5 ms·

It might be an unpopular opinion here, but I'm not entirely sure that the GDPR is going to be a good thing. It seems strange to me to have this enforcement of p

by sb8244 9y ago

guitarbill 9y ago
For sure it's a bit of a blunt tool, but we've seen companies can't be relied on to do it themselves. And yes, as devs it does force us to ask hard questions that we've been conveniently ignoring, usually at the request of management or marketing. Does this need detailed analytics? Do we need to store this information? How do we need to store this information? How do we design UX to withdraw consent? How do we handle the absence of consent? Etc. More difficult, but more ethical, too. One nice thing (maybe) is that it's so much effort to get consent to run pervasive analytics on EU users, that many people might just stop running pervasive analytics on EU users at all. Maybe all users? At least I can dream...
danieldk 9y ago
It might be an unpopular opinion here, but I'm not entirely sure that the GDPR is going to be a good thing. It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries. I see your point, but a large majority of web sites are extremely misbehaving, since they allow Google (any typically a bunch of other analytics firms) to track users around the web without any consent (through Google Analytics). I find this terribly frustrating. I decided to opt out of the Google ecosystem completely, but data about me is still vacuumed through Google analytics and Google-hosted JavaScript/CSS. I use uMatrix, but blocking Google-hosted assets is out of reach for most non-technical users. We would not be here in the first place if companies and website owners treated the user's privacy with respect. I don't feel pity for them that they jump through hoops now. If you host a small personal site, just consider axing Google analytics. You can get reasonably good statistics by just using a local log analyzer that does not upload your visitor's data to an analytics/ad company. Respect your user's privacy.
- closeparen 9y ago
  >. You can get reasonably good statistics by just using a local log analyzer that does not upload your visitor's data to an analytics/ad company. 1) Has your user consented to your webserver's access logging? 2) Has your user consented to the use of access log entries about them for analytical purposes? 3) How will you delete the access log entries corresponding to a user upon request? 4) How will you provide a user with the access log entries about them upon request? (I am not a lawyer, this is not legal advice).
  - beberlei 9y ago
    from what i catched talking to our lawyer, there are other levels of consent than explicit by the user explicit consent that might be revoked, in this case. 1. concerns of security and quality of service (gathering logs with full ip addresses is allowed for a reasonable time, a few days for example). 2. you don't need to delete the logs if you use them for this specific purpose only. 3. for analytical purpose it is enough to use pseudonomic identifiers, in case of ip address zero out the last part and you are fine. 4. using Piwik or your own cookies? Suddenly its not a third party cookie anymore and you are more free to do things. The problems for operators begin when they are handing this over to a third party.
- brylie 9y ago
  It is remarkable how many websites use Google fonts. I wasn't really aware until I used uBlock to disable third party fonts, and icons started disappearing on many fonts. Web designers are inadvertently enabling mass corporate surveillance by simply trying to save bandwidth on font icons.
  - chmars 9y ago
    Google Fonts is actually not a problem from a GDPR perspective as long as the EU-US 'Privacy Shield' is in force. All in all, Google's data privacy compliance is outstanding in comparison with most other US companies, only Amazon and Microsoft are probably on the same level.
- 9y ago
Shoothe 9y ago
> It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries. If you don't process PII about people from EU then GDRP does not apply. Merely accessing the page from EU does not trigger GDRP.
- sb8244 9y ago
  I'm pretty sure it does trigger in this case, if you have any tools like GA on your site.
- x0x0 9y ago
  PII is an American concept, not a GDPR concept. The GDPR has a notion of personal data and it is much more expansive than PII. While merely accessing the page from the EU doesn't trigger GDPR, logging and analytics may. I do think DPAs attempting to regulate EU external sites will be something to behold.
hvidgaard 9y ago
> It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries. If you open shop in a different country, you follow their laws. Your website being accessible in a country is seen as the same thing. It's not hard to implement geo blocking if you want to show best effort and thereby opt out of it.
- askvictor 9y ago
  This can very quickly become onerous for anyone wanting to run a website, if they have to understand the law of any country where it might be accessed. I think the onus of geoblocking should be in the country that decides this website doesn't obey it's laws, otherwise only large corporations with lawyers will be able to run websites. If your website is doing business (i.e. Has some sort of legal presence) in another country, well, that's a different story.
  - hvidgaard 9y ago
    If I'm just serving cat pictures, then I agree. But as soon as money and/or PII is involved, then a different set of rules apply.
- sb8244 9y ago
  This is where the technical complexity comes in. All of a sudden my static hosted page on github which gets a few hundred visitors per month and uses analytics should have Geo blocking? How much overhead will that add to the small site?
  - smu 9y ago
    It's very unlikely your static page contains personal data that would be ok in the US but not in EU. If you're referring to logging, there are some good responses in this discussion on how that will still be ok.
lloeki 9y ago
> It might be an unpopular opinion here, but I'm not entirely sure that the GDPR is going to be a good thing Feedback from the trenches: it is a very good thing. Suddenly corporate people are beginning to care about security and privacy: we receive spontaneous inquiries from customers about compliance as well as various questions about password storage policy and proper encryption. Previously the very same people were laughing in our face when we told them passwords must not be stored as plaintext. Whatever the content itself, the message of the GDPR is clear: companies have to care about their users privacy and security, or they'll get a wild kick in the guts.

