6 ms·

You shouldn't be storing anything without first obtaining consent. Why are you using analytics indiscriminately? The GDPR does actually have exceptions for cas

by lucian1900 9y ago

You shouldn't be storing anything without first obtaining consent. Why are you using analytics indiscriminately? The GDPR does actually have exceptions for cases where local law requires you to store data. Any jurisdiction can already enforce their laws upon you if you affect their citizens. There's nothing new here.

ryanwaggoner 9y ago
You shouldn't be storing anything without first obtaining consent. Why are you using analytics indiscriminately? Sorry, I find this ludicrous. Using analytics "indiscriminately"? What does that even mean? The most basic use case for analytics is to use them indiscriminately to see how visitors are using your site. Not to mention that this is basically impossible, since storing IP addresses in Apache log files is also probably a breach. Someone in the EU sends you an email, now you're in violation because the header info is PII. A german walks into your hospital in Miami and signs in; if you don't have a special snowflake data management process for them that runs alongside your standard HIPAA-compliant one, you're probably in violation. Any jurisdiction can already enforce their laws upon you if you affect their citizens. No, they can't. They can declare any law, but that doesn't mean they can enforce it. I really think that basically every business around the world who doesn't have a direct EU presence in terms of office, employees should (and probably will) just ignore the GDPR. It's a huge violation of sovereignty, the freedom and ideals of the internet, and a great example of how people will be pleased to let their governments enact policies no matter how harmful or dangerous as long as they're against an "enemy" that they hate.
- sveme 9y ago
  > Any jurisdiction can already enforce their laws upon you if you affect their citizens. Isnt't that already done by the US? The case against Kim Dotcom comes to my mind.
  - ryanwaggoner 9y ago
    I'm definitely not defending US jurisdictional overreach.
  - adventured 9y ago
    Kim Dotcom made the mistake of operating servers in the US jurisdiction. New Zealand made the mistake of complying with the US requests to extradite him. The US could not have effectively enforced its laws upon Kim Dotcom without New Zealand's assistance. If China comes after me for something terrible I say about Mao (stray absurd example), and the US turns me over to China because they're influenced and or intimidated by China, that would be a similar premise: the US would bear immense, near total responsibility for capitulating, showing no backbone.
- shadowtree 9y ago
  So what is your beef then? Businesses that operate in the EU have to comply, businesses that don't interact with EU residents don't. As the US has a special relationship with EU (Privacy Shield, ..), it recognizes GDPR as valid. Don't like it? Focus on China, where WeChat is now your national ID card and is also linked to your personal credit score. Violate any government rules - your credit score goes down. Medical reps now have to register with the Chinese government before they're allowed to enter hospitals and their personal credit score is linked to their behavior. There you go, full data transparency nirvana. The world is a big and complicated space and big regions define their culture differently. Europe is not business-focused, but puts the citizen first. The US considers businesses as citizens, data privacy a hindrance for profitability - and China wonders what this citizen thing is.
  - ryanwaggoner 9y ago
    Some random EU resident visiting your website != operating in the EU, by any reasonable definition.
    - IntronExon 9y ago
      Why not? It would certainly be ludicrous for a brick and mortar establishment to be subjected to that, but if you’re offering a global product, welcome to the rest of the world.
    - mrtksn 9y ago
      What's the reasonable definition of operating in the EU?
      - GlitchMr 9y ago
        - Being located in EU. - Or in case where you aren't located in EU, providing services specifically to EU residents, which can be hinted by having a language choice mostly spoken in EU countries, allowing EU currencies (Euro, British pound and so on) or specifically mentioning supporting EU, for instance by saying that your website can deliver packages to European Union. Facebook for instance has offices in EU, which makes it clear that they are under GDPR, but even if they didn't, they do provide Facebook in EU languages.
- musage 9y ago
  > Using analytics "indiscriminately"? What does that even mean? It's up to you to unpack the bucket of "analytics, IP addresses, etc." you introduced. > The most basic use case for analytics is to use them indiscriminately to see how visitors are using your site. Indiscriminately in the sense of "all visitors", not necessarily in the sense of "all data". > a huge violation of sovereignty, the freedom and ideals of the internet The internet doesn't have ideals, and if it did, anything, people like Stallman would represent them more closely than marketing eels. > a great example of how people will be pleased to let their governments enact policies no matter how harmful or dangerous as long as they're against an "enemy" that they hate While you're making up more stuff, note how not a word of the initial comment was addressed; instead you just launched into a diatribe against straw men, of dreams of a golden age of digital privacy and whatnot. But yeah, those people salivating at the mouth out to hurt their "enemies" at unfathomable costs to themselves must be stopped ^^
ori_b 9y ago
> You shouldn't be storing anything without first obtaining consent. Why are you using analytics indiscriminately? tail -f /var/log/nginx/access.log Did you turn off nginx's default logging?
- deleted 9y ago
  [deleted]

