7 ms·

> As a company that uses third-party services for data processing (which includes almost every piece of SaaS-type software) you have to sign a data processing a

> As a company that uses third-party services for data processing (which includes almost every piece of SaaS-type software) you have to sign a data processing agreement with each of those, which can mean considerable effort. At least for SaaS it's pretty clear-cut. For freelancers, contractors and consultants the situation is way more confused. AFAICT I need a data processing agreement with every client, even if I only log into their servers once a month to update WordPress and check their logs, because I am now deemed to be processing personal information. These details need talking about, and I've yet to see industry bodies doing so.

PeterisP 9y ago
IMHO it simply requires companies to make a clear choice. Either they have the organizational capacity to handle private information properly, or they should not do it at all. There's no reason for every company to get a data processing agreement with every SaaS they use as long as they're not putting private data of other people inside; and in most cases (except CRM and payment systems) they should not do so. There's no reason for every random company to get a data processing agreement with the contractor maintaining their WordPress site if that site doesn't contain any private information, and it probably should not. On the other hand, if it does, then giving full access to that data should be more difficult than simply giving the keys to a random contractor; the company is fully responsible for whatever you do ("Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject."), so that includes vetting you, being able to supervise what you've done, and probably some liability requirement. On the other hand, if that's a standard service you're providing, it all means that your standard agreement form just needs a few extra paragraphs to cover that data processing part. The log/IP address issue has technical solutions - you can use logrotate in combination with gnupg to ensure that logs are available if you need to analyze them, but are encrypted and not available to everyone logging on that server.
- OrganicMSG 9y ago
  "Either they have the organizational capacity to handle private information properly, or they should not do it at all." While I admire the intent here, in the world at large it seems that multinationals and governments fail at this one with monotonous regularity and Blanche's final line - 'Whoever you are, I have always depended on the kindness of strangers', has been adopted by the computer security industry as the unofficial motto.
  - PeterisP 9y ago
    What I've seen from the world at large is not large multinationals failing at handling private information properly, but rather them not trying to handle private information properly. I.e. it's not because they're incapable of doing so if they wanted, but that they didn't even attempt to do so. GDPR is a way of forcing some of them to stop handling the information, and forcing those who do to actually start trying.
    - aeorgnoieang 9y ago
      And you're fine with all of the organizations smaller than "large multinationals" possibly having to shutdown and layoff all of their employees?
- LoSboccacc 9y ago
  And what happens when anything of that changes in scope? You gonna resend the consent form to each and every past user? Of corse not. What will happen instead is that behind a consent box a lengthy disclaimer will ask consent for every piece of information and blanket every length of scope, triggering a cascade across providers and contractors.
  - _o_ 9y ago
    No it will not. For consent it is explicitly forbiden to use legal / technical speech and you can't cascade it. Allowing you to use my data has nothing to do with you giving my data to google. The more 3rd party "providers" the more fishy will your site look. And you can bet the user wont give consent for 100 tick boxes - you can't pretick them, it needs to be opt-in. And this is the reason: https://www.paypal.com/ie/webapps/mpp/ua/third-parties-list https://www.paypal.com/ie/webapps/mpp/ua/third-parties-list This might help: https://pagefair.com/blog/2018/granular-gdpr-consent/ https://pagefair.com/blog/2018/granular-gdpr-consent/

PeterisP 9y ago

IMHO it simply requires companies to make a clear choice. Either they have the organizational capacity to handle private information properly, or they should not do it at all. There's no reason for every company to get a data processing agreement with every SaaS they use as long as they're not putting private data of other people inside; and in most cases (except CRM and payment systems) they should not do so. There's no reason for every random company to get a data processing agreement with the contractor maintaining their WordPress site if that site doesn't contain any private information, and it probably should not. On the other hand, if it does, then giving full access to that data should be more difficult than simply giving the keys to a random contractor; the company is fully responsible for whatever you do ("Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject."), so that includes vetting you, being able to supervise what you've done, and probably some liability requirement. On the other hand, if that's a standard service you're providing, it all means that your standard agreement form just needs a few extra paragraphs to cover that data processing part. The log/IP address issue has technical solutions - you can use logrotate in combination with gnupg to ensure that logs are available if you need to analyze them, but are encrypted and not available to everyone logging on that server.

OrganicMSG 9y ago
"Either they have the organizational capacity to handle private information properly, or they should not do it at all." While I admire the intent here, in the world at large it seems that multinationals and governments fail at this one with monotonous regularity and Blanche's final line - 'Whoever you are, I have always depended on the kindness of strangers', has been adopted by the computer security industry as the unofficial motto.
- PeterisP 9y ago
  What I've seen from the world at large is not large multinationals failing at handling private information properly, but rather them not trying to handle private information properly. I.e. it's not because they're incapable of doing so if they wanted, but that they didn't even attempt to do so. GDPR is a way of forcing some of them to stop handling the information, and forcing those who do to actually start trying.
  - aeorgnoieang 9y ago
    And you're fine with all of the organizations smaller than "large multinationals" possibly having to shutdown and layoff all of their employees?
LoSboccacc 9y ago
And what happens when anything of that changes in scope? You gonna resend the consent form to each and every past user? Of corse not. What will happen instead is that behind a consent box a lengthy disclaimer will ask consent for every piece of information and blanket every length of scope, triggering a cascade across providers and contractors.
- _o_ 9y ago
  No it will not. For consent it is explicitly forbiden to use legal / technical speech and you can't cascade it. Allowing you to use my data has nothing to do with you giving my data to google. The more 3rd party "providers" the more fishy will your site look. And you can bet the user wont give consent for 100 tick boxes - you can't pretick them, it needs to be opt-in. And this is the reason: https://www.paypal.com/ie/webapps/mpp/ua/third-parties-list https://www.paypal.com/ie/webapps/mpp/ua/third-parties-list This might help: https://pagefair.com/blog/2018/granular-gdpr-consent/ https://pagefair.com/blog/2018/granular-gdpr-consent/