3 ms·

How does that work? If I have a server in my US living room, and someone from an overprotective country visits my server, and my pokemon trading site sets an is

How does that work? If I have a server in my US living room, and someone from an overprotective country visits my server, and my pokemon trading site sets an is_deleted flag to keep foreign keys valid, can you really say I'm breaking the law? It doesn't seem like laws specific to some European country should apply anywhere outside of that country. I can maybe see the EU(since they like to apply laws everywhere). You did call them 'customers', which means there's an exchange of money. Is there a restriction on European banks to prohibit them from dealing with sites that don't comply with the country's law?

jacquesm 10y ago
Don't do business in the EU if you don't intend to respect the laws. I find the word 'overprotective' out of place in your comment, it says that you feel that once someone gives you their data it is yours to do with as you please. As for laws specific to a country applying outside it: you can do whatever you want but the moment you hold assets abroad or intend to travel you are exposing yourself to potential legal action, something always good to keep in mind. The United States has a long history of enforcing its laws outside its borders. Also, you are wrong about how you'd go about implementing such deletion. You don't need an 'is_deleted' flag at all to keep your foreign keys valid, all you would have to do is to overwrite the record with random data or blank the personally identifiable fields and delete anything that that user has given you. That's not that hard and purposefully mis-implementing that would not look very good if it ever came to a lawsuit. Pro-tip: consult with a lawyer versed in the matter if you want to do this stuff at all it is better to do it by the book. "Keeping foreign keys valid" is not an excuse to break the law.
- MichaelBurge 10y ago
  > Don't do business in the EU if you don't intend to respect the laws. A lot of Japanese sites IP-ban foreigners so they don't have to deal with them. I always figured, why not leave the site open for everyone but not officially support them? I guess putting technical measures in place prevents having your assets seized, or being sued or arrested when you step foot there. If an EU customer with data retention laws uses a VPN to bypass an IP-block(and pays with bitcoin or something), would you still be subject to their laws? Or would the attempt to block them be sufficient legally?
  - jacquesm 10y ago
    It's not about you blocking them or not blocking them. It's simply about respecting the rights of your users. If you feel that taking users data without giving them the option to ask for you to delete it needs laws that can and will be enforced then you can see why our industry has a bad reputation when it comes to managing end user data. This sort of behavior is exactly why the industry is no longer self-regulating but is now forcibly regulated in the EU. And soon to be much more forcibly regulated, come 2018 the new version of the DPD will come into effect which has much more teeth because there are still plenty of companies that are trying to evade their responsibilities. For instance, from then on, if you have been breached you will be required by law to report the breach. So, be nice to your users, respect their data and try to be better than your competitors rather than to find ways in which you can creatively evade legislation that is especially meant to apply to you and your customers.
- yladiz 10y ago
  Prefacing that I think we all have a right to privacy/right to be forgotten, or whatever phrasing is used for this in the EU, as a thought exercise, I'm wondering if you didn't want to abide by this, could you effectively do it? If I run an app and didn't want to handle the whole process of deleting user data or wanted to keep it for later, for whatever reason, would it be possible to forbid/block EU users/customers from using the website?
  - rovr138 9y ago
    Make that part of your terms. We don't fully delete the data. We don't allow for this reason EU residents since we can't comply with law XXXX. If they use it, they're the ones breaking the agreement. Not sure what would happen though. If they sue you, you can probably sue them back. But not sure what you would end up needing to do.
true_religion 10y ago
Delete their email address, name, or any other identifying information. That's it. To me, the troubling factor is that the EU hasn't clarified the law so seeks to apply it to individuals who are not in the EU and never intended to do business with EU residents.
- ska 10y ago
  any other identifying information This part is actually much harder than it looks. Honestly though, if you tell users you can delete their data on request, you should just do that - delete all of their data, full stop. If you can't or choose not to, you should just be up front about that, also - that means in plain language they will see, not buried in a TOS or whatever. It's the only ethical way to handle this. National boundaries and jurisdiction are side issues, really.
  - jacquesm 10y ago
    > This part is actually much harder than it looks. Not really, at least I've found keeping data much harder than deleting it. The only hard part is backups.
    - ska 10y ago
      I think I was unclear - I meant that deleting only "identifying" data, i.e. anonymizing a dataset is hard. Perhaps I misread the earlier comment. Deleting all data is as you note, easy, with the exception of backups.
      - jacquesm 10y ago
        Anonymizing a dataset is next to impossible, especially if you have the ability to combine it with other datasets.
        ska 10y ago
        precisely.

