521–530 of 710 posts
From skimming over the spec, it seems that politicians haven't thought about any other sites than social networks or some other profit making sites. Even in that case, if some ML system is trained on the data of the customer, do they have to re-train after anyone invokes right to be forgotten.
Earlier quoted context omitted.
If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…
When stuff like this comes up it always seems so weird to me that with all the work that regulators put into this, why can't they at least scratch the surface of providing some specific examples? Of course there are legal documents, and maybe some "for dummies" versions written up about it. But would it be so crazy for these regulators to hire someone who knows something about commonly used open source software and b…
Say our landing web page contains an intercom chat widget and google analytics tracking.
At that point we have collected the user ip at most, which would become sensitive only if connected with data from two other businness entities.
What the heck am I supposed to write into the damn thing now?
Earlier quoted context omitted.
> As a company that uses third-party services for data processing (which includes almost every piece of SaaS-type software) you have to sign a data processing agreement with each of those, which can mean considerable effort. At least for SaaS it's pretty clear-cut. For freelancers, contractors and consultants the situation is way more confused. AFAICT I need a data processing agreement with every client, even if I on…
IMHO it simply requires companies to make a clear choice. Either they have the organizational capacity to handle private information properly , or they should not do it at all. There's no reason for every company to get a data processing agreement with every SaaS they use as long as they're not putting private data of other people inside; and in most cases (except CRM and payment systems) they should not do so. There…
Of corse not. What will happen instead is that behind a consent box a lengthy disclaimer will ask consent for every piece of information and blanket every length of scope, triggering a cascade across providers and contractors.
Earlier quoted context omitted.
When stuff like this comes up it always seems so weird to me that with all the work that regulators put into this, why can't they at least scratch the surface of providing some specific examples? Of course there are legal documents, and maybe some "for dummies" versions written up about it. But would it be so crazy for these regulators to hire someone who knows something about commonly used open source software and b…
There’s more to that. Startups now exists as a constellation of services and it’s quite hard to tell what goes into a PIA document and whar not. Say our landing web page contains an intercom chat widget and google analytics tracking. At that point we have collected the user ip at most, which would become sensitive only if connected with data from two other businness entities. What the heck am I supposed to write into…
https://gdpr.report/news/2018/02/01/gdpr-google-analytics-2/
If I were you, I would add my own chat (there is bunch of them on github) and use piwik instead of google analytics.
(By the rule of the thumb, for each 3rd party provider, ask them about gdpr compliancy and purge all the data you are not getting user consent - GDPR is retroactive)
Earlier quoted context omitted.
OPs point is that if you act responsibly in good faith you'll probably avoid any issues, and likely be warned before they target you for maximum fines :)
That's heavily dependent on the regulator in question, and there's 30-ish of them. Since American companies are very unlikely to have a lead regulator, you will need to comply with conflicting rulings from each. In half a dozen languages.
Earlier quoted context omitted.
Sure I delete files that I don't like, but I don't typically rewrite all my old backups to purge them from there too.
This is my biggest question about HIPAA and GDPR about deleting specific user records and data. How are others planning on deleting data from all backups. It seems like any automatic process that modifies all existing backups has the potential to accidentally corrupt all backups in the process. Is there any safe way to safely delete a record out of my prior database snapshots, or is there a reason I don't actually ne…
Don’t leak private keys, so you should generally use a decryption service if you need access to the data record. Handy to prove access too!
That works and survives fairly intense audits at least in my experience.
Earlier quoted context omitted.
I'm not sure what you mean by "holes". It seems like it's a fundamental and intended feature of the GDPR that you can't achieve compliance-by-default. You have to explicitly audit every interaction between every system you have, to ensure that either no personal information is present or the interaction complies with GDPR standards.
" ...you have to explicitly audit every interaction between every system... " But would you though? If you're a large co. you'd have a configuration management system where you just pull the specs/data rather than do an audit. If you're a small co. you'd know already, and if not you'd just go look. Right? My experience is that anyone complaining about the amount of work GDPR is causing is a. not compliant anyway (and…
The law applies to business entities so it will go and cover every piece of infrastructure they run retroactively.
Imagine having a dev with contributions and commits in a dozen projects calling github to exercise his newfound right of removing all personal identifiable information from the system.
Earlier quoted context omitted.
IMHO it simply requires companies to make a clear choice. Either they have the organizational capacity to handle private information properly , or they should not do it at all. There's no reason for every company to get a data processing agreement with every SaaS they use as long as they're not putting private data of other people inside; and in most cases (except CRM and payment systems) they should not do so. There…
And what happens when anything of that changes in scope? You gonna resend the consent form to each and every past user? Of corse not. What will happen instead is that behind a consent box a lengthy disclaimer will ask consent for every piece of information and blanket every length of scope, triggering a cascade across providers and contractors.
And this is the reason: https://www.paypal.com/ie/webapps/mpp/ua/third-parties-list
This might help:
Earlier quoted context omitted.
Only without consent from the user. Previously it was an ethically grey area to be logging IP addresses anyway. If you are preventing malicious use, then that is allowed as long as you are not using that data outside of the bounds of the user's consent. If, however, a company is storing IP addresses to identify users without their consent and are found to be specifically targeting them without their consent, then tha…
You appear to be suggesting that "intent" defines the shape of law here, but I really don't think that's the case. By my reading, information becomes personal —and therefore subject to GDPR— when it can be used to identify people. If you've got login timestamps, IP addresses and user records, for legitimate reasons, any other logging that includes IPs is tainted because it takes anybody with that data two minutes to…
Earlier quoted context omitted.
And also, there's also the slightly grey-area requirement that (if you're using it as your legal basis) consent should not be required in order to utilise your product, merely to utilise the feature set that requires the data. If you need everything, then you'll need to use "fulfilment of a contract" as the basis, and in that case, you probably need to make your ToS pretty tight too.
Question about the freely given consent - Say I'm a car company like Tesla and I collect telemetry from the car to train a self-driving car model. I ask the user for consent to collect this data to train the self-driving model. For the users that refuse this consent, can I prevent them from accessing the self-driving feature of the car? If not, how would the company deal with the free-rider problem - nobody opts in b…