11 ms·

EU GDPR – Another reason for SaaS to reconsider on-premise

145 points by aberoham 9y ago

twakefield 9y ago
This post was inspired by "The Nightmare Letter: A Subject Access Request under GDPR" [0]. Which shows the potential scary consequences of subject access requests. There's a lot of FUD around this topic. I've seen posts opinions ranging from "no big deal" to "this is actually good for U.S. SaaS" to "This is going to kill SaaS". It will be interesting to see how enforcement of the GDPR plays out. At the moment, with Facebook transgressions in the news, the pendulum seems to be swinging towards privacy. We'll see how far it swings. [0] https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce...
- louthy 9y ago
  As a CTO at a European SaaS company I don't particularly find 'The Nightmare Letter' nightmarish at all. If you're doing your job properly then this stuff isn't hard. It's had very little effect on our day-to-day - yeah, it's cost us real cash money in lawyers, and additional training for GDPR, but most of what is going to be legislation we were already doing. As an individual I welcome this legislation - it should really help to stop the shoddy practises that clearly go on (based on the amount outrage I've seen on this issue). GDPR seems, to me, to be proportionate and reasonable. I don't see this helping US SaaS companies, because once GDPR is in-place then I'd consider EU SaaS providers to be more attractive. It's a real selling point that your data isn't leaking or being mismanaged. If anything I see this as a potential boon for the SaaS companies doing their job properly, because the companies that have in-house systems (or have their own bespoke solutions) are going to have to prove those systems themselves - and have all the answers to The Letter. Whereas a good SaaS company can take those problems off their hands.
  - ryandrake 9y ago
    Nothing in that nightmare letter seems unreasonable for an end user to want to know, and I'd be hesitant to do business with a company that can't answer those questions about their own business. If those "nightmare" questions are the bar, it's a pretty low bar.
    - amarkov 9y ago
      The issue isn't whether the company has the answers to the questions, but what it costs to assemble those answers in the requested form. You can't respond to detailed legal inquiries by just having customer support copy-paste from documentation; they don't have the expertise required to guarantee a complete and correct answer.
      - qw 9y ago
        Why do they have to copy and paste? Why couldn’t they make a self service tool where they login and get all documentation that is required by law? The law says that you have the right to information, but does it say you have the right to a human responding with only the requested information?
      - heavenlyblue 9y ago
        Just the same way a bank clerk is given a set of security questions so that he could prove your identity and the legal/security departments make sure those questions are relevant and to be trusted. Most of the time you're not speaking to the bank's lawyers when trying to open an account.
  - adventured 9y ago
    > I don't see this helping US SaaS companies, because once GDPR is in-place then I'd consider EU SaaS providers to be more attractive. It's a real selling point that your data isn't leaking or being mismanaged. That doesn't make any sense. If GDPR is in place, then US SaaS firms won't be leaking & mismanaging your data, the whole point is they'll have to start complying or else. US SaaS firms will still have a vast advantage because: they're radically larger with far greater financial resources, have a drastically larger VC environment of initial funding, and still have the world's largest homogeneous economy as the base hub to initialize out of and get to huge scale to easily afford to spend anything they need to on compliance. What the EU just did is make the compliance picture far more difficult and complex for small European competitors as a whole. With Brexit, the EU lost 15% of its economic mass, further aggrevating this concept of regulatory & compliance splintering across Europe. The European splintering will only get worse as individual European non-EU nations come up with their own rules on this type of stuff. Salesforce or Workday can more easily comply with a dozen compliance approaches across the whole of Europe, than a given start-up in Portugal or Greece can.
    - heavenlyblue 9y ago
      You're making an argument about the good parts of GDPR into an argument about whether the political system should take sides in terms of business opportunities it gives. Is GDPR good for personal data safety? I think it is. Is GDPR easier for small businesses than for larger ones? No.
  - moduspol 9y ago
    > I don't see this helping US SaaS companies, because once GDPR is in-place then I'd consider EU SaaS providers to be more attractive. It's a real selling point that your data isn't leaking or being mismanaged. Does GDPR prevent data from being leaked or mismanaged?
    - heavenlyblue 9y ago
      But it gives a clear way of penalising the company if they are caught doing so (and a clear definition of what "doing so" means).
