Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

561–570 of 710 posts

Re: How GDPR Will Change The Way You Develop

#561

Post by grabeh »

_o_ wrote: post #524
LoSboccacc wrote: post #522

Earlier quoted context omitted.

There’s more to that. Startups now exists as a constellation of services and it’s quite hard to tell what goes into a PIA document and whar not. Say our landing web page contains an intercom chat widget and google analytics tracking. At that point we have collected the user ip at most, which would become sensitive only if connected with data from two other businness entities. What the heck am I supposed to write into…

Ask your chat provider if he is GDPR compliant, he will provide you the confirmations that you need to add to your page. Regarding google analytics, you are risking getting banned if you feed it with personal data (including ip). https://gdpr.report/news/2018/02/01/gdpr-google-analytics-2/ If I were you, I would add my own chat (there is bunch of them on github) and use piwik instead of google analytics. (By the rule…

There are several grounds on which you can legally process data in addition to consent, so it is unhelpful to talk in general terms about purging data where you are not getting user consent. If you are using data to provide a service, then generally it will not a consent-based processing for example.

You have to assess each use to which you put any personal data and determine the correct processing basis for that usage. Often there are more relevant bases than consent.

I do appreciate that the definition of 'consent' in this regard is often thought of in different terms though. When I think of consent I think of the narrow data protection consent, whereas I think often in layman's terms it has a broader definition which is often linked to disclosure requirements in relation to privacy policies etc.

Re: How GDPR Will Change The Way You Develop

#562

Post by belzsch »

njl wrote: post #332
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

Web logs are not a punishable offence under the GDPR, if you have a legal basis for retaining those logs and reasonable retention and data minimisation policies. If those are in place and you've documented them, you have nothing to worry about.

Why? You have a legitimate interest (one of the six legal bases under the GDPR) to combat fraud and maintain information security. That's the primary reason you have those IPs in your logs in the first place.

If you're using those logs for analytics purposes, things get slightly murkier, but if you're just using IP addresses to enrich your log data with GeoIP, you should be fine. You might even be able to get away with more granular third-party databases, but the more detailed you get, the closer you get to profiling (which is not where you want to be, if you want to minimise your legal fees).

More to the point, I don't understand all this talk about web logs being illegal. If people have collected and processed personal data without thinking about the whys and wherefores, isn't it just a good thing this makes one think about what one is logging and what it's used for? Granted, IP addresses are far from sensitive (depending on your threat model), but I've seen things in technical logs that make me happy about reliable automated retention policies. Also, granted, it's a hassle - that's the price you pay for privacy.

I'd still be glad if nginx et al shipped with more GDPR-compatible defaults.

Re: How GDPR Will Change The Way You Develop

#563

Post by PeterisP »

sobani wrote: post #554
_o_ wrote: post #528

Earlier quoted context omitted.

No it will not. For consent it is explicitly forbiden to use legal / technical speech and you can't cascade it. Allowing you to use my data has nothing to do with you giving my data to google. The more 3rd party "providers" the more fishy will your site look. And you can bet the user wont give consent for 100 tick boxes - you can't pretick them, it needs to be opt-in. And this is the reason: https://www.paypal.com/ie…

A quick scan through that list doesn't raise any red flags for me. Of course they need to share data with payment providers (like a bank), or else they won't be able to get or deposit your money. Of course they need to share data with auditing firms, or else they won't be able to do business in certain countries. Of course they need to provide customer service. Of course they need to check for fraud. etc. What do you…

Many of the things listed above (legal requirements, etc) don't actually require consent, so they have different criteria - in essence, Paypal just needs to clearly inform the user what they're doing. Consent is just one of six criteria that may allow you to use private data; the actually necessary (as opposed to merely desirable/profitable) use cases of the data fall under one of the other criteria and don't require obtaining consent.

Consent is mostly relevant to all the marketing and customer analysis activities, which aren't essential to the service, so can be refused, and would be severely curtailed as users stop consenting to these uses of their data.

Re: How GDPR Will Change The Way You Develop

#564

Post by danieltillett »

e12e wrote: post #533
danieltillett wrote: post #470

Earlier quoted context omitted.

Performance data is not going to tell me where the users are located. Yes it was only because I had the logs was I able to do this analysis. The issue is not over these sort of analyses which I am sure nobody would object to, but that GDPR casts such a wide net.

You implied you already had "local" servers - it sounded like bandwidth/load information might indicate the area were load was increasing.

Local to the market - actually they are regional.

The complication is that I have a client-based fallover where when one server becomes overloaded the client is switched automatically over to a different server (client based load balancing). This make it hard to sort out where the load is coming from without looking at the IP address.

Re: How GDPR Will Change The Way You Develop

#565

Post by chopin »

kasey_junk wrote: post #458
chopin wrote: post #346

Earlier quoted context omitted.

Don't slurp up data worldwide, then. If you don't do that, you're fine. If you do business you'd better know the law of your target audience, isn't it?

How does one avoid people making web requests originating in Europe from reaching your servers else where? The obvious answer is by geographically identifying them by IP. Which GDPR makes pains to point out is personal data.

So you don't store data from that IP? How is this a problem? And that's perfectly compliant with the GDPR.

It seems you can't be bothered to not store data.

Re: How GDPR Will Change The Way You Develop

#566

Post by mrweasel »

rorykoehler wrote: post #543
nrjames wrote: post #505

Earlier quoted context omitted.

