4 ms·

> That's ... just wrong The lawyers would disagree with you. If the email address contains anything that identifies you personally, it's PII and thus falls un

> That's ... just wrong The lawyers would disagree with you. If the email address contains anything that identifies you personally, it's PII and thus falls under GDPR. Therefore, if you collect email addresses you have to go through great pains to protect them. As for the rest of your stuff, while you are technically correct your comment is pretty useless. We live in a data driven world that requires.... well... collecting data. Saying "just dont collect email" isn't helpful and collecting IP address info without associating it with use data is pretty pointless. It is a huge, expensive undertaking to make any kind of "legacy" pre-GDPR infrastructure GDPR compliant. > If you simply avoid collecting data, none of the other stuff affects you. If you are doing anything useful on the internet, you are collecting data.

zAy0LfpBZLC8mAC 9y ago
> The lawyers would disagree with you. If the email address contains anything that identifies you personally, it's PII and thus falls under GDPR. You are simply missing the point. It's not required to "contain" anything. If it is the email address of a person, then that makes it PII. > Therefore, if you collect email addresses you have to go through great pains to protect them. Well, yes, of course you do? If you want to profit from using other people's addresses, you better make sure they don't get harmed by it. > We live in a data driven world that requires.... well... collecting data. Erm ... no? We don't live in a data driven world, we live in a world where some people are completely unwilling to respect the boundaries of other people and consider it their right to do whatever it takes to manipulate them in their interest. There is no such right, there is nothing that requires that you violate other people. > Saying "just dont collect email" isn't helpful Well, whether it is helpful depends on what you expect to be helped with. But it is a perfectly viable thing to do. If people voluntarily hand you their email address so you can send them invoices, say, there is absolutely no problem with you doing so, because that obviously means that there is consent. Anything beyond that, and you are just selfishly trying to ignore the interests of other people, and it is perfectly viable to just not do that. > collecting IP address info without associating it with use data is pretty pointless. ... so don't do it, then? > It is a huge, expensive undertaking to make any kind of "legacy" pre-GDPR infrastructure GDPR compliant. Erm, well, it's an expensive undertaking to stop being an asshole ... so what? > If you are doing anything useful on the internet, you are collecting data. So, if I publish a free software project on my own web server that doesn't write any log files ... that's not useful? Could you explain how exactly that reasoning goes?
kelnos 9y ago
> Saying "just dont collect email" isn't helpful If you don't need that email address for anything, then don't collect it. If you do (perhaps because the customer has agreed to let you send them email), then fine, collect it, but also provide a way to delete it, permanently, if the customer wants to terminate their relationship with you. > It is a huge, expensive undertaking to make any kind of "legacy" pre-GDPR infrastructure GDPR compliant. Yes, it is. But worthwhile things are often not trivial.
- Silhouette 9y ago
  But worthwhile things are often not trivial. Indeed. But there is not trivial, and then there is prohibitively difficult and expensive to the point of being unreasonable. Obvious examples, exhibit A: Suppose you use a deduplicating backup system, and being a responsible service you also ensure that all user data is properly encrypted as part of your backup process. If each single customer who decides they don't want to deal with you any more can require you to remove any reference to them from anything you currently store or have ever stored, please describe a technically and commercially viable strategy for reliably cleansing your backups.
  - kelnos 9y ago
    Here's the thing: tough shit. I am super tired of the "it costs too much", "it's too hard to do" excuses. You've built your business off of my data. Not yours. Mine. I dictate how it is used and who has it. You keeping my data can actually be a threat to my security and livelihood. We have swung way too far into a regime where personal information is irresponsibly slung around the internet with no accountability and no consequences when that data is misused. > If each single customer who decides they don't want to deal with you any more can require you to remove any reference to them from anything you currently store or have ever stored, please describe a technically and commercially viable strategy for reliably cleansing your backups. That's not my job to do. That's "your" job as a responsible technologist to figure out, based on your knowledge of your systems and processes. I'm in the midst of preparing to be GDPR compliant at my employer, and I'm not saying it's easy, but all these problems are tractable. Would I rather be focused 100% on building new products and features? Sure, who wouldn't? But part of being a professional developer is taking responsibility for the software you write, which includes handling customer data with respect. GDPR is a step in the right direction for that.

zAy0LfpBZLC8mAC 9y ago

> The lawyers would disagree with you. If the email address contains anything that identifies you personally, it's PII and thus falls under GDPR. You are simply missing the point. It's not required to "contain" anything. If it is the email address of a person, then that makes it PII. > Therefore, if you collect email addresses you have to go through great pains to protect them. Well, yes, of course you do? If you want to profit from using other people's addresses, you better make sure they don't get harmed by it. > We live in a data driven world that requires.... well... collecting data. Erm ... no? We don't live in a data driven world, we live in a world where some people are completely unwilling to respect the boundaries of other people and consider it their right to do whatever it takes to manipulate them in their interest. There is no such right, there is nothing that requires that you violate other people. > Saying "just dont collect email" isn't helpful Well, whether it is helpful depends on what you expect to be helped with. But it is a perfectly viable thing to do. If people voluntarily hand you their email address so you can send them invoices, say, there is absolutely no problem with you doing so, because that obviously means that there is consent. Anything beyond that, and you are just selfishly trying to ignore the interests of other people, and it is perfectly viable to just not do that. > collecting IP address info without associating it with use data is pretty pointless. ... so don't do it, then? > It is a huge, expensive undertaking to make any kind of "legacy" pre-GDPR infrastructure GDPR compliant. Erm, well, it's an expensive undertaking to stop being an asshole ... so what? > If you are doing anything useful on the internet, you are collecting data. So, if I publish a free software project on my own web server that doesn't write any log files ... that's not useful? Could you explain how exactly that reasoning goes?

kelnos 9y ago

> Saying "just dont collect email" isn't helpful If you don't need that email address for anything, then don't collect it. If you do (perhaps because the customer has agreed to let you send them email), then fine, collect it, but also provide a way to delete it, permanently, if the customer wants to terminate their relationship with you. > It is a huge, expensive undertaking to make any kind of "legacy" pre-GDPR infrastructure GDPR compliant. Yes, it is. But worthwhile things are often not trivial.

Silhouette 9y ago
But worthwhile things are often not trivial. Indeed. But there is not trivial, and then there is prohibitively difficult and expensive to the point of being unreasonable. Obvious examples, exhibit A: Suppose you use a deduplicating backup system, and being a responsible service you also ensure that all user data is properly encrypted as part of your backup process. If each single customer who decides they don't want to deal with you any more can require you to remove any reference to them from anything you currently store or have ever stored, please describe a technically and commercially viable strategy for reliably cleansing your backups.
- kelnos 9y ago
  Here's the thing: tough shit. I am super tired of the "it costs too much", "it's too hard to do" excuses. You've built your business off of my data. Not yours. Mine. I dictate how it is used and who has it. You keeping my data can actually be a threat to my security and livelihood. We have swung way too far into a regime where personal information is irresponsibly slung around the internet with no accountability and no consequences when that data is misused. > If each single customer who decides they don't want to deal with you any more can require you to remove any reference to them from anything you currently store or have ever stored, please describe a technically and commercially viable strategy for reliably cleansing your backups. That's not my job to do. That's "your" job as a responsible technologist to figure out, based on your knowledge of your systems and processes. I'm in the midst of preparing to be GDPR compliant at my employer, and I'm not saying it's easy, but all these problems are tractable. Would I rather be focused 100% on building new products and features? Sure, who wouldn't? But part of being a professional developer is taking responsibility for the software you write, which includes handling customer data with respect. GDPR is a step in the right direction for that.