4 ms·

I am curious, if you offered a service that allowed users to post their own data to your service. How do you protect against customers posting data that violate

I am curious, if you offered a service that allowed users to post their own data to your service. How do you protect against customers posting data that violates the GDPR. I.e. peoples personal information being posted in plaintext? Is this type of case covered by the GDPR? Also how are things like access logs supposed to handled according to the GDPR? Our software records all requests made to our API, they log your userid, ip address, and what you were trying to do. We have clients who are in the US who required the above feature for auditing purposes.

everdev 9y ago
Typically, privacy violations are instances where the user has not consented to sharing the information. In the scenario you describe, if someone willingly posts their own personal information they have forfeited their right to privacy. The law is meant to protect people from companies rather than people from themselves.
- woolvalley 9y ago
  Your joe blogger using somesmallwordpresshosting.com and you have a freeform comments page. People post 'private' comments of others. Who is responsible for what? How the fuck do you know if its of an 'EU citizen' if that isn't made obvious? Can you get fined literal millions because you fucked up some detail for your blog newsletter's email list?
realbarack 9y ago
I am not a lawyer nor a security expert but we've decided at the place where I work that unstructured fields which are unlikely to contain personal data—but might in edge cases where a user chooses to enter it—don't fall under the GDPR purview. An extreme example of this is in hosted email—if Alice writes an email to bob@gmail.com with some of Charlie's personal information, it would be absurd if Charlie could ask Google to remove the email. (Although maybe reasonable if Charlie could request to not have his data used by Google to target him or anyone else with ads.)
- x0x0 9y ago
  I have to guess this is why gmail stopped (or at least announced stopping) personalized targeting: the difficulty of deciding if anyone on the email is subject to GDPR.
paulsutter 9y ago
It should be very clear to the user how the data will be used and shared. If a hotel asks for free-form feedback, it shouldn't magically post the response as a review, under the user's name, on a public site, for example.
the_mitsuhiko 9y ago
> I am curious, if you offered a service that allowed users to post their own data to your service. How do you protect against customers posting data that violates the GDPR. I.e. peoples personal information being posted in plaintext? You ensure that those users have a way to delete the data again.
- jcadam 9y ago
  I'd actually considered implementing a "soft delete" function for my service (knowledge management SaaS), out of fear that a user would accidentally delete something important. Now with GDPR pending, I think I won't. I'll just leave my 'no sh*t delete' function in place. If I get a request to restore any data I can say, "Sorry, the Europeans made me burn your data when you unwittingly clicked the red 'delete' button (as well as the confirmation dialog you didn't read)."
  - gnud 9y ago
    If you purge soft-deleted records after (say) 2 months, and don't use those records for anything unless they are undeleted by the users request, I don't think that should cause any problems with GDPR. Of course, IANAL.
x0x0 9y ago
The GDPR defines two types of companies: processors and controllers. The crucial distinction is (roughly) if a company makes decisions. Someone performing targeting or operating a website is probably a controller, whereas AWS, who makes no decisions and just follows directions, is a processor. If you don't want to be a processor, the best thing to do is probably in your contracts disallow usage of your service for anything containing GDPR covered personal data. As for access logs, those will be some mixture of the two bases offered in the GDPR. Some will be required by legitimate interests (such as those collected for legal requirements) and some will be subject to consent. This is a complex discussion.

everdev 9y ago

Typically, privacy violations are instances where the user has not consented to sharing the information. In the scenario you describe, if someone willingly posts their own personal information they have forfeited their right to privacy. The law is meant to protect people from companies rather than people from themselves.

woolvalley 9y ago
Your joe blogger using somesmallwordpresshosting.com and you have a freeform comments page. People post 'private' comments of others. Who is responsible for what? How the fuck do you know if its of an 'EU citizen' if that isn't made obvious? Can you get fined literal millions because you fucked up some detail for your blog newsletter's email list?

realbarack 9y ago

I am not a lawyer nor a security expert but we've decided at the place where I work that unstructured fields which are unlikely to contain personal data—but might in edge cases where a user chooses to enter it—don't fall under the GDPR purview. An extreme example of this is in hosted email—if Alice writes an email to bob@gmail.com with some of Charlie's personal information, it would be absurd if Charlie could ask Google to remove the email. (Although maybe reasonable if Charlie could request to not have his data used by Google to target him or anyone else with ads.)

x0x0 9y ago
I have to guess this is why gmail stopped (or at least announced stopping) personalized targeting: the difficulty of deciding if anyone on the email is subject to GDPR.

paulsutter 9y ago

It should be very clear to the user how the data will be used and shared. If a hotel asks for free-form feedback, it shouldn't magically post the response as a review, under the user's name, on a public site, for example.

the_mitsuhiko 9y ago

> I am curious, if you offered a service that allowed users to post their own data to your service. How do you protect against customers posting data that violates the GDPR. I.e. peoples personal information being posted in plaintext? You ensure that those users have a way to delete the data again.

jcadam 9y ago
I'd actually considered implementing a "soft delete" function for my service (knowledge management SaaS), out of fear that a user would accidentally delete something important. Now with GDPR pending, I think I won't. I'll just leave my 'no sh*t delete' function in place. If I get a request to restore any data I can say, "Sorry, the Europeans made me burn your data when you unwittingly clicked the red 'delete' button (as well as the confirmation dialog you didn't read)."
- gnud 9y ago
  If you purge soft-deleted records after (say) 2 months, and don't use those records for anything unless they are undeleted by the users request, I don't think that should cause any problems with GDPR. Of course, IANAL.

x0x0 9y ago

The GDPR defines two types of companies: processors and controllers. The crucial distinction is (roughly) if a company makes decisions. Someone performing targeting or operating a website is probably a controller, whereas AWS, who makes no decisions and just follows directions, is a processor. If you don't want to be a processor, the best thing to do is probably in your contracts disallow usage of your service for anything containing GDPR covered personal data. As for access logs, those will be some mixture of the two bases offered in the GDPR. Some will be required by legitimate interests (such as those collected for legal requirements) and some will be subject to consent. This is a complex discussion.