Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

671–680 of 710 posts

Re: How GDPR Will Change The Way You Develop

#671

Post by Silhouette »

s73v3r_ wrote: post #668
aeorgnoieang wrote: post #660

Earlier quoted context omitted.

Why is that crazy? Why is it not crazy that the EU thinks it's so awesome that no business would ever think it's better off without them?

Because most of the people complaining are tiny businesses, and the EU is the single biggest market out there.

Most businesses are tiny businesses. In the UK, 96% of all businesses are microbusinesses (classed as having 0-9 employees) and 99.9% of all businesses are SMEs (classes as having up to 250 employees).

Governments tend to obsess about big businesses, and the EU more than most. However, in the entire UK, there are only about seven thousand large businesses. Smaller businesses collectively contribute the majority of almost every important economic metric (jobs, tax revenues, etc.).

And of course, even the successful large businesses used to be successful smaller businesses.

Given that heavyweight EU regulations disproportionately affect those smaller businesses, because their compliance costs are relatively high, and given that excessive regulation makes it harder or in some cases impractical for businesses to trade within the EU, it is kind of crazy that the EU keeps putting these barriers up. Its own economic fortunes and those of its member states fundamentally depend on maintaining a good environment for smaller businesses to start and grow. Things rarely end well for economies that fail to do so.

Re: How GDPR Will Change The Way You Develop

#672

Post by wsy »

boredatwork wrote: post #652
dragonwriter wrote: post #637

Earlier quoted context omitted.

> If people are creating software that burns fossil fuels They aren't. Only hardware burns fossil fuels, and computing hardware doesn't inherently do so, for the most part, only if you choose to hook it up to a fossil fuel power plant rather than something else; the software isn't the thing directly to address. OTOH, the personal data use you are drawing a poor analogy to is the direct point of concern.

I don't want to torture this metaphor any further, but you're kinda proving my point that software developers do not consider the energy and environmental impact of their work. Software that uses significant CPU time uses more electricity and is worse for the environment. Misuse of personal data is a problem. Wasting electricity is a problem. Online harassment is a problem.

If wasting electricity becomes such a big problem for the society as misuse of personal data already is, sure, let's introduce regulations on that, too.

In some European countries, there are regulations already on how to insulate new buildings to avoid energy waste.

Re: How GDPR Will Change The Way You Develop

#673

Post by x0x0 »

nrjames wrote: post #505
njl wrote: post #494

Earlier quoted context omitted.

The user can request I delete all of the data related to them without “undue delay”. Are you ready to purge all references to certain IP addresses in your logs? Don’t forget backups. GDPR blows up a lot of assumptions we make about writing software and managing servers. https://www.privacy-regulation.eu/en/article-17-right-to-era...

Again, you do not have to if is business critical and used for fraud prevention. You must routinely delete logs before they get too old (60-90 days maybe), but you do not need to take special action beyond that. I’m not saying the GDPR isn’t troublesome, but having spent the better part of the last 6 months combing through the law and interpretations of it, I think the concern over IP addresses in log files that can…

Data portability is no more work than a SAR. Nothing says you have to give them the data in a convenient format; you can perfectly well hand a pg or mysql dump to them that is nothing more than the unformatted output of your SAR process and call it a day. In particular, it doesn't have to be convenient at all to do data interchange; it just has to be "structured, commonly-used and machine-readable format."

Re: How GDPR Will Change The Way You Develop

#674

Post by havkom »

aeorgnoieang wrote: post #657
havkom wrote: post #531

Earlier quoted context omitted.

Yes and no. One of the most important principles in GDPR is “purpose limitation” (Article 5.1b): “Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes“ If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing - that is most cert…

> If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing ... Charitably, I think your sentence is just unclear. It seems much more reasonable that someone just thinking or realizing "that the data could also be used for marketing" isn't legally prohibited. Right? Someone would actually need to use the data, in some concrete specifi…

Yes

Re: How GDPR Will Change The Way You Develop

#675

Post by confounded »

sunir wrote: post #633
confounded wrote: post #408

Earlier quoted context omitted.

