Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

351–360 of 710 posts

Re: How GDPR Will Change The Way You Develop

#351

Post by madez »

Silhouette wrote: post #310
jacquesm wrote: post #183

Earlier quoted context omitted.

The collective economic effect of that will be massive. Please do. And realize that you are ceding the single largest market to your competition.

The collective economic effect of that will be massive. Please do. And realize that you are ceding the single largest market to your competition. That doesn't necessarily follow. For example, EU but non-UK customers represent only a small fraction of the user base for one of my businesses. With hindsight, we would have done better to exclude those customers entirely, avoid spending time and money complying with ever-…

It might be that the EU willingly rejects certain business. Maybe, if you aren't GDPR compliant, you are not wanted by the EU.

Re: How GDPR Will Change The Way You Develop

#352

Post by chopin »

jacobr1 wrote: post #262
dkersten wrote: post #92

Earlier quoted context omitted.

> A lot of what you might call 'avoiding recklessness' is demonstrably bad for some people And? Making sure that the bridge will hold under the weight that its required to is demonstrably bad for my profits (if I were the construction company). That doesn't mean that we should loosen the regulations or whatever. We don't owe anyone the right to profits, regulations are meant to protect us and keep the playing field f…

It isn't obvious that is a case. Some companies make bad short-term decisions. But many take a longer-term view. Who would hire the construction company again that made the bad bridge? Or consider food and drug regulation. Countries with more lax requirements for proof of drug efficacy and large-scale trails don't have worse health outcomes. In fact, the countries with stricter policy regimes are often slower to have…

Construction companies circumvent this by going bankrupt all the time and setting up the next shell company. Big projects will often be done by a pool of companies. Which would you hold accountable then.

As well, some things are so bad that you don't want to punish after the fact.

Re: How GDPR Will Change The Way You Develop

#353

Post by Silhouette »

the_mitsuhiko wrote: post #339
Silhouette wrote: post #326

Earlier quoted context omitted.

We've been careful about what data we collect since day one, long before the GDPR was an issue. We're not doing anything shady with the data we do have, and we actively avoid questionable practices particularly around marketing, where we have ethical problems with being intrusive or compromising people's privacy regardless of any legal constraints. And yet having read the GDPR and much commentary about it, we're stil…

> We're not doing anything shady with the data we do have But you can never guarantee that someone else won't do. The biggest issue to user's privacy has traditionally been data breaches. So even if you don't want to do something shady, a data loss might still be highly problematic for users. I agree that IP addresses are unlikely to be the biggest concern here however.

The biggest issue to user's privacy has traditionally been data breaches.

I'm not convinced that's true, but let's assume it is for the sake of this discussion.

In that case, wouldn't a better approach be to mandate reasonable safeguards to protect against data breaches, and to penalise those who are seriously negligent in that respect?

Otherwise again I think you're aiming at the wrong target. Deleting stale data might have some marginal benefit in terms of privacy in the event of a breach, but the risk and consequences are surely much greater for the organisation that has only recent data but uses admin:admin for their root credentials. Meanwhile, the overheads of updating long-standing logging or backup systems where that older data might lurk to fully isolate everything could easily be among the highest practical costs for compliance, particularly for a lot of smaller organisations.

Re: How GDPR Will Change The Way You Develop

#354

Post by _o_ »

cortesoft wrote: post #340
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

> Every complaint about it shows that you don't respect others and you dont care about them. And this is the reason it became legislation. Ok, that is just silly. This sounds so much like the 'Why do you want privacy if you have nothing to hide?' arguments. It is very reasonable to both have a company that handle customer data responsibly AND have issues with the GDPR. Imagine if every time you walked down the street…

Oh, so in construction business, you don't need to prove your plans are statically safe, you just build a bridge and no one cares until it colapses? Don't worry, you are far safer here, no one will ask you anything until it collapses. But after it does, you will need a proof it didn't happen becoase of you. That you did all you could. Is there something wrong?

Re: How GDPR Will Change The Way You Develop

#355

Post by Silhouette »

madez wrote: post #351
Silhouette wrote: post #310

Earlier quoted context omitted.

