Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

431–440 of 710 posts

Re: How GDPR Will Change The Way You Develop

#431

Post by s73v3r_ »

SquareWheel wrote: post #356
Jakob wrote: post #159

Earlier quoted context omitted.

The legal ramifications of storing IP addresses didn’t change with GDPR. You should already have them anonymized since they count as personal data: Google Analytics ( https://developers.google.com/analytics/devguides/collection... ): ga('set', 'anonymizeIp', true); Web server (here nginx, https://stackoverflow.com/a/45405406 ): map $remote_addr $remote_addr_anon { ~(?P \d+\.\d+\.\d+)\. $ip.0; ~(?P [^:]+:[^:]+): $ip::…

Are IP addresses actually considered "personal data"? They are how computers talk to each other. Anonymizing them doesn't make any sense to me.

They're anonymized for things like logs. When the computers aren't talking to each other, the reasons to know the exact IP address are rather minimized. If you feel you have a real need to do so, then you just need to inform your users what you're doing.

Re: How GDPR Will Change The Way You Develop

#433

Post by jcranmer »

_o_ wrote: post #354
cortesoft wrote: post #340

Earlier quoted context omitted.

> Every complaint about it shows that you don't respect others and you dont care about them. And this is the reason it became legislation. Ok, that is just silly. This sounds so much like the 'Why do you want privacy if you have nothing to hide?' arguments. It is very reasonable to both have a company that handle customer data responsibly AND have issues with the GDPR. Imagine if every time you walked down the street…

Oh, so in construction business, you don't need to prove your plans are statically safe, you just build a bridge and no one cares until it colapses? Don't worry, you are far safer here, no one will ask you anything until it collapses. But after it does, you will need a proof it didn't happen becoase of you. That you did all you could. Is there something wrong?

Actually, you don't need to do that proof. The construction plans need to be signed off on by certified (government-accredited but still fully private practice, not even necessarily a different company) engineer. But the government doesn't look at those plans and check your work.

What happens instead is that you need to be inspected by the government before it's allowed to be occupied or put into use. And if it ever should happen that it does collapse, then the structural engineer who signs off on the plans faces criminal liability particularly in extreme cases (Kansas City Hyatt is the most memorable experience).

Re: How GDPR Will Change The Way You Develop

#434

Post by grabeh »

oliwarner wrote: post #405
deif wrote: post #387

Earlier quoted context omitted.

Only without consent from the user. Previously it was an ethically grey area to be logging IP addresses anyway. If you are preventing malicious use, then that is allowed as long as you are not using that data outside of the bounds of the user's consent. If, however, a company is storing IP addresses to identify users without their consent and are found to be specifically targeting them without their consent, then tha…

You appear to be suggesting that "intent" defines the shape of law here, but I really don't think that's the case. By my reading, information becomes personal —and therefore subject to GDPR— when it can be used to identify people. If you've got login timestamps, IP addresses and user records, for legitimate reasons, any other logging that includes IPs is tainted because it takes anybody with that data two minutes to…

Your intention and how you actually use the data are critical to an entity's compliance with the GDPR. If I am only using IP addresses for legitimate purposes of monitoring/protecting my network then that is very different to using IP addresses to assist in my tracking of users for advertising purposes for example.

The classification of data of personal data is likely beyond dispute but you are then under obligations on how you actually make use of that data.

Entities should have in place relevant protective measures to ensure that if you have only collected data for a limited purpose, it should not be used for purposes beyond that.

Re: How GDPR Will Change The Way You Develop

#435

Post by sacheendra »

freeone3000 wrote: post #420
SahAssar wrote: post #384

Earlier quoted context omitted.

It's not given freely unless consent is given, which in most cases it isn't.

You're referring to express consent. However, the user is granting implied consent - they're the ones visiting our website, they're the ones requesting our images and executing our javascript, and they're the ones filling out our forms. We're not forcing them to do any of these things.

Extreme example: you are standing in the way of my car.

Re: How GDPR Will Change The Way You Develop

#436

Post by TheCoelacanth »

oliwarner wrote: post #405
deif wrote: post #387

Earlier quoted context omitted.

