15 ms·

GDPR – A Practical Guide for Developers (2017)

379 points by FooBarWidget 9y ago

nynno 9y ago
We've created an open-source client SDK as a starter kit for making apps compliant with EU GDPR: https://github.com/gdprhq/GdprHq.Io.ClientSdk https://github.com/gdprhq/GdprHq.Io.ClientSdk Anyone interested in beta testing/integration?
njl 9y ago
> Restrict processing – in your admin panel where there’s a list of users, there should be a button “restrict processing”. The user settings page should also have that button. When clicked (after reading the appropriate information), it should mark the profile as restricted. That means it should no longer be visible to the backoffice staff, or publicly. You can implement that with a simple “restricted” flag in the users table and a few if-clasues here and there. The simple hubris in this statement is jaw-dropping. “Just a flag and a few if clauses! Easy peasy!”
- simonw 9y ago
  This article is one of the best I've seen for describing actual features that you need to build. I agree that the specific language here is poorly chosen ("simple" and "a few if-clauses" are perilously close to the word "just") but I don't think that should detract from the enormous value the article itself provides.
elnygren 9y ago
GDPR and Kappa/event sourcing/message queue based/you name it architecture goes together nicely as you get audit logs of everything and it should be quite doable to propagate "delete this person's data" events around the place. It's a huge hassle compared to what many companies are doing with customer data now but I think it's for the best. Most things about GDPR go like "Does it feel a bit shady? It probably is. Don't do that." (depending on your moral compass of course) One thing is for sure: there's a lot of opportunities for consultants as all the big companies need help to resolve the mess of legacy systems storing customer data.
- TobbenTM 9y ago
  (assuming you meant to write Kafka) Being able to notify every internal service to delete a user's data is always nice, but in the case of event sourcing, the events are the data. Yet you can't delete Kafka events (not sure about other platforms). In my eyes, GDPR is the death of Kafka as an event sourcing store.
  - elnygren 9y ago
    Kafka doesn't persist things forever. AFAIK it's totally OK if you have say 14d retention and then the data is deleted from Kafka too (it was deleted from everywhere else already because there was an event/request to do so)
    - TobbenTM 9y ago
      Heh, I think we're talking about different scenarios. In the case of event sourcing, we often set the retention period to 'forever', because the events in Kafka are our source of truth. Then we just build a materialising layer on top of Kafka, with the possibility to rehydrate based on _every_ event in the Kafka topics. In this case we would have to do some really weird compaction to delete singular events.
      - dpwm 9y ago
        It really depends on what you're doing. If you're doing something where the people you're storing data about don't need to interact with each other, you can actually store each user's events in a separate event log. This can be fed to more transient event queues which do not have an indefinite retention period where interaction is required. Not sure about how well-geared Kafka is to this scenario though.
      - dominotw 9y ago
        I think that scenario is adressed on this confulent blog post > Deleting a message from a compacted topic is as simple as writing a new message to the topic with the key you want to delete and a null value. When compaction runs the message will be deleted forever. Handling GDPR with Apache Kafka: How does a log forget? https://www.confluent.io/blog/handling-gdpr-log-forget/ https://www.confluent.io/blog/handling-gdpr-log-forget/
berkay 9y ago
"I think all of the above features can be implemented in a few weeks by a small team. " how to trust the rest of the article after reading this?
lifeisstillgood 9y ago
I think the right to be forgotten is a serious flaw in what otherwise is a major step forward in Data handling law. Data today has been compared by Schneier to pollution in the industrial revolution. The GDPR is probably the first anti-pollution law with real bite and with a real grasp of just how far this all goes (the extra-territoriality etc) This does not make this perfect solution. I honestly don't think that "being forgotten" actually makes sense as a right - it seems to have sprung from some unusual case law in ECJ and could much more easily be dealt with by a "do not further process". But we genuinely can always find ways to implement new laws - the most obvious is to encrypt user data, and then lose the key, but beyond that i think the best outcome of all this is to stop moving data around so much. moving data from system to system is a smell in my view - and one that a eu law is going to help architects the world over realise they are doing wrong
- deltron3030 9y ago
  Like pollution laws, it's nonsense if not enforced worldwide. The web can't be contained to a specific locality anymore, it's against the core idea of the technology. The people in the EU who are responsible for this have no clue about the technology.
  - lifeisstillgood 9y ago
    The GDPR specifically states that any processing of EU citizens personal / private data essentially two huge things come out of GDPR - personal data about a EU citizen belongs to that citizen, and if you process data about an EU citizen even if you are out of the EU, you are covered by this law (extra-territoriality) These are huge forward thinking political steps. they do get this stuff. I just think the deletion part is a mis-step
    - deltron3030 9y ago
      It just sounds good, but in a more or less open world, small businesses selling digital products will just block EU access, even if they're physically located in the EU. Opening a company in the US is easy.
andygcook 9y ago
Does this apply to internal software like Slack and Github provided by an employer to an employee? e.g. An ex-employee requests that all their identifiable data be deleted from all communication and systems of their former employer. That seems like a problem for institutional knowledge transfer. Will the employer have to adhere to that request?
- majewsky 9y ago
  How is identifiable data important for institutional knowledge transfer?
  - TheAceOfHearts 9y ago
    I can imagine scenarios where it would be important to know who worked on something. For example, using git blame I might learn someone was heavily involved with a project or feature. Then I might look on our internal Wiki for old posts which include discussions explaining why certain design decisions were made.
    - andygcook 9y ago
      Right, this is the scenario I was thinking of. Most systems that include any type of communication nowadays require you to use a real identity. An ex-employee that asks to have their identify obfuscated from all their work breaks the system of record to answer questions like who worked on what, what decisions were made by whom, etc.
- pbhjpbhj 9y ago
  It's "personal identifiable data" that covered. What you did at work doesn't count, your companies record of which days you worked is not personal within the company. If they shared it without anonymising it then it becomes personal. "andygcook wrote this library" in internal company data isn't personal data.
nomercy400 9y ago
Few questions: "Forget me" - What is personal information? Say I have a table with user_id and username, and an order table with user_id, order_id and other other stuff. If the user request a 'forget me', what do I delete? Blank the username? Delete the user_id row? Delete all orders belonging to the user (how would I report these gaps to tax agencies)? Delete the user from my trained ML model (is that even possible?). "Consent checkboxes" - To what extent can users be forced to give consent or be denied from a service? Like the Cookie law, almost every website requires you to accept the fact that cookies are used, otherwise your experience is degraded (eg. you cannot watch news videos). Or say I want to order something from a webshop, and in order to place an order, I must consent with sharing my personal information with third parties for marketing purposes, else I cannot place the order. Do I have to call them out later? How is this law going to solve things if it prevents me from using things? "Export data" / "See all my data" - What is 'all my data' here? Is in information I entered when I signed up for a service? Is it information derived from this data (eg. my google search suggestions/ads profile)? "Don’t assume 3rd parties are compliant" - if I, the data collector, gets fined because a 3rd party, data processor, is not compliant, can I retrieve part of the losses from the data processor? I mean, OpenID allows sharing a lot of personal information from data collectors like Facebook and Google with almost any random site. What can I expect here? "Consent checkboxes – “I accept the terms and conditions” would no longer be sufficient to claim that the user has given their consent for processing their data." - So if I, as a user, don't give any explicit consent to any personal information sharing, and in May I receive a marketing email from a party I don't have an account with (because they sold my personal information prior to this), I could say they broke the GDPR law? "Keeping data for no longer than necessary" - My tax agency requires me to keep records of orders/sales/invoices up to 5 years ago. If a user requests deleting their personal information within that time period, what should I do? "Forget me" - Say an employee leaves a company, and they request their personal information to be deleted. What information do I have to delete? Their Active Directory account? Their salary statements (I need those for tax agencies)? Their name in the git history? Their name from all minutes of all meetings they attended? Their name from documentation they wrote? Some things might be doable to implement in just 8 weeks, if I had clear guidelines on how to do this, but as of now, I have so many situations where it is unclear what I should do, and no clear way to get answers, that I don't know how I can comply with this law within 8 weeks, as a small software company.
