How GDPR Will Change The Way You Develop • Hacker News Board

Re: How GDPR Will Change The Way You Develop

#511

Post by Tomte » Wed, Feb 28, 2018, 4:41 AM UTC

chrisweekly wrote: post #489

deif wrote: post #387

Earlier quoted context omitted.

Only without consent from the user. Previously it was an ethically grey area to be logging IP addresses anyway. If you are preventing malicious use, then that is allowed as long as you are not using that data outside of the bounds of the user's consent. If, however, a company is storing IP addresses to identify users without their consent and are found to be specifically targeting them without their consent, then tha…

>"Previously it was an ethically grey area to be logging IP addresses anyway." wat. Standard log formats capture IP, and have ~forever. Who claims this is an ethical quandary?

I won‘t address „ethical“, but collecting full IP addresses has been discussed as possibly illegal in Germany for years now.

And since the recent European court decision, I suppose it is settled: yes, illegal.

Re: How GDPR Will Change The Way You Develop

#512

Post by dcosson » Wed, Feb 28, 2018, 4:43 AM UTC

njl wrote: post #332

_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

When stuff like this comes up it always seems so weird to me that with all the work that regulators put into this, why can't they at least scratch the surface of providing some specific examples? Of course there are legal documents, and maybe some "for dummies" versions written up about it.

But would it be so crazy for these regulators to hire someone who knows something about commonly used open source software and building web apps, to help provide a little bit of actionable technical advice? For instance, the majority of the internet is running on Apache or Nginx, why not have an official, EU-sponsored blog post explaining "here's how to set up a LAMP stack, or nginx and rails on a linux server, that complies with GDPR". Of course they can't cover every obscure language or framework, but it would be a starting point. And it would probably end up a lot cheaper than having to investigate and/or penalize people who didn't read the fine print of the law and/or didn't understand how it translates to actually running software.

Because despite how "simple" this post is saying these laws are, there still seems to be quite a bit of confusion on this thread, among smart developers, about questions like whether or not we're allowed to keep collecting webserver logs in the default format or not.

Re: How GDPR Will Change The Way You Develop

#513

Post by Tomte » Wed, Feb 28, 2018, 4:43 AM UTC

OrganicMSG wrote: post #483

hanoz wrote: post #468

Earlier quoted context omitted.

IP addresses are deemed personally identifiable information. All web servers log these by default - before asking users for permission to do so - and are therefore, bafflingly, about to become illegal.

How does this work out for Git repos and other things with encryption backed histories? If I run a software project and a developer wants an identifying section of a repo back-edited, do I have to edit and rebase the whole repo, and what does this do to the trust in a project that is based on a verifiable history? Also, I can't help but notice that currently there is a hell of a lot of money being bet on immutable pu…

How it works out? Badly.

But you generally cannot build a system that intentionally does not have a certain capability and then successfully claim that laws don‘t apply to you, because your beautiful system does not accomodate them.

Re: How GDPR Will Change The Way You Develop

#514

Post by Eridrus » Wed, Feb 28, 2018, 4:45 AM UTC

jimnotgym wrote: post #205

I have been through a number of GDPR resources and seminars and I am still of the opinion that there is nothing in it to worry people who are acting in good faith with their customers data. The organisations fined under existing laws seem to have been breathtakingly negligent or just deliberately callous.

Q: would I still be able to keep session logs of user journeys through my site without explicit consent? If not, this seems like huge issue for ecommerce analytics. If I need to obtain explicit consent, that the user isn't required to provide to continue accessing the site then I don't see how these technologies are not basically dead in the EU.

Can you even legally do a customer churn analysis under the GDPR without explicit consent?

One of the biggest complaints I have about this is that the uses for data keep growing, and legally, you can't even test a hypothesis before getting consent, which you won't be able to do frequently because users hate being asked about anything.

My intuitive response to this law is to want to split my data into EU/non-EU parts, do all my work on the non-EU parts and hope that the insights gained there can be applied to EU users.

Re: How GDPR Will Change The Way You Develop

#515

Post by s73v3r_ » Wed, Feb 28, 2018, 5:02 AM UTC

danieltillett wrote: post #478

s73v3r_ wrote: post #427

Earlier quoted context omitted.

"Yep. It is worse that it can be a EU resident (non-citizen) visiting the the USA using a USA only service and the law as currently written still applies. Good luck." You're going to have to provide proof to back up that statement.

The regulations are ridiculously broad [0]. They appear to cover everyone in the world no matter where they are or what their citizenship. The EU seems to be aiming for a universal human right. "The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence , respect their fundamental rights and freedoms, in partic…

That's the intro statement. That's like saying the Declaration of Independence is overly broad because it says that "all men are created equal."

Re: How GDPR Will Change The Way You Develop

#516

Post by kerng » Wed, Feb 28, 2018, 5:05 AM UTC

What I like about GDPR is that it might help change the mindset that storing customer data is purel an asset - it should be a liability. Hopefully other countries will ratify similar laws. Then something like the Equifax breach could go unpunished!

Re: How GDPR Will Change The Way You Develop

#517

Post by driverdan » Wed, Feb 28, 2018, 5:08 AM UTC

mfoy_ wrote: post #44

>GDPR will require developers to know the legal and policy landscape of their profession. (This has been the norm for other fields for centuries: how embarrassing for us.) Favourite takeaway.

Developers should already know the "legal and policy landscape."

Sending email? You should know the CAN-SPAM act. Do business with CA citizens? You'd better know about CA's privacy policy requirements. Doing ecommerce? You need to learn about sales tax and PCI requirements.

Re: How GDPR Will Change The Way You Develop

#518

Post by h1boo » Wed, Feb 28, 2018, 5:10 AM UTC

How is this law okay with international trade agreements? Why doesn't US say that this (rather fuzzy law) is meant to hurt tech companies which is disproportionally based there? In retaliation couldn't they come up with some law that impacts EU businesses?

Re: How GDPR Will Change The Way You Develop

#519

Post by sseth » Wed, Feb 28, 2018, 5:28 AM UTC

aidos wrote: post #107

How are people planning on implementing GDPR at the DB level? What about DB backups?

One approach may be to tokenize user information. Ensure that any personal data is separated from other data and mapped via tokens and kept in one place. Handle backups of this database with special care.

You can then have the rest of your systems work as normal.

All this is easier said than done if you have a large investment in existing systems, but it is probably a design approach you can enforce from the beginning if you are a startup.

Re: How GDPR Will Change The Way You Develop

#520

Post by YetAnotherNick » Wed, Feb 28, 2018, 5:28 AM UTC

s73v3r_ wrote: post #414

wglb wrote: post #178

Earlier quoted context omitted.

Consider the case of an EU citizen traveling in the US transaction in USD. This person is covered. Even if they are in the US.

You're gonna have to provide a citation for that.

Yeah, like the sites doing that for China.