Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

611–620 of 710 posts

Re: How GDPR Will Change The Way You Develop

#611

Post by poooogles »

adrianN wrote: post #605
nrjames wrote: post #505

Earlier quoted context omitted.

Again, you do not have to if is business critical and used for fraud prevention. You must routinely delete logs before they get too old (60-90 days maybe), but you do not need to take special action beyond that. I’m not saying the GDPR isn’t troublesome, but having spent the better part of the last 6 months combing through the law and interpretations of it, I think the concern over IP addresses in log files that can…

You'd also have to argue why you need to store the IP and not just a hash of the IP if it's just for fraud prevention.

If you're using an IPv4 address as a seed then that's pretty useless due to the small address space.

Re: How GDPR Will Change The Way You Develop

#612

Post by OrganicMSG »

gnud wrote: post #573
OrganicMSG wrote: post #483

Earlier quoted context omitted.

How does this work out for Git repos and other things with encryption backed histories? If I run a software project and a developer wants an identifying section of a repo back-edited, do I have to edit and rebase the whole repo, and what does this do to the trust in a project that is based on a verifiable history? Also, I can't help but notice that currently there is a hell of a lot of money being bet on immutable pu…

If this is an opern source repo on GitHub/GitLab, I think you could argue that the developer "made the data public" in giving it to you in the first place. That's an exception to the requirement to delete data. The same goes for public ledgers. The tricky situation is when someone puts personal data not about themselves, but about a third party into a public ledger...

I've been reading through the text of the act, and while there is an exception allowing you to process data that has been made explicitly public by the person it relates to without asking them for permission, it seems to indicate that you still have to give them the ability to edit it later.

Re: How GDPR Will Change The Way You Develop

#613

Post by TheCoelacanth »

danieltillett wrote: post #567
TheCoelacanth wrote: post #501

Earlier quoted context omitted.

Both clauses explicitly limit their scope to the EU. > the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union > the monitoring of their behaviour as far as their behaviour takes place within the Union .

No they don't. The first is limited to subjects in the EU while the second is limited to activity in EU. If the first clause was limited to activities that take place within the EU the clause would say this - actually there would be no need for two clauses as you would just have one clause that says sale, service and monitoring.

It clearly says offering goods and services to subjects in the Union. It only applies if they are in the Union when you are offering them goods or services. If you offer them goods or services outside of the Union and they later enter the Union, you didn't offer goods to someone in the Union, so GDPR doesn't apply.

Re: How GDPR Will Change The Way You Develop

#614

Post by PeterisP »

icebraining wrote: post #557
OrganicMSG wrote: post #483

Earlier quoted context omitted.

How does this work out for Git repos and other things with encryption backed histories? If I run a software project and a developer wants an identifying section of a repo back-edited, do I have to edit and rebase the whole repo, and what does this do to the trust in a project that is based on a verifiable history? Also, I can't help but notice that currently there is a hell of a lot of money being bet on immutable pu…

Why are you accepting PII into your software projects' source repository in the first place?

Source repositories in many (most?) companies include the full names of the employees who authored every particular commit. This is PII. GDPR refers to all personal information you're handling, not excluding information of your employees.

Re: How GDPR Will Change The Way You Develop

#615

Post by rmc »

beojan wrote: post #581
raducu wrote: post #579

Earlier quoted context omitted.

I'm sure there will be a lot of hipster-trolls suing left and right, trying to make a name for themselves.

This isn't the US, the law is enforced by governments, not lawsuits.

Actually one new thing about the GDPR is that consumer rights organisations can sue companies/organisations to enforce privacy rights.

Max Schrems (who's case killed Safe Harbour) has set up an org None of your Business (https://noyb.eu) to do exactly this.

Re: How GDPR Will Change The Way You Develop

#616

Post by raverbashing »

FlyingAvatar wrote: post #604
ahultgren wrote: post #598

Earlier quoted context omitted.