wtfstatists 9y ago
Lets say I have a bookmark file which contain list of urls. It is associated with one user account. Its likely associated with one person but I cannot identify that person. There is no other information associated with the user account. Is the bookmark file personal data ?
- majewsky 9y ago
  In general, it's probably even sensitive personal data. A list of URLs can potentially identify a person's religious beliefs, sexual orientation, political views etc.
  - wtfstatists 9y ago
    > A list of URLs can potentially identify a person's religious beliefs, sexual orientation, political views etc. But can he be identified ? I believe if its too difficult to identify using even "religious beliefs, sexual orientation, political views etc" then its not personal data. Though I cant seem to find link to the page where I read it. On similar note, even IP _alone_ appears to be non personal data if since it cannot identify a person [1]. From Case 582/14 – Patrick Breyer v Germany [2] On appeal, the Regional Court of Berlin (the "Kammergericht") ruled that IP addresses in the hands of website operators could qualify as personal data if the relevant individual provides additional details to the website operator (e.g., name, email address, etc.) in the course of using the website. Lol even German Govt cant seem to figure out its own laws. They should have gone to one of those consultants. [1] https://www.gdpreu.org/the-regulation/key-concepts/personal-data/ https://www.gdpreu.org/the-regulation/key-concepts/personal-... [2] https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases https://www.whitecase.com/publications/alert/court-confirms-...
- muchbetterguy 9y ago
  Another way to phrase this question is “what use is the bookmark file without a user to use it?” I don’t think there’s anything wrong with storing anonymous data: a log of bookmarked urls for instance. So long as there’s no way to trace back who they belong to if that person wants to be forgotten.
DangerousPie 9y ago
I really don't understand how this is going to work in practice for small side projects with a single part-time developer. How are they supposed to afford implementing all these changes, none of which seem trivial or even practical for your standard little PHP site? So if I run a forum as a side project, what are my options? 1) Spend all free time over the next few months adding these features and neglect any other work on the project. 2) Ignore the GDPR and hope nobody complains. 3) Shut down the side project. Of course if you're Facebook or Twitter you just assign a few developers to this and you'll be fine. But I don't understand how this will not end up killing small-time web companies, or at least make them a lot less feasible to create. I suspect many people will go for (2) and hope this fizzles out the same way the cookie law did.
- rmc 9y ago
  Or just don't store personal data?
- blowski 9y ago
  Until Stripe, that seemed to be true of PCI compliance as well. Just keep saying your project is too small form tone to spend any time trying to hack it.
- stefan_ 9y ago
  Don't store a bunch of personally identifiable data and you don't have to do any of this. We have seen what this laissez faire attitude to "capture everything, delete never" has done. Trust has been supremely squandered so at this point I don't think anyone is particularly inclined to believe when someones cries wolf.
  - DangerousPie 9y ago
    The problem is that pretty much everything seems to be considered personally identifiable data. Any web community will at least be storing usernames, passwords, emails and most likely IP addresses. As far as I know, all of that counts. And even if you don't have a login system, your web server is still going to be logging people's IP addresses.
muchbetterguy 9y ago
One of the clearest things I’ve read on The subject. It is a lot of common sense. Questions over the right to be forgotten vs tax / legal issues come under the “legitimate interest” clause I think. You should delete their data except where you are required to keep it. And that may mean deleting preferences and browsing history, but not their name and address if you are required to keep it. I intend to implement a “forget me” feature by anonymising any PID and potentially redacting things like messages between users on our system. That way we keep info for stats purposes but don’t have any way to id a person from the data we hold. The restoring backups / storing preferences about deletion request etc in a separate DB solution is also a good idea. It shows willing to comply with the regulation as well even if it may not strictly be compliant (e.g. until the backup has synced up with the preferences DB, you still have the PID) I think so long as you show a lot of willing and progress towards being compliant and take all practical and reasonable steps to do so, then it shouldn’t be too much of a burden.
damontal 9y ago
What about Wikipedia? User accounts are linked with article edits/history. So if you delete the user how do you handle their edits?
- marksomnian 9y ago
  Suppression[0] or similar tech. Delete the username associated with the edit, while keeping the diff around. [0]: https://en.wikipedia.org/wiki/Wikipedia:Oversight https://en.wikipedia.org/wiki/Wikipedia:Oversight
boggio 9y ago
God damn it EU, all these regulations make it impossible for small companies, indie developers to cope with all the bureaucracy. The VAT for digital products, now the GDPR. 10 more years of regulation and you will spend 90% of the time working on implementing legal requirements and 10% on the actual product.
- lucideer 9y ago
  GDPR—while vastly different to what has become the defacto standard practice in most companies—is largely simple, basic, common decency and common sense. My very tiny startup won't have any problems complying because we've actually given a smidgen of consideration to our users' privacy up until now. In fact, I foresee it being a much greater tax on large corporations: the work in GDPR is not compliance—that's relatively easy once you have procedures in place—the real work is converting existing non-compliant systems to bring them into compliance. This is going to be much easier for those maintaining relatively small, simpler systems, and easiest of all for brand new startups.
  - davnicwil 9y ago
    From what I have seen and understood about the regulations and the spirit of them this is basically right. If your system was intentionally designed with both privacy and the ability for users to own their data (i.e. edit & hard delete whatever, whenever for any reason) in mind, then GDPR should be essentially complied with already 'out of the box'. If this was not the case, either for cynical reasons, simple disregard for the importance of these things, or a decision to not prioritise these things in favour of shipping more features faster, and you just essentially slapped a checkbox with some legal copy over your signup process and thought you were done with all that pesky user data privacy stuff, well, you're in for a pretty bad time now. Maybe my reading of it the regulations is naive and it won't be so easy in the first case and will be easy to subvert anyway in the second case. But if not, to be perfectly honest it seems just like what good regulation should do - incentivise good behaviour - allowing businesses that behave well by nature to thrive without too much extra hassle introduced, and suppress both the bad behaviour itself and the general productivity of the business behind it where that's not the case.
tobr 9y ago
I wonder how to deal with data that is accidentally identifiable. For example, imagine that you are running an anonymous poll or survey. In the general case that would not identify an individual person, but in some circumstances a particular collected answer will be unique and could theoretically be connected to an individual. In such cases it's not really possible to give individuals control over their data, because except for the special case the whole point is that it's not connected to an individual...
marten-de-vries 9y ago
It's interesting to see how the GDPR seems to clash with some popular data models. For example, git. Rewriting history of a shared branch is disastrous, but it's currently the only way to redact, say, an e-mail address someone committed with a couple of years ago. I'm curious how the various code hosting sides plan to handle that. Perhaps we'll see an extension of the data model that links commits to committer UUIDs, with the actual information being linked to that, making removal easier.
