Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

371–380 of 710 posts

Re: How GDPR Will Change The Way You Develop

#371

Post by tjohns »

magic-chicken wrote: post #303
mfoy_ wrote: post #268

Earlier quoted context omitted.

Software development needs some sort of Iron Ring ( https://en.wikipedia.org/wiki/Iron_Ring ) to remind us to be humble.

As you can see in the article, it already exists in Canada. Some engineering schools like École de technologie supérieure (ÉTS) offers a 4 year Software Engineering program that enable you to become a member of the Ordre des ingénieurs du Québec. It's a self-regulatory body that governs Quebec's professional engineers. There is a ceremony where they give you an iron ring, mostly to remind you to be humble and to alwa…

Software Engineers can theoretically become PEs, but it's very recent. Practically speaking, it's difficult right now.

NCEES recently created a PE exam for software engineers in 2013, in collaboration with IEEE and IEEE-CS. However, it's up to state engineering boards whether or not to administer the exam. California does NOT yet the administer the Software Engineering PE exam.

Re: How GDPR Will Change The Way You Develop

#372

Post by danieltillett »

jacquesm wrote: post #333
danieltillett wrote: post #289

Earlier quoted context omitted.

The history of laws suggest that to rely on non-enforcement of a law is not wise. The GDPR is a good idea that has been written badly.

I've read most of it and I disagree that it has been written badly. As laws come it is accessible, has some pretty clearly defined goals and it is for the most part something you could easily comply with.

Yes the first 90% is reasonable, it is the last 10% that is a nightmare.

I comply with the general intent (always have), but the law as currently written is near impossible to comply with. My feeling is this will be realised by the EU and a more rational set of guidelines will emerge.

Re: How GDPR Will Change The Way You Develop

#373

Post by timothycaldwell »

_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

It's not easy at all to understand. I'm a developer and have spent 40+ hours in meetings with lawyers because the interpretation of the law isn't easy at all. There is a whole team of lawyers looking into this. 40% of my team is working on GDPR implementation.

Just figuring out if users are allowed to use my service is hard. There is a different age of consent in different EU countries, and apparently some haven't even decided on an age of consent yet. What happens if I am in a country that has age of consent of 14, but then they vacation and use the app in a country that has age of consent of 16? We are required to offboard users if they aren't of the age of consent. What is the support flow for letting those users back into the app if they accidentally said they were born in 2016? What if the company owns multiple apps, and the user users the same OAUTH account to login into each app? If in one app they enter their birthdate as underage, now I have requirements to delete the user from all apps.

My default mindset is to avoid collecting any data that I don't need so my app stores almost no info about where users are located. But EU regulations have told me I need delete all EU user accounts who don't agree to the new terms in X days after May 25th. Does this mean I have to go delete all user accounts who haven't logged in since a certain date since I can't differentiate EU vs non-EU? Those users aren't going to be happy. Some users log in through email so we are able to email them, but other users use phone number login where we can't contact them. We are potentially deleting huge numbers of accounts.

We host our help center site using a third party service. Does that third party service happen to store IP address in the logs? Now I have to care about that as well.

Lets say my company built an Apple TV or Xbox 360 app two years ago. There is a small group of dedicated users but it doesn't make us any money and we haven't updated it. Now we have to go build an interstital making them agree to new terms before they can use the app. None of the developers who built the app are still around, I guess we need to just delete the app now.

It turns out that there were a bunch of Russian accounts who tried to manipulate the election and we only found out months later. Good thing this happened before GDPR. After GDPR all they have to do is claim they are in the EU, and then delete their account, and there data won't be completely unaccessible 30 days later.

I am a big advocate for privacy and a member of the EFF for a decade. Maybe my company just already has good privacy practices, these regulations are making development much slower, without providing additional privacy benefits. If you want to see some change, I would think massive fines for data breaches would be the way to go.

Re: How GDPR Will Change The Way You Develop

#374

Post by BjoernKW »

jopsen wrote: post #358
BjoernKW wrote: post #294

Earlier quoted context omitted.

In principle, yes. The intention behind and the principles outlined by the GDPR are good. However, the devil's in the details, specifically in how these principles are supposed to be implemented. Some of these details are not quite clear yet. It's almost impossible to navigate these issues without getting at least some basic legal advice and investing a fair bit of time. Unfortunately, as often is the case with EU re…

OPs point is that if you act responsibly in good faith you'll probably avoid any issues, and likely be warned before they target you for maximum fines :)

I hope so. Unfortunately, that won't necessarily be the case.

Small businesses have been specifically and routinely targeted by dubious law firms for not complying with certain regulations like legal notice requirements or disclaimers on websites.

The EU and local as well as member state authorities also often are oblivious to problems smaller companies might have.

