Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

501–510 of 710 posts

Re: How GDPR Will Change The Way You Develop

#501

Post by TheCoelacanth »

danieltillett wrote: post #493
TheCoelacanth wrote: post #487

Earlier quoted context omitted.

You're leaving off the end of the sentence. Data collected about someone outside of the EU is not covered by GDPR even if they later enter the EU. > where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the…

There is an “or” not an “and” between these two clauses. It applies if you offer any goods or service, OR monitor behaviour inside the EU. It is interesting that the monitoring clause only applied if the subject is inside the EU when the monitoring is done, while the service or goods clause applies if the person is inside the EU with no requirement that the service or good was acquire or used within the EU. I can’t r…

Both clauses explicitly limit their scope to the EU.

> the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union

> the monitoring of their behaviour as far as their behaviour takes place within the Union.

Re: How GDPR Will Change The Way You Develop

#502

Post by x0x0 »

oliwarner wrote: post #405
deif wrote: post #387

Earlier quoted context omitted.

Only without consent from the user. Previously it was an ethically grey area to be logging IP addresses anyway. If you are preventing malicious use, then that is allowed as long as you are not using that data outside of the bounds of the user's consent. If, however, a company is storing IP addresses to identify users without their consent and are found to be specifically targeting them without their consent, then tha…

You appear to be suggesting that "intent" defines the shape of law here, but I really don't think that's the case. By my reading, information becomes personal —and therefore subject to GDPR— when it can be used to identify people. If you've got login timestamps, IP addresses and user records, for legitimate reasons, any other logging that includes IPs is tainted because it takes anybody with that data two minutes to…

Intent comes into play when you determine the appropriate processing basis; for eg preventing abuse, the basis isn't consent and therefore consent is not required. So GP is partially wrong. If your intent is to use the data for marketing purposes, then you are much more likely to require consent. See LI balancing tests.

Re: How GDPR Will Change The Way You Develop

#503

Post by fyfy18 »

Silhouette wrote: post #426
jacquesm wrote: post #390

Earlier quoted context omitted.

Yes, the VAT mess definitely does not deserve the beauty prize but with the MOSS it is actually manageable. I've done it for a couple of years and as long as your IPSP cooperates it shouldn't be more than 15 minutes of work per quarter.

I've done it for a couple of years and as long as your IPSP cooperates it shouldn't be more than 15 minutes of work per quarter. That might be true if you're lucky enough to have a single third-party payment service that collects all of your revenues including administering the VAT parts for you. Unfortunately, there are many reasons why that might not be the case or even possible. Even if you do use one of those ser…

At least in the UK, HMRC email me whenever rates in a member country change, and they publish them online too:

https://www.gov.uk/government/collections/vat-information-sh...

Re: How GDPR Will Change The Way You Develop

#504

Post by x0x0 »

njl wrote: post #494
nrjames wrote: post #476

Earlier quoted context omitted.

Standard server logs with IP addresses must be disclosed in a privacy policy but you do not have to seek consent for them because you collect them as part of a business critical need to prevent fraud. See Recital 47, which includes the language: "The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned." https://www…

The user can request I delete all of the data related to them without “undue delay”. Are you ready to purge all references to certain IP addresses in your logs? Don’t forget backups. GDPR blows up a lot of assumptions we make about writing software and managing servers. https://www.privacy-regulation.eu/en/article-17-right-to-era...

The user can request whatever. If you are processing the data via consent, you have to obey. If you processing the data under a different basis, then you may well not; you have to figure out. I hope you like paying lawyers!

Re: How GDPR Will Change The Way You Develop

#505

Post by nrjames »

njl wrote: post #494
nrjames wrote: post #476

Earlier quoted context omitted.

Standard server logs with IP addresses must be disclosed in a privacy policy but you do not have to seek consent for them because you collect them as part of a business critical need to prevent fraud. See Recital 47, which includes the language: "The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned." https://www…

The user can request I delete all of the data related to them without “undue delay”. Are you ready to purge all references to certain IP addresses in your logs? Don’t forget backups. GDPR blows up a lot of assumptions we make about writing software and managing servers. https://www.privacy-regulation.eu/en/article-17-right-to-era...

Again, you do not have to if is business critical and used for fraud prevention. You must routinely delete logs before they get too old (60-90 days maybe), but you do not need to take special action beyond that. I’m not saying the GDPR isn’t troublesome, but having spent the better part of the last 6 months combing through the law and interpretations of it, I think the concern over IP addresses in log files that can be used for security and fraud-prevention is unfounded. Data portability requests are likely where it will get onerous and expensive. Even with those, there is flexibility build in to prevent users from repeatedly requesting their data at short intervals.

Re: How GDPR Will Change The Way You Develop

#506

Post by wyager »

mfoy_ wrote: post #81
aeorgnoieang wrote: post #73

Earlier quoted context omitted.

I thought that was needlessly snarky. I'm pretty sure other fields rely on lawyers to know the relevant legal landscape just like we do.

No. Professionals in engineering or the trades have to know the regulations that govern their industry and abide by them. What many SVers call "innovation", other industries would call "reckless". How embarrassing for us! EDIT: In terms of regulation, we're practically chiropractors.

And most of those industries have been stagnant for decades.

Re: How GDPR Will Change The Way You Develop

#507

Post by intrasight »

What really strikes me is the fact that we spend so many years getting good at remembering things, and now we have to get good at forgetting things. Seems to me that forgetting is way easier than remembering. But I could be wrong.

Was just reading this article which I found very informative: http://www.davidfroud.com/does-right-to-erasure-include-back...

Re: How GDPR Will Change The Way You Develop

#508

Post by wyager »

mamon wrote: post #234
sbov wrote: post #177

Earlier quoted context omitted.

The comparison is disingenuous. The internet makes anything you build automatically global. You're blasting software engineers for not knowing worldwide regulations. How many New York lawyers know the regulations of France? How many local UK construction companies know the building codes of Japan? None. Knowing all regulations in the world for any given industry would be a full time job. The people you seem to be imp…

So, the GDPR is doing you a favour by forcing you to think in advance "who will my users be?". So far web applications were "accidentally" global, now you have to be more careful and deliberate. Which is a good thing.

Ah yes, digital isolationism and segregated networks are great. Have we given up on the idea of the internet being a force for global human interaction? Are vague and impotent privacy protections more important?

Re: How GDPR Will Change The Way You Develop

#509

Post by wyager »

floatrock wrote: post #291
sbov wrote: post #177

Earlier quoted context omitted.

The comparison is disingenuous. The internet makes anything you build automatically global. You're blasting software engineers for not knowing worldwide regulations. How many New York lawyers know the regulations of France? How many local UK construction companies know the building codes of Japan? None. Knowing all regulations in the world for any given industry would be a full time job. The people you seem to be imp…

> How many New York lawyers know the regulations of France? New York lawyers who do business in France do. If you're accepting ~dollars~ euros to place French ads on your pages targeting French customers, seems reasonable to know the relevant French regulations.

You don’t need to make money off Europeans to be targeted by the GDPR - you just need to have data about Europeans.

Re: How GDPR Will Change The Way You Develop

#510

Post by wyager »

jopsen wrote: post #360
freeone3000 wrote: post #342

Earlier quoted context omitted.

It's a bit more strict than that. If I have customers in France, this affects me, no matter how many, no matter if it's one dude in Florida who happens to also be French. The reach is absurd.

Is the reach more absurd than what US court claim?

The worst transgressions of US courts shouldn’t be the standard we aim for.
Post reply on HN