jacquesm 10y ago

Don't do business in the EU if you don't intend to respect the laws. I find the word 'overprotective' out of place in your comment, it says that you feel that once someone gives you their data it is yours to do with as you please. As for laws specific to a country applying outside it: you can do whatever you want but the moment you hold assets abroad or intend to travel you are exposing yourself to potential legal action, something always good to keep in mind. The United States has a long history of enforcing its laws outside its borders. Also, you are wrong about how you'd go about implementing such deletion. You don't need an 'is_deleted' flag at all to keep your foreign keys valid, all you would have to do is to overwrite the record with random data or blank the personally identifiable fields and delete anything that that user has given you. That's not that hard and purposefully mis-implementing that would not look very good if it ever came to a lawsuit. Pro-tip: consult with a lawyer versed in the matter if you want to do this stuff at all it is better to do it by the book. "Keeping foreign keys valid" is not an excuse to break the law.

MichaelBurge 10y ago
> Don't do business in the EU if you don't intend to respect the laws. A lot of Japanese sites IP-ban foreigners so they don't have to deal with them. I always figured, why not leave the site open for everyone but not officially support them? I guess putting technical measures in place prevents having your assets seized, or being sued or arrested when you step foot there. If an EU customer with data retention laws uses a VPN to bypass an IP-block(and pays with bitcoin or something), would you still be subject to their laws? Or would the attempt to block them be sufficient legally?
- jacquesm 10y ago
  It's not about you blocking them or not blocking them. It's simply about respecting the rights of your users. If you feel that taking users data without giving them the option to ask for you to delete it needs laws that can and will be enforced then you can see why our industry has a bad reputation when it comes to managing end user data. This sort of behavior is exactly why the industry is no longer self-regulating but is now forcibly regulated in the EU. And soon to be much more forcibly regulated, come 2018 the new version of the DPD will come into effect which has much more teeth because there are still plenty of companies that are trying to evade their responsibilities. For instance, from then on, if you have been breached you will be required by law to report the breach. So, be nice to your users, respect their data and try to be better than your competitors rather than to find ways in which you can creatively evade legislation that is especially meant to apply to you and your customers.
yladiz 10y ago
Prefacing that I think we all have a right to privacy/right to be forgotten, or whatever phrasing is used for this in the EU, as a thought exercise, I'm wondering if you didn't want to abide by this, could you effectively do it? If I run an app and didn't want to handle the whole process of deleting user data or wanted to keep it for later, for whatever reason, would it be possible to forbid/block EU users/customers from using the website?
- rovr138 9y ago
  Make that part of your terms. We don't fully delete the data. We don't allow for this reason EU residents since we can't comply with law XXXX. If they use it, they're the ones breaking the agreement. Not sure what would happen though. If they sue you, you can probably sue them back. But not sure what you would end up needing to do.

true_religion 10y ago

Delete their email address, name, or any other identifying information. That's it. To me, the troubling factor is that the EU hasn't clarified the law so seeks to apply it to individuals who are not in the EU and never intended to do business with EU residents.

ska 10y ago
any other identifying information This part is actually much harder than it looks. Honestly though, if you tell users you can delete their data on request, you should just do that - delete all of their data, full stop. If you can't or choose not to, you should just be up front about that, also - that means in plain language they will see, not buried in a TOS or whatever. It's the only ethical way to handle this. National boundaries and jurisdiction are side issues, really.
- jacquesm 10y ago
  > This part is actually much harder than it looks. Not really, at least I've found keeping data much harder than deleting it. The only hard part is backups.
  - ska 10y ago
    I think I was unclear - I meant that deleting only "identifying" data, i.e. anonymizing a dataset is hard. Perhaps I misread the earlier comment. Deleting all data is as you note, easy, with the exception of backups.
    - jacquesm 10y ago
      Anonymizing a dataset is next to impossible, especially if you have the ability to combine it with other datasets.
      - ska 10y ago
        precisely.