I plan to completely ignore GDPR laws and will not modify neither my privacy policy not my SaaS product, even if I have a lot of customers from the EU.
Change one letter in your username and your comment suddenly makes a lot more sense.
GDPR for lazy people: Block all European users with Cloudflare Workers
621–630 of 1001 posts
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#622Earlier quoted context omitted.
I'm a Brit. I am the MD of a small IT company. I have two partners and 20 employees. We started in 2000. We turn over about £1.5Mpa. We sell our services to people and organisations. Our backups are now smaller these days (thanks to GDPR). I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR. There is no way on earth that the EU as a whole has looked on your…
It's curious how these "basic, fundamental" rights only apply to select industries, while others are free to completely ignore them (art. 85). What kind of basic, fundamental right is that?
http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...
(see below for my response wrt SS85) I prefer to dwell on things like this:
The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.
Below:
A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned. Therefore, as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the controller is able to demonstrate, in accordance with the accountability principle, that the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where such notification cannot be achieved within 72 hours, the reasons for the delay should accompany the notification and information may be provided in phases without undue further delay.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#623Earlier quoted context omitted.
Tired of the eternal startup excuse to justify bad behaviour when it comes to protection of consumer privacy. If it is impossible for some startups to respect strong privacy practices maybe we simply don't need those startups. This 'startupism' is almost an ideology. No mechanical engineer would complain about safety regulation just because it means that they cannot start a business in their garage. In other industri…
Here's a thought: regulation like this is, along with the heavy-handed ideology that lead to it, is the reason why the EU is still lagging regarding technical innovation. I think this attitude is the primary reason Silicon Valley took hold in the USA and that the EU has nothing comparable. If the EU wants to legislate itself out of the future they're more than welcome to do so -- and I applaud every site who makes th…
I'm not onboard with the idea that Silicon Valley holds a monopoly on technical innovation. Getting people to click on ads on smartphones doesn't capture the entire scope of technology. Europe's economy is roughly as large as that of the United States. Many world-leading companies from the car industry, to chemicals, to biotech reside in Europe.
The US holds one dominating advantage in one subset of technology. Consumer-facing internet tech. While a lot of people employed in this field commentate on this website, it's a marginal part of the tech industry, and it's not worth sacrificing privacy for, Europe does not need Silicon Valley to produce high-value products.
And if adtech is supposed to be the definition of the future, rather than genomics, complex manufacturing and the life sciences than I'm okay with us skipping that part. There are business models that don't rely on sacrificing the attention and privacy of consumers.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#624Earlier quoted context omitted.
Also tired of people thinking that a company not wanting a rule means they were intending to do the exact the opposite of that rule, especially given said rule is incredibly vague and designed to be applied "on principle". Fortunately for all of us, safety regulation is actually very specific in requirements.
Upthread we have the claim that "most early-stage startups use the... best practice of 'delete=1'," pretending to delete user data while actually retaining it. So, the exact opposite of the rule.
Why is delete=1 a best practice? There are competing concerns here. The government has now decided for everyone. Agree or disagree it is not worth implyng immorality where no immoral intent is present.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#625Earlier quoted context omitted.
I'm a Brit. I am the MD of a small IT company. I have two partners and 20 employees. We started in 2000. We turn over about £1.5Mpa. We sell our services to people and organisations. Our backups are now smaller these days (thanks to GDPR). I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR. There is no way on earth that the EU as a whole has looked on your…
How do you handle developer computers with possible client data on them, even semi-anonymized? Or when communicating issues on the live server, you might transfer client information to other stake holders to debug issue. Are you tracking that communication. Where does the communication data reside, perhaps on a server outside of the EU? There is a lot of complications that arise if you think about the second order/th…
I don’t know GDPR inside and out, but I have worked at places (not military) where I could be held criminally liable for misuse or negligent disclosure of PII.
The answer to “How do you handle...” is that you get your shit together. Separation of duties, build and configuration standards, no customer data on random laptops.
When I was in high school, I worked at a sandwich/coffee shop. The precious commodity in that store was cash. We didn’t leave cash on a counter, or on a roll in our pockets it was in a locked register. When there was more than $500, we withdrew down to $250 and put the cash in a safe. At the end of the night, we put the cash in a locked pouch and two of us walked to the bank and put it in a dropbox.
Data is no different, just more complex.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#626Earlier quoted context omitted.
Merely setting a delete flag is not compliant with the GDPR, that's why a cascading delete is necessary. Any programmer worth their salt knows mass random deletes and updates are extremely inefficient.
Wouldn't it be possible to just delete the 'idetifiabel' parts in the database in order to be GDPR compliant? If you for instance save all the user data like user preferences under a random userId, and then delete the personal data (such as email address, name etc.) associated with the userId I would expect this to be GDPR complaint without having to do a cascading delete.
That it isn’t known with confidence is your answer to whether it is worth implying it is easy.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#627Earlier quoted context omitted.
Merely setting a delete flag is not compliant with the GDPR, that's why a cascading delete is necessary. Any programmer worth their salt knows mass random deletes and updates are extremely inefficient.
HN won’t let me go deeper, so here it goes: > "you could easily not switch to a CASCADE, but instead set delete=1 and mark every sensitive field with a special value " Emphasize on the part after “and”
That is insufficient. You can still infer identities through metadata and behavioural analysis. For instance purchase history and geolocation is often enough to identify some individuals.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#628Earlier quoted context omitted.
Tired of the eternal startup excuse to justify bad behaviour when it comes to protection of consumer privacy. If it is impossible for some startups to respect strong privacy practices maybe we simply don't need those startups. This 'startupism' is almost an ideology. No mechanical engineer would complain about safety regulation just because it means that they cannot start a business in their garage. In other industri…
Here's a thought: regulation like this is, along with the heavy-handed ideology that lead to it, is the reason why the EU is still lagging regarding technical innovation. I think this attitude is the primary reason Silicon Valley took hold in the USA and that the EU has nothing comparable. If the EU wants to legislate itself out of the future they're more than welcome to do so -- and I applaud every site who makes th…
Is it?
Visit Germany sometime. Drive through the countryside. Most parts of the US look like a hollowed out shell by comparison.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#629I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…
The transition period will be difficult for some people, but I think that GDPR will probably be good for the world in the long-term. New companies will start building their systems correctly from the beginning, and, ideally, the law won't be too heavily enforced on small companies during the transition period. The next generation of programming tutorials will show people how to build things in privacy-conscious ways.…
Maybe. It is more likely the United States will create the opposite regime. Since all major Internet software firms are American or Chinese it is also possible that the EU May sideline itself.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#630Earlier quoted context omitted.
Here's a thought: regulation like this is, along with the heavy-handed ideology that lead to it, is the reason why the EU is still lagging regarding technical innovation. I think this attitude is the primary reason Silicon Valley took hold in the USA and that the EU has nothing comparable. If the EU wants to legislate itself out of the future they're more than welcome to do so -- and I applaud every site who makes th…
I'm not onboard with the idea that Silicon Valley holds a monopoly on technical innovation. Getting people to click on ads on smartphones doesn't capture the entire scope of technology. Europe's economy is roughly as large as that of the United States. Many world-leading companies from the car industry, to chemicals, to biotech reside in Europe. The US holds one dominating advantage in one subset of technology. Consu…
>The US holds one dominating advantage in one subset of technology. Consumer-facing internet tech. While a lot of people employed in this field commentate on this website, it's a marginal part of the tech industry, and it's not worth sacrificing privacy for, Europe does not need Silicon Valley to produce high-value products.
> it's a marginal part of the tech industry
Hilarious