How GDPR Will Change The Way You Develop • Hacker News Board

Re: How GDPR Will Change The Way You Develop

#631

Post by wtfstatists » Wed, Feb 28, 2018, 1:57 PM UTC

PeterisP wrote: post #618

wtfstatists wrote: post #484

Earlier quoted context omitted.

The biggest issue to user's privacy has traditionally been data breaches. Peoples lives and most intimate details is going to be stored as bits. Get used to it. Whether for targeting purpose (Facebook) or personal reasons (Strava). Whether stored on remote servers or home. It wont affect likeliness of data breaches. Focus on good software designs and let programmers design such systems in peace. All this needed was f…

GDPR is designed to not simply accept that "Peoples lives and most intimate details is going to be stored as bits. Get used to it." but instead try to change that. Changing that is nontrivial, since it requires changing the behavior of everyone handling this data - so, something that can be done only by law. It will restrict Facebook, it will restrict Strava, it will restrict data stored on remote servers and home. W…

Not all private data is stored for commercial reasons. People themselves want to store their lives, make use of advancement in IT and improve their lives. Now what about those data ? If its stored in a computer connected to internet then its at the risk of data breaches. Its even easier as a typical user is not capable nor can he detect such attacks (see botneting toasters).

So if the rationale for GDPR to reduce data breaches or to deny private data to future rouge govt, then it fails. Private data will still exist even if its not commercialzed. Its irrelevent who control it (user or company) as long as its connected to internet, there is risk of data breaches.

Unless you propose to go back to storing actual photos in actual albums. ITT im not sure.

Re: How GDPR Will Change The Way You Develop

#632

Post by chopin » Wed, Feb 28, 2018, 2:18 PM UTC

kasey_junk wrote: post #608

chopin wrote: post #565

Earlier quoted context omitted.

So you don't store data from that IP? How is this a problem? And that's perfectly compliant with the GDPR. It seems you can't be bothered to not store data.

You don’t see the humor (at least) of a privacy regulation requiring me to learn more about the consumers hitting the site? Previously they were so private I knew nothing but an IP. Now I’m instrumenting my systems with geo lookup databases which usually also include much more fine grained data (such as home/business) than that. In any case, your original point was to just not interact with those people, which requir…

There is no active filtering required if you don't store anything. I don't understand why this is so hard to grasp.

You can learn as much as you want as long as you don't store it or provide that information to a third party.

I believe our industry has too long gotten away with a "store everything" mentality. I have zero sympathy for web sites which slurp up everything from their visitors.

Re: How GDPR Will Change The Way You Develop

#633

Post by sunir » Wed, Feb 28, 2018, 2:31 PM UTC

confounded wrote: post #408

njl wrote: post #332

Earlier quoted context omitted.

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

Of all the wonderful things that we're capable of as technologists, I think we can figure out a way to strip raw-IP addresses from log-files once we don't need them any more. I'll need to figure out to handle this on the data I'm responsible for at the moment. It's boring and it doesn't help the product, but it's not supposed to. In idlewords' terms, I feel like I'm finally purging toxic waste: http://idlewords.com/t…

You need the IP records for jurisdictions that require long term retention for law enforcement requests including copyright infringement.

So you must delete them and also keep them.

Re: How GDPR Will Change The Way You Develop

#634

Post by xxs » Wed, Feb 28, 2018, 2:34 PM UTC

notyourday wrote: post #630

xxs wrote: post #622

Earlier quoted context omitted.

The company from PA (USA) needs a EU VAT number to operate in the EU... The VAT registration would be revoked in the specific member state where it was issued. If there is a tax agreement between a specific member state (EU) and the US, IRS can show interest in Joe. If there are like a thousand sales in a specific member state (the taxation is not EU wide global), no one will show interested, so if Joe is small - it'…

No, it does not. A company in PA, USA does not give two cents about EU VAT. It charges EU customers in the US and provides services in the US and tells EU to shove it. Actually, it does not even do that. It simply ignores everything that EU does.

Like I've said if you are small enough to avoid any interest, it's ok - but selling electronic services to EU residents without VAT in the EU is not legal.

Overall VAT is taxation on the consumption, the consumption is within the EU member state, the state receives the tax.

Summary:

When US companies encounter European VAT: When doing business in the territory of the EU a company will deal with VAT: when selling something, the company will have to charge the customer with VAT... [0]

Also: The EU’s VAT law considers everything that is not a good (generally a tangible property) as a service. Services can include everything from the licensing for intellectual property to downloadable software to consulting – to name but a few examples. The VAT requirements for services depend on the final customer

U.S. Foreign Commercial Services for U.S. Companies [1], [2]

[0]: https://www.rsm.global/insights/tax-news/europe-how-european... [1]: https://2016.export.gov/europeanunion/eg_eu_030910.asp [2]: https://www.export.gov/article?id=European-Union-How-the-EU-...

