Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

591–600 of 710 posts

Re: How GDPR Will Change The Way You Develop

#591

Post by icebraining »

debt wrote: post #179
jacquesm wrote: post #172

Earlier quoted context omitted.

What you do or do not do should not be grounded in the consequences that you will face but in what's the best for your users. If you feel that your users rights are of no concern to you then you are of course entirely able to ignore this law and to pretend it does not exist because in practice there will most likely not be any consequences whatsoever. You do not have a place of business in the EU, you do not transact…

"You do not have a place of business in the EU, you do not transact any business there to begin with so you are free to ignore the law. " Wrong. If you have a customer from the EU or any component of your infrastructure in the EU, you must comply with GPDR.

If you have a customer from the EU (...) you must comply with GPDR.

Nope, you have to specifically target people in the EU:

"In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. (...) the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention"

https://gdpr-info.eu/recitals/no-23/

Re: How GDPR Will Change The Way You Develop

#592

Post by icebraining »

politician wrote: post #236
wglb wrote: post #178

Earlier quoted context omitted.

Consider the case of an EU citizen traveling in the US transaction in USD. This person is covered. Even if they are in the US.

Technically true, but what does the enforcement action actually look like against the small town ice cream shop that doesn't know or care about the rights under the GDPR of a tourist from Spain?

I don't think it's even technically true. The GDPR applies to EU businesses or businesses dealing with people in the EU, not all EU citizens.

Re: How GDPR Will Change The Way You Develop

#593

Post by raducu »

beojan wrote: post #581
raducu wrote: post #579

Earlier quoted context omitted.

I'm sure there will be a lot of hipster-trolls suing left and right, trying to make a name for themselves.

This isn't the US, the law is enforced by governments, not lawsuits.

I lack legal experties, but I'd assume you will easily be able to sue any company and claim they infringe somehow on your rights as stated by this GDPR; maybe I'm wrong.

I attended a GCP event and I could practically see the hipsters pupils dilate/mouth foaming as they went in the hisper frenzy "this GDPR is a huuuge opportunity".

Re: How GDPR Will Change The Way You Develop

#594

Post by kbart »

raducu wrote: post #593
beojan wrote: post #581

Earlier quoted context omitted.

This isn't the US, the law is enforced by governments, not lawsuits.

I lack legal experties, but I'd assume you will easily be able to sue any company and claim they infringe somehow on your rights as stated by this GDPR; maybe I'm wrong. I attended a GCP event and I could practically see the hipsters pupils dilate/mouth foaming as they went in the hisper frenzy "this GDPR is a huuuge opportunity".

You can write a complaint to responsible institutions that then chose how to act (send a warning to violating company, issue them fine, start an investigation etc.) You cannot sue companies yourself, unless you can prove that (big) damage was done to you as a direct consequence of violation, then you can seek compensation via civil lawsuit.

Re: How GDPR Will Change The Way You Develop

#595

Post by walshemj »

dcosson wrote: post #512
njl wrote: post #332

Earlier quoted context omitted.

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

When stuff like this comes up it always seems so weird to me that with all the work that regulators put into this, why can't they at least scratch the surface of providing some specific examples? Of course there are legal documents, and maybe some "for dummies" versions written up about it. But would it be so crazy for these regulators to hire someone who knows something about commonly used open source software and b…

And give up all those expensive multi year court cases for there lawyer friends :-)

Re: How GDPR Will Change The Way You Develop

#596

Post by emilfihlman »

deif wrote: post #387
njl wrote: post #332

Earlier quoted context omitted.

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

Only without consent from the user. Previously it was an ethically grey area to be logging IP addresses anyway. If you are preventing malicious use, then that is allowed as long as you are not using that data outside of the bounds of the user's consent. If, however, a company is storing IP addresses to identify users without their consent and are found to be specifically targeting them without their consent, then tha…

Holy shit what.

IP logging is not ethically ambiguous in any way. It's 100% okay. You chose to connect to that IP. If you don't want your IP logged don't send an IP packet to that address. It's very simple.

This is beyond ridiculous. The entitlement I see here is cancerous in the literal sense.

Re: How GDPR Will Change The Way You Develop

#598

Post by ahultgren »

emilfihlman wrote: post #596
deif wrote: post #387

Earlier quoted context omitted.

Only without consent from the user. Previously it was an ethically grey area to be logging IP addresses anyway. If you are preventing malicious use, then that is allowed as long as you are not using that data outside of the bounds of the user's consent. If, however, a company is storing IP addresses to identify users without their consent and are found to be specifically targeting them without their consent, then tha…

Holy shit what. IP logging is not ethically ambiguous in any way. It's 100% okay. You chose to connect to that IP. If you don't want your IP logged don't send an IP packet to that address. It's very simple. This is beyond ridiculous. The entitlement I see here is cancerous in the literal sense.

Holy shit can't you read up before complaining without knowing the details? There is the exception that you may use and store data that is necessary for providing the service. Thus, since ip is necessary for talking to a server, you don't need to explicitly ask for consent. However you MUST NOT do anything else with that IP, like logging it for longer than necessary or tracking users across sites (without consent).

Why do you need to log ip? To prevent abuse? That's ok. For how long? That's up do you to decide, but it must be motivated and documented.

What's so hard to understand? How is this not perfectly reasonable already? Why are you entitled to not respect other's personal data?

Re: How GDPR Will Change The Way You Develop

#599

Post by ionised »

freeone3000 wrote: post #420
SahAssar wrote: post #384

Earlier quoted context omitted.

It's not given freely unless consent is given, which in most cases it isn't.

You're referring to express consent. However, the user is granting implied consent - they're the ones visiting our website, they're the ones requesting our images and executing our javascript, and they're the ones filling out our forms. We're not forcing them to do any of these things.

Implied consent is not consent.

Re: How GDPR Will Change The Way You Develop

#600

Post by xxs »

moreless wrote: post #587
xxs wrote: post #580

Earlier quoted context omitted.

>A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense... You need retention policies and if you use the web logs for (let's say) detection malicious behavior or troubleshooting, you are in the clear.

Also, you can keep just a hash(seed + IP address) - enough to uniquely identify user session (so you can debug possible problems) but not enough to pinpoint a specific user. Of course in reality nothing is that simple, but it can be done, and it can be done automatically. I am sure there will be GDPR nginx plugins/configs available soon.

Unless you use IPv6 hashing IPv4 address space is way, way too narrow. Hash+seed is trivial to have the original IP recovered So whoever advises that got no idea how hashing (and collision of the latter) works.

(Brute force of few billion hashes in the days of crypto currencies is a walk in the park)

Post reply on HN