Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

621–630 of 710 posts

Re: How GDPR Will Change The Way You Develop

#621

Post by rmc »

robin_reala wrote: post #69
aeorgnoieang wrote: post #58

What's troubling to me is that it's very unclear what specifically is required. I know the linked post isn't legal advice, but in the page about 'privacy by design' linked to by the origin link, they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! Can a…

> Can any site just 'do an end run around' the law by requiring their users to agree to allow them to collect whatever data they collect now or that they've already collected? No: a consent from a user must be for granular information with a specific listed purpose.

And consent can be revoked, and must be as easy to revoke as to give.

Re: How GDPR Will Change The Way You Develop

#622

Post by xxs »

notyourday wrote: post #380
77pt77 wrote: post #287

Earlier quoted context omitted.

> The only thing that GDPR wants from you is to handle others data with same RESPECT as you handle yours. Plus a minimum of 20M€ fine in case they don't think your "common sense" is good enough. For a one man shop that is not working under the legal protection an LLC or equivalent provides, this can be deadly!

Good luck to EU trying to enforce it against JoeSchmoeLLC from PA

The company from PA (USA) needs a EU VAT number to operate in the EU... The VAT registration would be revoked in the specific member state where it was issued.

If there is a tax agreement between a specific member state (EU) and the US, IRS can show interest in Joe. If there are like a thousand sales in a specific member state (the taxation is not EU wide global), no one will show interested, so if Joe is small - it's very likely Joe is safe.

Operating w/o the VAT could also spring money laundering interests -- the institutions concerned with anti-money-laundering cases tend to have rather long reach.

Re: How GDPR Will Change The Way You Develop

#623

Post by PeterisP »

chii wrote: post #552
robin_reala wrote: post #84

Earlier quoted context omitted.

You’re thinking about it in terms of pieces of information, but GDPR thinks about it more in terms of the uses of that information. You wouldn’t expect to ask a user “Can we store your email address?“. The granular action for storing the email address is “Can we email you from time to time product offers?”. Once the user consents then that email address (and potentially full name, etc etc) can only be used for that c…

The problem I have is that a site could tie acceptance with allowance. e.g., I run a free, ads and promotion funded site, but I actually supplement revenue by selling the user's actions on the site to a third party. users can also have accumulated virtual currency as rewards, which can be used for premium sections of the site. then along comes GDPR, and I tie acceptance of some virtual currency rewards with acceptanc…

No, that's not presumed to be freely given consent.

https://gdpr-info.eu/recitals/no-43/ "Consent is presumed not to be freely given if ... the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance."

If the data is actually needed to execute the contract (i.e. a delivery address if you're mailing stuff to the user), then you don't need separate consent; but if it's not (e.g. just revenue) then any "confirmation clicks" that are tied to site access being cut off would be just that - simply clicks that don't count as freely given consent.

Also, if you consider giving a reward for acceptance of GDPR consent, then you must also consider that consent can be revoked at any time (including 5 seconds afterward) and it must be literally as easy to withdraw consent as it is to give it.

Re: How GDPR Will Change The Way You Develop

#624

Post by srrr »

dcosson wrote: post #512
njl wrote: post #332

Earlier quoted context omitted.

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

When stuff like this comes up it always seems so weird to me that with all the work that regulators put into this, why can't they at least scratch the surface of providing some specific examples? Of course there are legal documents, and maybe some "for dummies" versions written up about it. But would it be so crazy for these regulators to hire someone who knows something about commonly used open source software and b…

As others have noted: Laws with examples would be to specific to survive fast technological changes. Laws do mostly contain the 'spirit' of the idea and are applicable to many different situations and times.

But the European Commission does gives examples: https://ec.europa.eu/info/law/law-topic/data-protection/refo...

This is of course no nginx configuration. But the thing is.. there is no one size fits all example configuration. The situation depends on: 1) What do you use the data for? 2) How long do you really need it? 3) Can you securely handle it? 4) Has the user consented?

Saving ip adresses in log files can be fully complaint IF you only use them for legal reasons (sue an attacker, ...), have severe access restrictions on the files, delete them as fast as possible and get consent from the user prior to saving the logs.

It depends on your goal, workflow and abilities if you are allowed to store this data, and you must decide for yourself. If in doubt.. don't store it.

