Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

481–490 of 710 posts

Re: How GDPR Will Change The Way You Develop

#481

Post by danieltillett »

TheCoelacanth wrote: post #451
danieltillett wrote: post #277

Earlier quoted context omitted.

The EU is going to send over its army and force you to comply. My understanding is the GDPR applies to residents of the EU, not just citizens, and it also applies when they are outside the EU. In practice this means it is impossible to determine if it applies unless you gather far more information than you really need from your users - “sorry we have to invade your privacy to protect your privacy”.

It does not apply to people outside of the EU. Article 3[1] is quite clear about that it applies to people in the EU. [1] https://gdpr-info.eu/art-3-gdpr/

It says it applies to the “...processing of personal data of data subjects who are in the Union…”.

If someone in the EU (say a visitor) asks to have their data removed that was collected while they were outside the EU, then the controller or processor is supposed to comply.

How is any business supposed to know if a user while they were in the USA of a service located in the USA will not later travel to the EU and make a data removal request while there? If the request comes from someone located in the EU then the regulations apply.

The practical result is you can’t just geo ban people from the EU and this is before we get to the problem of proxies.

Re: How GDPR Will Change The Way You Develop

#482

Post by solipsism »

envy2 wrote: post #479
njl wrote: post #332

Earlier quoted context omitted.

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

> This is just going to be another way for EU regulators to smack around Google and Facebook. Actually, it's more like a giant gift to Google and Facebook: GDPR borders on regulatory capture, with only the giants really having the resources to comply properly. This will hurt startups and smaller firms far more than it will the big dogs with their armies of compliance lawyers.

That assumes enforcement will be homogeneous.

Re: How GDPR Will Change The Way You Develop

#483

Post by OrganicMSG »

hanoz wrote: post #468
Diederich wrote: post #394

Earlier quoted context omitted.

> A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. Can you expand on that?

IP addresses are deemed personally identifiable information. All web servers log these by default - before asking users for permission to do so - and are therefore, bafflingly, about to become illegal.

How does this work out for Git repos and other things with encryption backed histories? If I run a software project and a developer wants an identifying section of a repo back-edited, do I have to edit and rebase the whole repo, and what does this do to the trust in a project that is based on a verifiable history?

Also, I can't help but notice that currently there is a hell of a lot of money being bet on immutable public ledgers.

Re: How GDPR Will Change The Way You Develop

#484

Post by wtfstatists »

the_mitsuhiko wrote: post #339
Silhouette wrote: post #326

Earlier quoted context omitted.

We've been careful about what data we collect since day one, long before the GDPR was an issue. We're not doing anything shady with the data we do have, and we actively avoid questionable practices particularly around marketing, where we have ethical problems with being intrusive or compromising people's privacy regardless of any legal constraints. And yet having read the GDPR and much commentary about it, we're stil…

> We're not doing anything shady with the data we do have But you can never guarantee that someone else won't do. The biggest issue to user's privacy has traditionally been data breaches. So even if you don't want to do something shady, a data loss might still be highly problematic for users. I agree that IP addresses are unlikely to be the biggest concern here however.

The biggest issue to user's privacy has traditionally been data breaches.

Peoples lives and most intimate details is going to be stored as bits. Get used to it.

Whether for targeting purpose (Facebook) or personal reasons (Strava). Whether stored on remote servers or home. It wont affect likeliness of data breaches. Focus on good software designs and let programmers design such systems in peace.

All this needed was fine for data breaches. Not the mess called GDPR.

Re: How GDPR Will Change The Way You Develop

#485

Post by ncallaway »

boredatwork wrote: post #325
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

Sure I delete files that I don't like, but I don't typically rewrite all my old backups to purge them from there too.

This is my biggest question about HIPAA and GDPR about deleting specific user records and data.

How are others planning on deleting data from all backups. It seems like any automatic process that modifies all existing backups has the potential to accidentally corrupt all backups in the process.

Is there any safe way to safely delete a record out of my prior database snapshots, or is there a reason I don't actually need to do this?