    - louthy 9y ago
      No - but it penalises you if you fail to follow best practice (like not encrypting data at rest for example). So, the incentive to do the right thing is greater seeing as you can be fined a percentage of your turnover.
      - moduspol 9y ago
        Indeed. Just pointing out the clear difference between that and what was stated.
        louthy 9y ago
        Thanks for clearing that up. I’m sure nobody knew what I meant until I made the clarifying post above. As an individual I am much more likely to trust an organisation that follows GDPR regulations over one that doesn’t. That obviously doesn’t mean they’re never going to have a data breach- but by law they will have to announce it within 3 days, and will face massive fines if negligent - that, to me, is a company I would prefer to give my business to - and was my point. Pedantry doesn’t help.
        moduspol 9y ago
        GDPR is very popular here on HN, but I think it's important to keep a level head about what it actually does and what its real-world effects will be. That is the entire point of this thread, after all. The difference between "not having a breach" and "a legal obligation to announce it within three days" is not semantic. It is absolutely material to the real-world value of GDPR, and claims about it should reflect that.
- hectormalot 9y ago
  I suspect that the 'nightmare GDPR letter' pushes the boundaries on what the GDPR would probably intent as a reasonable request, and I wonder if it would hold up in court if challenged by one of the companies. I think most of the provisions make a lot of sense if you look at them in a simple way. It's not unreasonable to ask a company: * what information on me do you keep? * what are you using it for? * can you provide me with a copy of my data? (with interesting situations where the data itself might be privacy or competitively sensitive, e.g. can I expect a company to share derived insurance scores with me? what if the data also includes other people's data?) * can you erase my data? As for impact on small SaaS businesses, I think it is relatively limited. .e.g For my SaaS side business I could probably answer the nightmare request within a day, if I would get 1+ request per week we could probably automate the response, with the exception of manual ID validation. Information deletion is something that the app wouldn't handle well at the moment and would be a bit more work. Thinking of it in this way, this is probably only a problem for a) large user bases (in which case I hope companies have the capacity to automate these requests efficiently), and b) data hoarding / ad companies (for which I don't really feel sorry)
  - kenbaylor 9y ago
    For any company that is compliant with GDPR (after 25th May 2018), the answers your 4 questions (2 on data collection, other 2 on data subject rights) must already be in their privacy notice on their website, with instructions for how to contact their data protection officer.
- wukerplank 9y ago
  The privacy laws in my country were nearly as restrictive as GDPR and now they get a bit stricter. No big deal. GDPR is only stating the obvious and actually it is sad that the protection of most private information is not common sense but needs to be enforced with rigorous punishment.
- Spearchucker 9y ago
  I've had that letter bookmarked for months now, and the thing that worries me most is that for example, as a subject that hasn't ever owned an Android phone, doesn't use Google, Gmail or have a YouTube account - if I send that letter to Google, what stops Google from just straight-out lying to me? How do they prove their honesty to me if they say "we got nothing on you"?
  - kenbaylor 9y ago
    This is a key reason why there are data protection officers under GDPR. They report to the highest level of management (mostly the board) and are independent. They are also called mini-regulators. They ensure the company is compliant. If they are not doing their job, (and you are not content with their reply), you then appeal to the Data Protection Authority (DPA, Privacy Regulator in the country). The DPA has full powers of subpoena (and a whole lot more), and are not to be trifled with.
    - chopin 9y ago
      That doesn't help. I'm in a similar position, but I'd like to know which data has eg. Facebook on me. If they write back "you have no account, we have no data on you" how I am to know that this is true (and it is almost certainly not)? With nothing on hand it doesn't make sense to go to a regulator.
      - kenbaylor 9y ago
        There is a process to be followed. If you have the response from the DPO and a reasonable suspicion based on evidence, you can absolutely to to the DPA. If your evidence is strong, that may proceed on that. If not but there are many other similar complaints, they can formally ask the company to 'clarify' issues....which is a very dangerous thing if you are a company that is evasive.
