Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

661–670 of 710 posts

Re: How GDPR Will Change The Way You Develop

#661
post #437

Earlier quoted context omitted.

We've been careful about what data we collect since day one, long before the GDPR was an issue. We're not doing anything shady with the data we do have, and we actively avoid questionable practices particularly around marketing, where we have ethical problems with being intrusive or compromising people's privacy regardless of any legal constraints. And yet having read the GDPR and much commentary about it, we're stil…

> What matters most about laws is what they actually say. Intent, as has been demonstrated countless times, is secondary. That's different per legal system. In some the text is more relevant. In various others the intend behind the law is very much relevant. I highly suggest to not follow your advice!!

That's different per legal system.

In which EU or EU member state jurisdiction is that not the case, please?

Re: How GDPR Will Change The Way You Develop

#662
post #503

Earlier quoted context omitted.

I've done it for a couple of years and as long as your IPSP cooperates it shouldn't be more than 15 minutes of work per quarter. That might be true if you're lucky enough to have a single third-party payment service that collects all of your revenues including administering the VAT parts for you. Unfortunately, there are many reasons why that might not be the case or even possible. Even if you do use one of those ser…

At least in the UK, HMRC email me whenever rates in a member country change, and they publish them online too: https://www.gov.uk/government/collections/vat-information-sh...

We've had some emails from them as well, but we still assume it's our responsibility to check the rates weekly, based on the fact that at least one rate change has come into effect with little more notice than that and nobody (including HMRC) actively notified us first.

Publishing the rates is certainly better than not publishing them, but unless that information is updated in close to real time so it picks up those short-notice changes and unless it's supplied in a machine-readable format so that you can use it as a basis for automatically calculating correct VAT at the time of sale, it's of limited value for anything other than spotting mistakes retrospectively.

Re: How GDPR Will Change The Way You Develop

#663

Earlier quoted context omitted.

When stuff like this comes up it always seems so weird to me that with all the work that regulators put into this, why can't they at least scratch the surface of providing some specific examples? Of course there are legal documents, and maybe some "for dummies" versions written up about it. But would it be so crazy for these regulators to hire someone who knows something about commonly used open source software and b…

> When stuff like this comes up it always seems so weird to me that with all the work that regulators put into this, why can't they at least scratch the surface of providing some specific examples? Technology is something which constantly changes. From the point of view of the legislator, legal text that is too concrete will stagnate innovation and progress by "locking" people into current technological assumptions.…

That doesn't work though. Sure, if it was some industry initiative then a broad statement of intent and people figure out the details as they go would be OK.

But this one comes with massive, company destroying fines attached.

If you and other domain experts debate and decide on a best practice, and then some EU commissioner disagrees and destroys your company with a fine you cannot pay, will you be so sure that vague laws are a good idea then? Will it seem like freedom to explore, or will it seem more like walking through a minefield?

The EU wants to regulate the precise details of data handling in software firms. It can do that. But it's trying to have its cake and eat it - micromanaging the tech industry at the same time as refusing to be precise about what it wants. It just expects everyone to intuit what they want, on pain of corporate death if you fail.

Re: How GDPR Will Change The Way You Develop

#664
post #508
post #234

Earlier quoted context omitted.

So, the GDPR is doing you a favour by forcing you to think in advance "who will my users be?". So far web applications were "accidentally" global, now you have to be more careful and deliberate. Which is a good thing.

Ah yes, digital isolationism and segregated networks are great. Have we given up on the idea of the internet being a force for global human interaction? Are vague and impotent privacy protections more important?

I live in EU. -> Are vague and impotent privacy protections more important ? More important than "global human interaction" ? Yes, in my opinion. "Global human interaction" doesn't mean it should be the Far-West gold rush. It aims at fair and equal human interactions with the respect for the freedom of each single human on Earth. Freedom means equality for all, and to ensure more equality, we created laws. Laws are not perfect, but sometime they are the only tool we have. Laws are not fixed in stone, they can be improved over-time. Essentially we want global human interaction with respect of individuals.

Re: How GDPR Will Change The Way You Develop

#665

Earlier quoted context omitted.

Other countries mandate that we keep logs for 7 years. This is unworkable.

I believe that you're okay in that case. Some countries in the EU require that you have financial records stored for five years, and they will always contain personal identifiable information. The GDPR states, if I recall correctly, that because some other law requires you to store the information for X number of years, the customer can't force you to delete it. Similarly credit agencies aren't required to comply wit…

The cookie law was never well thought out, that's why nobody read it in the way it was "intended" (what was the intent anyway). The distinction between a regular cookie and a tracking cookie doesn't exist except in the minds of the EU regulators, so no surprise that all they achieved with this was making the EU web experience horrible by default instead of opt-in horrible - browsers have let you request notification of cookies being set since forever, after all, and you can create extensions to notify you in whatever way you like.

Re: How GDPR Will Change The Way You Develop

#666

Earlier quoted context omitted.