by sb8244 9y ago

guitarbill 9y ago

For sure it's a bit of a blunt tool, but we've seen companies can't be relied on to do it themselves. And yes, as devs it does force us to ask hard questions that we've been conveniently ignoring, usually at the request of management or marketing. Does this need detailed analytics? Do we need to store this information? How do we need to store this information? How do we design UX to withdraw consent? How do we handle the absence of consent? Etc. More difficult, but more ethical, too. One nice thing (maybe) is that it's so much effort to get consent to run pervasive analytics on EU users, that many people might just stop running pervasive analytics on EU users at all. Maybe all users? At least I can dream...

danieldk 9y ago

It might be an unpopular opinion here, but I'm not entirely sure that the GDPR is going to be a good thing. It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries. I see your point, but a large majority of web sites are extremely misbehaving, since they allow Google (any typically a bunch of other analytics firms) to track users around the web without any consent (through Google Analytics). I find this terribly frustrating. I decided to opt out of the Google ecosystem completely, but data about me is still vacuumed through Google analytics and Google-hosted JavaScript/CSS. I use uMatrix, but blocking Google-hosted assets is out of reach for most non-technical users. We would not be here in the first place if companies and website owners treated the user's privacy with respect. I don't feel pity for them that they jump through hoops now. If you host a small personal site, just consider axing Google analytics. You can get reasonably good statistics by just using a local log analyzer that does not upload your visitor's data to an analytics/ad company. Respect your user's privacy.

closeparen 9y ago
>. You can get reasonably good statistics by just using a local log analyzer that does not upload your visitor's data to an analytics/ad company. 1) Has your user consented to your webserver's access logging? 2) Has your user consented to the use of access log entries about them for analytical purposes? 3) How will you delete the access log entries corresponding to a user upon request? 4) How will you provide a user with the access log entries about them upon request? (I am not a lawyer, this is not legal advice).
- beberlei 9y ago
  from what i catched talking to our lawyer, there are other levels of consent than explicit by the user explicit consent that might be revoked, in this case. 1. concerns of security and quality of service (gathering logs with full ip addresses is allowed for a reasonable time, a few days for example). 2. you don't need to delete the logs if you use them for this specific purpose only. 3. for analytical purpose it is enough to use pseudonomic identifiers, in case of ip address zero out the last part and you are fine. 4. using Piwik or your own cookies? Suddenly its not a third party cookie anymore and you are more free to do things. The problems for operators begin when they are handing this over to a third party.
brylie 9y ago
It is remarkable how many websites use Google fonts. I wasn't really aware until I used uBlock to disable third party fonts, and icons started disappearing on many fonts. Web designers are inadvertently enabling mass corporate surveillance by simply trying to save bandwidth on font icons.
- chmars 9y ago
  Google Fonts is actually not a problem from a GDPR perspective as long as the EU-US 'Privacy Shield' is in force. All in all, Google's data privacy compliance is outstanding in comparison with most other US companies, only Amazon and Microsoft are probably on the same level.
9y ago

Shoothe 9y ago

> It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries. If you don't process PII about people from EU then GDRP does not apply. Merely accessing the page from EU does not trigger GDRP.

sb8244 9y ago
I'm pretty sure it does trigger in this case, if you have any tools like GA on your site.
x0x0 9y ago
PII is an American concept, not a GDPR concept. The GDPR has a notion of personal data and it is much more expansive than PII. While merely accessing the page from the EU doesn't trigger GDPR, logging and analytics may. I do think DPAs attempting to regulate EU external sites will be something to behold.

hvidgaard 9y ago

> It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries. If you open shop in a different country, you follow their laws. Your website being accessible in a country is seen as the same thing. It's not hard to implement geo blocking if you want to show best effort and thereby opt out of it.

askvictor 9y ago
This can very quickly become onerous for anyone wanting to run a website, if they have to understand the law of any country where it might be accessed. I think the onus of geoblocking should be in the country that decides this website doesn't obey it's laws, otherwise only large corporations with lawyers will be able to run websites. If your website is doing business (i.e. Has some sort of legal presence) in another country, well, that's a different story.
- hvidgaard 9y ago
  If I'm just serving cat pictures, then I agree. But as soon as money and/or PII is involved, then a different set of rules apply.
sb8244 9y ago
This is where the technical complexity comes in. All of a sudden my static hosted page on github which gets a few hundred visitors per month and uses analytics should have Geo blocking? How much overhead will that add to the small site?
- smu 9y ago
  It's very unlikely your static page contains personal data that would be ok in the US but not in EU. If you're referring to logging, there are some good responses in this discussion on how that will still be ok.

lloeki 9y ago

> It might be an unpopular opinion here, but I'm not entirely sure that the GDPR is going to be a good thing Feedback from the trenches: it is a very good thing. Suddenly corporate people are beginning to care about security and privacy: we receive spontaneous inquiries from customers about compliance as well as various questions about password storage policy and proper encryption. Previously the very same people were laughing in our face when we told them passwords must not be stored as plaintext. Whatever the content itself, the message of the GDPR is clear: companies have to care about their users privacy and security, or they'll get a wild kick in the guts.