391–400 of 710 posts
Earlier quoted context omitted.
What do you mean one-offs? Pretty much every company with an engineer on staff is collecting as much data as they can with zero regard to the user's expectations of privacy. The regulation exists to stop an epidemic, not to act on a few one-offs.
If the user wanted privacy, they wouldn't be giving data to our services. It's a bit ridiculous to punish us for keeping what users freely give us.
Earlier quoted context omitted.
Not all organisations will need to be compliant with GDPR. By that I mean, if your organisation only do marketing in, for example, the US and Canada, only accepts USD/CAD and they are no legitimate appearance that you do/want to do business in Europe, you are not required to be GDPR compliant, even if an european customer goes on your website and purchases a product/service. If your website accepts Euros, has multipl…
Not quite. GDPR applies to you, a US entity, if you do business with an EU citizen trading in dollars living in the US.
I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…
If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…
I don't see this as a bad thing. For far too long, we've not cared at all about user data and privacy.
I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…
If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…
Can you expand on that?
I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…
In principle, yes. The intention behind and the principles outlined by the GDPR are good. However, the devil's in the details, specifically in how these principles are supposed to be implemented. Some of these details are not quite clear yet. It's almost impossible to navigate these issues without getting at least some basic legal advice and investing a fair bit of time. Unfortunately, as often is the case with EU re…
At least for SaaS it's pretty clear-cut. For freelancers, contractors and consultants the situation is way more confused.
AFAICT I need a data processing agreement with every client, even if I only log into their servers once a month to update WordPress and check their logs, because I am now deemed to be processing personal information.
These details need talking about, and I've yet to see industry bodies doing so.
Earlier quoted context omitted.
> The only thing that GDPR wants from you is to handle others data with same RESPECT as you handle yours. Plus a minimum of 20M€ fine in case they don't think your "common sense" is good enough. For a one man shop that is not working under the legal protection an LLC or equivalent provides, this can be deadly!
Good luck to EU trying to enforce it against JoeSchmoeLLC from PA
I'm genuinely curious.
What if one exclusively collects telemetry IDs (unique per application), with which usage stats are sent. To what extent is this personal data? On who does the burden of proof for 'being able to identify a natural person' fall?
Earlier quoted context omitted.
> How many New York lawyers know the regulations of France? New York lawyers who do business in France do. If you're accepting ~dollars~ euros to place French ads on your pages targeting French customers, seems reasonable to know the relevant French regulations.
It's a bit more strict than that. If I have customers in France, this affects me, no matter how many, no matter if it's one dude in Florida who happens to also be French. The reach is absurd.
That's not true.
Earlier quoted context omitted.
Backups of various kinds are in a similar position. The reason GDPR is a bad law is that its real effect is so ambiguous. Read literally, it imposes significant burdens on data controllers, particularly because of things like the right to erasure. Those burdens may be disproportionate particularly for smaller organisations that only handle a limited amount of data in the first place. The alternative, which I've notic…
> The alternative, which I've noticed GDPR's defenders tend to favour as understanding has grown, is something to the effect that regulators won't actually enforce the rules in a draconian fashion and will only go after serious infringement in practice. But that's a dangerous position to adopt in legal matters, because ultimately it means if you go too far in complying when others don't then you are at a disadvantage…
As a freelancer/consultant, I wish there was official guidance on when we are a data processor for our clients, and when we're not. Which employment situations make a difference (if any do).
It's not just our industry; anyone who's self-employed is in the same position if they see any personal data from their clients' businesses.
Earlier quoted context omitted.
Quit storing ips unless you are legally obliged to do so (audit trial, mandated surveillance, like that other EU directive...). Generally security audit purposes will likely let you keep logs for "reasonable time" (weeks). Beyond that, why store them?
You know for things like being able to do analysis. For example, last week I wanted to know where to locate our next local server and so needed to know where the usage growth was coming from. I happen to noticed that the usage over the last few weeks was quite different to the historical data. If I only had 2 weeks of data I would have made our service worse for our customers.
https://ico.org.uk/for-organisations/guide-to-the-general-da...