Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

641–650 of 710 posts

Re: How GDPR Will Change The Way You Develop

#641

Post by outsideoflife »

klokoman wrote: post #469
77pt77 wrote: post #465

Earlier quoted context omitted.

What this law means is that I'll never do any business, even freelance, without being shielded by an LLC.

Not just business, even information websites are affected. This is the most vicious attack against freedom of speech the EU ever pulled off.

Could you elaborate on how this is a restriction on freedom of speech? How is an 'information site' affected? Take HN for example, when I signed up they didn't even ask my name. They probably log IP addresses and would be entitled to, for the purposes of analyzing malicious use.

Re: How GDPR Will Change The Way You Develop

#642

Post by aeorgnoieang »

chopin wrote: post #352
jacobr1 wrote: post #262

Earlier quoted context omitted.

It isn't obvious that is a case. Some companies make bad short-term decisions. But many take a longer-term view. Who would hire the construction company again that made the bad bridge? Or consider food and drug regulation. Countries with more lax requirements for proof of drug efficacy and large-scale trails don't have worse health outcomes. In fact, the countries with stricter policy regimes are often slower to have…

Construction companies circumvent this by going bankrupt all the time and setting up the next shell company. Big projects will often be done by a pool of companies. Which would you hold accountable then. As well, some things are so bad that you don't want to punish after the fact.

> Construction companies circumvent this by going bankrupt all the time and setting up the next shell company.

This would be a much more difficult thing for them to do if it was easy to track the history of bad behavior of the relevant people. This seems like something that should be relatively easy to do nowadays, module some probably not-too-significant obstacles like the 'right to be forgotten'.

> Big projects will often be done by a pool of companies. Which would you hold accountable then.

In the absence of detailed information, one would reasonably hold them all partially accountable.

> As well, some things are so bad that you don't want to punish after the fact.

There's no perfect way to do this. Murder seems like it's "so bad that you don't want to punish after the fact" but I don't think either of us would want to live in a society that was perfectly capable of preventing any murders.

Re: How GDPR Will Change The Way You Develop

#643

Post by Eridrus »

ec109685 wrote: post #541
Eridrus wrote: post #514

Earlier quoted context omitted.

Q: would I still be able to keep session logs of user journeys through my site without explicit consent? If not, this seems like huge issue for ecommerce analytics. If I need to obtain explicit consent, that the user isn't required to provide to continue accessing the site then I don't see how these technologies are not basically dead in the EU. Can you even legally do a customer churn analysis under the GDPR without…

No, put up a “trap” page, tell the user you need to collect certain data to operate the site and make the user clicks Accept before they can use your it.

I think the GDPR explicitly forbids that; if your site doesn't need the data to keep functioning, it can't just stop working.

Re: How GDPR Will Change The Way You Develop

#644

Post by aeorgnoieang »

icebraining wrote: post #590
p1necone wrote: post #453

Earlier quoted context omitted.

So we should have a whitelist of countries we decide we are "doing business" in and block all other traffic globally?

You don't need to block traffic, just don't specifically target those countries[1]. And don't track people connecting from them. [1] https://gdpr-info.eu/recitals/no-23/

That "recital" is still pretty vague; the relevant text:

> Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

Note that "the use of a language or a currency generally used in one or more Member States ... may make it apparent that the controller envisages offering goods or services to data subjects in the Union". So simply using a language in use in a EU member country may be sufficient that you "envisage" offering your goods or services. That seems significantly different than your claim that one need merely not "specifically target those countries".

Re: How GDPR Will Change The Way You Develop

#645

Post by funkymike »

pbowyer wrote: post #588
PeterisP wrote: post #559

Earlier quoted context omitted.

Can you elaborate about what exactly do you mean by "anything of that changes in scope"? If you have the same use case of private data but have technical changes (i.e. a different subcontractor handling the processing) then you do not need a new consent. If you have a new use case, then yes, you get to use only the data of those users who agree to it. Which will not be all users anyway, as consent must be freely give…

> If you have the same use case of private data but have technical changes (i.e. a different subcontractor handling the processing) then you do not need a new consent. That is not how some are reading it. It's not how I've understood Article 28(2) either, though getting new consent each time is nuts (e.g. I change from Mailgun to Postmark and have to ask all SaaS customers for consent). Some discussions: https://seql…

> That is not how some are reading it. It's not how I've understood Article 28(2) either, though getting new consent each time is nuts (e.g. I change from Mailgun to Postmark and have to ask all SaaS customers for consent).

