GDPR: Don't Panic • Hacker News Board

Re: GDPR: Don't Panic

#611

Post by jonathanyc » Fri, May 18, 2018, 4:28 PM UTC

megaman22 wrote: post #481

Constantly trying to whitewash over the fact that GPDR is a huge pain in the ass and will involve a lot of work for a lot of companies is what I don't understand, but Mr. Mattheij has been doing it for months, so that's evidently very important to him for some reason. It's chewed up a few weeks of active development time putting in features for purging and exporting anything that looks like it might be personal infor…

Oh man, the rest of us are so sorry that you are now required to responsibly handle personal information.

To quote the author:

> Then automate it. If you could automate the collection of the data in the first place then you definitely can automate the rest of the life cycle. There is no technical hurdle companies won’t jump through if it gets them juicy bits of data but as soon as the data needs to be removed we’re suddenly back in the stone age and some artisan with a chisel and hammer will have to jump into action to delete the records and this will take decades for even a small website. Such arguments are not made in good faith and in general make the person making them look pretty silly after all nobody ever complained about collecting data, in fact there are whole armies of programmers working hard to scrape data from public websites which is a lot more work than properly dealing with the life cycle of that data after it has been collected. So yes, it is a burden, no, the burden isn’t huge unless you expressly make it so but that’s your problem.

Re: GDPR: Don't Panic

#612

Post by andrewla » Fri, May 18, 2018, 4:30 PM UTC

I find this confusing:

> Note that the 20 million Euros or 4% of global turnover is the maximum fine, the specific language is ‘a fine up to €20 million or up to 4% of the annual worldwide turnover of the preceding financial year in case of an enterprise, whichever is greater’, so that’s the maximum of the fine that’s being set by the 20 million or the 4%, and this bit is there to ensure that even the likes of Facebook and Google will not simply ignore the law and pay the fine to be able to continue as they have so far. This in no way should be read as you, the small business operator will face a fine of 20 million for each and every infraction that could be found.

Saying that this is intended to be aimed at the Facebooks and Googles is all well and good, but that's covered by the "4%" criterion. The €20 million figure is aimed at companies that have a global turnover of less than €500M, not the Googles and Facebooks. That's why it's scary.

Re: GDPR: Don't Panic

#613

Post by frockington » Fri, May 18, 2018, 4:33 PM UTC

dragonwriter wrote: post #609

frockington wrote: post #520

Earlier quoted context omitted.

If the court seals the record its nearly impossible for anyone but government agencies to discover

> If the court seals the record its nearly impossible for anyone but government agencies to discover No, it is not, because background check and other third-party intelligence firms aren't purely reactive now, they have and use tools to proactively vacuum up public records and maintain their own DBs. After-the-fact sealing of arrest records or expunging of convictions has no effect on data that is already in third-pa…

Never knew this, so is it that just no employer cares enough about minor misdemeanors or the cost of doing so makes it not worthwhile? I've never heard of anyone getting a job offer taken back because of a minor misdemaonor

Re: GDPR: Don't Panic

#614

Post by thomaskcr » Fri, May 18, 2018, 4:34 PM UTC

guitarbill wrote: post #596

thomaskcr wrote: post #580

Earlier quoted context omitted.

It's not that it's annoying, it's that I literally cannot answer "are we GDPR compliant?". If you search for GDPR IP address, you get a ton of different opinions. Do I need to sanitize logs? How does that fit in with the requirements for security compliance we are also subject to? At the end of the day, I am the one person who has to answer that question/is responsible for being GDPR compliant. I've spent hours doing…

So everything should be written out explicitly, because you'd rather complete a checkbox-ticking exercise rather than thinking about it and do the correct, ethical thing in good faith? Sounds like a win for the GDPR to me, we know rigid checkbox-ticking is ineffective. Apart from that, NIST 800-53/800-171 are catalogs of "security controls and associated assessment procedures" for "Federal Information Systems and Org…

> NIST 800-53/800-171 are catalogs of "security controls and associated assessment procedures"

Yes, so a law or rule or EO says "you must be compliant with this framework" - the GDPR just left off the part where they have controls/a framework.

It's not rigid box ticking, a control defines what you need to do. How you do that is up to you and should be updated often as things evolve. For example, in the GDPR I would say you must catalog data collected and perform a personal data assessment with justification for whether "piece of data" is personal data or not. I can comply with that, I have lots of supporting documentation that an IP address does not personally identify a person.

Then if a regulator releases a clarification that an IP address is personal data or the consensus of the security community changes or whatever happens, I just update my security plan and make sure the IP address is handled the same as all of the other personal data in our systems and I was never out of compliance.

It basically works the same in practice, you must make a good faith effort to comply -- but proving you made a good faith effort and documenting what you did and why is also part of the compliance framework. The GDPR doesn't have that, you're at the whims of the EU because there is nothing except internet opinions on how to comply.

Re: GDPR: Don't Panic

#615

Post by jacquesm » Fri, May 18, 2018, 4:35 PM UTC

SomeGermanGuy wrote: post #552

aeorgnoieang wrote: post #548

Earlier quoted context omitted.

