12 ms·

I really don't understand how this is going to work in practice for small side projects with a single part-time developer. How are they supposed to afford imple

I really don't understand how this is going to work in practice for small side projects with a single part-time developer. How are they supposed to afford implementing all these changes, none of which seem trivial or even practical for your standard little PHP site? So if I run a forum as a side project, what are my options? 1) Spend all free time over the next few months adding these features and neglect any other work on the project. 2) Ignore the GDPR and hope nobody complains. 3) Shut down the side project. Of course if you're Facebook or Twitter you just assign a few developers to this and you'll be fine. But I don't understand how this will not end up killing small-time web companies, or at least make them a lot less feasible to create. I suspect many people will go for (2) and hope this fizzles out the same way the cookie law did.

rmc 9y ago
Or just don't store personal data?
blowski 9y ago
Until Stripe, that seemed to be true of PCI compliance as well. Just keep saying your project is too small form tone to spend any time trying to hack it.
stefan_ 9y ago
Don't store a bunch of personally identifiable data and you don't have to do any of this. We have seen what this laissez faire attitude to "capture everything, delete never" has done. Trust has been supremely squandered so at this point I don't think anyone is particularly inclined to believe when someones cries wolf.
- DangerousPie 9y ago
  The problem is that pretty much everything seems to be considered personally identifiable data. Any web community will at least be storing usernames, passwords, emails and most likely IP addresses. As far as I know, all of that counts. And even if you don't have a login system, your web server is still going to be logging people's IP addresses.
  - lucideer 9y ago
    Passwords are not personal data, and even if they were, you aren't storing them anyway (right?). There's a tricky question around usernames: they're technically not personal data since they aren't necessarily the real name of the user, but the user can choose to use their real name as their username, which is not easy to distinguish in any automated way. You don't need to store IPs
    - tyfon 9y ago
      If someone makes a real name username and you don't do anything else about it, you should be fine. However, if you take that username, look up the user in the real world and send spam without consent you are in deep shit. It's all about consent of use and for what. The user has implicitly given consent to use their username as a username but nothing else.
  - tscs37 9y ago
    Your webserver logging IP addresses is a legitimate interest that does not require consent (preventing abuse). I do hope you're not storing passwords, only a securely stretched and hashed variant, which is not subject to the GDPR. Emails and Usernames will require consent, as do IPs stored outside a context of legitimate interest (preventing abuse). The only thing that most communities will be missing is a function to delete all user data from their website (ie, delete user + all posts on request) but that should come into standard software soon enough or is already present.
  - CM30 9y ago
    The point about IP addresses and emails makes me wonder what would happen to spammer blacklists. If they're personal information, does that mean services like Stop Forum Spam and Akismet need to remove data when requested, even if it makes life harder for forum admins and community managers? What about those topics you see on admin forums where you're given a giant list of IPs and emails to copy into the ban settings page?
    - jimnotgym 9y ago
kyriakos 9y ago
Small side project means small data too, easy to manually sort out gdpr requests as need arises. No need to automate everything.
- DangerousPie 9y ago
  True for some parts of it, but what about things like asking for explicit consent, logging each read access to the database or implementing a "restricted" feature? None of these things are supported by most standard software.
  - EwanToo 9y ago
    I can't remember the last time I worked with a database that couldn't write out a query log? That's not to say GDPR isn't a pain, but there's not any significant technical challenges that I know of, it's much more of a challenge in terms of business processes
    - osteele 9y ago
      Last week I looked at a couple of hosted data services whose free tier didn’t give access to a query log. This is pretty common for hobbyist projects. This means this logging has to be implemented at the app layer. The developer has to pay for log retention, which doesn’t come for free with several of the hobbyist-level hosting services that I’m familiar with. I agree with your general point that there’s no significant technical challenges, at least for even a minimal dev team or a practitioner with time to put into this. Maybe hobbyists shouldn’t be handling this data in the first place, or maybe this is an opportunity for GDPR-complaint SaaS to help them do so safely.
sovietmudkipz 9y ago
One man shop here... Cloudfront forwards country information to your origin servers in AWS. My plan was to not do business or display content in European countries until an easy solution to GDPR enables me to quickly meet it's criteria. Certainly libraries will crop up helping to ease the burden of the regulation for smaller operations. Though... I'm not quite sure what happens when a European citizen uses VPN to spoof a non-GDPR country to gain access to my site, provides me their personal data, then requests to be forgotten. Would it be relevant that I intended my site _not_ to be used in Europe and the user in question circumvented my attempts not to do business in Europe? My bet is that it wouldn't. * Shrug * > 2) Ignore the GDPR and hope nobody complains. > 3) Shut down the side project. Basically, I'm implementing a hybrid of #2 and #3 by not letting European users into my system until I know I can comply with GDPR cheaply and easily.
