421–430 of 710 posts
Earlier quoted context omitted.
And remember that GDPR applies to EU citizens outside the EU too, so you’d need to confirm with the user upfront that they aren’t an EU citizen before capturing the information.
It also applies to users that are not EU citizens, but are located in the EU.
Earlier quoted context omitted.
Guess what? The EU agrees with you. That's why the recommendation is that you strip PII from your logs for everybody. That way they can still be append only and you won't have to do any rewriting. > I, personally, believe that logs should be fundamentally append-only, and thus will not be doing business with EU subjects (since the GDPR requires that I delete records from my logs on demand). That statement does not ho…
> That's why the recommendation is that you strip PII from your logs for everybody. The problem is that IP addresses — a fundamental requirement for an acceptable network logging system — are considered PII. If this were about things like names, dates of birth &c. then I'd be in full agreement. But considering an IP address personal information which must be deleted on demand is IMNSHO insane. > That statement does n…
If you're an ISP that changes, in that case there is a retention requirement. But a regular business in the normal course of performing its expected activities has no business retaining IP addresses longer than necessary. If that to you is unacceptable because you want append-only logs that stretch back years then that's your choice.
But if I had to choose between cutting off roughly half of my turnover because I didn't want to comply with the law or complying with the law and slightly re-arranging my logging then I'd happily pick the latter.
So no need to delete on demand, simply don't store them longer than you feel you need to in order to meet your business goals. 30 days or so should do it. Six months or longer would require a detailed explanation.
And most importantly: disclose what you do. That way your customers can make informed decisions and you won't look bad in the eyes of the law if they decide to decide on whether or not you meant to act in good faith or if you took to interpreting things in the way that suits you best.
I will show you another case, company that isnt "bitching" over laws that are good for all humans not just EU and does the right thing, you know backblaze, right? "The changes that are being made by companies such as Backblaze to comply with GDPR will almost certainly apply to customers from all countries. And that’s a good thing. The protections afforded to EU citizens by GDPR are something all users of our service…
So nice to see progress in privacy but please someone explains how GDPR will help EU startups! GDPR is inevitably going to hinder any new company forced to abide by it. So the next Uber/Wechat will first flourish in US/China/Russia and then come to the EU, not the other way around. Entrepreneurs / investors also want their time & money to be used to build value first rather than solve yet another accidental complexit…
Why does everything have to help startups?
"GDPR is inevitably going to hinder any new company forced to abide by it."
I disagree. You simply shouldn't be collecting that data in most instances anyway. And if you truly do need it, you should have been asking permission before. Somehow we got it into our heads that it was perfectly acceptable to just take things without asking. I'm fairly certain I learned not to do this in Kindergarten.
"Entrepreneurs / investors also want their time & money to be used to build value first rather than solve yet another accidental complexity that is irrelevant until your revenue model is proven."
The GDPR has no impact on this, unless the only way you can create "value" is by disrespecting your users. You can still build value the old fashioned way, by providing something of use to your users.
Earlier quoted context omitted.
I wouldn't say marginal, but it is a lot easier to implement GDPR if you do it up-front, from day one. If you start off with a policy of just not collecting or storing information unless you've made a conscious decision that you really do need it, that's a huge start. From there, you your main obligations are to ensure that any personal data you do collect can be deleted at a reasonably granular level, and that you d…
Besides implementation costs, you're simply leaving money on the table. You can make lots of profit by selling user's tertiary preference data, often enough to buoy for a few months. It's ridiculous that some Europeans are forcing us to give up money for some fee-fees.
Earlier quoted context omitted.
https://en.wikipedia.org/wiki/Data_Retention_Directive Apparently no longer in effect (overthrown)
Yes, it was. Also, in case it wasn't clear, that rule only applied to communications services, not your average website.
Same thing for IRC or xmpp servers
It was actually quite broad.
Earlier quoted context omitted.
That would be a plausible theory if the EU even realised that many thousands of these smaller businesses exist, but as we learned with the VAT mess, they literally didn't.
Yes, the VAT mess definitely does not deserve the beauty prize but with the MOSS it is actually manageable. I've done it for a couple of years and as long as your IPSP cooperates it shouldn't be more than 15 minutes of work per quarter.
That might be true if you're lucky enough to have a single third-party payment service that collects all of your revenues including administering the VAT parts for you. Unfortunately, there are many reasons why that might not be the case or even possible. Even if you do use one of those services, it can't magically cope with all the edge cases any more than you or I can, and of course they tend to take an extra cut out of your revenue.
For everyone who needs to manage their taxes a bit closer to home, it takes longer than your suggested time just to check the rates regularly in case some member state decided to increase them with about a week's notice again. There's not really any good answer to VAT MOSS, there are just more inconvenient and/or expensive and slightly less inconvenient and/or expensive.
Earlier quoted context omitted.
So a US company providing services to a US naturalized citizen in the US that is also a dual citizen of a country in the EU makes the company liable to follow these regulations? That makes no sense. This sounds unenforceable.
Yep. It is worse that it can be a EU resident (non-citizen) visiting the the USA using a USA only service and the law as currently written still applies. Good luck. The next fun job is working out how to remove the data from all your backups when you get a removal request. I have taken the approach that I will comply with the general intent of the GDPR (which I did long before it existed), but not try to apply the ri…
You're going to have to provide proof to back up that statement.
Earlier quoted context omitted.
I would (maybe naively) think that the cost of GDPR compliance would be small if your company is already safeguarding user data and respecting user privacy. If a company’s cost is “staggering“ doesn’t that say a lot about its existing privacy practices?
You're completely wrong. Just for starters, you will need to decide which data you have to process and which is optional. Some data will need to be kept for compliance purposes. How much anonymization will be applied. What data is in every single internal db in your org? Do you even know of all the internal dbs? Each data will have to be tagged with the collection basis, either legitimate interest or consent. The GDP…
Earlier quoted context omitted.
my company seems to be going on a encrypt everything spree. I am not sure how GDPR requires encryption. Can you be GDPR complaint ( in theory) with zero encryption?
Of course—if you don't store personal data (trivially). In fact, encryption (security) is mostly orthogonal to how you track and handle personal and sensitive data (privacy protection). You could encrypt everything and still be wildly GDPR non-compliant, if the encrypted information you're storing lacks clear purpose and explicit consent.
We store data encrypted because it
A) leaves no room for misunderstanding with different regulators or their respective auditors, and
B) provides a computationally infeasible barrier against accidental personal information disclosure even if the storage system was improperly decommissioned
Point B in particular can be explained to auditors without problems. They understand both the intent and the technical measures put in place. But how we store data is only tangentially relevant to how we handle data. Let alone what we need to collect in the first place.
(The KYC/AML/SOW requirements in gambling are quite demanding; they impose significant data collection and retention needs.)
Earlier quoted context omitted.
If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…
Only without consent from the user. Previously it was an ethically grey area to be logging IP addresses anyway. If you are preventing malicious use, then that is allowed as long as you are not using that data outside of the bounds of the user's consent. If, however, a company is storing IP addresses to identify users without their consent and are found to be specifically targeting them without their consent, then tha…
One other interesting thing to keep in mind is that GDPR does not exempt public, government organisations. It will be interesting to see what happens with that, if anything.