      - heavenlyblue 9y ago
        You have an entity that regularly creates accounts on Facebook, then sends the letters requesting the data Facebook holds for them. For any requests replying those accounts do not exist that entity brings Facebook to court.
gtirloni 9y ago
This article feels the need to repurpose the term "on-premises" to mean "self-hosted". From a previous article [0]: In the SaaS context, “on-premise” historically meant deploying a separate instance of your SaaS application to your customer’s server room or data center, behind their firewall. More recently, this term may also include deploying to the customer’s private cloud at a cloud provider like Amazon Web Services or Azure I'm a bit baffled this is necessary. You go from two terms that are widely understood to now having to add a disclaimer every time you say "on-premises". 0 - https://gravitational.com/blog/time-to-reconsider-going-onprem/ https://gravitational.com/blog/time-to-reconsider-going-onpr...
- twakefield 9y ago
  Point taken. I've struggled with this because we see these terms intermingled in practice. This is probably because most of our customers (SaaS vendors) think of everything that is not traditional multi-tenant SaaS as "on-premise". Also, self-hosted does connote the customer's IT is running the application, where a lot of times we see the vendor running the application (just on customer infrastructure).
  - gtirloni 9y ago
    Ah, the vendor running the app on the customer's infrastructure. Got it. Thanks, that makes sense.
- amarkov 9y ago
  The motivation is that both kinds of "on-premise" create roughly similar engineering challenges. (Your app has to be adaptable to heterogenous execution environments, all your code changes will be in a partially released state for indefinite periods of time, it's hard to immediately diagnose whether a reported problem is your fault or user error...)
- threeseed 9y ago
  Self hosted may as well be on premise for most companies though. The whole point of SaaS is that someone else manages the app. If you've ever worked in an enterprise you would understand that it can take months/years and significant amounts of money to get an app "installed". Often there needs to be a business case, project and resourcing plans, security and risk reviews, legal compliance checks etc. The infrastructure (cloud versus on premise) is just one part of a dozen and not usually the most challenging.
roomey 9y ago
Genuine question, do people realise Facebook Europe (among others) is headquartered in Ireland, and has to abide by fairly strict rules already? Eg. I can write them and they have to provide me with any personal information they have on me at the moment, for a nominal fee. I could probably get most of the questions on the nightmare letter above answered!
- lovich 9y ago
  "strict" only applies once they've been punished for violating those rules, which has not happened with those Irish regulations as far as I am aware. Facebook gives some information out, but does not give it all[1] [1]http://www.zdnet.com/article/facebook-releasing-your-personal-data-reveals-our-trade-secrets/ http://www.zdnet.com/article/facebook-releasing-your-persona...
- kenbaylor 9y ago
  Most of the EU litigation has been against Facebook. They have spent many millions in EU GDPR projects (such as the ability to download all records, which is in the news cycle right now). Under the current legislation, they can be sued by each regulator in each country separately (this has happened to them multiple times). Under the GDPR, they will mostly be sued by just the Irish Data Protection Authority (other EU regulators will funnel issues to the Irish DPA first).
- dane-pgp 9y ago
  There's one particular aspect of the GDPR which I realised recently could have a significant effect on Facebook. The regulations give users a specific right to data portability, with the wording: "In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible." https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/ Conceivably, a Facebook user could demand that Facebook support automatically sending their Facebook posts to their friends on third party social networks. I imagine that an EU court would not be very sympathetic to Facebook claiming that it isn't technically feasible for a (large, monopolistic, American) company to support this use case when small open source (European?) competitors have implemented the W3C social networking standards (e.g. ActivityPub) with no trouble. Once Facebook is forced by the GDPR to publish data to competing sites, I imagine it will feel compelled to also support receiving data from people on those sites, otherwise the one-way flow of data would put Facebook users at a disadvantage. But then there is basically no reason to use Facebook, as users of competing sites would still be able to see and be seen by their friends on Facebook. This is such a disastrous outcome for Facebook that I wouldn't be surprised if lawyers at Google (or some other big company) were already working on the legal complaints they are going to launch come May, when the GDPR comes into force.
antoncohen 9y ago
This doesn't make a lot of sense. If you are a SaaS provider that has the option of selling your software as on-premises, you are almost certainly a processor not a controller. Put another way, when a consumer goes to a consumer site and gives it personal data, that consumer site is the controller. When the controller uses a third-party SaaS to process or store the data, that third-party is a processor. If you are a controller you need to ensure that your processors are capable of handling GDPR requests, e.g., they can delete specific data for a user or provide a dump for a user. The processor (third-party SaaS) will have to write that capability into their software. Bringing that SaaS software on-premises doesn't change much. It eliminates the processor, but if I'm a controller purchasing some big SaaS-like product to run myself, I'm going to insist it have GDPR features built-in. The third-party SaaS vendor will have to write GDPR feature whether they sell it as SaaS or on-prem.