- Neuron4ger 9y ago
  Apparently Git is ok by GDPR as data subjects do not have the right to erasure if the information is meant for archiving purposes in the public interest [1]. [1] http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:320... (Article 17)
  - marten-de-vries 9y ago
    > Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: > [...] > (d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; (emphasis mine) I'd not say redacting a git repository does 'seriously impair' processing for archiving purposes. All the data (with the exception of the redacted e-mail) is still there, after all. Still, the hashes will have changed, making the repo less useful for current users. But that has nothing to do with archival.
    - Neuron4ger 9y ago
      Thank you for emphasizing that last part. I think you might be right.
    - nokcha 9y ago
      What if the purpose of the archiving is to not only record what was changed but also who changed it?
nawitus 9y ago
> I think all of the above features can be implemented in a few weeks by a small team. That's.. optimistic in the enterprise world.
testt 9y ago
12stPR – A Practical Guide for Developers 12st
havkom 9y ago
I just want to point out that a lot of the article is the authors own opinion on how the regulation should be implemented into software and a lot of things are probably not needed normally and would be a burden for businesses. My own take (and the take of most European data protection lawyers I meet) is that consent is not needed, and also possibly is inappropriate in 90% of the cases - instead the “legal basis” called “legitimate interest” should be used instead. This is where you do your own judgement if your data processing is reasonable. Imagine if you yourself always had to consent to all common sense use of your personal data, what a hassle! If you use legitimate interest, also skip the “under 16” part, consent checkboxes and re-request consent part of the article (Of course there is more to it, but I would not get in to that unless you are doing data processing you do not think the data subjects in general would approve of). Functions that allow the users to delete and automatically download/access their own data is good practice for legitimate interest but not needed. You are anyway in general allowed to deal with these types of request on a case by case basis if you provide your data subjects with an email address. What you should do though is automatically delete data that you do not need anymore, such as old logs, customers contact details of customers long gone, old backups etc. The parts of encyption, you should create an api etc are not required but may be good practice. Just make sure you have normal OK data and data access security. As discussed above, you SHOULD use data for purposes that the customer has not agreed/consented to. However, never use personal data for purposes that are not compatible with the purposes you informed your customers of when collecting the data (normally stated in your privacy notice on your web site). If you did not have a privacy notice at the time of collection pre-GDPR, what is an compatible purpose will be a judgement call from the context of collection.
- nawitus 9y ago
  This is the biggest problem with GDPR, there's no agreement what it means, but it will go into effect in a few weeks.
  - havkom 9y ago
    What is “it”? GDPR is in large parts based on the Data Protection Directive from 1995 and “Convention 108” from 1981. There is ample of case law, data protection authority opinions, guidance, etc.
marcrosoft 9y ago
> In this particular case, it applies to companies that are not registered in Europe, but are having European customers. Umm, nope. The EU doesn't have any authority to enforce companies outside of the EU to do anything.
- glimmung 9y ago
  You are confusing legislation and enforcement. A great deal of legislation has an extra-territorial dimension. We live in a connected world, so ignoring this legislation should not be assumed to be free of consequences.
- joris 9y ago
  That’s not true. You’re within their scope if you process and/or target EU citizens. It might of course be difficult to execute the judgment but they can still sue you in the EU. In the US that happens also, for example when some stakeholder sues a foreign website that infringes on their rights. If the sued entity doesn’t show up in court, they just issue a default judgment (meaning the plaintiff wins by default). You can even sue a John Doe in court (at least in the US). In practice, the EU is also resource constrained like any other government entity, so you probably won’t have much to fear. I mean they’re not going to sue millions of companies all over the world, it just means they have created themselves a new stick that they can choose to use. I hear that they’ll likely first go after entities that have a big impact on the public (i.e., the most blatant cases).
Rovanion 9y ago
Is it just for me the advisor to the deputy prime minister of a EU country does not work?
GordonS 9y ago
> Age checks – you should ask for the user’s age, and if the user is a child (below 16), you should ask for parent permission Please tell me this is only required when age is relevant, such as for sale of alcohol and tobacco? Otherwise, surely most data holders don't need a customer's age, and this would be forcing them to collect more personal information! And personally, as a consumer, I don't want to provide information that isn't relevant, so I'm more likely to use a competitor that doesn't ask for such needless PI.
- havkom 9y ago
  If you use “consent” as your “legal basis” and you are asking for consent that is related to the offering of services over the internet (such as a web shop, a social media web site, discussion forum, ...), you need to somehow verify age (16 years normally) or be very clear that under 18 years olds (“children”) are not to access your service (and not have evidence pointing to that this is undermined) Note that the 16 years old rule applies to “consent” only. As I stated in a separate comment “consent” is often not the way to do things. I, and many EU data protection lawyers I have met, believe consent to be a “last resort” legal basis of processing personal data. Instead, the legal basis called “legitimate interest” should normally be used where you as a company decides what is resonable, you think is needed to achieve the purposes you are processing data for, and, what the data subject would reasonable expect. There is no under 16 age limit or age verification requirement in general for “legitimate interest”
  - GordonS 9y ago
    In my own case, we only need customer PI as contacts for billing and support, so from what I've read, that doesn't need consent. Thinking about it, I suppose it does make sense to ask users if they are over 16 if you are going to be processing data in a way that does require consent, just so you know that they can legally give that consent.
    - havkom 9y ago
      I believe this is true. In my country (Sweden) it appears like consent outside of offering internet services may require the data subject to be 18, not 13 (Sweden has made a local adjustment to 13 years of the 16-years old rule referred to). So this rule may actually be a relief of who can consent to what.
GordonS 9y ago
Does the GDPR state that all this needs to be automated? Given how infrequently a small business will get requests to delete, restrict or export data, is it allowed to just do it manually when requested by email?
- kazen44 9y ago
  The GDPR does not state that it needs to be automated. I assume SME's will also not automate this unless they get a lot of request. Basically all features that are required by the GDPR are already in most common SME software.
  - GordonS 9y ago
    In that case, the GDPR actually sounds quite positive - I believe users should be able to request that their data is deleted, and be told in advance if it's going to be used for anything non-obvious (e.g. training an ML model).
- glimmung 9y ago
  No, it does not have to be automated, and if manual / email approaches work at your scale that's fine. The legislation explicitly refers to "proportionality", although people exploiting the FUD around it to drum up business rarely use the word.
goblin89 9y ago
I’ve been reading the EU’s General Data Protection Regulation, and it seems to contain certain loopholes that may be exploited by less than honest agents. The sad possibility is that the mere existence of such loopholes can push an otherwise law-obedient small companies towards mostly-ignoring GDPR in order to remain competitive. For example, there’s this huge “if” concerning personal data removal, reiterated in multiple sections of GDPR. Quoting the very first section about data processing principles[0], personal data can be stored even after you’ve achieved the initial explicitly stated purpose, as long as it: > will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’) How wide is the range of activities that can be reasonably claimed to be for scientific or statistical purposes, or for safeguarding the rights and freedoms of your user? How strictly would this be enforced in cases where scientific and statistical purposes are closely intertwined with commercial interests, as it often happens? Meanwhile, the referenced Article 89(1)[1] doesn’t seem to take a hard stance except for requiring “data minimization”. Even pseudonymisation is explicitly optional, as long as you’ll have a convincing argument that pseudonymising the PII you’ve collected prevents you from fulfilling your “statistical purposes”. I’m not a lawyer and I’m wondering if someone with more expertise can weigh in on this. [0] https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/ [1] https://gdpr-info.eu/art-89-gdpr/ https://gdpr-info.eu/art-89-gdpr/
