Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR: Don't Panic

jacquesmattheij.com

Post reply on HN
Print view View original

781–790 of 833 posts

Re: GDPR: Don't Panic

#781

Post by swat535 »

guitarbill wrote: post #596
thomaskcr wrote: post #580

Earlier quoted context omitted.

It's not that it's annoying, it's that I literally cannot answer "are we GDPR compliant?". If you search for GDPR IP address, you get a ton of different opinions. Do I need to sanitize logs? How does that fit in with the requirements for security compliance we are also subject to? At the end of the day, I am the one person who has to answer that question/is responsible for being GDPR compliant. I've spent hours doing…

So everything should be written out explicitly, because you'd rather complete a checkbox-ticking exercise rather than thinking about it and do the correct, ethical thing in good faith? Sounds like a win for the GDPR to me, we know rigid checkbox-ticking is ineffective. Apart from that, NIST 800-53/800-171 are catalogs of "security controls and associated assessment procedures" for "Federal Information Systems and Org…

It is one of the most basics tenets of any legislative system that penal provisions be as precise as possible so as to avoid any abuse from the legislator or the executive body tasked with enforcing said statute.

If the legislation is principle based or overly broad so as to cater to the notion that it will be enforced in an ethical and moral manner the purpose shall be defeated.

As such, there shall be no manner in which the individuals who are regulated will have any sense of how to comply with the legislation and ultimately this undermines the rule of law as well as the respect of the public for such legislation.

Such legislation that sets out fines and penalties, especially the absolutely ridiculously high penalties provided for by GDPR, must be as precise as possible so as to ensure the public knows exactly what is prohibited and what is not. This is notwithstanding the fact that this marvelous bit of administrative madness has the ability to bankrupt any organisation up to and including developing countries.

To trust that the executive body will apply regulations in an ethical and fair manner is a rather paradoxical view especially when such regulations also include mechanisms for judicial review and public control. Thus, legislation which claims to be fair and ethical is also, by the same token, providing measures in case the system is abused, which is again rather paradoxical.

These are not apples and oranges, this is a massive administrative monster that container penal sanctions and as such must be rule based based on basic legal principles that apply in pretty much every jurisdiction, European or otherwise.

Re: GDPR: Don't Panic

#782

Post by guitarbill »

spelunker wrote: post #599
guitarbill wrote: post #596

Earlier quoted context omitted.

So everything should be written out explicitly, because you'd rather complete a checkbox-ticking exercise rather than thinking about it and do the correct, ethical thing in good faith? Sounds like a win for the GDPR to me, we know rigid checkbox-ticking is ineffective. Apart from that, NIST 800-53/800-171 are catalogs of "security controls and associated assessment procedures" for "Federal Information Systems and Org…

If I'm going to be fined or penalized for not being compliant then yes, explicit would be nice. Checkboxes sound great.

Fair enough. As an implementer at a company, I can understand that sentiment. But the GDPR isn't for companies, it's for users.

Laws and regulations tend to stick around for longer than expected, and they're static. Technology and "cyber criminals" are dynamic. For better or worse, the GDPR acknowledges this. I think that's a testament to the Article 29 Working Party, in a world where most politicians are clueless about technology.

Re: GDPR: Don't Panic

#783

Post by Boulth »

tzs wrote: post #326
LoSboccacc wrote: post #252

Earlier quoted context omitted.

And you’re wrong Ip are personal data https://ec.europa.eu/info/law/law-topic/data-protection/refo... Without conditions. Even hashing them doesn’t make them ‘irreversibly anonimized’ because the ip space is too small for hashing to be irreversible. A rainbow table can be built with all ips and use to deanonimize the ip.

The document you link to has this interesting statement: > The law protects personal data regardless of the technology used for processing that data – it’s technology neutral and applies to both automated and manual processing, provided the data is organised in accordance with pre-defined criteria (for example alphabetical order). It also doesn’t matter how the data is stored – in an IT system, through video surveill…

I believe the answer is embedded in the quote that you provided. Can you use the net to go back from weights to data? If not, then it's irreversible.

On the other hand, as parent noticed, hashing IPs is not effective as it's possible to reverse it (the IP space is small).

Re: GDPR: Don't Panic

#784

Post by Boulth »

LoSboccacc wrote: post #771
apple4ever wrote: post #721

Earlier quoted context omitted.

No you are wrong. I don’t care what some silly EU court said. IPs are not personal data. They can apply to a range of people.

I agree ip can address multiple persons. What is common sense matters little. Ip were enshrined in law as personal information and that’s that. It’s stupid, but it’s not something you can just argue away with reason and logic, you have to argue it with lawyers in courts, and given precedents you gonna lose, and that’s what matters.

