How GDPR Will Change The Way You Develop • Hacker News Board

Re: How GDPR Will Change The Way You Develop

#531

Post by havkom » Wed, Feb 28, 2018, 6:24 AM UTC

shkkmo wrote: post #359

havkom wrote: post #328

Earlier quoted context omitted.

See GDPR recital 24 ( http://www.privacy-regulation.eu/en/recital-24-GDPR.htm ): [...] In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to…

Thanks for the link. > potential subsequent use of personal data processing techniques Not a lawyer, but doesn't every access log with IPs and urls have the /potential/ to be parsed to aggregate a profile of site usage? Even if you aren't actually doing or intending to do any profiling, the potential still exists. You may well be correct about all this (and I suspect you are). I'm specifically trying to push back aga…

Yes and no. One of the most important principles in GDPR is “purpose limitation” (Article 5.1b):

“Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes“

If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing - that is most certainly in violation with this principle and therefor forbidden.

A “lawful basis” for the marketing purpose will not save you from this principle.

This is also where the public privacy policy/notice plays a role - for the company to be able to prove that the IP addresses where also originally collected for marketing purposes and fair information was given about this purpose at the point of collection.

In terms of GDPR’s territorial scope I guess at the point in time you start to use the DDoS prevention IP logs for profiling you come into GDPR scope. You would also be immediately be in violation of the purpose limitation principle if it is for marketing purposes.

Re: How GDPR Will Change The Way You Develop

#532

Post by ec109685 » Wed, Feb 28, 2018, 6:24 AM UTC

agar wrote: post #206

While this article is interesting, I strongly encourage anyone - from CEOs, to managers, to individual developers - to actually read the text of the GDPR. This is not written in unintelligible legal-ese. It is very approachable, understandable by a layman, and organized such that relevant Articles are easy to find. It might take an hour or two, yet may have a fundamental impact on how you approach your job for the fo…

If you work for a big company and are not a lawyer, you should listen to your lawyers and not try to interpret the law yourself. There are pitfalls and misunderstanding you will run into otherwise. If your company is large enough, they should meet with privacy regulators and work with them to show them implementation decisions and make sure the regulators are in alignment with the approach taken.

Re: How GDPR Will Change The Way You Develop

#533

Post by e12e » Wed, Feb 28, 2018, 6:28 AM UTC

danieltillett wrote: post #470

e12e wrote: post #386

Earlier quoted context omitted.

Re: "Where usage growth was coming from" sounds like the kind of things a log of performance data pr server might also answer. Can't argue with the fact that storing less and corner grained data will make certain ad hoc queries harder. That's kinda the point.

Performance data is not going to tell me where the users are located. Yes it was only because I had the logs was I able to do this analysis. The issue is not over these sort of analyses which I am sure nobody would object to, but that GDPR casts such a wide net.

You implied you already had "local" servers - it sounded like bandwidth/load information might indicate the area were load was increasing.

Re: How GDPR Will Change The Way You Develop

#534

Post by halflings » Wed, Feb 28, 2018, 6:31 AM UTC

grabeh wrote: post #440

peterhunt wrote: post #415

Earlier quoted context omitted.

It's left ambiguous, but it's likely that any aggregate computed from personal data may also be considered personal data (i.e. how many unique IPs you've seen).

If you are looking to derive aggregated insights from data then you need to be clear on your anonymisation processes and understand whether or not you any derived dataset is capable of identifying individuals whether in isolation or through reasonable means. To me if you are taking a tally of the volume of unique IPs alone that would never be sufficient to identify a person but maybe I don't have the full context?

What you're saying makes sense. Any data derived from PII should considered as PII itself if it can be used to identify users, and even if it cannot be used for that, it needs to be cleared frequently enough such that you don't end up with data derived from information for which you received a deletion request, for instance.

In practice, you can achieve this by simply refreshing your derived data frequently (ever ~30-60 days), and for aggregated data k-anonymity is a good way to enforce this privacy constraint.

https://en.wikipedia.org/wiki/K-anonymity

Re: How GDPR Will Change The Way You Develop

#535

Post by havkom » Wed, Feb 28, 2018, 6:35 AM UTC

shkkmo wrote: post #359

havkom wrote: post #328

Earlier quoted context omitted.

See GDPR recital 24 ( http://www.privacy-regulation.eu/en/recital-24-GDPR.htm ): [...] In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to…

Thanks for the link. > potential subsequent use of personal data processing techniques Not a lawyer, but doesn't every access log with IPs and urls have the /potential/ to be parsed to aggregate a profile of site usage? Even if you aren't actually doing or intending to do any profiling, the potential still exists. You may well be correct about all this (and I suspect you are). I'm specifically trying to push back aga…

And no, GDPR is from my own experience not easy to understand or apply in practice - except for PPT toy problems.