Re: How GDPR Will Change The Way You Develop

#635

Post by boredatwork » Wed, Feb 28, 2018, 2:41 PM UTC

belzsch wrote: post #562

njl wrote: post #332

Earlier quoted context omitted.

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

Web logs are not a punishable offence under the GDPR, if you have a legal basis for retaining those logs and reasonable retention and data minimisation policies. If those are in place and you've documented them, you have nothing to worry about. Why? You have a legitimate interest (one of the six legal bases under the GDPR) to combat fraud and maintain information security. That's the primary reason you have those IPs…

> If people have collected and processed personal data without thinking about the whys and wherefores, isn't it just a good thing this makes one think about what one is logging and what it's used for

If people are creating software that burns fossil fuels without thinking about the whys wouldn't it be a good thing to have a law that regulates how we use electricity? Shouldn't an EU regulator have input on whether you can release your new blockchain app? You should be fine if its purpose falls into one of the covered categories...

People are creating online communities that enable abuse of members. Do we need statues and regulations to mandate abuse protections in online interactions and punish platforms that allow users to abuse other users?

Re: How GDPR Will Change The Way You Develop

#636

Post by boredatwork » Wed, Feb 28, 2018, 2:41 PM UTC

fleetingmoments wrote: post #609

ncallaway wrote: post #485

Earlier quoted context omitted.

This is my biggest question about HIPAA and GDPR about deleting specific user records and data. How are others planning on deleting data from all backups. It seems like any automatic process that modifies all existing backups has the potential to accidentally corrupt all backups in the process. Is there any safe way to safely delete a record out of my prior database snapshots, or is there a reason I don't actually ne…

What if you're using an append-only log, like Kafka as your data backbone?

You got a big problem.

Re: How GDPR Will Change The Way You Develop

#637

Post by dragonwriter » Wed, Feb 28, 2018, 2:44 PM UTC

boredatwork wrote: post #635

belzsch wrote: post #562

Earlier quoted context omitted.

Web logs are not a punishable offence under the GDPR, if you have a legal basis for retaining those logs and reasonable retention and data minimisation policies. If those are in place and you've documented them, you have nothing to worry about. Why? You have a legitimate interest (one of the six legal bases under the GDPR) to combat fraud and maintain information security. That's the primary reason you have those IPs…

> If people have collected and processed personal data without thinking about the whys and wherefores, isn't it just a good thing this makes one think about what one is logging and what it's used for If people are creating software that burns fossil fuels without thinking about the whys wouldn't it be a good thing to have a law that regulates how we use electricity? Shouldn't an EU regulator have input on whether you…

> If people are creating software that burns fossil fuels

They aren't. Only hardware burns fossil fuels, and computing hardware doesn't inherently do so, for the most part, only if you choose to hook it up to a fossil fuel power plant rather than something else; the software isn't the thing directly to address.

OTOH, the personal data use you are drawing a poor analogy to is the direct point of concern.

Re: How GDPR Will Change The Way You Develop

#638

Post by piracykills » Wed, Feb 28, 2018, 2:56 PM UTC

mamon wrote: post #234

sbov wrote: post #177

Earlier quoted context omitted.

The comparison is disingenuous. The internet makes anything you build automatically global. You're blasting software engineers for not knowing worldwide regulations. How many New York lawyers know the regulations of France? How many local UK construction companies know the building codes of Japan? None. Knowing all regulations in the world for any given industry would be a full time job. The people you seem to be imp…

So, the GDPR is doing you a favour by forcing you to think in advance "who will my users be?". So far web applications were "accidentally" global, now you have to be more careful and deliberate. Which is a good thing.

I assume GDPR would only impact you if you operate a business from European locations, right? Not like they can enforce their laws on my small business run from the other side of the planet.

So long as my country isn't willing to extradite me, I don't really care what their laws are and I will adamantly refuse to comply with them as they're entirely irrelevant to me.

Re: How GDPR Will Change The Way You Develop

#639

Post by tekknik » Wed, Feb 28, 2018, 3:05 PM UTC

I don’t see this helping at all. The big companies will just get consent and then it’s business as normal. Sites that can’t comply due to lack of resources will just block EU access. Really this is just a bullet point for the big guys and stifling for the small guys.

Re: How GDPR Will Change The Way You Develop

#640

Post by aeorgnoieang » Wed, Feb 28, 2018, 3:06 PM UTC

wyager wrote: post #509

floatrock wrote: post #291

Earlier quoted context omitted.

> How many New York lawyers know the regulations of France? New York lawyers who do business in France do. If you're accepting ~dollars~ euros to place French ads on your pages targeting French customers, seems reasonable to know the relevant French regulations.

You don’t need to make money off Europeans to be targeted by the GDPR - you just need to have data about Europeans.

That's pretty disingenuous as it seems impossible to "make money off Europeans" without having any data about them.