- grabeh 9y ago
  Any exceptions to the regulation will inevitably be subject to a narrow interpretation particularly if it is clear that someone is looking to do something which is outside the spirit of the regulation.
- Sylos 9y ago
  These sort of cases will be decided on by a judge. You'll at the very least have to make your decisions sound reasonable. But yeah, these loopholes do exist nonetheless. The GDPR has been reported on as the most lobbied law in the history of the EU. It scares Google, Facebook, Microsoft et al.
hanoz 9y ago
As a freelance developer I'm quite sure that if I were to force my clients to comply with as strict an interpretation of GDPR as this, I would pretty shortly find myself replaced by a freelance developer with a more relaxed attitude to GDPR compliance.
- sb8244 9y ago
  This is probably true. If I were in this situation, I would probably only make suggestions and not force compliance.
skybrian 9y ago
It seems likely this will lead to increased centralization and/or standardization as many website owners decide it is too complicated and risky to write custom software managing their own user accounts. This might be similar to how merchants often sell through larger websites like Amazon, or mobile developers sell through app stores. Or, much like many startups begin with Bootstrap for their CSS and Django provides a built-in admin user interface, perhaps there will be open source skeleton web apps that have all the data models and UI needed for GDPR? It sounds like there will be lots of business opportunities here.
tajen 9y ago
What happens if your service lets users manage their own customers’ data? I mean, for a product such as Airtables, FieldBookApp, Sharepoint Forms or, simply, Google Forms: Are we, cloud app providers, supposed to ensure our users don’t put PII data in the spreadsheets, and if they do, are we supposed to manage their users’ consent and process their users’ requests for edition and deletion? At the extreme, what should Heroku do for the Postgres darabases they provide to their customers ? I could only find GDPR blogs about apps facing the final users, but they generally don’t talk about compliance for B2B apps.
- Sylos 9y ago
  In that case, your customer is the "controller" and you're the "data processor". The whole GDPR is written with such B2B relationships in mind. Chapter 4 is specifically all about that. Article 28 specifies the situation for the data processor: https://gdpr-info.eu/art-28-gdpr/ https://gdpr-info.eu/art-28-gdpr/ And well, basically your customer has to tell you all of these things in the contract. (Article 28 Section 3) Furthermore, if you yourself want to pass that data on to another data processor, you have to notify the controller of that and tell that data processor those things that the controller specified in the contract, too. It's also in the responsibility of the controller to select data processors that implement "appropriate technical and organisational measures". That's a term that you should also find plenty of literature and discussions on. The GDPR specifies somewhat in its recitals: https://gdpr-info.eu/recitals/no-78/ https://gdpr-info.eu/recitals/no-78/ And you might also want to get certified that you are GDPR-compliant, just to make it trivial for customers to see that you can implement those appropriate organizational and technical measures.
5_minutes 9y ago
This is basically developed to protect users from big abusive companies such as Facebook, Google, Twitter and big marketing agencies. But it really is overkill for the local restaurant that wants to mail their customers. Using a bazooka to kill some flies.
- cinquemb 9y ago
  It's worse than that, because GDPR in of itself, will not technically stop useds from inadvertently blasting data to any service Decentralized services that EU citizens use will be even less in compliance as data is shared and copied between nodes by default. Sure block a few servers by spending more resources to find/go through the legal moves than it will take for a dozen more to pop up… see torrent sites/software and how people are monetizing such, because that will be the future… laws like GDPR only make such even more attractive. And lets just set aside that nation state actors that are routinely compromised will still collect this data that will leak on to the internet… lol These laws are analogous to those that were against the printing press… fighting the tide of reality where it's easier to do nothing than to contort something to fit a luddites dream of personal privacy provided by the state mandates (on top of building a functional product), without having to do anything oneself to protect ones interest, in the age of deep packet inspection, 0day-exploit-exfil-as-a-service, and metadata drone strikes. Would be more effective to just make it law that users have to plug a black box onto their devices/networks so it can just filter non GDPR colored bytes lol
YetAnotherNick 9y ago
What about things explicitly designed in a way that there is no option to be forgotten. What about commits in version control sites? What about mailing lists? From skimming over the spec, it seems that politicians haven't thought about any other sites than social networks or some other profit making sites. Even in that case, if some ML system is trained on the data of the customer, do they have to re-train after anyone invokes right to be forgotten.
- smarx007 9y ago
  Well, if you model can tell guess my name from 100 browser history entries, then yes, I want the law to require you to retrain your model once I invoke that right. An interesting matter is a use of blockchain-like scheme. I guess the law would mean you can't put GDPR protected information in a public distributed blockchain, but instead use identifiers to decouple GDPR info from that ID. And the invocation of that right to be forgotten would require us to permanently delete an entry linking that identifier to a user.
zavi 9y ago
Practical guide to developers - build your product in the US then expand to Indo-Pacific. Don't bother with rolling out to Europe. AI is the future of business & healthcare, which, due to inherent need for data, is incompatible with anti-data sharing laws such as GDPR. Population is rapidly aging in Europe (47.1 year old average in Germany, 42.9 in EU), so might as well set your business up for the long term by pivoting to the region where growth will take place (and where general population is more acceptive of emerging technologies that rely on easy access to data).
- scrollaway 9y ago
  This is the worst advice in this thread. Not only do you lose the European market for no good reason and on logic you might hear from moon landing conspiracy theorists, but you don't even solve your issue as you will still have European users no matter what. People do travel.
  - zavi 9y ago
    If you don't have physical assets in Europe which can be seized then whether or not traveling Europeans decide to use your service is irrelevant. GDPR is not going to force you to take down your service in the US or India. It's kind of like a Saudi visiting California and requesting that local gay people be stoned as per the law of their land - not going to happen.
antaviana 9y ago
For example, imagine you only collect an email at sign up (no name, no country) and you state in your EULA that you might use the email to send onboarding information or commercial communications (promotions, newsletter) that can be opted out. If you do not have any means to know the country where the owner of the email is located, how do you ensure the right of non-EU citizens to receive the commercial communications they have agreed to receive in your EULA unless they opt out later? If you do not collect your user country for privacy reasons (I would be wary to sign up for a trial of a service who wants to know my citizenship), how can you prevent EU citizens from using your product?
nihonde 9y ago
This strikes me as all very pie-in-the-sky. I understand the law, and the policies that it serves, but the article assumes that a company has a single, centralized data source that you can just put some hand-waving “if then statements” around to limit access, and that supports perfect cascading of data from the user down so we can just implement a few checkboxes to configure, etc. It sounds like good stuff, but that’s not how things work in the real world, where half your users trade Excel output, and can’t be bothered to log their interactions with third parties. I’m not saying that they shouldn’t do it, but they won’t.
GordonS 9y ago
What about cookies? I noticed .NET Core 2.1 is adding a cookie bar, saying its for GDPR compliance - but I didn't see anything about cookies in the article?

