Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

451–460 of 710 posts

Re: How GDPR Will Change The Way You Develop

#451

Post by TheCoelacanth »

danieltillett wrote: post #277
77pt77 wrote: post #269

How would this be enforceable for companies that have their headquarters only in the USA even if they have european users? Will this also apply for citizens of a EU country living outside the EU?

The EU is going to send over its army and force you to comply. My understanding is the GDPR applies to residents of the EU, not just citizens, and it also applies when they are outside the EU. In practice this means it is impossible to determine if it applies unless you gather far more information than you really need from your users - “sorry we have to invade your privacy to protect your privacy”.

It does not apply to people outside of the EU. Article 3[1] is quite clear about that it applies to people in the EU.

[1] https://gdpr-info.eu/art-3-gdpr/

Re: How GDPR Will Change The Way You Develop

#452

Post by bskap »

mywittyname wrote: post #378
magic-chicken wrote: post #303

Earlier quoted context omitted.

As you can see in the article, it already exists in Canada. Some engineering schools like École de technologie supérieure (ÉTS) offers a 4 year Software Engineering program that enable you to become a member of the Ordre des ingénieurs du Québec. It's a self-regulatory body that governs Quebec's professional engineers. There is a ceremony where they give you an iron ring, mostly to remind you to be humble and to alwa…

> Can software engineers become P.E. in the U.S ? Yes. Most CS/CE/SE programs in the USA are part of the school's engineering college and are ABET accredited, which is the governing body of professional engineering in the USA. To become an PE in the USA, one needs to first graduate from an ABET program, take the Fundamentals of Engineering exam, work for at least four years in their field of study, then they make tak…

Many CS programs are accredited by ABET, but they're covered by the Computing Accreditation Commission which doesn't qualify graduates to sit for the FE exam. And many top CS programs, including CMU and Stanford, aren't ABET accredited at all.

Nationwide, there's only 27 Software Engineering programs accredited by ABET. So graduates of those programs could sit for it but until graduates from top programs qualify, no one is going to require it.

Re: How GDPR Will Change The Way You Develop

#453

Post by p1necone »

isostatic wrote: post #447
cortesoft wrote: post #348

Earlier quoted context omitted.

Right, but the point is that you KNOW the country your bridge or tunnel is going to be used in, because you build it there. If I build a web app and deploy it on a server in California, it can immediately be used by people in almost any country in the world. Is it my responsibility to follow the censorship rules from China on my webapp in California? Is it my responsibility to know all the regulations on web apps fro…

If you don't do any business in the EU I'm not sure how the new law would apply.

So we should have a whitelist of countries we decide we are "doing business" in and block all other traffic globally?

Re: How GDPR Will Change The Way You Develop

#454

Post by TheCoelacanth »

freeone3000 wrote: post #368
mathie25 wrote: post #208

Earlier quoted context omitted.

"[...]Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibilit…

So what, English and French? Those are the two major languages of the union, but are also the two official languages of canada. Seems like you can easily get hamstrung on a technicality.

Those are factors, not hard and fast rules. If you are a Canadian company and you provide services in English and French, that alone wouldn't indicate that you are targeting EU users. There would need to be other factors indicating your intent to target EU users.

Re: How GDPR Will Change The Way You Develop

#455

Post by jcranmer »

_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

Sentiments like yours are the reason why GDPR is problematic. One of the things that legal experts quickly realize is that there are as many definitions of common sense as there are people in the room. As this thread shows in great detail, there is wide variation in understanding what it's meant to cover. The real problem is that the regulatory agencies, in response to this confusion, are essentially refusing to issue any clarifications in guidelines. The GDPR is at risk of becoming a law that says "You have to follow my rules, but I'm not going to tell you what they are," which is counterproductive to its own ends.

Re: How GDPR Will Change The Way You Develop

#456

Post by jakeogh »

wila wrote: post #406
notyourday wrote: post #380

Earlier quoted context omitted.