- powvans 9y ago
  I don't think you can escape it by simply throwing up a firewall to try to block EU users. It seems that you're just inextricably pulled into this as soon as you record any data about an EU citizen. Unfortunately you can't know with good certainty whether or not that has happened.
- geocar 9y ago
  I cannot imagine why anyone would want to intentionally violate someone's privacy and ignore their stated preferences; to use their data in a way they would not want, regardless of what country they live in. It surprises me that anyone would want to make an insecure system on purpose and take no responsibility for being hacked. That's what "ignoring the GDPR" means on some level. It just so happens that the GDPR provides a powerful tool to protect me and my rights, even when I'm in the USA on business, at a Starbucks on their public Wifi. There's a lot of guffing about IP addresses and weblogs that is confusing a lot of people. Without knowing what kind of information you think you need to collect without permission and without benefitting the person involved, it's difficult if you're a chicken little, or if you're a scumbag spammer: I'll have no sympathy for the latter, but am happy to try and decode the GDPR for the former (within reason: I'm doing some GDPR consultancy at the moment)
powvans 9y ago
It looks like the maximum fine is 4% of annual revenue... seems like the regulation has no teeth if you have no revenue. IANAL and could be totally wrong. To your point about small companies, I agree, it feels onerous. What irks me about the right to be forgotten is that it directly counters my right to remember things. Should a shop keeper be allowed to record their observations about who enters their store each day? If they maintain a physical guest book in their brick and mortar store, does a visitor have a right to be erased from that book?
- davejamesmiller 9y ago
  > It looks like the maximum fine is 4% of annual revenue... seems like the regulation has no teeth if you have no revenue. Up to €20 million, or 4% annual global turnover – whichever is higher.
- muchbetterguy 9y ago
  The fine is up to 20M euro or 4% whichever is greater AFAIK.. and will match the seriousness of the offence. ie a small side project who refuses to honour a forget me request is highly unlikely to be fined 20m euro. However, one that deliberately mines the web for huge amounts of PID without consent and profits from it now has a new regulation to watch out for.
- pbhjpbhj 9y ago
  Re the last question, yes, absolutely. Why would data format matter?
  - powvans 9y ago
    I don't think it matters to the principle, but rather to the practicality. It's now practical to aggregate massive amounts of data and create a privacy concern that's unlikely to have existed in the world of offline records. The principle is freedom of speech. If you tell me that I cannot write down the names of the people who came to visit me today without their permission, you are violating my right to freedom of speech.
- tajen 9y ago
lucideer 9y ago
Smaller summarised guide for very small side projects: 1. ideally, don't store personal data 2. if you absolutely need to, store the bare minimum 3. if you're doing 2, don't give any of it to 3rd parties The article splits its bullet points into three sections. The second section is basic security best practice: you should have this covered anyway regardless of the size of your project. If you stick to my points above, the author's remaining bullets should either be null, or much much easier to implement.
dazc 9y ago
'I suspect many people will go for (2) and hope this fizzles out the same way the cookie law did.' I suspect you may be right. http://nocookielaw.com/ http://nocookielaw.com/
devit 9y ago
Use forum software that already implements the required features.
pkaye 9y ago
4) If you are not living in the EU you are not obligated to implement any of the changes. Being a small time developer, what is the worst that can happen?
- Fej 9y ago
  Banned from the majority of the world's developed countries.
  - pkaye 9y ago
    What will happen? They will block your website?
- bkanber 9y ago
  If you service any users in the EU or process any personal information of EU citizens, you must comply with GDPR.
  - pkaye 9y ago
    What will they do if you don't comply?
    - scrollaway 9y ago
      Warn you, help you, or fine you, just like they would an eu business.
grabeh 9y ago
Option 4) - adopt a risk-based approach to compliance, and look to assess whether any aspect of your service, and the way it makes use of data in its current form is an egregious breach of GDPR. If that is the case, you're likely in breach of existing data protection law. In terms of risk factors, most side projects will generally use data to provide a service to customers. This type of processing is unlikely to attract regulatory attention. It's also unlikely that the vast majority of entities will be 100% compliant come May 25, but as the Belgian data protection authority has pointed out, it is important that people demonstrate a good faith approach to compliance. For new requirements around restriction of processing/provision of data in a programmatic manner, again, dependent on risk, it is likely not necessary to implement these features and side project owners should focus on building their product instead. Relevant risks for a side-project owner are around a) volume of data held, b) types of uses of data, c) likelihood of users making a requests around erasure/restriction (look at any historic requests received here), and d) regulatory focus on specific areas of the legislation. This law is not going to fizzle out and on a general level, in my view it is advisable for any entity to look to respect user data regardless of legal obligations relating to that.