379 points by FooBarWidget 9y ago

We've created an open-source client SDK as a starter kit for making apps compliant with EU GDPR: https://github.com/gdprhq/GdprHq.Io.ClientSdk https://github.com/gdprhq/GdprHq.Io.ClientSdk Anyone interested in beta testing/integration?

njl 9y ago

> Restrict processing – in your admin panel where there’s a list of users, there should be a button “restrict processing”. The user settings page should also have that button. When clicked (after reading the appropriate information), it should mark the profile as restricted. That means it should no longer be visible to the backoffice staff, or publicly. You can implement that with a simple “restricted” flag in the users table and a few if-clasues here and there. The simple hubris in this statement is jaw-dropping. “Just a flag and a few if clauses! Easy peasy!”

simonw 9y ago
This article is one of the best I've seen for describing actual features that you need to build. I agree that the specific language here is poorly chosen ("simple" and "a few if-clauses" are perilously close to the word "just") but I don't think that should detract from the enormous value the article itself provides.

elnygren 9y ago

GDPR and Kappa/event sourcing/message queue based/you name it architecture goes together nicely as you get audit logs of everything and it should be quite doable to propagate "delete this person's data" events around the place. It's a huge hassle compared to what many companies are doing with customer data now but I think it's for the best. Most things about GDPR go like "Does it feel a bit shady? It probably is. Don't do that." (depending on your moral compass of course) One thing is for sure: there's a lot of opportunities for consultants as all the big companies need help to resolve the mess of legacy systems storing customer data.

TobbenTM 9y ago
(assuming you meant to write Kafka) Being able to notify every internal service to delete a user's data is always nice, but in the case of event sourcing, the events are the data. Yet you can't delete Kafka events (not sure about other platforms). In my eyes, GDPR is the death of Kafka as an event sourcing store.
- elnygren 9y ago
  Kafka doesn't persist things forever. AFAIK it's totally OK if you have say 14d retention and then the data is deleted from Kafka too (it was deleted from everywhere else already because there was an event/request to do so)
  - TobbenTM 9y ago
    Heh, I think we're talking about different scenarios. In the case of event sourcing, we often set the retention period to 'forever', because the events in Kafka are our source of truth. Then we just build a materialising layer on top of Kafka, with the possibility to rehydrate based on _every_ event in the Kafka topics. In this case we would have to do some really weird compaction to delete singular events.
    - dpwm 9y ago
      It really depends on what you're doing. If you're doing something where the people you're storing data about don't need to interact with each other, you can actually store each user's events in a separate event log. This can be fed to more transient event queues which do not have an indefinite retention period where interaction is required. Not sure about how well-geared Kafka is to this scenario though.
    - dominotw 9y ago
      I think that scenario is adressed on this confulent blog post > Deleting a message from a compacted topic is as simple as writing a new message to the topic with the key you want to delete and a null value. When compaction runs the message will be deleted forever. Handling GDPR with Apache Kafka: How does a log forget? https://www.confluent.io/blog/handling-gdpr-log-forget/ https://www.confluent.io/blog/handling-gdpr-log-forget/

berkay 9y ago

"I think all of the above features can be implemented in a few weeks by a small team. " how to trust the rest of the article after reading this?

lifeisstillgood 9y ago

I think the right to be forgotten is a serious flaw in what otherwise is a major step forward in Data handling law. Data today has been compared by Schneier to pollution in the industrial revolution. The GDPR is probably the first anti-pollution law with real bite and with a real grasp of just how far this all goes (the extra-territoriality etc) This does not make this perfect solution. I honestly don't think that "being forgotten" actually makes sense as a right - it seems to have sprung from some unusual case law in ECJ and could much more easily be dealt with by a "do not further process". But we genuinely can always find ways to implement new laws - the most obvious is to encrypt user data, and then lose the key, but beyond that i think the best outcome of all this is to stop moving data around so much. moving data from system to system is a smell in my view - and one that a eu law is going to help architects the world over realise they are doing wrong

deltron3030 9y ago
Like pollution laws, it's nonsense if not enforced worldwide. The web can't be contained to a specific locality anymore, it's against the core idea of the technology. The people in the EU who are responsible for this have no clue about the technology.
- lifeisstillgood 9y ago
  The GDPR specifically states that any processing of EU citizens personal / private data essentially two huge things come out of GDPR - personal data about a EU citizen belongs to that citizen, and if you process data about an EU citizen even if you are out of the EU, you are covered by this law (extra-territoriality) These are huge forward thinking political steps. they do get this stuff. I just think the deletion part is a mis-step
  - deltron3030 9y ago
    It just sounds good, but in a more or less open world, small businesses selling digital products will just block EU access, even if they're physically located in the EU. Opening a company in the US is easy.

andygcook 9y ago

Does this apply to internal software like Slack and Github provided by an employer to an employee? e.g. An ex-employee requests that all their identifiable data be deleted from all communication and systems of their former employer. That seems like a problem for institutional knowledge transfer. Will the employer have to adhere to that request?

majewsky 9y ago
How is identifiable data important for institutional knowledge transfer?
- TheAceOfHearts 9y ago
  I can imagine scenarios where it would be important to know who worked on something. For example, using git blame I might learn someone was heavily involved with a project or feature. Then I might look on our internal Wiki for old posts which include discussions explaining why certain design decisions were made.
  - andygcook 9y ago
    Right, this is the scenario I was thinking of. Most systems that include any type of communication nowadays require you to use a real identity. An ex-employee that asks to have their identify obfuscated from all their work breaks the system of record to answer questions like who worked on what, what decisions were made by whom, etc.
pbhjpbhj 9y ago
It's "personal identifiable data" that covered. What you did at work doesn't count, your companies record of which days you worked is not personal within the company. If they shared it without anonymising it then it becomes personal. "andygcook wrote this library" in internal company data isn't personal data.

nomercy400 9y ago

Few questions: "Forget me" - What is personal information? Say I have a table with user_id and username, and an order table with user_id, order_id and other other stuff. If the user request a 'forget me', what do I delete? Blank the username? Delete the user_id row? Delete all orders belonging to the user (how would I report these gaps to tax agencies)? Delete the user from my trained ML model (is that even possible?). "Consent checkboxes" - To what extent can users be forced to give consent or be denied from a service? Like the Cookie law, almost every website requires you to accept the fact that cookies are used, otherwise your experience is degraded (eg. you cannot watch news videos). Or say I want to order something from a webshop, and in order to place an order, I must consent with sharing my personal information with third parties for marketing purposes, else I cannot place the order. Do I have to call them out later? How is this law going to solve things if it prevents me from using things? "Export data" / "See all my data" - What is 'all my data' here? Is in information I entered when I signed up for a service? Is it information derived from this data (eg. my google search suggestions/ads profile)? "Don’t assume 3rd parties are compliant" - if I, the data collector, gets fined because a 3rd party, data processor, is not compliant, can I retrieve part of the losses from the data processor? I mean, OpenID allows sharing a lot of personal information from data collectors like Facebook and Google with almost any random site. What can I expect here? "Consent checkboxes – “I accept the terms and conditions” would no longer be sufficient to claim that the user has given their consent for processing their data." - So if I, as a user, don't give any explicit consent to any personal information sharing, and in May I receive a marketing email from a party I don't have an account with (because they sold my personal information prior to this), I could say they broke the GDPR law? "Keeping data for no longer than necessary" - My tax agency requires me to keep records of orders/sales/invoices up to 5 years ago. If a user requests deleting their personal information within that time period, what should I do? "Forget me" - Say an employee leaves a company, and they request their personal information to be deleted. What information do I have to delete? Their Active Directory account? Their salary statements (I need those for tax agencies)? Their name in the git history? Their name from all minutes of all meetings they attended? Their name from documentation they wrote? Some things might be doable to implement in just 8 weeks, if I had clear guidelines on how to do this, but as of now, I have so many situations where it is unclear what I should do, and no clear way to get answers, that I don't know how I can comply with this law within 8 weeks, as a small software company.