Only without consent from the user. Previously it was an ethically grey area to be logging IP addresses anyway. If you are preventing malicious use, then that is allowed as long as you are not using that data outside of the bounds of the user's consent. If, however, a company is storing IP addresses to identify users without their consent and are found to be specifically targeting them without their consent, then tha…

You appear to be suggesting that "intent" defines the shape of law here, but I really don't think that's the case. By my reading, information becomes personal —and therefore subject to GDPR— when it can be used to identify people. If you've got login timestamps, IP addresses and user records, for legitimate reasons, any other logging that includes IPs is tainted because it takes anybody with that data two minutes to…

Worst case usage determines what information is subject to GDPR, but actual business use-case is what determines what data you are allowed to collect.

IP addresses are subject to GDPR, but that just means that you have to have either a legitimate business need for keeping them or to have the user's consent to keep them and you need to disclose to the user that you are keeping them and for how long.

You probably do have a legitimate need to keep IP address logs for some period of time to allow troubleshooting and possibly for a longer period of time to allow for fraud detection. As long as you are disclosing to the user that you are collecting that information and are abiding by the retention period that you are disclosing to users, then you will be allowed to collect logs of IP addresses.

Re: How GDPR Will Change The Way You Develop

#437

Post by bkor »

Silhouette wrote: post #326
the_mitsuhiko wrote: post #319

Earlier quoted context omitted.

> in which case what is the risk of keeping them around anyway? GDPR wants you to think differently about it: if you want to keep data, ensure that you actually need it. Do not treat data as an asset but as a liability.

We've been careful about what data we collect since day one, long before the GDPR was an issue. We're not doing anything shady with the data we do have, and we actively avoid questionable practices particularly around marketing, where we have ethical problems with being intrusive or compromising people's privacy regardless of any legal constraints. And yet having read the GDPR and much commentary about it, we're stil…

> What matters most about laws is what they actually say. Intent, as has been demonstrated countless times, is secondary.

That's different per legal system. In some the text is more relevant. In various others the intend behind the law is very much relevant. I highly suggest to not follow your advice!!

Re: How GDPR Will Change The Way You Develop

#438

Post by jamiepenney »

blibble wrote: post #409
allendoerfer wrote: post #218

Earlier quoted context omitted.

If you have ever opened a bank account in Europe, you have come across a checkbox, where you have to specify that you are not an American citizen. The US pushes their regulations on companies outside their jurisdiction, too.

the result for banking is that European banks refuse to let Americans open bank accounts depending on the levels enforcement I suspect the same will be true of many popular online services for GDPR: you check the "EU citizen" checkbox and you're banned

It's not just Europe, I've heard of banks here in New Zealand doing the same. The cost of compliance for them was more than the customer was worth.

Re: How GDPR Will Change The Way You Develop

#439

Post by ChickeNES »

Tomte wrote: post #13
mbesto wrote: post #12

Earlier quoted context omitted.

> Don't like it? Don't do business in/with the EU. Then you're free to ignore their frameworks, rules and regulations. So, should you just start blocking IPs from EU-based citizens?

Yes, if you're not willing to comply, that's exactly what you should do. OTOH it just shows your remaining customers that you're willing to do shitty things to them, as long as America is trailing in privacy legislation.

Given that the average small-to-medium sized business in the US is unlikely to do any business outside of the US, I think we'll be fine. :)

Re: How GDPR Will Change The Way You Develop

#440

Post by grabeh »

peterhunt wrote: post #415
confounded wrote: post #408

Earlier quoted context omitted.

Of all the wonderful things that we're capable of as technologists, I think we can figure out a way to strip raw-IP addresses from log-files once we don't need them any more. I'll need to figure out to handle this on the data I'm responsible for at the moment. It's boring and it doesn't help the product, but it's not supposed to. In idlewords' terms, I feel like I'm finally purging toxic waste: http://idlewords.com/t…

It's left ambiguous, but it's likely that any aggregate computed from personal data may also be considered personal data (i.e. how many unique IPs you've seen).

If you are looking to derive aggregated insights from data then you need to be clear on your anonymisation processes and understand whether or not you any derived dataset is capable of identifying individuals whether in isolation or through reasonable means. To me if you are taking a tally of the volume of unique IPs alone that would never be sufficient to identify a person but maybe I don't have the full context?
Post reply on HN