rmc 9y ago

Or just don't store personal data?

blowski 9y ago

Until Stripe, that seemed to be true of PCI compliance as well. Just keep saying your project is too small form tone to spend any time trying to hack it.

stefan_ 9y ago

Don't store a bunch of personally identifiable data and you don't have to do any of this. We have seen what this laissez faire attitude to "capture everything, delete never" has done. Trust has been supremely squandered so at this point I don't think anyone is particularly inclined to believe when someones cries wolf.

DangerousPie 9y ago
The problem is that pretty much everything seems to be considered personally identifiable data. Any web community will at least be storing usernames, passwords, emails and most likely IP addresses. As far as I know, all of that counts. And even if you don't have a login system, your web server is still going to be logging people's IP addresses.
- lucideer 9y ago
  Passwords are not personal data, and even if they were, you aren't storing them anyway (right?). There's a tricky question around usernames: they're technically not personal data since they aren't necessarily the real name of the user, but the user can choose to use their real name as their username, which is not easy to distinguish in any automated way. You don't need to store IPs
  - tyfon 9y ago
    If someone makes a real name username and you don't do anything else about it, you should be fine. However, if you take that username, look up the user in the real world and send spam without consent you are in deep shit. It's all about consent of use and for what. The user has implicitly given consent to use their username as a username but nothing else.
- tscs37 9y ago
  Your webserver logging IP addresses is a legitimate interest that does not require consent (preventing abuse). I do hope you're not storing passwords, only a securely stretched and hashed variant, which is not subject to the GDPR. Emails and Usernames will require consent, as do IPs stored outside a context of legitimate interest (preventing abuse). The only thing that most communities will be missing is a function to delete all user data from their website (ie, delete user + all posts on request) but that should come into standard software soon enough or is already present.
- CM30 9y ago
  The point about IP addresses and emails makes me wonder what would happen to spammer blacklists. If they're personal information, does that mean services like Stop Forum Spam and Akismet need to remove data when requested, even if it makes life harder for forum admins and community managers? What about those topics you see on admin forums where you're given a giant list of IPs and emails to copy into the ban settings page?
  - jimnotgym 9y ago

kyriakos 9y ago

Small side project means small data too, easy to manually sort out gdpr requests as need arises. No need to automate everything.

DangerousPie 9y ago
True for some parts of it, but what about things like asking for explicit consent, logging each read access to the database or implementing a "restricted" feature? None of these things are supported by most standard software.
- EwanToo 9y ago
  I can't remember the last time I worked with a database that couldn't write out a query log? That's not to say GDPR isn't a pain, but there's not any significant technical challenges that I know of, it's much more of a challenge in terms of business processes
  - osteele 9y ago
    Last week I looked at a couple of hosted data services whose free tier didn’t give access to a query log. This is pretty common for hobbyist projects. This means this logging has to be implemented at the app layer. The developer has to pay for log retention, which doesn’t come for free with several of the hobbyist-level hosting services that I’m familiar with. I agree with your general point that there’s no significant technical challenges, at least for even a minimal dev team or a practitioner with time to put into this. Maybe hobbyists shouldn’t be handling this data in the first place, or maybe this is an opportunity for GDPR-complaint SaaS to help them do so safely.

sovietmudkipz 9y ago

One man shop here... Cloudfront forwards country information to your origin servers in AWS. My plan was to not do business or display content in European countries until an easy solution to GDPR enables me to quickly meet it's criteria. Certainly libraries will crop up helping to ease the burden of the regulation for smaller operations. Though... I'm not quite sure what happens when a European citizen uses VPN to spoof a non-GDPR country to gain access to my site, provides me their personal data, then requests to be forgotten. Would it be relevant that I intended my site _not_ to be used in Europe and the user in question circumvented my attempts not to do business in Europe? My bet is that it wouldn't. * Shrug * > 2) Ignore the GDPR and hope nobody complains. > 3) Shut down the side project. Basically, I'm implementing a hybrid of #2 and #3 by not letting European users into my system until I know I can comply with GDPR cheaply and easily.