Again, you do not have to if is business critical and used for fraud prevention. You must routinely delete logs before they get too old (60-90 days maybe), but you do not need to take special action beyond that. I’m not saying the GDPR isn’t troublesome, but having spent the better part of the last 6 months combing through the law and interpretations of it, I think the concern over IP addresses in log files that can…

Other countries mandate that we keep logs for 7 years. This is unworkable.

I believe that you're okay in that case. Some countries in the EU require that you have financial records stored for five years, and they will always contain personal identifiable information. The GDPR states, if I recall correctly, that because some other law requires you to store the information for X number of years, the customer can't force you to delete it.

Similarly credit agencies aren't required to comply with deletion requests either. You can't simply GDPR your way out of a bad credit score.

But it's a total mess, when you read the GDPR it's clear that it's written by people with limited understanding of IT. Of cause it has to be extremely strict, otherwise you'll end up with a Cookie-law 2.0. The cookie law from the EU was read by the industry in a way that clearly wasn't intended. It made zero different to user tracking, we just got a bunch of pop-ups stating that the site uses Cookie. If you read that law as I believe it was intended, the idea would be that you could say yes to cookies or no. If you choose no, the site would disable the use of tracking cookies. But was to much work, so people just slapped a cookie pop-up on their sites.

Re: How GDPR Will Change The Way You Develop

#567

Post by danieltillett »

TheCoelacanth wrote: post #501
danieltillett wrote: post #493

Earlier quoted context omitted.

There is an “or” not an “and” between these two clauses. It applies if you offer any goods or service, OR monitor behaviour inside the EU. It is interesting that the monitoring clause only applied if the subject is inside the EU when the monitoring is done, while the service or goods clause applies if the person is inside the EU with no requirement that the service or good was acquire or used within the EU. I can’t r…

Both clauses explicitly limit their scope to the EU. > the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union > the monitoring of their behaviour as far as their behaviour takes place within the Union .

No they don't. The first is limited to subjects in the EU while the second is limited to activity in EU. If the first clause was limited to activities that take place within the EU the clause would say this - actually there would be no need for two clauses as you would just have one clause that says sale, service and monitoring.

Re: How GDPR Will Change The Way You Develop

#568

Post by danieltillett »

s73v3r_ wrote: post #515
danieltillett wrote: post #478

Earlier quoted context omitted.

The regulations are ridiculously broad [0]. They appear to cover everyone in the world no matter where they are or what their citizenship. The EU seems to be aiming for a universal human right. "The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence , respect their fundamental rights and freedoms, in partic…

That's the intro statement. That's like saying the Declaration of Independence is overly broad because it says that "all men are created equal."

See my posts down thread for the more detailed clauses.

Re: How GDPR Will Change The Way You Develop

#569

Post by mrweasel »

OrganicMSG wrote: post #483
hanoz wrote: post #468

Earlier quoted context omitted.

IP addresses are deemed personally identifiable information. All web servers log these by default - before asking users for permission to do so - and are therefore, bafflingly, about to become illegal.

How does this work out for Git repos and other things with encryption backed histories? If I run a software project and a developer wants an identifying section of a repo back-edited, do I have to edit and rebase the whole repo, and what does this do to the trust in a project that is based on a verifiable history? Also, I can't help but notice that currently there is a hell of a lot of money being bet on immutable pu…

> Also, I can't help but notice that currently there is a hell of a lot of money being bet on immutable public ledgers.

I've been pondering the same thing. You have to be extremely careful about building a new product on blockchain technology, because, depending on what you're building, you may be required to delete stuff from it in the future.

Re: How GDPR Will Change The Way You Develop

#570

Post by _o_ »

sobani wrote: post #554
_o_ wrote: post #528

Earlier quoted context omitted.

No it will not. For consent it is explicitly forbiden to use legal / technical speech and you can't cascade it. Allowing you to use my data has nothing to do with you giving my data to google. The more 3rd party "providers" the more fishy will your site look. And you can bet the user wont give consent for 100 tick boxes - you can't pretick them, it needs to be opt-in. And this is the reason: https://www.paypal.com/ie…

A quick scan through that list doesn't raise any red flags for me. Of course they need to share data with payment providers (like a bank), or else they won't be able to get or deposit your money. Of course they need to share data with auditing firms, or else they won't be able to do business in certain countries. Of course they need to provide customer service. Of course they need to check for fraud. etc. What do you…

Check it a little bit better, grep for "market". Google? Facebook (i dont have FB account, never had!)? I can hardly wait to NOT tick those and demand view of shared data.

They are already profiting from the service they provide but they still give (Sell! I bet they can use a different terminology but essentially this is it) the users data to other companies.

Those are the companies that brought GDPR on all of us, and those are the parties that should be punished with 4% global revenue, multiple times.

I bet everyone will be shocked what the companies are doing with our data, from our banks, credit card companies, insurance companies,... i think that everyone (or most) will stop complaining about GDPR and want it for their country too.

Just an example, what gets delivered just for Facebook: "Advertising ID and device ID to segment user groups based on app behaviour, encrypted e-mail address associated with PayPal users (without indicating account relationship), IP Address, Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages, ads and emails delivered to users. Mobile advertiser ID, IP Address and other metadata via Facebook SDK in mobile apps."

Encrypted e-mail address? Why encrypted, not hashed? IP? Why the FB needs my IP on connecting to paypal? And the list goes on and on. If GDPR will stop this the whole world will benefit.

Post reply on HN