The collective economic effect of that will be massive. Please do. And realize that you are ceding the single largest market to your competition. That doesn't necessarily follow. For example, EU but non-UK customers represent only a small fraction of the user base for one of my businesses. With hindsight, we would have done better to exclude those customers entirely, avoid spending time and money complying with ever-…

It might be that the EU willingly rejects certain business. Maybe, if you aren't GDPR compliant, you are not wanted by the EU.

That would be a plausible theory if the EU even realised that many thousands of these smaller businesses exist, but as we learned with the VAT mess, they literally didn't.

Re: How GDPR Will Change The Way You Develop

#356

Post by SquareWheel »

Jakob wrote: post #159
tekism wrote: post #148

This is a bit confusing, I have a website and I log IP addresses in my web server log and I use google analytics, what do I need to do?

The legal ramifications of storing IP addresses didn’t change with GDPR. You should already have them anonymized since they count as personal data: Google Analytics ( https://developers.google.com/analytics/devguides/collection... ): ga('set', 'anonymizeIp', true); Web server (here nginx, https://stackoverflow.com/a/45405406 ): map $remote_addr $remote_addr_anon { ~(?P \d+\.\d+\.\d+)\. $ip.0; ~(?P [^:]+:[^:]+): $ip::…

Are IP addresses actually considered "personal data"? They are how computers talk to each other. Anonymizing them doesn't make any sense to me.

Re: How GDPR Will Change The Way You Develop

#357

Post by chopin »

freeone3000 wrote: post #344
madez wrote: post #331

Earlier quoted context omitted.

You attest so legally binding. The legal system does not function on mathematical proofs. If it turns out you did not speak the truth, you can be fined, and maybe even jailed. That's how it works. Also, we are not talking about forgetting someone personally, but deleting their data. I assume that's clear.

So if you're willing to indefinitely lie, you just get out? This seems inefficient.

You better have not a breach in this case...

Re: How GDPR Will Change The Way You Develop

#358

Post by jopsen »

BjoernKW wrote: post #294
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

In principle, yes. The intention behind and the principles outlined by the GDPR are good. However, the devil's in the details, specifically in how these principles are supposed to be implemented. Some of these details are not quite clear yet. It's almost impossible to navigate these issues without getting at least some basic legal advice and investing a fair bit of time. Unfortunately, as often is the case with EU re…

OPs point is that if you act responsibly in good faith you'll probably avoid any issues, and likely be warned before they target you for maximum fines :)

Re: How GDPR Will Change The Way You Develop

#359

Post by shkkmo »

havkom wrote: post #328
shkkmo wrote: post #293

Earlier quoted context omitted.

> Sounds like you have a legitimate interest in logging IP addresses for security purposes, it is an effective measure and that your legitimate interest on balance outweighs the interests of the data subject. If that is the case you could probably rely on the “legal basis” called legitimate interest and do not need consent or anything like that. Assuming you are right, that answers part of my question. Yet, I would p…

See GDPR recital 24 ( http://www.privacy-regulation.eu/en/recital-24-GDPR.htm ): [...] In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to…

Thanks for the link.

> potential subsequent use of personal data processing techniques

Not a lawyer, but doesn't every access log with IPs and urls have the /potential/ to be parsed to aggregate a profile of site usage?

Even if you aren't actually doing or intending to do any profiling, the potential still exists.

You may well be correct about all this (and I suspect you are). I'm specifically trying to push back against the assertion: "I really don't think ... that anything in GDPR is hard to understand"

Re: How GDPR Will Change The Way You Develop

#360

Post by jopsen »

freeone3000 wrote: post #342
floatrock wrote: post #291

Earlier quoted context omitted.

> How many New York lawyers know the regulations of France? New York lawyers who do business in France do. If you're accepting ~dollars~ euros to place French ads on your pages targeting French customers, seems reasonable to know the relevant French regulations.

It's a bit more strict than that. If I have customers in France, this affects me, no matter how many, no matter if it's one dude in Florida who happens to also be French. The reach is absurd.

Is the reach more absurd than what US court claim?
Post reply on HN