Could you link to these precedents? I'd like to read that in detail.

Re: GDPR: Don't Panic

#785

Post by Boulth »

icedchai wrote: post #744
badwolf wrote: post #733

Earlier quoted context omitted.

User ID's are considered PII though. If it can be mapped to the user, it's by definition identifying information

Identifiers that have no meaning outside of your system are not PII.

Reading https://ec.europa.eu/info/law/law-topic/data-protection/refo... I would agree, of course if that identifier is not in some other database, that maps it to a person. If you have just ids in a backup and you remove the person-ID mapping this should be fine.

Re: GDPR: Don't Panic

#786

Post by Boulth »

mbrumlow wrote: post #688
acdha wrote: post #608

Earlier quoted context omitted.

The conventional solution to that problem I’ve heard for the last couple decades is to use encryption so the backup doesn’t need to be altered ahead of your normal rotation schedule as long as you can probably drop a customer’s key on demand.

The backups are encrypted, but the there is no way for the backup software to know one client's data from the other. Its block based, so all it sees is a volume. Post hosting providers, or anybody really don't create new volumes for each customer. They would simply have a directory per client. Onces you start needing to know more about the file system then you sort of waste all the benefits block based backups provid…

I think the parent means encrypt customer data with key specific to that customer. When you erase that customer key their data becomes irreversibly damaged.

Re: GDPR: Don't Panic

#787

Post by Boulth »

weehobbes wrote: post #300

As a solo business owner based in the US, I’ve been spending the last couple weeks learning about GDPR and getting compliant. While it has not been a fun process, I do think in general the regulation is quite reasonable and overall good for the world in general. So far, GDPR compliance has not cost me any money, only time. There are three problems however that I have with GDPR and I’d love to hear how other small non…

> Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.

Source: https://ec.europa.eu/info/law/law-topic/data-protection/refo...

Re: GDPR: Don't Panic

#788

Post by mmt »

jacquesm wrote: post #776
mmt wrote: post #735

Earlier quoted context omitted.

In that case and now, in this case, too.. the government will have a legal monopoly on the data.

There is nothing that will magically transfer corporate data to the government.

I'm not sure what you mean by this. No magic is required, only sufficient desire by those in power.

That wasn't my point, though. It was that now only governments are allowed to gather and keep this data. Granted, the breadth of what's available to them may not be as great if they're mainly recording traffic with no access to corporate servers, but even that access can be periodically arranged given sufficient desire.

Re: GDPR: Don't Panic

#789

Post by mbrumlow »

Boulth wrote: post #786
mbrumlow wrote: post #688

Earlier quoted context omitted.

The backups are encrypted, but the there is no way for the backup software to know one client's data from the other. Its block based, so all it sees is a volume. Post hosting providers, or anybody really don't create new volumes for each customer. They would simply have a directory per client. Onces you start needing to know more about the file system then you sort of waste all the benefits block based backups provid…

I think the parent means encrypt customer data with key specific to that customer. When you erase that customer key their data becomes irreversibly damaged.

I get that, but the problem is the way data is stored today it is stored on a single volume. That is many customers are stored on a single volume. When backed up there is normally one key per volume.

I guess the real issue is who will be responsible ensuring backups are stored in a way that different clients are isolated.

As somebody who makes backup software I know the burden will at some point be on my plate.

That being said, if people stored data differently, and did actually have a key per customer then the backup software won't matter, because like the parent and you said, just delete the key. But nothing really works like that today, and it will require a massive amount of software to be rewritten to handle this sort of stuff. So until then either you can't backup your data, or you make the backup provider figure it out.

Re: GDPR: Don't Panic

#790

Post by DanBC »

merinowool wrote: post #571
DanBC wrote: post #454

Earlier quoted context omitted.

But that law has to be read in conjunction with others, which set out when trial is at magistrates or crown court; and what the sentencing guidance is. The courts must follow the sentencing council guidelines unless it's in the public interest not to do so. https://www.sentencingcouncil.org.uk/wp-content/uploads/Drug... The starting point is 100% of weekly income; the range is 75% to 125% of weekly income. > Band B 1…

Judges don't have to adhere to guidelines as these are only guidelines. I have seen couple of cases where people were punished severely for something rather minor. Only thing you can do is to complaint about the judging.

English judges do have to adhere to the sentencing council guidelines.

https://www.sentencingcouncil.org.uk/about-us/

> The primary role of the Council is to issue guidelines on sentencing which the courts must follow unless it is in the interests of justice not to do so.

> The Sentencing Council is an independent, non-departmental public body of the Ministry of Justice and replaced the Sentencing Guidelines Council and the Sentencing Advisory Panel in April 2010.

Post reply on HN