Earlier quoted context omitted.
It sounds to me like this reflects more on the startup's sloppy practices than anything else. Prevalence of this bad practice shouldn't be an excuse for it.
Regular database backups are a bad practice?
No, read again.
GDPR for lazy people: Block all European users with Cloudflare Workers
671–680 of 1001 posts
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#672I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…
> My biggest fear is that all of these complex bureaucratic laws are just raising the bar for doing a startup.
A senior executive at a large bank once told me "that's the idea!". Specifically, complex and onerous regulation makes it a lot harder for upstarts and, while costly for large established players, they can bear it.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#673Earlier quoted context omitted.
>properly handling sensitive information But the thing is that GDPR affects all PII not just sensitive one so your random small useless app/blog/game/forum that has some personally identifiable but harmless and unimportant data stored is now under the same restrictions like your email or FB data.
Like, say, a personality quiz on Facebook?
[deleted]
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#674Protip: you can ignore the GDPR and get away with it if your business is located somewhere that the GDPR has a snowball's chance in hell of being enforced. For example, America
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#675Earlier quoted context omitted.
How do you handle developer computers with possible client data on them, even semi-anonymized? Or when communicating issues on the live server, you might transfer client information to other stake holders to debug issue. Are you tracking that communication. Where does the communication data reside, perhaps on a server outside of the EU? There is a lot of complications that arise if you think about the second order/th…
I don’t know GDPR inside and out, but I have worked at places (not military) where I could be held criminally liable for misuse or negligent disclosure of PII. The answer to “How do you handle...” is that you get your shit together. Separation of duties, build and configuration standards, no customer data on random laptops. When I was in high school, I worked at a sandwich/coffee shop. The precious commodity in that…
"The answer to “How do you handle...” is that you get your shit together."
Yes it is
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#676Earlier quoted context omitted.
Someone says "delete me and my purchases", so you do In many cases, that will be your mistake. The right to erasure is not absolute, and if you need to keep those records for a good reason -- for example, as evidence to support tax returns or defend chargebacks -- then you are entitled to refuse to delete them and to continue processing them for the necessary purposes. Otherwise mortgages would suddenly become a very…
Great, so now we get to spend money on lawyers and time in the courts to decide what information falls under “OK to keep for a good reason”
A simple example: another law requires it.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#677Earlier quoted context omitted.
If you and the small group of people are the only living creatures on the planet, then absolutely! That is to say, this isn't really comparable, for obvious reasons.
PII is a hazardous material, and it should be regulated like other hazardous materials, for obvious reasons.
This is so hyperbolic. Hazardous material? So your old IP address that has since changed 27 times being in some forgotten log file somewhere is now basically like uranium or industrial waste. Makes sense.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#678Earlier quoted context omitted.
In the specific case of XMPP, wouldn't I need to have an agreement with every other admin who federates their XMPP server and work out what exactly our roles are as defined by GDPR? XMPP still has active development community around it so this will no doubt get much easier with time, but that's just XMPP.
Maybe not: You need to have a "Legal Basis" and only 1 of them is the "subject has given consent" one. There's another: "The processing is NECESSARY FOR THE PERFORMANCE OF A CONTRACT to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;"
I thought you would have to al least all the admins to agree to follow the GDPR so that data can be retrieved, corrected, and deleted on demand right?
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#679Does not work.
If you already have information on EU users, you may be violating GDPR anyways.
Re: GDPR for lazy people: Block all European users with Cloudflare Workers
#680Earlier quoted context omitted.
Merely setting a delete flag is not compliant with the GDPR, that's why a cascading delete is necessary. Any programmer worth their salt knows mass random deletes and updates are extremely inefficient.
Wouldn't it be possible to just delete the 'idetifiabel' parts in the database in order to be GDPR compliant? If you for instance save all the user data like user preferences under a random userId, and then delete the personal data (such as email address, name etc.) associated with the userId I would expect this to be GDPR complaint without having to do a cascading delete.
If you're absolutely certain that the user's identity cannot be reconstructed from the remaining data points, then yes, a full anonymization is enough. You are, after all, removing personally identifiable information, even if the record structure remains in your database.
It's a law, not a technical constraint. No one gives a fuck about some foreign key relations, they care that personal data cannot be accessed, or somehow reconstructed.