Re: How GDPR Will Change The Way You Develop

#375

Post by wglb »

freeone3000 wrote: post #344
madez wrote: post #331

Earlier quoted context omitted.

You attest so legally binding. The legal system does not function on mathematical proofs. If it turns out you did not speak the truth, you can be fined, and maybe even jailed. That's how it works. Also, we are not talking about forgetting someone personally, but deleting their data. I assume that's clear.

So if you're willing to indefinitely lie, you just get out? This seems inefficient.

Depending on your industry, or your global customer requirements, you might have to have an audit that shows that you have such procedures in place. If you are small, don't get breached, and attest that you have done the deletion.

Re: How GDPR Will Change The Way You Develop

#376

Post by avar »

woolvalley wrote: post #165

Will the GDPR eventually make bitcoin or other immutable public distributed databases illegal in the EU? Do you have default judgements on thousands john doe node operators around the world? Will EU ISPs be required to censor any kind of blockchain node eventually when someone has a GDPR complaint for that network? Will we arrest teenagers for running ethereum miners on their gaming computers after all of this?

The GDPR gives you this out for that[1]:

    "the personal data are no longer necessary in relation to the
    purposes for which they were collected or otherwise processed"
The data you submitted to a blockchain database is inherently needed forever for it to function, so I think there's zero chance that this will be interpreted as to make Blockchains illegal.

What might happen is that this in combination with the "Conditions for consent"[1] will force people who ship blockchain software to have prominent warnings saying that you're about to ship data that'll be public forever.

1. https://gdpr-info.eu/art-17-gdpr/

2. https://gdpr-info.eu/art-7-gdpr/

Re: How GDPR Will Change The Way You Develop

#377

Post by wglb »

njl wrote: post #332
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

I don't think it is quite that bad. It is certainly less than going full ISO 27001, and less than a major breach.

Re: How GDPR Will Change The Way You Develop

#378

Post by mywittyname »

magic-chicken wrote: post #303
mfoy_ wrote: post #268

Earlier quoted context omitted.

Software development needs some sort of Iron Ring ( https://en.wikipedia.org/wiki/Iron_Ring ) to remind us to be humble.

As you can see in the article, it already exists in Canada. Some engineering schools like École de technologie supérieure (ÉTS) offers a 4 year Software Engineering program that enable you to become a member of the Ordre des ingénieurs du Québec. It's a self-regulatory body that governs Quebec's professional engineers. There is a ceremony where they give you an iron ring, mostly to remind you to be humble and to alwa…

> Can software engineers become P.E. in the U.S ?

Yes. Most CS/CE/SE programs in the USA are part of the school's engineering college and are ABET accredited, which is the governing body of professional engineering in the USA. To become an PE in the USA, one needs to first graduate from an ABET program, take the Fundamentals of Engineering exam, work for at least four years in their field of study, then they make take the PE exam.

Now, almost nobody does this right now. Only 32 people took the Oct 2017 exams in Software, and Computer & Electrical Engineering. For reference, about 4000 people took the various Civil Engineering exams.

There's really no incentive to become a licensed engineer the USA. I've never seen a job posting mention one at all. So I think the exercise would be purely academic (though, I'd love to hear from someone who has a license and uses it).

Re: How GDPR Will Change The Way You Develop

#379

Post by danieltillett »

e12e wrote: post #305
danieltillett wrote: post #301

Earlier quoted context omitted.

You know for things like being able to do analysis. For example, last week I wanted to know where to locate our next local server and so needed to know where the usage growth was coming from. I happen to noticed that the usage over the last few weeks was quite different to the historical data. If I only had 2 weeks of data I would have made our service worse for our customers.

You might be a good candidate for storing aggregated (anonymized) data. [ed: incidentally you're kinda sorta in the area GDPR wants to combat: "it'd be nice to know what x want to buy next, and where - for logistical and marketing purposes. Why can't we just store a full profile of everything x does, where and when?]

The problem becomes if you make a mistake or aggregate in the wrong way you end up losing the ability to do later analysis. If I had thrown out my logs I would have provided my customers with a worse experience.

I am supportive of the intent of the GDPR and we have always gone out of our way to minimise the data we collect, but as currently written the law has a whole lot of very negative downstream effects.

Really the law seems to have been written to catch a few bad players and has ended up netting everyone in the world.

Re: How GDPR Will Change The Way You Develop

#380

Post by notyourday »

77pt77 wrote: post #287
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

> The only thing that GDPR wants from you is to handle others data with same RESPECT as you handle yours. Plus a minimum of 20M€ fine in case they don't think your "common sense" is good enough. For a one man shop that is not working under the legal protection an LLC or equivalent provides, this can be deadly!

Good luck to EU trying to enforce it against JoeSchmoeLLC from PA
Post reply on HN