Good luck to EU trying to enforce it against JoeSchmoeLLC from PA

Not really a problem for EU if JoeSchmoeLLC is really treating this as not a law for them. US and pretty much every country in the EU have excellent extradition agreements. [0] [0] https://en.wikipedia.org/wiki/List_of_United_States_extradit...

Extradition for what? Violating EU law? I do that almost every second of every day. PA is not subject to EU law whatsoever.

Re: How GDPR Will Change The Way You Develop

#457

Post by hanrelan »

wastedhours wrote: post #61
_o_ wrote: post #37

Earlier quoted context omitted.

Very simplified, you can not use or give personal data to someone else without optin given consent (where you must state in non legal, non tech speech for what they will be used) and same goes for enabling others (ad networks, google,..) to get those data. Or you are breaking the law. Further, user must be allowed to view, change or delete those data and remove consent to use them in whole chain (your site, ad networ…

And also, there's also the slightly grey-area requirement that (if you're using it as your legal basis) consent should not be required in order to utilise your product, merely to utilise the feature set that requires the data. If you need everything, then you'll need to use "fulfilment of a contract" as the basis, and in that case, you probably need to make your ToS pretty tight too.

Question about the freely given consent - Say I'm a car company like Tesla and I collect telemetry from the car to train a self-driving car model. I ask the user for consent to collect this data to train the self-driving model.

For the users that refuse this consent, can I prevent them from accessing the self-driving feature of the car? If not, how would the company deal with the free-rider problem - nobody opts in because they want their privacy but they also want the feature?

Re: How GDPR Will Change The Way You Develop

#458

Post by kasey_junk »

chopin wrote: post #346
sbov wrote: post #177

Earlier quoted context omitted.

The comparison is disingenuous. The internet makes anything you build automatically global. You're blasting software engineers for not knowing worldwide regulations. How many New York lawyers know the regulations of France? How many local UK construction companies know the building codes of Japan? None. Knowing all regulations in the world for any given industry would be a full time job. The people you seem to be imp…

Don't slurp up data worldwide, then. If you don't do that, you're fine. If you do business you'd better know the law of your target audience, isn't it?

How does one avoid people making web requests originating in Europe from reaching your servers else where?

The obvious answer is by geographically identifying them by IP. Which GDPR makes pains to point out is personal data.

Re: How GDPR Will Change The Way You Develop

#459

Post by timothycaldwell »

fmblwntr wrote: post #411
timothycaldwell wrote: post #373

Earlier quoted context omitted.

It's not easy at all to understand. I'm a developer and have spent 40+ hours in meetings with lawyers because the interpretation of the law isn't easy at all. There is a whole team of lawyers looking into this. 40% of my team is working on GDPR implementation. Just figuring out if users are allowed to use my service is hard. There is a different age of consent in different EU countries, and apparently some haven't ev…

To be honest, I can't imagine a situation in which I would need a new law in order to have follow age of consent laws. Like, you are really complaining that if a user says they're underage, you have to treat them as such? Or that if you operate in multiple countries you have to look up the relevant laws? All of this seems like a basic requirement, and I'm honestly shocked that it was never an issue before.

We already comply with age of consent laws. GDPR changes the law and adds lots of edge cases around users transitioning from valid user -> invalid user as I described above.

I'm not complaining. I'm just saying it's not basic or simple. I often see the attitude that, "Oh that should be easy" when someone hasn't implemented something.

This essay covers it well: Reality has a surprising amount of detail https://news.ycombinator.com/item?id=16184255

It reminds me of people who have taken the programming 101 class telling me, creating Amazon is easy, its just a webpage. Or I could completely run Twitter off of just 4 machines.

Re: How GDPR Will Change The Way You Develop

#460

Post by tensor »

_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

I certainly don't create a long living policy document for my own personal data though. There seems to be additional paper and process requirements above and beyond the technical aspects, at least according to the article.
Post reply on HN