Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

321–330 of 710 posts

Re: How GDPR Will Change The Way You Develop

#321

Post by Silhouette »

77pt77 wrote: post #304
havkom wrote: post #273

Earlier quoted context omitted.

Sounds like you have a legitimate interest in logging IP addresses for security purposes, it is an effective measure and that your legitimate interest on balance outweighs the interests of the data subject. If that is the case you could probably rely on the “legal basis” called legitimate interest and do not need consent or anything like that. Do: - Make a link to a privacy policy clearly accessible (eg on your websi…

> Sounds like you have a legitimate interest in logging IP addresses for security purposes European legislation demands this in fact. You have to keep the logs for a few months.

What European legislation is that?

Re: How GDPR Will Change The Way You Develop

#322

Post by Someone »

mamon wrote: post #242
Someone wrote: post #142

Earlier quoted context omitted.

Up to 4% or €20 million, whichever is greater .

Let me get it straight: if your global revenue is €10 million, you won't pay 4%(€400k) penalty, you'll pay €20 million, because it's greater of the two? It seems like this will be especially harmful to small companies.

Up to $20 million, depending on the severity of the infringement. I think the reason that floor is there is to handle cases where an organization doesn’t have much revenue, either through accounting shenanigans or because it is a non-profit (made up example: a free PDF to text converter that claims to be stateless but mines passwords and information to blackmail people with)

Re: How GDPR Will Change The Way You Develop

#324

Post by kuschku »

wuliwong wrote: post #278
dragonwriter wrote: post #6

Earlier quoted context omitted.

> I don't see what sort of authority they'd have to impose this on citizens of other countries. The authority they have is that delegated by the sovereign members of the EU, and the fact that the authority of a sovereign power is limited only by its own decisions and it's practical capabilities. (The US also imposes it's ruled extraterritorially when it feels like it.)

I agree but I think a similar question would be: how would this ever be enforced on a US based company/website where it had a EU visitor. I wrote this in another comment but I think outside of just blocking your site in the EU, they would need a further agreement (or I guess precedent) with the US government to actually enforce a penalty on the US company.

> but I think outside of just blocking your site in the EU, they would need a further agreement (or I guess precedent) with the US government to actually enforce a penalty on the US company.

The US has given lots of precedent cases for that. The usual approach the US takes is to force the banks the foreign site is operating with to seize all assets. The EU likely would do the same.

Re: How GDPR Will Change The Way You Develop

#325

Post by boredatwork »

_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

Sure I delete files that I don't like, but I don't typically rewrite all my old backups to purge them from there too.

Re: How GDPR Will Change The Way You Develop

#326

Post by Silhouette »

the_mitsuhiko wrote: post #319
Silhouette wrote: post #317

Earlier quoted context omitted.

The usefulness of ip addresses that old is very limited. Either the old IP addresses can be tied to a specific individual, which means they are potentially useful for legitimate security purposes such as helping to identify someone who has previously tried to scam you, or they can't, in which case what is the risk of keeping them around anyway?

> in which case what is the risk of keeping them around anyway? GDPR wants you to think differently about it: if you want to keep data, ensure that you actually need it. Do not treat data as an asset but as a liability.

We've been careful about what data we collect since day one, long before the GDPR was an issue. We're not doing anything shady with the data we do have, and we actively avoid questionable practices particularly around marketing, where we have ethical problems with being intrusive or compromising people's privacy regardless of any legal constraints. And yet having read the GDPR and much commentary about it, we're still concerned about the potential risks it introduces.

I think it's important to remember that GDPR itself doesn't want anything. GDPR is not a person, it's a set of legal regulations. What matters most about laws is what they actually say. Intent, as has been demonstrated countless times, is secondary.

Now, the people who wrote the GDPR might have wanted people to change their minds or think differently about privacy issues. However, that doesn't make the GDPR itself any less dangerous, and as I've argued elsewhere in this discussion, essentially those same authorities do have form already for being heavy-handed in other areas of EU law, and have caused real damage to plenty of businesses as a direct result.

Re: How GDPR Will Change The Way You Develop

#327

Post by pfarnsworth »

_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

This is very self-righteous. At my company, we respect our customer's data immensely. What happens is that some non-PCI data (but still PII like email addresses) data leak naturally into our log files, and I've been told his means that we need to clear our logs of that as well. We use this for debugging and data analytics, and email address is our primary username, so it's a huge undertaking for us to make this shift. I've been told this requires us to clear tape backups as well.

So it's not anything to do not respecting our customer data, it has everything to do with not seeing the unintended consequences.

Re: How GDPR Will Change The Way You Develop

#328

Post by havkom »

shkkmo wrote: post #293
havkom wrote: post #273

Earlier quoted context omitted.

Sounds like you have a legitimate interest in logging IP addresses for security purposes, it is an effective measure and that your legitimate interest on balance outweighs the interests of the data subject. If that is the case you could probably rely on the “legal basis” called legitimate interest and do not need consent or anything like that. Do: - Make a link to a privacy policy clearly accessible (eg on your websi…

> Sounds like you have a legitimate interest in logging IP addresses for security purposes, it is an effective measure and that your legitimate interest on balance outweighs the interests of the data subject. If that is the case you could probably rely on the “legal basis” called legitimate interest and do not need consent or anything like that. Assuming you are right, that answers part of my question. Yet, I would p…

See GDPR recital 24 (http://www.privacy-regulation.eu/en/recital-24-GDPR.htm):

[...] In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.

It appears like monitoring is closely related to profiling, defined in Article 4 as:

‘profiling' means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements

If you are trying to eg. predict preferences of data subjects by collecting the logs you are probably monitoring their behavior.

If you are doing this it should be pretty clear to you from the purposes you are collecting information for. Security purposes (such as preventing DDoS attacks) are probably not purposes of monitoring data subjects behavior or profiling.

Re: How GDPR Will Change The Way You Develop

#329

Post by [deleted] »

_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

[deleted]

Re: How GDPR Will Change The Way You Develop

#330

Post by jacquesm »

prewett wrote: post #314
jacquesm wrote: post #203

Earlier quoted context omitted.

Yes, but like with all this stuff: Your intent to comply with the law carries a lot more weight than actual compliance in edge cases.

That's not very comforting when your goal is avoid having unforeseen problems like being arrested on your European vacation due to violating a law that doesn't apply to your country but you still violated because it applies to all EU citizens regardless of their geographical location.

This has never happened as far as I can detect.

The only country that does this sort of thing is the US.

Post reply on HN