Not just business, even information websites are affected. This is the most vicious attack against freedom of speech the EU ever pulled off.

Could you elaborate on how this is a restriction on freedom of speech? How is an 'information site' affected? Take HN for example, when I signed up they didn't even ask my name. They probably log IP addresses and would be entitled to, for the purposes of analyzing malicious use.

It's all PII. People post personal details about their lives here, some use their real names as their username, the site asks for email addresses, how is it not PII?

As for IPs. Any website could claim they need IP addresses for analyzing malicious use. So either it'll be a new cookie law in which they all use the vagueness of the new rules to loophole themselves out, or the EU will decide that this is only "reasonable" sometimes. The law effectively says nothing so whether or not HN would be entitled to store this data is essentially undefined.

Here's what will really happen to HN - nothing. But Google will get huge fines for doing exactly the same thing, and everyone will be left wondering if they're next.

Re: How GDPR Will Change The Way You Develop

#667

Earlier quoted context omitted.

Perhaps separate subsidiaries for the EU, which does respect the GDPR, and one for China, which tracks everything that could be tracked?

How would that be useful to you? The EU subsidiary would not be legally able to use any of that data (it can't take it from the China subsidiary in any way whatsoever); and the China subsidiary would not be practically able to use any of that data, since they don't have any users/customers in EU.

The China subsidiary would be able to use the data in China, to advertise and acquire more Chinese customers.

Of course, I suggested that more for the situation where the EU had data privacy laws, and China required intense tracking of customers.

Re: How GDPR Will Change The Way You Develop

#668

Earlier quoted context omitted.

It's crazy how many businesses think they're so awesome that no market would ever think they're better off without them.

Why is that crazy? Why is it not crazy that the EU thinks it's so awesome that no business would ever think it's better off without them?

Because most of the people complaining are tiny businesses, and the EU is the single biggest market out there.

Re: How GDPR Will Change The Way You Develop

#669
post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

It's not easy at all to understand. I'm a developer and have spent 40+ hours in meetings with lawyers because the interpretation of the law isn't easy at all. There is a whole team of lawyers looking into this. 40% of my team is working on GDPR implementation. Just figuring out if users are allowed to use my service is hard. There is a different age of consent in different EU countries, and apparently some haven't ev…

Ah, age laws. I remember when the USA brought in COPPA, I worked on the Google account system at the time. What a mess. Turns out lots of people register Gmail accounts for local businesses that aren't big or sophisticated enough to use their own top level domain and hosted email solution - they just grab a free webmail address and paint it on the side of their plumbing van or whatever.

Oh, and when asked for a date of birth, they don't know what to put because it's a company account and not a person.

So they put the founding date of their company.

Which is often less than 13 years old. So now the account is locked because they need "parental consent". Or maybe they're trying to create an account, in which case they need to be locked out from creating an account because they "lied" about their age. But they aren't logged in, so how do you do that?

The already existing account doesn't have a parent of course. And it's owner is already an adult. No problem, you think, the owner will just have to prove they're an adult and it's OK.

But COPPA specifies precisely how you can check if someone is an adult, and it was written by a bunch of US regulators who don't appear to know much about life outside the USA. For instance one acceptable age verification mechanism is a credit card, but lots of people around the world don't have credit cards. Everyone having 5 cards is a US thing. So that doesn't work. You could also do a video conference with them, but good luck hiring enough people to do that at anything like a workable cost (per user margins are ultra thin). And so on. Pretty quickly you realise there's no way to recover that is both cheap enough to be deployed, and globally usable. That ignores the fact that some techniques hurt privacy far far more than any website ever normally would e.g. demanding and verifying government ID.

So people just lose their business email.

I've never seen a government pass data related regulation that wasn't a complete disaster. All such laws I'm aware of are riddled with contradictions, collateral damage and total absence of evidence that it actually helped anyone, anywhere.

Re: How GDPR Will Change The Way You Develop

#670
post #204
post #134

Suppose you were a small startup based in America, accepting online payments from users/advertisers using American platforms or financial institutions. Suppose you make no effort to comply with GPDR - what realistic consequences can you face? I suspect that this is the kind of thing which larger/established companies would worry about. If you're a seed/series-A startup, it seems like you have far more important thing…

No one is forcing you to follow it, but I suspect this is just the begining, GDPR is comming from EU due to history reasons, Europe has a lot of bad memories about keeping lists and tracking users. From Nazis to Stasi, USSR and so on and on. What is today done by google, fb, twitter is a light years ahead of that. Try to understand that GDPR is not something bad, it is rasing credibility for your bussiness and is doi…

It's not related to the Nazis. Please. If it were really related to memory of abusive governments they wouldn't have just written a law with phenomenal penalties and ultra-vague language that everyone can be argued to violate - exactly the sort of law that all totalitarian states love to have.

GDPR exists because the EU wants to be the primary legislating entity in Europe, replacing local governments, and because it likes the idea of funding itself through huge fines. It exists to serve political ends.

Post reply on HN