3 ms·

No one is discussing blanket permissions, ie using these cookies or information for advertising. You cannot have a site with a login without a cookie. It's gd

by x0x0 9y ago

No one is discussing blanket permissions, ie using these cookies or information for advertising. You cannot have a site with a login without a cookie. It's gdpr compliant to inform users you will use cookies for that purpose and not pretend there's some magic way to have a login gated site without a cookie or something functionally equivalent. A site development tool is very similar. Understanding if code is working and where it's breaking is a fundamental technical requirement to build and operate a production website. Stoking paranoia by calling bug reporters "pervasive tracking tools" is misguided; this tool only sees information that the user was handing to the site. ie any personal data is obviously already disclosed to the site.

bryanrasmussen 9y ago
I wasn't talking about the cookie. As far as blanket permissions goes you said 'Simply say you must allow cookies and our debugging tool or don't use the site', saying if you use the site we gather all this data sort of implies a blanket permission is given by using the site. This is generally what one does with the cookie warnings - the ones that say if you continue to use the site you agree to us setting cookies. I suppose you meant that you would have a message like - in order that we can keep our site performing optimally and fix any errors that might arise in day to day operations we need to track your actions on this site. (only a better message than that) - maybe that works but - well I think it might run into problems. Blanket permissions do not only mean we allow you to advertise to us. The bug reporter, as I understand in this case, tracks everything the user does on the site and associates it with the user account. I suppose that something that tracks everything you do on a site can be considered pervasive. You can argue you have a fundamental technical requirement to gather some particular data, but going from the technical requirement is to understand if code is working and where it's breaking to therefore we will need to gather every action users do on the site seems shortsightedly heading for a significant fine. This is what I meant in my other comment that if data is saved for a reasonable amount of time - 3 weeks maybe - and especially if the customer gives permission to analyze the data when they make a bug report then you would free from any problems.
- x0x0 9y ago
  The simple fact is the tracking tool knows nothing that the site doesn't already know. Because the user performed it on the site. If the user wasn't comfortable with the site knowing information X, and associating that information with that account, then the user shouldn't have done it on the site. The sole additional information this tracking tool gathers is things like internal state of the application. There is zero additional personal information disclosure.
  - bryanrasmussen 9y ago
    This seems to be a personal or philosophical stance of yours, I'm talking specifically about legal requirements of GDPR. Those are different than the legal requirements of the cookie law. As far as the tracking tool knowing nothing that the site doesn't already know, in real time that is true, but the GDPR addresses your site's 'memory' and in that case it is obviously false - which is actually sort of the whole purpose of the logging tool isn't it? So, as an easy to understand example, in my current work at a telecom we have a map where the user can add in address information and find if there is any outage happening in their area. We were logging the addresses entered. For GDPR reasons we removed these addresses from the log. We have set up temporary logging of the addresses that raise certain kinds of errors so that we can examine those addresses later - this is a reasonable usage and we inform the user 'We may save the addresses you enter here for a short time for the purposes of improving the performance of the application' (not exact message). The tracking tool would retain the data we have decided not to retain, admittedly in a more difficult to extract format, but the GDPR does not make allowances for that and really it would be silly if they did. Furthermore, for our site and service (and for any services that could be argued that people need to use) I believe stating if you're not okay with us keeping your data don't use the site would run into non-GDPR legal problems but would also be contrary to GDPR requirements and is as such a no-go for anyone wanting to remain in business - and anyway it would probably piss off customers. I could give other examples, but as I said your argument seems based on philosophical grounds that I believe if they were accepted by a European court would render the GDPR effectively useless, and as such I doubt it would be accepted.

by x0x0 9y ago

bryanrasmussen 9y ago

I wasn't talking about the cookie. As far as blanket permissions goes you said 'Simply say you must allow cookies and our debugging tool or don't use the site', saying if you use the site we gather all this data sort of implies a blanket permission is given by using the site. This is generally what one does with the cookie warnings - the ones that say if you continue to use the site you agree to us setting cookies. I suppose you meant that you would have a message like - in order that we can keep our site performing optimally and fix any errors that might arise in day to day operations we need to track your actions on this site. (only a better message than that) - maybe that works but - well I think it might run into problems. Blanket permissions do not only mean we allow you to advertise to us. The bug reporter, as I understand in this case, tracks everything the user does on the site and associates it with the user account. I suppose that something that tracks everything you do on a site can be considered pervasive. You can argue you have a fundamental technical requirement to gather some particular data, but going from the technical requirement is to understand if code is working and where it's breaking to therefore we will need to gather every action users do on the site seems shortsightedly heading for a significant fine. This is what I meant in my other comment that if data is saved for a reasonable amount of time - 3 weeks maybe - and especially if the customer gives permission to analyze the data when they make a bug report then you would free from any problems.

x0x0 9y ago
The simple fact is the tracking tool knows nothing that the site doesn't already know. Because the user performed it on the site. If the user wasn't comfortable with the site knowing information X, and associating that information with that account, then the user shouldn't have done it on the site. The sole additional information this tracking tool gathers is things like internal state of the application. There is zero additional personal information disclosure.
- bryanrasmussen 9y ago
  This seems to be a personal or philosophical stance of yours, I'm talking specifically about legal requirements of GDPR. Those are different than the legal requirements of the cookie law. As far as the tracking tool knowing nothing that the site doesn't already know, in real time that is true, but the GDPR addresses your site's 'memory' and in that case it is obviously false - which is actually sort of the whole purpose of the logging tool isn't it? So, as an easy to understand example, in my current work at a telecom we have a map where the user can add in address information and find if there is any outage happening in their area. We were logging the addresses entered. For GDPR reasons we removed these addresses from the log. We have set up temporary logging of the addresses that raise certain kinds of errors so that we can examine those addresses later - this is a reasonable usage and we inform the user 'We may save the addresses you enter here for a short time for the purposes of improving the performance of the application' (not exact message). The tracking tool would retain the data we have decided not to retain, admittedly in a more difficult to extract format, but the GDPR does not make allowances for that and really it would be silly if they did. Furthermore, for our site and service (and for any services that could be argued that people need to use) I believe stating if you're not okay with us keeping your data don't use the site would run into non-GDPR legal problems but would also be contrary to GDPR requirements and is as such a no-go for anyone wanting to remain in business - and anyway it would probably piss off customers. I could give other examples, but as I said your argument seems based on philosophical grounds that I believe if they were accepted by a European court would render the GDPR effectively useless, and as such I doubt it would be accepted.