Re: How GDPR Will Change The Way You Develop

#625

Post by dralley »

njl wrote: post #332
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

Welcome to every other industry, where "breaking things" and doing whatever you want with reckless abandon isn't considered acceptable behavior.

It's not like you couldn't say the same thing x1000 with respect to finance laws.

Re: How GDPR Will Change The Way You Develop

#626

Post by PeterisP »

wang_li wrote: post #308
TomMarius wrote: post #199

Earlier quoted context omitted.

The problem is that the law applies to them even if they use a proxy. If they report/sue you afterwards, you might be looking at a huge amount of trouble.

People will just add a checkbox that the customer must check to complete the transaction: [] I affirm that I an not an EU citizen.

The general direction is correct, but not the specific implementation - since it applies to everyone in the EU, no matter what their citizenship, you can just reject all transactions where the shipping address (or credit card address for virtual goods) is in the EU; and that should probably be fine.

On the other hand, if you actually want to sell stuff to EU and get a nontrivial number of deals, then no amount of weird checkboxes is going to convince the regulator that it's okay, they aren't stupid.

Re: How GDPR Will Change The Way You Develop

#627

Post by srrr »

oliwarner wrote: post #405
deif wrote: post #387

Earlier quoted context omitted.

Only without consent from the user. Previously it was an ethically grey area to be logging IP addresses anyway. If you are preventing malicious use, then that is allowed as long as you are not using that data outside of the bounds of the user's consent. If, however, a company is storing IP addresses to identify users without their consent and are found to be specifically targeting them without their consent, then tha…

You appear to be suggesting that "intent" defines the shape of law here, but I really don't think that's the case. By my reading, information becomes personal —and therefore subject to GDPR— when it can be used to identify people. If you've got login timestamps, IP addresses and user records, for legitimate reasons, any other logging that includes IPs is tainted because it takes anybody with that data two minutes to…

And it even gets more interesting: The question is not if you can identify a user by merging your different data sets. The question is if you can identify a user if you merge one of your data sets with any other data set, even if this set is currently not in your possession. (This can happen if the provider is able to mach IP addresses to personal information.)

Re: How GDPR Will Change The Way You Develop

#628

Post by PeterisP »

s73v3r_ wrote: post #419
elcapitan wrote: post #365

I wonder if we will see a kind of dual universe privacy in implementations once countries like China become equal as a market for internet services, and they create some sort of a reverse GDPR law. Then for all customers from the EU you will have to completely anonymize and protect all data to the last bit, while for Chinese customers you'll have to implement the most rigid and total tracking possible?

Perhaps separate subsidiaries for the EU, which does respect the GDPR, and one for China, which tracks everything that could be tracked?

How would that be useful to you?

The EU subsidiary would not be legally able to use any of that data (it can't take it from the China subsidiary in any way whatsoever); and the China subsidiary would not be practically able to use any of that data, since they don't have any users/customers in EU.

Re: How GDPR Will Change The Way You Develop

#629

Post by PeterisP »

h1boo wrote: post #518

How is this law okay with international trade agreements? Why doesn't US say that this (rather fuzzy law) is meant to hurt tech companies which is disproportionally based there? In retaliation couldn't they come up with some law that impacts EU businesses?

It doesn't breach current international trade agreements.

In the long run, however, we'd expect to see international trade agreements attempting to harmonize these requirements worldwide, and likely include some mechanism that makes cross-border enforcement easier.

Re: How GDPR Will Change The Way You Develop

#630

Post by notyourday »

xxs wrote: post #622
notyourday wrote: post #380

Earlier quoted context omitted.

Good luck to EU trying to enforce it against JoeSchmoeLLC from PA

The company from PA (USA) needs a EU VAT number to operate in the EU... The VAT registration would be revoked in the specific member state where it was issued. If there is a tax agreement between a specific member state (EU) and the US, IRS can show interest in Joe. If there are like a thousand sales in a specific member state (the taxation is not EU wide global), no one will show interested, so if Joe is small - it'…

No, it does not. A company in PA, USA does not give two cents about EU VAT. It charges EU customers in the US and provides services in the US and tells EU to shove it. Actually, it does not even do that. It simply ignores everything that EU does.
Post reply on HN