GDPR Feels Useless • Hacker News Board

Re: GDPR Feels Useless

#31

Post by samdunham » Fri, Apr 12, 2019, 8:32 PM UTC

pas wrote: post #17

Mirioron wrote: post #5

I don't view GDPR to be quite as useless as the author does, but the point about the user having to protect their data themselves is spot on. GDPR only protects you against good actors that are under EU jurisdiction. Everyone else could very well be doing whatever they want with the data you leak. The EU can't fine a Chinese company if the Chinese company has no presence in the EU. Another thing the author doesn't me…

First of all, GDPR does not apply to personal sites. ( https://law.stackexchange.com/a/28086 - see current "in force" version of the directive: https://eur-lex.europa.eu/eli/reg/2016/679/oj see recital 18) > [...] GDPR sets a minimum amount of cost/effort to run a website [...] This is simply false. If you want to post something on the 'net, nothing changes. You want to count page downloads? (You know those old schoo…

I'd say that medium sized sites are more troublesome in that regard. Once a site has grown big enough to become cumbersome for one person to manage, but not large enough for most to justify staff, then you have an issue. There shouldn't be any excuse for a small site to fall behind with updates, etc... It's simple.

Re: GDPR Feels Useless

#32

Post by MattPalmer1086 » Fri, Apr 12, 2019, 10:06 PM UTC

ziddoap wrote: post #23

legitster wrote: post #15

Earlier quoted context omitted.

According to our council, even encrypted or hashed data was still counted as PII as those are security measures, not privacy measures.

I mean, trust your council over some random guy on the internet (me), but I would seek a second opinion on this from a technilogically savvy lawyer. There are absolutely implementations available that will allow you to have a hash, not tied to other data, sitting in your opt-out list that you than check other hashes against. No PII in the mix.

If I got the hash database I could absolutely test whether specific people were in it, and I could probably reverse a large number of them with dictionary based attacks.

There are no completely robust options where you can claim that this data cannot compromise personal privacy, so I guess from a legal perspective it doesn't stop it being PII.

Re: GDPR Feels Useless

#33

Post by pas » Sun, Apr 14, 2019, 7:42 PM UTC

Mirioron wrote: post #22

pas wrote: post #19

Earlier quoted context omitted.

You can host your own forum. And if you do it as purely personal activity, then GDPR does not apply.

Is running a forum a purely personal activity? I'm not so sure. It certainly won't be if you have any third party services running on it.

Why not? You can set up a family forum, to share stories, pictures, etc. That's household-y and personal. Fits the definition from the law pretty well.

There's some thinking about what constitutes purely personal activity ( https://ec.europa.eu/justice/article-29/documentation/other-... ) usually the test is whether it can potentially reach anyone in the public, is some financial/professional gain for the operator, etc.

> I'm not so sure. It certainly won't be if you have any third party services running on it.

Those are handled in the text too. Basically the controller / provider / operator of said 3rd party service has to be GDPR compliant, not the user. (So if you fire up a WordPress blog, you probably don't have to worry about it.)

Re: GDPR Feels Useless

#34

Post by pas » Sun, Apr 14, 2019, 7:43 PM UTC

samdunham wrote: post #31

pas wrote: post #17

Earlier quoted context omitted.

First of all, GDPR does not apply to personal sites. ( https://law.stackexchange.com/a/28086 - see current "in force" version of the directive: https://eur-lex.europa.eu/eli/reg/2016/679/oj see recital 18) > [...] GDPR sets a minimum amount of cost/effort to run a website [...] This is simply false. If you want to post something on the 'net, nothing changes. You want to count page downloads? (You know those old schoo…

I'd say that medium sized sites are more troublesome in that regard. Once a site has grown big enough to become cumbersome for one person to manage, but not large enough for most to justify staff, then you have an issue. There shouldn't be any excuse for a small site to fall behind with updates, etc... It's simple.

Absolutely. This is the typical problem of small-medium sized shops everywhere around the world. If you're just a really small one-man army, big companies don't really care. If you are getting bigger, suddenly you will find competition and a lot of regulatory burden. (Most startups usually fail at this point as far as I know.)

Re: GDPR Feels Useless

#35

Post by pas » Sun, Apr 14, 2019, 8:21 PM UTC

Mirioron wrote: post #25

pas wrote: post #17

Earlier quoted context omitted.

First of all, GDPR does not apply to personal sites. ( https://law.stackexchange.com/a/28086 - see current "in force" version of the directive: https://eur-lex.europa.eu/eli/reg/2016/679/oj see recital 18) > [...] GDPR sets a minimum amount of cost/effort to run a website [...] This is simply false. If you want to post something on the 'net, nothing changes. You want to count page downloads? (You know those old schoo…

> First of all, GDPR does not apply to personal sites. And next to no websites actually fall under this exemption. Furthermore, simply to know that your website falls under this exemption comes with the cost. You must know that your website falls under this exemption, requiring you to know GDPR and/or requiring a lawyer to look it over (high cost). > This is simply false. If you want to post something on the 'net, no…

Of course, just as with any piece of regulation, some might affect you without you ever knowing it.

Furthermore, you seem to be mixing things up with outright falsehoods. If you are a user, and you want to use a service that provides publishing, let's say tumblr/medium, you don't have to worry anything. If you are a - let's say - power user, and you want to set up a website, then you set up - again, let's say - WordPress, then you don't have to worry about it, because it's a purely personal activity and the providers of the trackers have the burden of compliance here.

I'm not saying "yaay, it's the best thing ever", and it'll surely change as courts and data protection authorities of member states interpret and apply the regulation (and then cases against those go through the courts), but it's certainly a serious attempt at some sort of ideology about personal data. And the tracking and cookies is completely irrelevant most of the time. (After all almost all sites really don't know and gather more than your IP address and your user-agent.) However. Malicious users can inject all kinds of CSS-based history-leaking nasty stuff, and big players like FB and G can naturally feel that building a universal profile based on your activity and data and visits of others sites (where G or FB is embedded), and that's what this is about. That now there's a decision that you have a right to know what G/FB/etc does with your data. How that profile looks like and what happens to it, who has access to it, and who does what with it.

> What's the chance that every single website owner everywhere never gives out personal data to the wrong person? I would say that that chance is effectively zero.

Great point. It leads to a very important discussion about security. Sites are very lousy when it comes to social engineering. (And this is somewhat covered already: https://gdpr-info.eu/recitals/no-64/ )