Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

531–540 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#531

Post by cabaalis »

hk__2 wrote: post #519
ars wrote: post #497

Earlier quoted context omitted.

It's not so easy. Someone buys a book. Transaction is recorded, and now we know total book sales. Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. There's ways around it, obviously. But they are not easy. Much easier to just mark as deleted. Another example: Threaded conversation - someone deletes their post, and oops all the replies are now orphaned.

> Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. Erase the name and address fields from the user in the database. You don’t have to delete any line, and that person doesn’t have any personal info in your database anymore. Problem solved.

Mostly solved. Anonymized data sets can sometimes be de-anonymized if the conditions are right and external factors can be applied.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#532

Post by cromwellian »

hk__2 wrote: post #519
ars wrote: post #497

Earlier quoted context omitted.

It's not so easy. Someone buys a book. Transaction is recorded, and now we know total book sales. Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. There's ways around it, obviously. But they are not easy. Much easier to just mark as deleted. Another example: Threaded conversation - someone deletes their post, and oops all the replies are now orphaned.

> Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. Erase the name and address fields from the user in the database. You don’t have to delete any line, and that person doesn’t have any personal info in your database anymore. Problem solved.

Assuming the remaining data can't be used to deanonymize them. This solution buys into the myth that anonymizing data protects PII.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#533

Post by viraptor »

amarkov wrote: post #523
viraptor wrote: post #513

Earlier quoted context omitted.

When you learn that someone lied and they are under 13yo, the rule applies again.

I'm not aware of any rule or case which supports this claim.

It doesn't have to be a specific rule. You learn that the age declaration was invalid so the "§312.10 Data retention and deletion requirements" applies unless you have a verifiable parent consent.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#535

Post by anfogoat »

badminton1 wrote: post #473
anfogoat wrote: post #446

My biggest _annoyance_ with GDPR and its advocates is the constant touting of "giving users control over their data" when in reality it is hindering voluntary actions that by their nature require some of "my data". If I want to service a small group of people with, say, an XMPP network, and those users are willing and eager to just go with it without any of this bs with terms and three-letter EU dictated roles, then…

GDPR is simply a response to abusive behavior. May not be the best response, but it was about time. Then, it is surprising to me that Americans are against a national id card, but are not OK with a privacy protection law.

But I'm not railing against _a_ privacy protection law, I'm railing against the GDPR. Fundamentally, for the simple reason that I want the freedom to with my data as I please, regardless of whether or not the service I want to use is meeting EU dictated goalposts or not.

(I'm European, though not in spirit apparently.)

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#536

Post by johnbellone »

contravariant wrote: post #530
daveFNbuck wrote: post #525

Earlier quoted context omitted.

You don't necessarily have to delete stuff from cold storage right away. You just need to have a process to remove deleted PII when you retrieve/rewrite your backups.

This might be a bit of a weird question, but how do you remember which information needs to be deleted when you're at the point where you need to use backups?

You would keep a list of unique identifiers (opaque) that were deleted and filter data out prior to rewriting/restoring it. It’s cumbersome but not impossible.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#537

Post by anfogoat »

myhf wrote: post #464
anfogoat wrote: post #446

My biggest _annoyance_ with GDPR and its advocates is the constant touting of "giving users control over their data" when in reality it is hindering voluntary actions that by their nature require some of "my data". If I want to service a small group of people with, say, an XMPP network, and those users are willing and eager to just go with it without any of this bs with terms and three-letter EU dictated roles, then…

If I want to service a small group of people with, say, a nuclear power plant, and those people are willing and eager to just go with it without any bs or roles, then it should be possible. When you make it prohibitive to handle hazardous materials, then you've done something wrong.

If you and the small group of people are the only living creatures on the planet, then absolutely! That is to say, this isn't really comparable, for obvious reasons.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#538

Post by mbob88 »

yzmtf2008 wrote: post #512
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

>properly handling sensitive information

But the thing is that GDPR affects all PII not just sensitive one so your random small useless app/blog/game/forum that has some personally identifiable but harmless and unimportant data stored is now under the same restrictions like your email or FB data.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#539

Post by cabaalis »

thisone wrote: post #494
badminton1 wrote: post #473

Earlier quoted context omitted.

GDPR is simply a response to abusive behavior. May not be the best response, but it was about time. Then, it is surprising to me that Americans are against a national id card, but are not OK with a privacy protection law.

I believe it's because, in general, Americans distrust government and trust corporations

Giving someone money or trust in exchange for a service or good is a straightforward relationship that implies various social contracts. Americans' relationship with government is far more adversarial.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#540

Post by txsh »

yzmtf2008 wrote: post #512
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

“Move fast and *break things.” Although, GDPR seems to be throwing on the brakes.
Post reply on HN