ryanwaggoner 9y ago

You shouldn't be storing anything without first obtaining consent. Why are you using analytics indiscriminately? Sorry, I find this ludicrous. Using analytics "indiscriminately"? What does that even mean? The most basic use case for analytics is to use them indiscriminately to see how visitors are using your site. Not to mention that this is basically impossible, since storing IP addresses in Apache log files is also probably a breach. Someone in the EU sends you an email, now you're in violation because the header info is PII. A german walks into your hospital in Miami and signs in; if you don't have a special snowflake data management process for them that runs alongside your standard HIPAA-compliant one, you're probably in violation. Any jurisdiction can already enforce their laws upon you if you affect their citizens. No, they can't. They can declare any law, but that doesn't mean they can enforce it. I really think that basically every business around the world who doesn't have a direct EU presence in terms of office, employees should (and probably will) just ignore the GDPR. It's a huge violation of sovereignty, the freedom and ideals of the internet, and a great example of how people will be pleased to let their governments enact policies no matter how harmful or dangerous as long as they're against an "enemy" that they hate.

sveme 9y ago
> Any jurisdiction can already enforce their laws upon you if you affect their citizens. Isnt't that already done by the US? The case against Kim Dotcom comes to my mind.
- ryanwaggoner 9y ago
  I'm definitely not defending US jurisdictional overreach.
- adventured 9y ago
  Kim Dotcom made the mistake of operating servers in the US jurisdiction. New Zealand made the mistake of complying with the US requests to extradite him. The US could not have effectively enforced its laws upon Kim Dotcom without New Zealand's assistance. If China comes after me for something terrible I say about Mao (stray absurd example), and the US turns me over to China because they're influenced and or intimidated by China, that would be a similar premise: the US would bear immense, near total responsibility for capitulating, showing no backbone.
shadowtree 9y ago
So what is your beef then? Businesses that operate in the EU have to comply, businesses that don't interact with EU residents don't. As the US has a special relationship with EU (Privacy Shield, ..), it recognizes GDPR as valid. Don't like it? Focus on China, where WeChat is now your national ID card and is also linked to your personal credit score. Violate any government rules - your credit score goes down. Medical reps now have to register with the Chinese government before they're allowed to enter hospitals and their personal credit score is linked to their behavior. There you go, full data transparency nirvana. The world is a big and complicated space and big regions define their culture differently. Europe is not business-focused, but puts the citizen first. The US considers businesses as citizens, data privacy a hindrance for profitability - and China wonders what this citizen thing is.
- ryanwaggoner 9y ago
  Some random EU resident visiting your website != operating in the EU, by any reasonable definition.
  - IntronExon 9y ago
    Why not? It would certainly be ludicrous for a brick and mortar establishment to be subjected to that, but if you’re offering a global product, welcome to the rest of the world.
  - mrtksn 9y ago
    What's the reasonable definition of operating in the EU?
    - GlitchMr 9y ago
      - Being located in EU. - Or in case where you aren't located in EU, providing services specifically to EU residents, which can be hinted by having a language choice mostly spoken in EU countries, allowing EU currencies (Euro, British pound and so on) or specifically mentioning supporting EU, for instance by saying that your website can deliver packages to European Union. Facebook for instance has offices in EU, which makes it clear that they are under GDPR, but even if they didn't, they do provide Facebook in EU languages.
musage 9y ago
> Using analytics "indiscriminately"? What does that even mean? It's up to you to unpack the bucket of "analytics, IP addresses, etc." you introduced. > The most basic use case for analytics is to use them indiscriminately to see how visitors are using your site. Indiscriminately in the sense of "all visitors", not necessarily in the sense of "all data". > a huge violation of sovereignty, the freedom and ideals of the internet The internet doesn't have ideals, and if it did, anything, people like Stallman would represent them more closely than marketing eels. > a great example of how people will be pleased to let their governments enact policies no matter how harmful or dangerous as long as they're against an "enemy" that they hate While you're making up more stuff, note how not a word of the initial comment was addressed; instead you just launched into a diatribe against straw men, of dreams of a golden age of digital privacy and whatnot. But yeah, those people salivating at the mouth out to hurt their "enemies" at unfathomable costs to themselves must be stopped ^^

ori_b 9y ago

> You shouldn't be storing anything without first obtaining consent. Why are you using analytics indiscriminately? tail -f /var/log/nginx/access.log Did you turn off nginx's default logging?

deleted 9y ago
[deleted]