3 ms·

So, again, there is no big problem. Easiest step: stop logging every single hit on your site (IP, browser, etc). You want a bit more analytics? Log general a

So, again, there is no big problem. Easiest step: stop logging every single hit on your site (IP, browser, etc). You want a bit more analytics? Log general attributes, but not the IP. Just that a hit occurred, browser, general geo (country). that's it. Perfectly compliant. Want them to fill out a form? Welcome to GDPR, as you should. As Maciej Cieglowski (idlewords, pinboard) so eloquently states, over and over again, you don't have to store and hoard all this data. It's BS to begin with, and dangerous in the long run.

elorant 9y ago
And how will the legislator know what I'm logging and what not?
- shadowtree 9y ago
  They don't. GDPR kicks in once a EU resident files a complaint. GDPR also enforces a data report card - so if a EU resident (not just a citizen!) asks you about their data, you have to comply and give a complete answer. If you then reveal you store PII without their consent or fail to reveal everything and get caught, the fines will kick in. Don't screw over EU residents and you're fine. And if you think this laughable, remember that it was a single Austrian law student, Max Schrems, who went after Facebook and killed the EU-US Safe Harbor agreement. EU pensioneers and students are what will kill you, endless time on their hands. :)
ryanwaggoner 9y ago
Actually, easiest step: completely ignore this, just like I would any random law from some international bureaucracy that has no jurisdiction over me.
- IntronExon 9y ago
  aka “The Burning Bridges” plan. It could work, assuming you don’t like to travel, and never do business in those countries, and the global geopolitical situation does not radically change. A bit short-sighted...
  - ryanwaggoner 9y ago
    Maybe so, but I’m not going to let every random bureaucrat around the world with an inflated sense of their importance dictate how I do business. If their enforcement mechanisms become such that I need to worry about it, I’ll do so then. Unless you think that the EU is going to monitor every website on the internet and magically divine who owns them and what they’re doing behind the scenes with user data, and then develop a blacklist for those people so they can’t travel or they can go after them after WW3? I guess I’ll really regret it if that’s the case. Until then, I’ll ignore.
    - IntronExon 9y ago
      Well, good luck with thst, but the world is full of random bureaucrats who can make your life massively difficult. It might or might not be right or fair, but it is and you play pretend at your own peril. Right now monitoring all sites can’t work, but how about five or ten years? Bureaucratic institutions can have very long memories.
    - shadowtree 9y ago
      Not how it works, but you show an attitude that is clearly hobbyist/freelance, which is fine. Enterprise and anything related to big money cares. Not like the EU is a small market. You'll also be surprised how much the US and EU cooperate, legally and economically. MS, Google, FB,... endless legal resources and yet the EU hammer is inescapable. The most interesting thing to me is how you don't see the opportunity that GDPR represents to MAKE money. We're all raking in contracts and work consulting clients and updating products - but hey, I guess you don't want to compete. Good luck!
      - ryanwaggoner 9y ago
        Ouch. You’re probably right about the hobbyist mindset. If I were responsible for a large enterprise I’m sure I’d be more circumspect about the stewardship I’d have over the company, employees, and customers. I hope that wouldn’t mean I’d decide it was fair and reasonable, just that I’d be more constrained on a practical level. But I’m not, so... Regardless, I have no interest in consulting to help companies solve an invented problem based on a bad law. I make plenty of money without making the world a worse place.
pbalau 9y ago
How would you then detect that there is a bot net messing with your service? How would you discriminate between bad actors from Romania? Are you going to mass ban huge chunks of possible customers because you dont have granulary enough data? The hard problem is that most of the data logged about you has very "good" uses, but in the same time it can be used for bad things. And there is no way to properly enforce only the good uses. Mass banning groups will only cripple the tech advances we see happening today.

elorant 9y ago

And how will the legislator know what I'm logging and what not?

shadowtree 9y ago
They don't. GDPR kicks in once a EU resident files a complaint. GDPR also enforces a data report card - so if a EU resident (not just a citizen!) asks you about their data, you have to comply and give a complete answer. If you then reveal you store PII without their consent or fail to reveal everything and get caught, the fines will kick in. Don't screw over EU residents and you're fine. And if you think this laughable, remember that it was a single Austrian law student, Max Schrems, who went after Facebook and killed the EU-US Safe Harbor agreement. EU pensioneers and students are what will kill you, endless time on their hands. :)

ryanwaggoner 9y ago

Actually, easiest step: completely ignore this, just like I would any random law from some international bureaucracy that has no jurisdiction over me.

IntronExon 9y ago
aka “The Burning Bridges” plan. It could work, assuming you don’t like to travel, and never do business in those countries, and the global geopolitical situation does not radically change. A bit short-sighted...
- ryanwaggoner 9y ago
  Maybe so, but I’m not going to let every random bureaucrat around the world with an inflated sense of their importance dictate how I do business. If their enforcement mechanisms become such that I need to worry about it, I’ll do so then. Unless you think that the EU is going to monitor every website on the internet and magically divine who owns them and what they’re doing behind the scenes with user data, and then develop a blacklist for those people so they can’t travel or they can go after them after WW3? I guess I’ll really regret it if that’s the case. Until then, I’ll ignore.
  - IntronExon 9y ago
    Well, good luck with thst, but the world is full of random bureaucrats who can make your life massively difficult. It might or might not be right or fair, but it is and you play pretend at your own peril. Right now monitoring all sites can’t work, but how about five or ten years? Bureaucratic institutions can have very long memories.
  - shadowtree 9y ago
    Not how it works, but you show an attitude that is clearly hobbyist/freelance, which is fine. Enterprise and anything related to big money cares. Not like the EU is a small market. You'll also be surprised how much the US and EU cooperate, legally and economically. MS, Google, FB,... endless legal resources and yet the EU hammer is inescapable. The most interesting thing to me is how you don't see the opportunity that GDPR represents to MAKE money. We're all raking in contracts and work consulting clients and updating products - but hey, I guess you don't want to compete. Good luck!
    - ryanwaggoner 9y ago
      Ouch. You’re probably right about the hobbyist mindset. If I were responsible for a large enterprise I’m sure I’d be more circumspect about the stewardship I’d have over the company, employees, and customers. I hope that wouldn’t mean I’d decide it was fair and reasonable, just that I’d be more constrained on a practical level. But I’m not, so... Regardless, I have no interest in consulting to help companies solve an invented problem based on a bad law. I make plenty of money without making the world a worse place.

pbalau 9y ago

How would you then detect that there is a bot net messing with your service? How would you discriminate between bad actors from Romania? Are you going to mass ban huge chunks of possible customers because you dont have granulary enough data? The hard problem is that most of the data logged about you has very "good" uses, but in the same time it can be used for bad things. And there is no way to properly enforce only the good uses. Mass banning groups will only cripple the tech advances we see happening today.