Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

651–660 of 710 posts

Re: How GDPR Will Change The Way You Develop

#651

Post by icebraining »

aeorgnoieang wrote: post #644
icebraining wrote: post #590

Earlier quoted context omitted.

You don't need to block traffic, just don't specifically target those countries[1]. And don't track people connecting from them. [1] https://gdpr-info.eu/recitals/no-23/

That "recital" is still pretty vague; the relevant text: > Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally…

Yes, but these things are assessed by judged, not by dice-throwing. I'm sure we can devise contrived examples that fall into gray area, but for the most part I think what I wrote is correct.

Re: How GDPR Will Change The Way You Develop

#652

Post by boredatwork »

dragonwriter wrote: post #637
boredatwork wrote: post #635

Earlier quoted context omitted.

> If people have collected and processed personal data without thinking about the whys and wherefores, isn't it just a good thing this makes one think about what one is logging and what it's used for If people are creating software that burns fossil fuels without thinking about the whys wouldn't it be a good thing to have a law that regulates how we use electricity? Shouldn't an EU regulator have input on whether you…

> If people are creating software that burns fossil fuels They aren't. Only hardware burns fossil fuels, and computing hardware doesn't inherently do so, for the most part, only if you choose to hook it up to a fossil fuel power plant rather than something else; the software isn't the thing directly to address. OTOH, the personal data use you are drawing a poor analogy to is the direct point of concern.

I don't want to torture this metaphor any further, but you're kinda proving my point that software developers do not consider the energy and environmental impact of their work. Software that uses significant CPU time uses more electricity and is worse for the environment.

Misuse of personal data is a problem. Wasting electricity is a problem. Online harassment is a problem.

Re: How GDPR Will Change The Way You Develop

#653

Post by aeorgnoieang »

PeterisP wrote: post #558
OrganicMSG wrote: post #490

Earlier quoted context omitted.

"Either they have the organizational capacity to handle private information properly, or they should not do it at all." While I admire the intent here, in the world at large it seems that multinationals and governments fail at this one with monotonous regularity and Blanche's final line - 'Whoever you are, I have always depended on the kindness of strangers', has been adopted by the computer security industry as the…

What I've seen from the world at large is not large multinationals failing at handling private information properly, but rather them not trying to handle private information properly. I.e. it's not because they're incapable of doing so if they wanted, but that they didn't even attempt to do so. GDPR is a way of forcing some of them to stop handling the information, and forcing those who do to actually start trying.

And you're fine with all of the organizations smaller than "large multinationals" possibly having to shutdown and layoff all of their employees?

Re: How GDPR Will Change The Way You Develop

#654

Post by arkh »

aeorgnoieang wrote: post #58

What's troubling to me is that it's very unclear what specifically is required. I know the linked post isn't legal advice, but in the page about 'privacy by design' linked to by the origin link, they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! Can a…

> Yet another item – "Don’t enable social media sharing by default.". Is the thinking that user's shouldn't be able to share something via social media without first explicitly enabling that option? That just seem unfriendly. Or is the idea that doing so protects someone from doing so accidentally? This seems a lot like the 'cookie law', itself an annoying mandated nagging that probably backfired (because everyone was effectively trained to just do whatever necessary to get rid of the corresponding notification on every site they visited).

Most social media sharing buttons are in fact scripts hosted outside the website currently visited. So even without using them a lot of data is send to Facebook, G+ and other social medias. If you want to see a good implementation of the idea, check Schneier's website: https://www.schneier.com/

Re: How GDPR Will Change The Way You Develop

#657

Post by aeorgnoieang »

havkom wrote: post #531
shkkmo wrote: post #359

Earlier quoted context omitted.

Thanks for the link. > potential subsequent use of personal data processing techniques Not a lawyer, but doesn't every access log with IPs and urls have the /potential/ to be parsed to aggregate a profile of site usage? Even if you aren't actually doing or intending to do any profiling, the potential still exists. You may well be correct about all this (and I suspect you are). I'm specifically trying to push back aga…

Yes and no. One of the most important principles in GDPR is “purpose limitation” (Article 5.1b): “Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes“ If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing - that is most cert…

> If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing ...

Charitably, I think your sentence is just unclear. It seems much more reasonable that someone just thinking or realizing "that the data could also be used for marketing" isn't legally prohibited. Right?

Someone would actually need to use the data, in some concrete specific way, for something illegal to have taken place.

Right?

Re: How GDPR Will Change The Way You Develop

#658

Post by ncallaway »

icebraining wrote: post #589
ncallaway wrote: post #488

Earlier quoted context omitted.

Is he a French citizen? My understanding is that GDPR applies to you (in theory) if you have any EU citizens as customers. Am I misunderstanding? Why is this incorrect?

Yes, that's incorrect, unless you are an EU business yourself. If not, you are only subject if your customers are in the EU. And more, "the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established" is not enough to show that you're targ…

Thanks for that reference! Really helpful.

Re: How GDPR Will Change The Way You Develop

#659

Post by ncallaway »

lawik wrote: post #603
ncallaway wrote: post #485

Earlier quoted context omitted.

This is my biggest question about HIPAA and GDPR about deleting specific user records and data. How are others planning on deleting data from all backups. It seems like any automatic process that modifies all existing backups has the potential to accidentally corrupt all backups in the process. Is there any safe way to safely delete a record out of my prior database snapshots, or is there a reason I don't actually ne…

Do you maintain your database backups indefinitely? If they rotate out after a month or so you will likely be inside the realm of what GDPR considers reasonable compliance. The live data is removed ASAP and the data will rotate out from the backups in a reasonable time frame. At least from the legal advice we've had. We have no plans to retroactively fix our backups. But we will have to make damn sure that if we need…

> But we will have to make damn sure that if we need to use a database backup we do not reintroduce user data that we've purged. For that purpose we will have to maintain a list of which users have been purged until the backups rotate out.

This is the approach we've generally taken as well.

Re: How GDPR Will Change The Way You Develop

#660

Post by aeorgnoieang »

s73v3r_ wrote: post #412
madez wrote: post #351

Earlier quoted context omitted.

It might be that the EU willingly rejects certain business. Maybe, if you aren't GDPR compliant, you are not wanted by the EU.

It's crazy how many businesses think they're so awesome that no market would ever think they're better off without them.

Why is that crazy? Why is it not crazy that the EU thinks it's so awesome that no business would ever think it's better off without them?
Post reply on HN