Holy shit can't you read up before complaining without knowing the details? There is the exception that you may use and store data that is necessary for providing the service. Thus, since ip is necessary for talking to a server, you don't need to explicitly ask for consent. However you MUST NOT do anything else with that IP, like logging it for longer than necessary or tracking users across sites (without consent). W…

You knock on my door and I write down that you visited me. Why is it somehow reasonable to compel me to forget that interaction existed?

It's ok to take a picture of the street out of your front window

It's not ok to take a picture of everyone that walks in front of your house, timestamped and on top of that you search their picture on Facebook (supposing you could do that) and keep all that info forever

Re: How GDPR Will Change The Way You Develop

#617

Post by rmc »

icebraining wrote: post #557
OrganicMSG wrote: post #483

Earlier quoted context omitted.

How does this work out for Git repos and other things with encryption backed histories? If I run a software project and a developer wants an identifying section of a repo back-edited, do I have to edit and rebase the whole repo, and what does this do to the trust in a project that is based on a verifiable history? Also, I can't help but notice that currently there is a hell of a lot of money being bet on immutable pu…

Why are you accepting PII into your software projects' source repository in the first place?

I presume email addresses are PII?

Re: How GDPR Will Change The Way You Develop

#618

Post by PeterisP »

wtfstatists wrote: post #484
the_mitsuhiko wrote: post #339

Earlier quoted context omitted.

> We're not doing anything shady with the data we do have But you can never guarantee that someone else won't do. The biggest issue to user's privacy has traditionally been data breaches. So even if you don't want to do something shady, a data loss might still be highly problematic for users. I agree that IP addresses are unlikely to be the biggest concern here however.

The biggest issue to user's privacy has traditionally been data breaches. Peoples lives and most intimate details is going to be stored as bits. Get used to it. Whether for targeting purpose (Facebook) or personal reasons (Strava). Whether stored on remote servers or home. It wont affect likeliness of data breaches. Focus on good software designs and let programmers design such systems in peace. All this needed was f…

GDPR is designed to not simply accept that "Peoples lives and most intimate details is going to be stored as bits. Get used to it." but instead try to change that.

Changing that is nontrivial, since it requires changing the behavior of everyone handling this data - so, something that can be done only by law. It will restrict Facebook, it will restrict Strava, it will restrict data stored on remote servers and home. While it won't affect likeliness of data breaches, it will affect the impact of data breaches - realistically speaking, many of the breached companies should not have had most or even all of that private data in the first place.

A data breach can't reveal information that you don't store; so a push to ensure that less companies are storing sensitive data, and those who do are storing less of it - that's something long overdue. GDPR is not designed to have people do X, Y and Z so that they can keep doing business as before; it's designed to ensure that many (most?) places where private data is used simply stop doing so.

Re: How GDPR Will Change The Way You Develop

#619

Post by bkor »

FlyingAvatar wrote: post #604
ahultgren wrote: post #598

Earlier quoted context omitted.

Holy shit can't you read up before complaining without knowing the details? There is the exception that you may use and store data that is necessary for providing the service. Thus, since ip is necessary for talking to a server, you don't need to explicitly ask for consent. However you MUST NOT do anything else with that IP, like logging it for longer than necessary or tracking users across sites (without consent). W…

You knock on my door and I write down that you visited me. Why is it somehow reasonable to compel me to forget that interaction existed?

Because 1) your analogy is off. People forget, a machine does not 2) GDPR is about privacy; tracking people's behaviour, linking things together without explicit consent is not allowed according to GDPR.

Re: How GDPR Will Change The Way You Develop

#620

Post by rmc »

notyourday wrote: post #380
77pt77 wrote: post #287

Earlier quoted context omitted.

> The only thing that GDPR wants from you is to handle others data with same RESPECT as you handle yours. Plus a minimum of 20M€ fine in case they don't think your "common sense" is good enough. For a one man shop that is not working under the legal protection an LLC or equivalent provides, this can be deadly!

Good luck to EU trying to enforce it against JoeSchmoeLLC from PA

It's HipNewStartupLLC in Delaware that's got more to worry about. VCs will want growth, and at the start things go up. Then they want to expand to the EU, and they've hit the road block.
Post reply on HN