wtfstatists 9y ago

Lets say I have a bookmark file which contain list of urls. It is associated with one user account. Its likely associated with one person but I cannot identify that person. There is no other information associated with the user account. Is the bookmark file personal data ?

majewsky 9y ago
In general, it's probably even sensitive personal data. A list of URLs can potentially identify a person's religious beliefs, sexual orientation, political views etc.
- wtfstatists 9y ago
  > A list of URLs can potentially identify a person's religious beliefs, sexual orientation, political views etc. But can he be identified ? I believe if its too difficult to identify using even "religious beliefs, sexual orientation, political views etc" then its not personal data. Though I cant seem to find link to the page where I read it. On similar note, even IP _alone_ appears to be non personal data if since it cannot identify a person [1]. From Case 582/14 – Patrick Breyer v Germany [2] On appeal, the Regional Court of Berlin (the "Kammergericht") ruled that IP addresses in the hands of website operators could qualify as personal data if the relevant individual provides additional details to the website operator (e.g., name, email address, etc.) in the course of using the website. Lol even German Govt cant seem to figure out its own laws. They should have gone to one of those consultants. [1] https://www.gdpreu.org/the-regulation/key-concepts/personal-data/ https://www.gdpreu.org/the-regulation/key-concepts/personal-... [2] https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases https://www.whitecase.com/publications/alert/court-confirms-...
muchbetterguy 9y ago
Another way to phrase this question is “what use is the bookmark file without a user to use it?” I don’t think there’s anything wrong with storing anonymous data: a log of bookmarked urls for instance. So long as there’s no way to trace back who they belong to if that person wants to be forgotten.

DangerousPie 9y ago

I really don't understand how this is going to work in practice for small side projects with a single part-time developer. How are they supposed to afford implementing all these changes, none of which seem trivial or even practical for your standard little PHP site? So if I run a forum as a side project, what are my options? 1) Spend all free time over the next few months adding these features and neglect any other work on the project. 2) Ignore the GDPR and hope nobody complains. 3) Shut down the side project. Of course if you're Facebook or Twitter you just assign a few developers to this and you'll be fine. But I don't understand how this will not end up killing small-time web companies, or at least make them a lot less feasible to create. I suspect many people will go for (2) and hope this fizzles out the same way the cookie law did.

rmc 9y ago
Or just don't store personal data?
blowski 9y ago
Until Stripe, that seemed to be true of PCI compliance as well. Just keep saying your project is too small form tone to spend any time trying to hack it.
stefan_ 9y ago
Don't store a bunch of personally identifiable data and you don't have to do any of this. We have seen what this laissez faire attitude to "capture everything, delete never" has done. Trust has been supremely squandered so at this point I don't think anyone is particularly inclined to believe when someones cries wolf.
- DangerousPie 9y ago
  The problem is that pretty much everything seems to be considered personally identifiable data. Any web community will at least be storing usernames, passwords, emails and most likely IP addresses. As far as I know, all of that counts. And even if you don't have a login system, your web server is still going to be logging people's IP addresses.

muchbetterguy 9y ago

One of the clearest things I’ve read on The subject. It is a lot of common sense. Questions over the right to be forgotten vs tax / legal issues come under the “legitimate interest” clause I think. You should delete their data except where you are required to keep it. And that may mean deleting preferences and browsing history, but not their name and address if you are required to keep it. I intend to implement a “forget me” feature by anonymising any PID and potentially redacting things like messages between users on our system. That way we keep info for stats purposes but don’t have any way to id a person from the data we hold. The restoring backups / storing preferences about deletion request etc in a separate DB solution is also a good idea. It shows willing to comply with the regulation as well even if it may not strictly be compliant (e.g. until the backup has synced up with the preferences DB, you still have the PID) I think so long as you show a lot of willing and progress towards being compliant and take all practical and reasonable steps to do so, then it shouldn’t be too much of a burden.

damontal 9y ago

What about Wikipedia? User accounts are linked with article edits/history. So if you delete the user how do you handle their edits?

marksomnian 9y ago
Suppression[0] or similar tech. Delete the username associated with the edit, while keeping the diff around. [0]: https://en.wikipedia.org/wiki/Wikipedia:Oversight https://en.wikipedia.org/wiki/Wikipedia:Oversight

boggio 9y ago

God damn it EU, all these regulations make it impossible for small companies, indie developers to cope with all the bureaucracy. The VAT for digital products, now the GDPR. 10 more years of regulation and you will spend 90% of the time working on implementing legal requirements and 10% on the actual product.

lucideer 9y ago
GDPR—while vastly different to what has become the defacto standard practice in most companies—is largely simple, basic, common decency and common sense. My very tiny startup won't have any problems complying because we've actually given a smidgen of consideration to our users' privacy up until now. In fact, I foresee it being a much greater tax on large corporations: the work in GDPR is not compliance—that's relatively easy once you have procedures in place—the real work is converting existing non-compliant systems to bring them into compliance. This is going to be much easier for those maintaining relatively small, simpler systems, and easiest of all for brand new startups.
- davnicwil 9y ago
  From what I have seen and understood about the regulations and the spirit of them this is basically right. If your system was intentionally designed with both privacy and the ability for users to own their data (i.e. edit & hard delete whatever, whenever for any reason) in mind, then GDPR should be essentially complied with already 'out of the box'. If this was not the case, either for cynical reasons, simple disregard for the importance of these things, or a decision to not prioritise these things in favour of shipping more features faster, and you just essentially slapped a checkbox with some legal copy over your signup process and thought you were done with all that pesky user data privacy stuff, well, you're in for a pretty bad time now. Maybe my reading of it the regulations is naive and it won't be so easy in the first case and will be easy to subvert anyway in the second case. But if not, to be perfectly honest it seems just like what good regulation should do - incentivise good behaviour - allowing businesses that behave well by nature to thrive without too much extra hassle introduced, and suppress both the bad behaviour itself and the general productivity of the business behind it where that's not the case.

tobr 9y ago

I wonder how to deal with data that is accidentally identifiable. For example, imagine that you are running an anonymous poll or survey. In the general case that would not identify an individual person, but in some circumstances a particular collected answer will be unique and could theoretically be connected to an individual. In such cases it's not really possible to give individuals control over their data, because except for the special case the whole point is that it's not connected to an individual...

marten-de-vries 9y ago

It's interesting to see how the GDPR seems to clash with some popular data models. For example, git. Rewriting history of a shared branch is disastrous, but it's currently the only way to redact, say, an e-mail address someone committed with a couple of years ago. I'm curious how the various code hosting sides plan to handle that. Perhaps we'll see an extension of the data model that links commits to committer UUIDs, with the actual information being linked to that, making removal easier.

