81–86 of 86 posts
Earlier quoted context omitted.
And those defaults must be changed. GDPR rightly forces businesses to reconsider hoarding data because it “might be useful sometime in the future”.
With GDPR most businesses still hoard as much data as they can, then work backwards to find a plausible excuse like debugging or customer support.
Earlier quoted context omitted.
This is effectively what the “GDPR compliant” providers mentioned in the article are already doing, namely, a one-way hash of the IP+UA. One of the points of the article is that this is non compliant, since you need to transmit the IP+UA to do this calculation to begin with.
But do they store individual IP+UA hashes, or do they mush them together in a bloom filter or a HyperLogLog data structure? In the first case, it could be argued they still store personally identifiable information (for a limited time, but still). In the second case I think it would be harder to argue the probabilistic data structure with lots of hashes mushed together still constitute personally identifiable informa…
Maybe I'm missing your point, but in the situation we're talking about (so-called "GDPR compliant" analytics), if I set up one of these services on my website, the user's IP+UA are transmitted to a 3rd party, for the sole purpose of analytics including counting unique visitors. My understanding is that this is quite different in the eyes of the GDPR from the question you posed, and is almost always not going to be compliant.
Earlier quoted context omitted.
But do they store individual IP+UA hashes, or do they mush them together in a bloom filter or a HyperLogLog data structure? In the first case, it could be argued they still store personally identifiable information (for a limited time, but still). In the second case I think it would be harder to argue the probabilistic data structure with lots of hashes mushed together still constitute personally identifiable informa…
> IP + UA gets transmitted to the first-party server already. They already have it. The question becomes – is it OK to anonymize this PII we already received for one purpose (serving the web page), to use it for another purpose also (counting unique visitors). Maybe I'm missing your point, but in the situation we're talking about (so-called "GDPR compliant" analytics), if I set up one of these services on my website,…
Earlier quoted context omitted.
I'm not a lawyer, so this isn't legal advice. "Die dynamische IP-Adresse stellt für einen Webseitenbetreiber ein personenbezogenes Datum dar, denn der Webseitenbetreiber verfügt abstrakt über rechtliche Mittel, die vernünftigerweise eingesetzt werden könnten, um mithilfe Dritter, und zwar der zuständigen Behörde und des Internetzugangsanbieters, die betreffende Person anhand der gespeicherten IP-Adressen bestimmen zu…
Alright, so no more DDoS protection or rate limiting. Do we need consent before a router or switch on the network can process traffic? Isn't the ISP violating the GDPR if they hand out information about a customer to third parties without consent? What about servers that have logs turned on (Apache) before GDPR went into effect? I know the opinion of lawyers about IP addresses. But it's so far from reality that it wo…
Earlier quoted context omitted.
Also there has been a huge amount of malicious compliance (though frankly it mostly doesn’t actually legally comply), deliberately muddying the waters and poisoning people’s impressions of GDPR and ePD. People have been convinced to blame GDPR rather than the businesses that have built themselves upon doing hostile and creepy stuff. (Cookie banners are the most obvious example of this. The businesses say “our hands a…
If you're trying to regulate a bunch of bad actors, and you don't anticipate that they will try to game whatever regulations you come up with, you are not doing your job well.
Also, a lot of the problems are not bad actors finding ways around the law but straight up violating it. The most prominent example is the consent bannes that try to discourage the deny option in various ways. The lawmakers did anticipate that kind of maliciousness and made sure to disallow it. What is lacking is mostly enforcement, and that is not something the lawmakers control.
Earlier quoted context omitted.
If you're trying to regulate a bunch of bad actors, and you don't anticipate that they will try to game whatever regulations you come up with, you are not doing your job well.
Sure they should have and probably did expect that there would be bad actors. But should they have expected that pretty much all businesses and even individuals would rather make their users miserable than give up tracking them? Is people adding cookie banners for their personal blogs because they are that addicted to meaningless analytics something anyone would have expected? Also, a lot of the problems are not bad…
Yes, emphatically. It's a one-time change for the admin that allows them to maintain the status quo, and they don't visit the site as often as users do.