Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

541–550 of 710 posts

Re: How GDPR Will Change The Way You Develop

#541

Post by ec109685 »

Eridrus wrote: post #514
jimnotgym wrote: post #205

I have been through a number of GDPR resources and seminars and I am still of the opinion that there is nothing in it to worry people who are acting in good faith with their customers data. The organisations fined under existing laws seem to have been breathtakingly negligent or just deliberately callous.

Q: would I still be able to keep session logs of user journeys through my site without explicit consent? If not, this seems like huge issue for ecommerce analytics. If I need to obtain explicit consent, that the user isn't required to provide to continue accessing the site then I don't see how these technologies are not basically dead in the EU. Can you even legally do a customer churn analysis under the GDPR without…

No, put up a “trap” page, tell the user you need to collect certain data to operate the site and make the user clicks Accept before they can use your it.

Re: How GDPR Will Change The Way You Develop

#543

Post by rorykoehler »

nrjames wrote: post #505
njl wrote: post #494

Earlier quoted context omitted.

The user can request I delete all of the data related to them without “undue delay”. Are you ready to purge all references to certain IP addresses in your logs? Don’t forget backups. GDPR blows up a lot of assumptions we make about writing software and managing servers. https://www.privacy-regulation.eu/en/article-17-right-to-era...

Again, you do not have to if is business critical and used for fraud prevention. You must routinely delete logs before they get too old (60-90 days maybe), but you do not need to take special action beyond that. I’m not saying the GDPR isn’t troublesome, but having spent the better part of the last 6 months combing through the law and interpretations of it, I think the concern over IP addresses in log files that can…

Other countries mandate that we keep logs for 7 years. This is unworkable.

Re: How GDPR Will Change The Way You Develop

#545

Post by sveme »

trothamel wrote: post #65
sveme wrote: post #10

Earlier quoted context omitted.

It's something that basically every big block is trying to do, the US has enforced DMCA and other stuff on other providers as well. Though in principle, GDPR only covers EU citizens - if you would be selling a product from Australia that exploded upon using it for the first time to an EU citizen, wouldn't you expect EU authorities to go after you as well?

No, I'd expect Australian regulators to be the ones that went after you in that case.

Hmm, if you're selling into the EU, it's EU regulations that you have to follow, not Australian. Maybe we just misunderstood each other, I'm talking about shipping a product to the EU.

Re: How GDPR Will Change The Way You Develop

#546

Post by tachyoff »

tluyben2 wrote: post #529
oliwarner wrote: post #405

Earlier quoted context omitted.

You appear to be suggesting that "intent" defines the shape of law here, but I really don't think that's the case. By my reading, information becomes personal —and therefore subject to GDPR— when it can be used to identify people. If you've got login timestamps, IP addresses and user records, for legitimate reasons, any other logging that includes IPs is tainted because it takes anybody with that data two minutes to…

In my experience of having lived all my life in the EU and mostly in 3 countries of the union, all law enforcement here is about intent, unlike the US for instance (as far as I read online ofcourse, like the Nintendo copyright case linked here a week ago). Copyright, drugs, bankrupting your company etc, judges look at intent not literally what the law says. So this will not be different. Nothing will change if you ar…

Mens rea (i.e. intent) is part of common law criminality (along with actus reus, which is the actual doing of something illegal). The United States, having its legal system derived from that of England’s (and thus being a common law legal system), absolutely requires intent when considering whether or not someone or some organization has committed a crime.

I’m not familiar with the referenced Nintendo case, but mens rea is usually only considered in criminal cases. Unless you’re prosecuting someone for illegally downloading copyrighted material or some such thing, intent wouldn’t be considered (it can increase liability in civil cases, though).

Re: How GDPR Will Change The Way You Develop

#547

Post by _o_ »

boredatwork wrote: post #325
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

Sure I delete files that I don't like, but I don't typically rewrite all my old backups to purge them from there too.

Once you have a way to backup data per user, just encrypt them with random key and once the account is deleted, delete the random key. We have done it this way, with having multiple live copies of backup key table on multiple locations and beeing backed up daily purging previous backup. The hard thing was to group the data in a way where we can encrypt them with users random key.

I hope I was helpful :)

Re: How GDPR Will Change The Way You Develop

#548

Post by arkh »

njl wrote: post #332
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

> act as a continuous drag on developing new technologies

Or foster new technologies around privacy and user management.

Re: How GDPR Will Change The Way You Develop

#549

Post by Oomroo »

I can't find a definition of "erasure". Do these count as erasure?:

1) copying a subset of items Y from a set X stored at location A to a new location (e.g. a new disk or another computer) B, then deleting location A (e.g. reformatting disk A)

2) storing all information encrypted with per-person keys, then deleting a person's key

Also how does one prove erasure ?

https://gdpr-info.eu/art-4-gdpr/

Re: How GDPR Will Change The Way You Develop

#550

Post by _petronius »

Oomroo wrote: post #549

I can't find a definition of "erasure". Do these count as erasure?: 1) copying a subset of items Y from a set X stored at location A to a new location (e.g. a new disk or another computer) B, then deleting location A (e.g. reformatting disk A) 2) storing all information encrypted with per-person keys, then deleting a person's key Also how does one prove erasure ? https://gdpr-info.eu/art-4-gdpr/

I think the key here is to think of this in obvious terms: can you (easily) recover the data? Are you trying to trick customers/regulators into thinking you got rid of the data, but really have a secret copy for later? Did you make a good-faith effort to comply with the law? If your answers are no, no, and yes, you’ve got nothing to worry about.

Law isn’t, despite what TV would have you believe, a game of pure technicalities (especially outside the US).

Post reply on HN