There is a lot of more behind the articles in GDPR since it is partly based on legal instruments on data protection from 1981(!), “Convention 108” and EU legislation from 1995. Case law, opinions from data protection authorities etc. are important.

In general though, I would not be worried about big fines or anything as long as you try to follow GDPR and you are not doing things the data subjects does not want you to do with their data.

In general, the best GDPR compliance test is how it feels in your gut, after learning the principles.

At the point in time you process personal data against the interests of the data subject (for example building marketing profiles, sharing data with third parties w/o request from the data subject, etc) it is time to start worrying and make sure you cross the i’s... GDPR is pretty permissive in general IMO but make sure you know the details.

Re: How GDPR Will Change The Way You Develop

#536

Post by ec109685 » Wed, Feb 28, 2018, 6:36 AM UTC

lmkg wrote: post #105

msla wrote: post #95

Earlier quoted context omitted.

> The GDPR says when you collect data, you have to tell the user what you intend to use it for. Then that part is worthless, just another click-through "agreement" practically nobody reads. That part won't change anything. > So if your business purpose is to mail something to the customer, full physical address is OK to collect. If your business purpose is to help them find a nearby store location, you may be expecte…

> Then that part is worthless GDPR requires that the use cases be itemized, and the user can opt out of each one individually. So if the user opts out of receiving a mailing but not the store locator, you have to manage how much data you collect about that person. I agree that for the most part this will just be another click-through like the cookie law was, but companies will be required to accommodate those minorit…

Not every little thing needs to be opted into individually. If you have a legitimate use of data for the user’s benefit, you can collect that data after a general consent as long as you provide a way for the user to see that data and delete it. If you use that data for your own benefits (like building an advertising profile), that needs to be opted into separately.

Re: How GDPR Will Change The Way You Develop

#537

Post by com » Wed, Feb 28, 2018, 6:38 AM UTC

jacquesm wrote: post #336

prewett wrote: post #318

Earlier quoted context omitted.

If the law applies outside the EU (for instance, if EU citizens travel to a non-EU country), then it is an extra-territorial law. As far as I understand the discussion here (which may or may not correspond with the actual law), the GDPR goes with the person. Wherever an EU citize goes, that EU citizen must be able to be forgotten, despite if the location they are in is outside EU jurisdiction. That is practically the…

EU citizens outside of the EU are out of scope for the GDPR.

Could you point at the language that unambiguously says that?

Edit: GDPR Recital 23, Article 3(2)(a). Excellent!

Re: How GDPR Will Change The Way You Develop

#538

Post by ec109685 » Wed, Feb 28, 2018, 6:44 AM UTC

mfoy_ wrote: post #44

>GDPR will require developers to know the legal and policy landscape of their profession. (This has been the norm for other fields for centuries: how embarrassing for us.) Favourite takeaway.

Not true. Developers should consult with lawers and privacy experts and not try to “know legal and policy landscape” themselves.

Re: How GDPR Will Change The Way You Develop

#539

Post by mark_edward » Wed, Feb 28, 2018, 6:46 AM UTC

freeone3000 wrote: post #364

gnfurlong wrote: post #99

Earlier quoted context omitted.

This doesn't make sense to me. Wouldn't that make every id that is one to one or one to many with a customer PII? That seems absurd. A user alias on some random site would meet that criteria, assuming they took name/address/etc when you signed up. Unless PII has some other significance than I'm interpretting it to have?

Right. So you'd have to have a business case for the user to have a persistent login, if you want to offer login functionality, beyond simply "track the user to see what they want". It's ridiculous.

Sounds good to me.

Screw you data vampires.

Re: How GDPR Will Change The Way You Develop

#540

Post by qwerpoiu » Wed, Feb 28, 2018, 6:48 AM UTC

A thought I had that I haven't heard elsewhere: this is the EU equivalent of the Great Firewall - an immensely powerful tool for governments to use against "foreign" companies that don't have the proper values.

The EU would love to have a tech company that could be compared to Google, Facebook, or Tencent, but its attempts to create one by fiat (Quaero, for example) have fallen flat.

The mechanism (legal rather than technical) and the claimed ideals (privacy rather than anti-pornography) are different, but the effect will be the same.

Depending on your perspective, this represents a tremendous opportunity for EU-based startups. Your government will almost certainly make things very difficult for your foreign competitors. Cozy up to your local Party officials!