571–580 of 710 posts
Earlier quoted context omitted.
The problem is that the law applies to them even if they use a proxy. If they report/sue you afterwards, you might be looking at a huge amount of trouble.
People will just add a checkbox that the customer must check to complete the transaction: [] I affirm that I an not an EU citizen.
I can't find a definition of "erasure". Do these count as erasure?: 1) copying a subset of items Y from a set X stored at location A to a new location (e.g. a new disk or another computer) B, then deleting location A (e.g. reformatting disk A) 2) storing all information encrypted with per-person keys, then deleting a person's key Also how does one prove erasure ? https://gdpr-info.eu/art-4-gdpr/
I think the key here is to think of this in obvious terms: can you (easily) recover the data? Are you trying to trick customers/regulators into thinking you got rid of the data, but really have a secret copy for later? Did you make a good-faith effort to comply with the law? If your answers are no, no, and yes, you’ve got nothing to worry about. Law isn’t, despite what TV would have you believe, a game of pure techni…
This rules out encryption+key-deletion as erasure because while you may not be able to (easily) recover the data, someone with more computing power could (now or in the future)
What about old magnetic disks and tape backups ? Even if you erase them they could possibly be recovered by someone else with the right resources
Earlier quoted context omitted.
IP addresses are deemed personally identifiable information. All web servers log these by default - before asking users for permission to do so - and are therefore, bafflingly, about to become illegal.
How does this work out for Git repos and other things with encryption backed histories? If I run a software project and a developer wants an identifying section of a repo back-edited, do I have to edit and rebase the whole repo, and what does this do to the trust in a project that is based on a verifiable history? Also, I can't help but notice that currently there is a hell of a lot of money being bet on immutable pu…
The tricky situation is when someone puts personal data not about themselves, but about a third party into a public ledger...
Earlier quoted context omitted.
What do you mean one-offs? Pretty much every company with an engineer on staff is collecting as much data as they can with zero regard to the user's expectations of privacy. The regulation exists to stop an epidemic, not to act on a few one-offs.
If the user wanted privacy, they wouldn't be giving data to our services. It's a bit ridiculous to punish us for keeping what users freely give us.
Hypocrites always wanna play innocent
Always want to take it to the full out extent
Always want to make it seem like good intent
Never want to face it when it time for punishmentEarlier quoted context omitted.
You think I am reaching, but the GDPR does act this way. Lets say your visiting the USA as an EU citizen and you get a pizza delivery from a local small pizza shop. They put your name and delivery address in their computer in an MS Access database that makes stickers, emails the delivery guy's gmail account and a person delivers a pizza to you. They have no idea your an EU citizen and they just put enough information…
You clearly don't know what you are talking about. Article 3 clearly states that it applies to > the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or > the monitoring of their behaviour as far as their behaviour takes place within the Union. It does not apply EU citizens while traveling outside of the EU. It applies when you are m…
Earlier quoted context omitted.
Extreme example: you are standing in the way of my car.
Extremer example: you jumped in front of of my car.
I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…
If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…
I seriously don't get what's the huge deal about this. Of course it sucks but it's not THAT hard to implement.
Earlier quoted context omitted.
Other countries mandate that we keep logs for 7 years. This is unworkable.
I believe that you're okay in that case. Some countries in the EU require that you have financial records stored for five years, and they will always contain personal identifiable information. The GDPR states, if I recall correctly, that because some other law requires you to store the information for X number of years, the customer can't force you to delete it. Similarly credit agencies aren't required to comply wit…
Earlier quoted context omitted.
> This is just going to be another way for EU regulators to smack around Google and Facebook. Actually, it's more like a giant gift to Google and Facebook: GDPR borders on regulatory capture, with only the giants really having the resources to comply properly. This will hurt startups and smaller firms far more than it will the big dogs with their armies of compliance lawyers.
That assumes enforcement will be homogeneous.
I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…
If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…
You need retention policies and if you use the web logs for (let's say) detection malicious behavior or troubleshooting, you are in the clear.