581–590 of 710 posts
Earlier quoted context omitted.
If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…
When stuff like this comes up it always seems so weird to me that with all the work that regulators put into this, why can't they at least scratch the surface of providing some specific examples? Of course there are legal documents, and maybe some "for dummies" versions written up about it. But would it be so crazy for these regulators to hire someone who knows something about commonly used open source software and b…
Technology is something which constantly changes. From the point of view of the legislator, legal text that is too concrete will stagnate innovation and progress by "locking" people into current technological assumptions. The text becomes inappropriate/outdated when the next wave of technologies come along.
Thus legislators try to document the spirit behind a legislation and try to stay away from concrete implementation details as much as possible, in order to give people maximum freedom to decide how they should implement things, and maximum freedom in technology choices.
So yes, to us implementors it is a hassle because we have no idea what we should concretely do. But we can also see this as freedom to explore how to best implement an idea.
I expect that in the next few months/years, domain experts such as us will debate and decide on implementation best practices.
Earlier quoted context omitted.
It also applies to users that are not EU citizens, but are located in the EU.
Don't most regulations? I'm not a citizen of a certain state, but when I drive through it, I still have to abide by their speed limit laws.
There’s many other regulations that only apply to citizens and not based on location.
Earlier quoted context omitted.
And what happens when anything of that changes in scope? You gonna resend the consent form to each and every past user? Of corse not. What will happen instead is that behind a consent box a lengthy disclaimer will ask consent for every piece of information and blanket every length of scope, triggering a cascade across providers and contractors.
Can you elaborate about what exactly do you mean by "anything of that changes in scope"? If you have the same use case of private data but have technical changes (i.e. a different subcontractor handling the processing) then you do not need a new consent. If you have a new use case, then yes, you get to use only the data of those users who agree to it. Which will not be all users anyway, as consent must be freely give…
Either these laws or will be ignored or more and more business will move out of European countries to abide by this law, which Europe really can't afford. I'll happily ignore this law.
Earlier quoted context omitted.
In my experience of having lived all my life in the EU and mostly in 3 countries of the union, all law enforcement here is about intent, unlike the US for instance (as far as I read online ofcourse, like the Nintendo copyright case linked here a week ago). Copyright, drugs, bankrupting your company etc, judges look at intent not literally what the law says. So this will not be different. Nothing will change if you ar…
Mens rea (i.e. intent) is part of common law criminality (along with actus reus, which is the actual doing of something illegal). The United States, having its legal system derived from that of England’s (and thus being a common law legal system), absolutely requires intent when considering whether or not someone or some organization has committed a crime. I’m not familiar with the referenced Nintendo case, but mens…
Earlier quoted context omitted.
If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…
>A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense... You need retention policies and if you use the web logs for (let's say) detection malicious behavior or troubleshooting, you are in the clear.
Of course in reality nothing is that simple, but it can be done, and it can be done automatically. I am sure there will be GDPR nginx plugins/configs available soon.
Earlier quoted context omitted.
And what happens when anything of that changes in scope? You gonna resend the consent form to each and every past user? Of corse not. What will happen instead is that behind a consent box a lengthy disclaimer will ask consent for every piece of information and blanket every length of scope, triggering a cascade across providers and contractors.
Can you elaborate about what exactly do you mean by "anything of that changes in scope"? If you have the same use case of private data but have technical changes (i.e. a different subcontractor handling the processing) then you do not need a new consent. If you have a new use case, then yes, you get to use only the data of those users who agree to it. Which will not be all users anyway, as consent must be freely give…
That is not how some are reading it. It's not how I've understood Article 28(2) either, though getting new consent each time is nuts (e.g. I change from Mailgun to Postmark and have to ask all SaaS customers for consent).
Some discussions: https://seqlegal.com/blog/article-28-gdpr-problems-processor... https://seqlegal.com/blog/gdpr-sub-processors-and-authorisat...
Earlier quoted context omitted.
"no matter if it's one dude in Florida who happens to also be French." That's not true.
Is he a French citizen? My understanding is that GDPR applies to you (in theory) if you have any EU citizens as customers. Am I misunderstanding? Why is this incorrect?
Earlier quoted context omitted.
If you don't do any business in the EU I'm not sure how the new law would apply.
So we should have a whitelist of countries we decide we are "doing business" in and block all other traffic globally?