> > The law has been in effect for over two years at this point So what's this whole thing that's going to happen soon? It's going into double effect or something?

The law was made public two years ago, to give companies time to get compliant. It actually goes into effect next friday.

It was already in effect, it just wasn't enforceable and that is what is changing next Friday.

Re: GDPR: Don't Panic

#616

Post by mindslight » Fri, May 18, 2018, 4:37 PM UTC

charleslmunger wrote: post #575

caffeine5150 wrote: post #512

I'm an attorney who's spent the last year or so working on GDPR compliance for a US SaaS provider some of whose clients have EU employees. My understanding is that it's true that EU enforcement is more in the spirit of "how can we get you compliant?" before doling out fines (vs. the US where it can be more "let's make an example of this company by hitting them with a big fine" and scaring others into compliance). I a…

The Honda case actually seems pretty reasonable to fine - Honda had an issue where consent from dealer events and other sources wasn't correctly recorded. So they have a large list of emails, where consent falls into three categories: * Person did not consent, they left the form blank * Person consented, but it was not recorded * Person actively denied consent ( wrote "no") Honda then sent commercial email to this se…

Also 13k/350k is 4 pence per email, which is tiny! Well below what they'd have had to pay if pay-to-be-received had been workable.

I'm not a fan of government or of fines, but this amount isn't even a slap on the wrist.

Re: GDPR: Don't Panic

#617

Post by Kalium » Fri, May 18, 2018, 4:38 PM UTC

guitarbill wrote: post #596

thomaskcr wrote: post #580

Earlier quoted context omitted.

It's not that it's annoying, it's that I literally cannot answer "are we GDPR compliant?". If you search for GDPR IP address, you get a ton of different opinions. Do I need to sanitize logs? How does that fit in with the requirements for security compliance we are also subject to? At the end of the day, I am the one person who has to answer that question/is responsible for being GDPR compliant. I've spent hours doing…

So everything should be written out explicitly, because you'd rather complete a checkbox-ticking exercise rather than thinking about it and do the correct, ethical thing in good faith? Sounds like a win for the GDPR to me, we know rigid checkbox-ticking is ineffective. Apart from that, NIST 800-53/800-171 are catalogs of "security controls and associated assessment procedures" for "Federal Information Systems and Org…

> So everything should be written out explicitly, because you'd rather complete a checkbox-ticking exercise rather than thinking about it and do the correct, ethical thing in good faith?

When doing the ethical, moral, right, correct thing might still be considered falling short of "reasonable measures" by some bureaucrat? It might be kinda nice to have had more detailed guidance.

Re: GDPR: Don't Panic

#618

Post by jacquesm » Fri, May 18, 2018, 4:38 PM UTC

jonathanoliver wrote: post #332

emiliobumachar wrote: post #177

Nice post. Typo: "food safety laws" is listed twice in the bullet points for the lemonade stand.

I was wondering if that was a joke, for added emphasis, or a mistake.

It was a mistake, thank you both, it has been fixed.

Re: GDPR: Don't Panic

#619

Post by andrewla » Fri, May 18, 2018, 4:39 PM UTC

dragonwriter wrote: post #605

meredydd wrote: post #339

Earlier quoted context omitted.

I think you and everyone making similar points in this thread are getting tripped up by the difference between rules-based regulation and principles-based regulation. This is unsurprising, given that the US is so heavily rules-based, but the EU (certainly the UK) has a long history of principles-based regulation. In rules-based regulation, all the rules are spelled out in advance, and the regulator is basically an au…

> In rules-based regulation, all the rules are spelled out in advance, and the regulator is basically an automaton once the rules are set. Given that description, after a couple decades working in some and dealing daily with the acts of other agencies who which issue and apply regulations on the US, let me assure you that the regulatory system in the US is nothing at all like “rule-based” as you have described it.

I have also been extensively involved in compliance issues at US companies in the financial space and this comment is dead-on. The idea of rule-based regulations is a complete straw man as far as I can tell.

Re: GDPR: Don't Panic

#620

Post by BjoernKW » Fri, May 18, 2018, 4:39 PM UTC

Sangermaine wrote: post #587

BjoernKW wrote: post #142

There's certainly no need to panic. The article doesn't address that apart from mindless hysteria there are some very real issues with GDPR. It doesn't have to of course because as the title suggests it's more about dispelling panic than about giving concrete advice. However, many real-life problems seemingly haven't even been considered by legislative bodies. In GDPR support forums questions like these have been rou…

>How will I be able to operate my small company website in the future in a legally compliant manner? Maybe you shouldn't operate your company if you can't comply, then. The entire point of the GDPR is elevating privacy as a priority. If that means companies that can't or won't compy can't operate, so be it. People always claim to be pro-privacy, and that means putting privacy above commerce, in the same way that a re…

If safety and sanitation regulations were as heavy-handed as GDPR there probably wouldn't be too many restaurants.

The point of GDPR indeed is elevating privacy as a priority. Good intent however doesn't automatically entail that the implementation has been equally good.

The EU Justice Commissioner only recently has been quoted that she herself could implement the rules required by GDPR. At the same time the European Commission's very own website isn't even remotely GDPR-compliant. That's just arrogant and condescending.