Of all the wonderful things that we're capable of as technologists, I think we can figure out a way to strip raw-IP addresses from log-files once we don't need them any more. I'll need to figure out to handle this on the data I'm responsible for at the moment. It's boring and it doesn't help the product, but it's not supposed to. In idlewords' terms, I feel like I'm finally purging toxic waste: http://idlewords.com/t…

You need the IP records for jurisdictions that require long term retention for law enforcement requests including copyright infringement. So you must delete them and also keep them.

Do you know which jurisdictions and laws that includes?

This sounds like the Investigatory Powers Act in the UK, though I haven't heard of similar laws in other liberal democracies.

Re: How GDPR Will Change The Way You Develop

#676

Post by gnaritas »

raverbashing wrote: post #616
FlyingAvatar wrote: post #604

Earlier quoted context omitted.

You knock on my door and I write down that you visited me. Why is it somehow reasonable to compel me to forget that interaction existed?

It's ok to take a picture of the street out of your front window It's not ok to take a picture of everyone that walks in front of your house, timestamped and on top of that you search their picture on Facebook (supposing you could do that) and keep all that info forever

> It's not ok to take a picture of everyone that walks in front of your house, timestamped and on top of that you search their picture on Facebook (supposing you could do that) and keep all that info forever

False, that's perfectly OK.

Re: How GDPR Will Change The Way You Develop

#677

Post by danieltillett »

TheCoelacanth wrote: post #613
danieltillett wrote: post #567

Earlier quoted context omitted.

No they don't. The first is limited to subjects in the EU while the second is limited to activity in EU. If the first clause was limited to activities that take place within the EU the clause would say this - actually there would be no need for two clauses as you would just have one clause that says sale, service and monitoring.

It clearly says offering goods and services to subjects in the Union. It only applies if they are in the Union when you are offering them goods or services. If you offer them goods or services outside of the Union and they later enter the Union, you didn't offer goods to someone in the Union, so GDPR doesn't apply.

If you offered them a service and they are in the EU then it is covered. There is no location exemption that this clause only applies when the service was offered when they are in the EU unlike the monitoring clause. Why do you think they broke this out into two separate clauses?

If you get a request from someone in the EU to remove their data you have to comply no matter where or when the data about them was acquired. The clause is quite clear on this point and it why it is written differently to the clause about monitoring.

Re: How GDPR Will Change The Way You Develop

#678

Post by danieltillett »

77pt77 wrote: post #607
danieltillett wrote: post #474

Earlier quoted context omitted.

It is not citizenship, but residency. Yes the regulations make no sense and they really aren’t enforceable outside of the EU.

> It is not citizenship, but residency. I think it's both.

There is nothing in the regulations that talk about citizenship, just residency.

Re: How GDPR Will Change The Way You Develop

#679

Post by Bizarro »

romanovcode wrote: post #585
Bizarro wrote: post #496

Either these laws or will be ignored or more and more business will move out of European countries to abide by this law, which Europe really can't afford. I'll happily ignore this law.

As an EU citizen I will have no problem not using your company if it cannot even provide basic privacy for me as a user.

You can make your own decisions about who you want to trust with your data without that law being in place.

The only thing that law does is wall off Europeans from the rest of the world.

This is the just the beginning of "protection" laws from bureaucrats in Brussels. You can believe that these laws are there to "protect you", but the rest of us know better.

Stop letting politicians run your lives, and you'll be better off.

Re: How GDPR Will Change The Way You Develop

#680

Post by wsy »

fleetingmoments wrote: post #609
ncallaway wrote: post #485

Earlier quoted context omitted.

This is my biggest question about HIPAA and GDPR about deleting specific user records and data. How are others planning on deleting data from all backups. It seems like any automatic process that modifies all existing backups has the potential to accidentally corrupt all backups in the process. Is there any safe way to safely delete a record out of my prior database snapshots, or is there a reason I don't actually ne…

What if you're using an append-only log, like Kafka as your data backbone?

Two options: a) use a reasonably short retention period, e.g. 6 weeks b) if you key your entries in Kafka, a new entry with the same key will overwrite the old one. That way you could overwrite PII content with an empty message.
Post reply on HN