powvans 9y ago
I don't think you can escape it by simply throwing up a firewall to try to block EU users. It seems that you're just inextricably pulled into this as soon as you record any data about an EU citizen. Unfortunately you can't know with good certainty whether or not that has happened.
geocar 9y ago
I cannot imagine why anyone would want to intentionally violate someone's privacy and ignore their stated preferences; to use their data in a way they would not want, regardless of what country they live in. It surprises me that anyone would want to make an insecure system on purpose and take no responsibility for being hacked. That's what "ignoring the GDPR" means on some level. It just so happens that the GDPR provides a powerful tool to protect me and my rights, even when I'm in the USA on business, at a Starbucks on their public Wifi. There's a lot of guffing about IP addresses and weblogs that is confusing a lot of people. Without knowing what kind of information you think you need to collect without permission and without benefitting the person involved, it's difficult if you're a chicken little, or if you're a scumbag spammer: I'll have no sympathy for the latter, but am happy to try and decode the GDPR for the former (within reason: I'm doing some GDPR consultancy at the moment)

powvans 9y ago

It looks like the maximum fine is 4% of annual revenue... seems like the regulation has no teeth if you have no revenue. IANAL and could be totally wrong. To your point about small companies, I agree, it feels onerous. What irks me about the right to be forgotten is that it directly counters my right to remember things. Should a shop keeper be allowed to record their observations about who enters their store each day? If they maintain a physical guest book in their brick and mortar store, does a visitor have a right to be erased from that book?

davejamesmiller 9y ago
> It looks like the maximum fine is 4% of annual revenue... seems like the regulation has no teeth if you have no revenue. Up to €20 million, or 4% annual global turnover – whichever is higher.
muchbetterguy 9y ago
The fine is up to 20M euro or 4% whichever is greater AFAIK.. and will match the seriousness of the offence. ie a small side project who refuses to honour a forget me request is highly unlikely to be fined 20m euro. However, one that deliberately mines the web for huge amounts of PID without consent and profits from it now has a new regulation to watch out for.
pbhjpbhj 9y ago
Re the last question, yes, absolutely. Why would data format matter?
- powvans 9y ago
  I don't think it matters to the principle, but rather to the practicality. It's now practical to aggregate massive amounts of data and create a privacy concern that's unlikely to have existed in the world of offline records. The principle is freedom of speech. If you tell me that I cannot write down the names of the people who came to visit me today without their permission, you are violating my right to freedom of speech.
tajen 9y ago

lucideer 9y ago

Smaller summarised guide for very small side projects: 1. ideally, don't store personal data 2. if you absolutely need to, store the bare minimum 3. if you're doing 2, don't give any of it to 3rd parties The article splits its bullet points into three sections. The second section is basic security best practice: you should have this covered anyway regardless of the size of your project. If you stick to my points above, the author's remaining bullets should either be null, or much much easier to implement.

dazc 9y ago

'I suspect many people will go for (2) and hope this fizzles out the same way the cookie law did.' I suspect you may be right. http://nocookielaw.com/ http://nocookielaw.com/

devit 9y ago

Use forum software that already implements the required features.

pkaye 9y ago

4) If you are not living in the EU you are not obligated to implement any of the changes. Being a small time developer, what is the worst that can happen?

Fej 9y ago
Banned from the majority of the world's developed countries.
- pkaye 9y ago
  What will happen? They will block your website?
bkanber 9y ago
If you service any users in the EU or process any personal information of EU citizens, you must comply with GDPR.
- pkaye 9y ago
  What will they do if you don't comply?
  - scrollaway 9y ago
    Warn you, help you, or fine you, just like they would an eu business.

grabeh 9y ago

Option 4) - adopt a risk-based approach to compliance, and look to assess whether any aspect of your service, and the way it makes use of data in its current form is an egregious breach of GDPR. If that is the case, you're likely in breach of existing data protection law. In terms of risk factors, most side projects will generally use data to provide a service to customers. This type of processing is unlikely to attract regulatory attention. It's also unlikely that the vast majority of entities will be 100% compliant come May 25, but as the Belgian data protection authority has pointed out, it is important that people demonstrate a good faith approach to compliance. For new requirements around restriction of processing/provision of data in a programmatic manner, again, dependent on risk, it is likely not necessary to implement these features and side project owners should focus on building their product instead. Relevant risks for a side-project owner are around a) volume of data held, b) types of uses of data, c) likelihood of users making a requests around erasure/restriction (look at any historic requests received here), and d) regulatory focus on specific areas of the legislation. This law is not going to fizzle out and on a general level, in my view it is advisable for any entity to look to respect user data regardless of legal obligations relating to that.