This makes sense from the user's perspective. Maybe they trust Mailgun but do not trust Postmark. If they have explicitly agreed to you sharing their personal data with one company you shouldn't be able to start sending that customer's personal data to another company without their consent.

If you sign up for my service and I ask for consent to send specific data to SecuriCo for "user analytics and tracking" I shouldn't be able to change that to sending the data to the NSA without telling you. The whole point is that the user should be in control of what businesses are doing with their personal information.

Re: How GDPR Will Change The Way You Develop

#646

Post by aeorgnoieang »

Tomte wrote: post #511
chrisweekly wrote: post #489

Earlier quoted context omitted.

>"Previously it was an ethically grey area to be logging IP addresses anyway." wat. Standard log formats capture IP, and have ~forever. Who claims this is an ethical quandary?

I won‘t address „ethical“, but collecting full IP addresses has been discussed as possibly illegal in Germany for years now. And since the recent European court decision, I suppose it is settled: yes, illegal.

What's a 'not full' IP address?

Re: How GDPR Will Change The Way You Develop

#647

Post by aeorgnoieang »

raverbashing wrote: post #616
FlyingAvatar wrote: post #604

Earlier quoted context omitted.

You knock on my door and I write down that you visited me. Why is it somehow reasonable to compel me to forget that interaction existed?

It's ok to take a picture of the street out of your front window It's not ok to take a picture of everyone that walks in front of your house, timestamped and on top of that you search their picture on Facebook (supposing you could do that) and keep all that info forever

> It's not ok to take a picture of everyone that walks in front of your house, timestamped and on top of that you search their picture on Facebook (supposing you could do that) and keep all that info forever

Why not? It's certainly not obvious why this is the case.

Re: How GDPR Will Change The Way You Develop

#648

Post by aeorgnoieang »

gnud wrote: post #573
OrganicMSG wrote: post #483

Earlier quoted context omitted.

How does this work out for Git repos and other things with encryption backed histories? If I run a software project and a developer wants an identifying section of a repo back-edited, do I have to edit and rebase the whole repo, and what does this do to the trust in a project that is based on a verifiable history? Also, I can't help but notice that currently there is a hell of a lot of money being bet on immutable pu…

If this is an opern source repo on GitHub/GitLab, I think you could argue that the developer "made the data public" in giving it to you in the first place. That's an exception to the requirement to delete data. The same goes for public ledgers. The tricky situation is when someone puts personal data not about themselves, but about a third party into a public ledger...

Is 'making data public' a plausibly reasonable defense tho? It's sad that that's not obvious.

Re: How GDPR Will Change The Way You Develop

#649

Post by aeorgnoieang »

musage wrote: post #383
njl wrote: post #332

Earlier quoted context omitted.

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. GDPR is a wonderful idea that will be insanely expensive to comply with, act as a continuous drag on developing new technologies, and end up offering only nominal protection to end users. This is just going to be another way for EU regulator…

> a continuous drag on developing new technologies Any and all of them? Because of anonymized IP addresses in server logs? I wouldn't even buy that when it comes to the web, but certainly not to mention talking about computers and software in general, or even "tech in general", whatever that would be.

What's an anonymized IP address? As others have pointed out, there is a sufficiently small number of IP (v4) addresses that any hash function output of them can be easily brute-forced nowadays. So the only 'anonymous' IP address is the one you never collect in the first place.

Re: How GDPR Will Change The Way You Develop

#650

Post by matt4077 »

aeorgnoieang wrote: post #646
Tomte wrote: post #511

Earlier quoted context omitted.

I won‘t address „ethical“, but collecting full IP addresses has been discussed as possibly illegal in Germany for years now. And since the recent European court decision, I suppose it is settled: yes, illegal.

What's a 'not full' IP address?

Leaving the last three digits out of logs gives you all the information you might need without making it possible to tie it back to a specific user. Google Analytics actually has an option for that.
Post reply on HN