Neuron4ger 9y ago
Apparently Git is ok by GDPR as data subjects do not have the right to erasure if the information is meant for archiving purposes in the public interest [1]. [1] http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:320... (Article 17)
- marten-de-vries 9y ago
  > Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: > [...] > (d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; (emphasis mine) I'd not say redacting a git repository does 'seriously impair' processing for archiving purposes. All the data (with the exception of the redacted e-mail) is still there, after all. Still, the hashes will have changed, making the repo less useful for current users. But that has nothing to do with archival.
  - Neuron4ger 9y ago
    Thank you for emphasizing that last part. I think you might be right.
  - nokcha 9y ago
    What if the purpose of the archiving is to not only record what was changed but also who changed it?

nawitus 9y ago

> I think all of the above features can be implemented in a few weeks by a small team. That's.. optimistic in the enterprise world.

testt 9y ago

12stPR – A Practical Guide for Developers 12st

havkom 9y ago

I just want to point out that a lot of the article is the authors own opinion on how the regulation should be implemented into software and a lot of things are probably not needed normally and would be a burden for businesses. My own take (and the take of most European data protection lawyers I meet) is that consent is not needed, and also possibly is inappropriate in 90% of the cases - instead the “legal basis” called “legitimate interest” should be used instead. This is where you do your own judgement if your data processing is reasonable. Imagine if you yourself always had to consent to all common sense use of your personal data, what a hassle! If you use legitimate interest, also skip the “under 16” part, consent checkboxes and re-request consent part of the article (Of course there is more to it, but I would not get in to that unless you are doing data processing you do not think the data subjects in general would approve of). Functions that allow the users to delete and automatically download/access their own data is good practice for legitimate interest but not needed. You are anyway in general allowed to deal with these types of request on a case by case basis if you provide your data subjects with an email address. What you should do though is automatically delete data that you do not need anymore, such as old logs, customers contact details of customers long gone, old backups etc. The parts of encyption, you should create an api etc are not required but may be good practice. Just make sure you have normal OK data and data access security. As discussed above, you SHOULD use data for purposes that the customer has not agreed/consented to. However, never use personal data for purposes that are not compatible with the purposes you informed your customers of when collecting the data (normally stated in your privacy notice on your web site). If you did not have a privacy notice at the time of collection pre-GDPR, what is an compatible purpose will be a judgement call from the context of collection.

nawitus 9y ago
This is the biggest problem with GDPR, there's no agreement what it means, but it will go into effect in a few weeks.
- havkom 9y ago
  What is “it”? GDPR is in large parts based on the Data Protection Directive from 1995 and “Convention 108” from 1981. There is ample of case law, data protection authority opinions, guidance, etc.

marcrosoft 9y ago

> In this particular case, it applies to companies that are not registered in Europe, but are having European customers. Umm, nope. The EU doesn't have any authority to enforce companies outside of the EU to do anything.

glimmung 9y ago
You are confusing legislation and enforcement. A great deal of legislation has an extra-territorial dimension. We live in a connected world, so ignoring this legislation should not be assumed to be free of consequences.
joris 9y ago
That’s not true. You’re within their scope if you process and/or target EU citizens. It might of course be difficult to execute the judgment but they can still sue you in the EU. In the US that happens also, for example when some stakeholder sues a foreign website that infringes on their rights. If the sued entity doesn’t show up in court, they just issue a default judgment (meaning the plaintiff wins by default). You can even sue a John Doe in court (at least in the US). In practice, the EU is also resource constrained like any other government entity, so you probably won’t have much to fear. I mean they’re not going to sue millions of companies all over the world, it just means they have created themselves a new stick that they can choose to use. I hear that they’ll likely first go after entities that have a big impact on the public (i.e., the most blatant cases).

Rovanion 9y ago

Is it just for me the advisor to the deputy prime minister of a EU country does not work?

GordonS 9y ago

> Age checks – you should ask for the user’s age, and if the user is a child (below 16), you should ask for parent permission Please tell me this is only required when age is relevant, such as for sale of alcohol and tobacco? Otherwise, surely most data holders don't need a customer's age, and this would be forcing them to collect more personal information! And personally, as a consumer, I don't want to provide information that isn't relevant, so I'm more likely to use a competitor that doesn't ask for such needless PI.

havkom 9y ago
If you use “consent” as your “legal basis” and you are asking for consent that is related to the offering of services over the internet (such as a web shop, a social media web site, discussion forum, ...), you need to somehow verify age (16 years normally) or be very clear that under 18 years olds (“children”) are not to access your service (and not have evidence pointing to that this is undermined) Note that the 16 years old rule applies to “consent” only. As I stated in a separate comment “consent” is often not the way to do things. I, and many EU data protection lawyers I have met, believe consent to be a “last resort” legal basis of processing personal data. Instead, the legal basis called “legitimate interest” should normally be used where you as a company decides what is resonable, you think is needed to achieve the purposes you are processing data for, and, what the data subject would reasonable expect. There is no under 16 age limit or age verification requirement in general for “legitimate interest”
- GordonS 9y ago
  In my own case, we only need customer PI as contacts for billing and support, so from what I've read, that doesn't need consent. Thinking about it, I suppose it does make sense to ask users if they are over 16 if you are going to be processing data in a way that does require consent, just so you know that they can legally give that consent.
  - havkom 9y ago
    I believe this is true. In my country (Sweden) it appears like consent outside of offering internet services may require the data subject to be 18, not 13 (Sweden has made a local adjustment to 13 years of the 16-years old rule referred to). So this rule may actually be a relief of who can consent to what.

GordonS 9y ago

Does the GDPR state that all this needs to be automated? Given how infrequently a small business will get requests to delete, restrict or export data, is it allowed to just do it manually when requested by email?

kazen44 9y ago
The GDPR does not state that it needs to be automated. I assume SME's will also not automate this unless they get a lot of request. Basically all features that are required by the GDPR are already in most common SME software.
- GordonS 9y ago
  In that case, the GDPR actually sounds quite positive - I believe users should be able to request that their data is deleted, and be told in advance if it's going to be used for anything non-obvious (e.g. training an ML model).
glimmung 9y ago
No, it does not have to be automated, and if manual / email approaches work at your scale that's fine. The legislation explicitly refers to "proportionality", although people exploiting the FUD around it to drum up business rarely use the word.