Re: How GDPR Will Change The Way You Develop

#486

Post by dingo_bat »

e12e wrote: post #274
shkkmo wrote: post #261

Earlier quoted context omitted.

Can you point me to a definitive source as to what websites that have access log that include IP addresses (which is pretty much everyone) have to do to be compliant? If there are steps that must be taken, who has to taken them? I've been looking, and I have found a bunch of contradictory explanations. My best guess is that if you have a disclaimer that says you log IP addresses for security purposes, you can keep yo…

Quit storing ips unless you are legally obliged to do so (audit trial, mandated surveillance, like that other EU directive...). Generally security audit purposes will likely let you keep logs for "reasonable time" (weeks). Beyond that, why store them?

Why not store them? It is data I created. For example I take a lot of photos. Most of them are shit, but I don't delete a single one.

Re: How GDPR Will Change The Way You Develop

#487

Post by TheCoelacanth »

danieltillett wrote: post #481
TheCoelacanth wrote: post #451

Earlier quoted context omitted.

It does not apply to people outside of the EU. Article 3[1] is quite clear about that it applies to people in the EU. [1] https://gdpr-info.eu/art-3-gdpr/

It says it applies to the “...processing of personal data of data subjects who are in the Union…”. If someone in the EU (say a visitor) asks to have their data removed that was collected while they were outside the EU, then the controller or processor is supposed to comply. How is any business supposed to know if a user while they were in the USA of a service located in the USA will not later travel to the EU and mak…

You're leaving off the end of the sentence. Data collected about someone outside of the EU is not covered by GDPR even if they later enter the EU.

> where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union.

Re: How GDPR Will Change The Way You Develop

#488

Post by ncallaway »

s73v3r_ wrote: post #398
freeone3000 wrote: post #342

Earlier quoted context omitted.

It's a bit more strict than that. If I have customers in France, this affects me, no matter how many, no matter if it's one dude in Florida who happens to also be French. The reach is absurd.

"no matter if it's one dude in Florida who happens to also be French." That's not true.

Is he a French citizen? My understanding is that GDPR applies to you (in theory) if you have any EU citizens as customers.

Am I misunderstanding? Why is this incorrect?

Re: How GDPR Will Change The Way You Develop

#489

Post by chrisweekly »

deif wrote: post #387
njl wrote: post #332

Earlier quoted context omitted.

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

Only without consent from the user. Previously it was an ethically grey area to be logging IP addresses anyway. If you are preventing malicious use, then that is allowed as long as you are not using that data outside of the bounds of the user's consent. If, however, a company is storing IP addresses to identify users without their consent and are found to be specifically targeting them without their consent, then tha…

>"Previously it was an ethically grey area to be logging IP addresses anyway."

wat.

Standard log formats capture IP, and have ~forever. Who claims this is an ethical quandary?

Re: How GDPR Will Change The Way You Develop

#490

Post by OrganicMSG »

PeterisP wrote: post #445
pbowyer wrote: post #395

Earlier quoted context omitted.

> As a company that uses third-party services for data processing (which includes almost every piece of SaaS-type software) you have to sign a data processing agreement with each of those, which can mean considerable effort. At least for SaaS it's pretty clear-cut. For freelancers, contractors and consultants the situation is way more confused. AFAICT I need a data processing agreement with every client, even if I on…

IMHO it simply requires companies to make a clear choice. Either they have the organizational capacity to handle private information properly , or they should not do it at all. There's no reason for every company to get a data processing agreement with every SaaS they use as long as they're not putting private data of other people inside; and in most cases (except CRM and payment systems) they should not do so. There…

"Either they have the organizational capacity to handle private information properly, or they should not do it at all."

While I admire the intent here, in the world at large it seems that multinationals and governments fail at this one with monotonous regularity and Blanche's final line - 'Whoever you are, I have always depended on the kindness of strangers', has been adopted by the computer security industry as the unofficial motto.

Post reply on HN