country living outside the EU?

The EU is going to send over its army and force you to comply.

My understanding is the GDPR applies to residents of the EU, not just citizens, and it also applies when they are outside the EU. In practice this means it is impossible to determine if it applies unless you gather far more information than you really need from your users - “sorry we have to invade your privacy to protect your privacy”.

Re: How GDPR Will Change The Way You Develop

#278

Post by wuliwong »

dragonwriter wrote: post #6
trothamel wrote: post #4

"The extraterritorial nature of these two frameworks..." I've noticed that this is something the EU has tried to do lately, to just sort of push their regulations on the rest of the world. I don't see what sort of authority they'd have to impose this on citizens of other countries. I wonder if Europe pushes the issue, if this will be treated like libel tourism, where US citizens and companies without a Eurpoean nexus…

> I don't see what sort of authority they'd have to impose this on citizens of other countries. The authority they have is that delegated by the sovereign members of the EU, and the fact that the authority of a sovereign power is limited only by its own decisions and it's practical capabilities. (The US also imposes it's ruled extraterritorially when it feels like it.)

I agree but I think a similar question would be: how would this ever be enforced on a US based company/website where it had a EU visitor. I wrote this in another comment but I think outside of just blocking your site in the EU, they would need a further agreement (or I guess precedent) with the US government to actually enforce a penalty on the US company.

Re: How GDPR Will Change The Way You Develop

#279

Post by danieltillett »

e12e wrote: post #275
77pt77 wrote: post #269

How would this be enforceable for companies that have their headquarters only in the USA even if they have european users? Will this also apply for citizens of a EU country living outside the EU?

Trade agreements.

Trade agreements don’t enforce laws, they just mean the countries are supposed to draft local laws that cover the action. This assumes that the GDPR is covered by trade agreement.

Re: How GDPR Will Change The Way You Develop

#280

Post by 77pt77 »

danieltillett wrote: post #277
77pt77 wrote: post #269

How would this be enforceable for companies that have their headquarters only in the USA even if they have european users? Will this also apply for citizens of a EU country living outside the EU?

The EU is going to send over its army and force you to comply. My understanding is the GDPR applies to residents of the EU, not just citizens, and it also applies when they are outside the EU. In practice this means it is impossible to determine if it applies unless you gather far more information than you really need from your users - “sorry we have to invade your privacy to protect your privacy”.

So a US company providing services to a US naturalized citizen in the US that is also a dual citizen of a country in the EU makes the company liable to follow these regulations?

That makes no sense.

This sounds unenforceable.

Post reply on HN