goblin89 9y ago

I’ve been reading the EU’s General Data Protection Regulation, and it seems to contain certain loopholes that may be exploited by less than honest agents. The sad possibility is that the mere existence of such loopholes can push an otherwise law-obedient small companies towards mostly-ignoring GDPR in order to remain competitive. For example, there’s this huge “if” concerning personal data removal, reiterated in multiple sections of GDPR. Quoting the very first section about data processing principles[0], personal data can be stored even after you’ve achieved the initial explicitly stated purpose, as long as it: > will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’) How wide is the range of activities that can be reasonably claimed to be for scientific or statistical purposes, or for safeguarding the rights and freedoms of your user? How strictly would this be enforced in cases where scientific and statistical purposes are closely intertwined with commercial interests, as it often happens? Meanwhile, the referenced Article 89(1)[1] doesn’t seem to take a hard stance except for requiring “data minimization”. Even pseudonymisation is explicitly optional, as long as you’ll have a convincing argument that pseudonymising the PII you’ve collected prevents you from fulfilling your “statistical purposes”. I’m not a lawyer and I’m wondering if someone with more expertise can weigh in on this. [0] https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/ [1] https://gdpr-info.eu/art-89-gdpr/ https://gdpr-info.eu/art-89-gdpr/

grabeh 9y ago
Any exceptions to the regulation will inevitably be subject to a narrow interpretation particularly if it is clear that someone is looking to do something which is outside the spirit of the regulation.
Sylos 9y ago
These sort of cases will be decided on by a judge. You'll at the very least have to make your decisions sound reasonable. But yeah, these loopholes do exist nonetheless. The GDPR has been reported on as the most lobbied law in the history of the EU. It scares Google, Facebook, Microsoft et al.

hanoz 9y ago

As a freelance developer I'm quite sure that if I were to force my clients to comply with as strict an interpretation of GDPR as this, I would pretty shortly find myself replaced by a freelance developer with a more relaxed attitude to GDPR compliance.

sb8244 9y ago
This is probably true. If I were in this situation, I would probably only make suggestions and not force compliance.

skybrian 9y ago

It seems likely this will lead to increased centralization and/or standardization as many website owners decide it is too complicated and risky to write custom software managing their own user accounts. This might be similar to how merchants often sell through larger websites like Amazon, or mobile developers sell through app stores. Or, much like many startups begin with Bootstrap for their CSS and Django provides a built-in admin user interface, perhaps there will be open source skeleton web apps that have all the data models and UI needed for GDPR? It sounds like there will be lots of business opportunities here.

tajen 9y ago

What happens if your service lets users manage their own customers’ data? I mean, for a product such as Airtables, FieldBookApp, Sharepoint Forms or, simply, Google Forms: Are we, cloud app providers, supposed to ensure our users don’t put PII data in the spreadsheets, and if they do, are we supposed to manage their users’ consent and process their users’ requests for edition and deletion? At the extreme, what should Heroku do for the Postgres darabases they provide to their customers ? I could only find GDPR blogs about apps facing the final users, but they generally don’t talk about compliance for B2B apps.

Sylos 9y ago
In that case, your customer is the "controller" and you're the "data processor". The whole GDPR is written with such B2B relationships in mind. Chapter 4 is specifically all about that. Article 28 specifies the situation for the data processor: https://gdpr-info.eu/art-28-gdpr/ https://gdpr-info.eu/art-28-gdpr/ And well, basically your customer has to tell you all of these things in the contract. (Article 28 Section 3) Furthermore, if you yourself want to pass that data on to another data processor, you have to notify the controller of that and tell that data processor those things that the controller specified in the contract, too. It's also in the responsibility of the controller to select data processors that implement "appropriate technical and organisational measures". That's a term that you should also find plenty of literature and discussions on. The GDPR specifies somewhat in its recitals: https://gdpr-info.eu/recitals/no-78/ https://gdpr-info.eu/recitals/no-78/ And you might also want to get certified that you are GDPR-compliant, just to make it trivial for customers to see that you can implement those appropriate organizational and technical measures.

5_minutes 9y ago

This is basically developed to protect users from big abusive companies such as Facebook, Google, Twitter and big marketing agencies. But it really is overkill for the local restaurant that wants to mail their customers. Using a bazooka to kill some flies.

cinquemb 9y ago
It's worse than that, because GDPR in of itself, will not technically stop useds from inadvertently blasting data to any service Decentralized services that EU citizens use will be even less in compliance as data is shared and copied between nodes by default. Sure block a few servers by spending more resources to find/go through the legal moves than it will take for a dozen more to pop up… see torrent sites/software and how people are monetizing such, because that will be the future… laws like GDPR only make such even more attractive. And lets just set aside that nation state actors that are routinely compromised will still collect this data that will leak on to the internet… lol These laws are analogous to those that were against the printing press… fighting the tide of reality where it's easier to do nothing than to contort something to fit a luddites dream of personal privacy provided by the state mandates (on top of building a functional product), without having to do anything oneself to protect ones interest, in the age of deep packet inspection, 0day-exploit-exfil-as-a-service, and metadata drone strikes. Would be more effective to just make it law that users have to plug a black box onto their devices/networks so it can just filter non GDPR colored bytes lol

YetAnotherNick 9y ago

What about things explicitly designed in a way that there is no option to be forgotten. What about commits in version control sites? What about mailing lists? From skimming over the spec, it seems that politicians haven't thought about any other sites than social networks or some other profit making sites. Even in that case, if some ML system is trained on the data of the customer, do they have to re-train after anyone invokes right to be forgotten.

smarx007 9y ago
Well, if you model can tell guess my name from 100 browser history entries, then yes, I want the law to require you to retrain your model once I invoke that right. An interesting matter is a use of blockchain-like scheme. I guess the law would mean you can't put GDPR protected information in a public distributed blockchain, but instead use identifiers to decouple GDPR info from that ID. And the invocation of that right to be forgotten would require us to permanently delete an entry linking that identifier to a user.

zavi 9y ago

Practical guide to developers - build your product in the US then expand to Indo-Pacific. Don't bother with rolling out to Europe. AI is the future of business & healthcare, which, due to inherent need for data, is incompatible with anti-data sharing laws such as GDPR. Population is rapidly aging in Europe (47.1 year old average in Germany, 42.9 in EU), so might as well set your business up for the long term by pivoting to the region where growth will take place (and where general population is more acceptive of emerging technologies that rely on easy access to data).

scrollaway 9y ago
This is the worst advice in this thread. Not only do you lose the European market for no good reason and on logic you might hear from moon landing conspiracy theorists, but you don't even solve your issue as you will still have European users no matter what. People do travel.
- zavi 9y ago
  If you don't have physical assets in Europe which can be seized then whether or not traveling Europeans decide to use your service is irrelevant. GDPR is not going to force you to take down your service in the US or India. It's kind of like a Saudi visiting California and requesting that local gay people be stoned as per the law of their land - not going to happen.

antaviana 9y ago

For example, imagine you only collect an email at sign up (no name, no country) and you state in your EULA that you might use the email to send onboarding information or commercial communications (promotions, newsletter) that can be opted out. If you do not have any means to know the country where the owner of the email is located, how do you ensure the right of non-EU citizens to receive the commercial communications they have agreed to receive in your EULA unless they opt out later? If you do not collect your user country for privacy reasons (I would be wary to sign up for a trial of a service who wants to know my citizenship), how can you prevent EU citizens from using your product?

nihonde 9y ago

This strikes me as all very pie-in-the-sky. I understand the law, and the policies that it serves, but the article assumes that a company has a single, centralized data source that you can just put some hand-waving “if then statements” around to limit access, and that supports perfect cascading of data from the user down so we can just implement a few checkboxes to configure, etc. It sounds like good stuff, but that’s not how things work in the real world, where half your users trade Excel output, and can’t be bothered to log their interactions with third parties. I’m not saying that they shouldn’t do it, but they won’t.

GordonS 9y ago

What about cookies? I noticed .NET Core 2.1 is adding a cookie bar, saying its for GDPR compliance - but I didn't see anything about cookies in the article?