- twakefield 9y ago
  Maybe I'm missing the point of your comment but a typical reason for delivering an application on your customer's infrastructure is that they don't want their data to leave their infrastructure. It's usually b-to-b where the customer is typically an enterprise buyer using their own data storage. So, the customer knows how its data is being processed.
  - pdpi 9y ago
    The point is that your b2b customer is itself a b2c business that holds customer data in the product you sold them. Irrespective of whether it’s hosted or on-prem, you’re considered a processor in GDPR parlance, and your customer is a controller. Your customer needs to be able to handle consumer GDPR requests, so, if your software ever touches end-user data, it needs to be able to handle whatever those GDPR requests might be
    - rvcdbn 9y ago
      > The point is that your b2b customer is itself a b2c business that holds customer data in the product you sold them. This is not true of most SaaS products I use on daily basis e.g. calendar, gmail, Slack, GitHub, code review tools, CI server, etc.
StreamBright 9y ago
The entire on-prem vs. cloud is orthogonal to GDPR. Your stack either compliant with it or it isnt, regardless if you run on AWS or on OVH.
77pt77 9y ago
Can I just say that my service doesn't cater to EU residents?
- gls2ro 9y ago
  As I am interpreting the GDPR (IANAL) it is not about what you say, it is about if you have or have not users from EU. See [0] specifically the phrase "It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location" [0] https://www.eugdpr.org/gdpr-faqs.html https://www.eugdpr.org/gdpr-faqs.html
  - icebraining 9y ago
    More or less; if you just happen to be accessible from the EU, but have otherwise no connection to the EU at all, you're probably not subject to the GDPR: "In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. (..) the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention" https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/
- galvin 9y ago
  If you don't target EU customers and you don't have an EU presence, sure. Other businesses who want to be GDPR compliant might not be able to use your service either.
- PeterisP 9y ago
  Sort of - you have to actually not cater to EU residents, simply saying so might not be sufficient, and (for an exaggerated example) a company implementing a signup screen that says "wink wink nudge nudge press quit if you're from EU" while having 25% of their business income from EU credit cards would be likely treated not as compliance but as malicious evasion. You have to avoid touching personal data of EU residents; various exceptions are understandable (e.g. people using some measures like VPN to circumvent some restriction), but in general if you do somehow happen to have a sizeable amount of such data, then obviously you're "catering to EU residents" in some way no matter what you claim.
marcrosoft 9y ago
I’m not sure why this doesn’t come up more but the EU does not have any authority to force non EU companies to do anything. Please stop pretending that GDPR effects US companies not operating in the EU.
- martimarkov 9y ago
  Because we live in a global world. Why would you build a startup to only be capable to NOT work in EU. When building a company and you want to have any dealing with EU companies. And there are a lot of those it just makes sense to adopt the most strict framework and deal with it.
  - marcrosoft 9y ago
    Oh, because of the internet I can serve a EU customer from the US without EU regulation. Why would a startup setup a nexus in the EU?
    - raquo 9y ago
      GDPR has its own, vague criteria for when it applies, and it's much more inclusive than the typical criteria for a nexus. For example, things like the company actively seeking out clients in EU countries, or offering the service in EU countries' languages, make it more likely that EU will consider the company to be subject to GDPR even if it has no presence in the EU. It seems to me that EU is overstepping their jurisdiction here, but I really don't know how international law works.
      - true_religion 9y ago
        Yes the language clause makes no sense to me. If we add French to support Quebec or Spanish for S. America, we can now be roped into an EU regulation?
        TeMPOraL 9y ago
        If you make steps to ensure that you're not servicing EU citizens, then I guess not. A little more clarification on that would be welcome.
andy_ppp 9y ago
Just slightly off topic, has anyone done an opinionated legal analysis of what GDPR means in the context of delivering a complex application. For example let’s say a recruitment company internal system. I think business people and lawyers alone struggle to grasp the meaning and spirit of the rules.
barry0079 9y ago
According to ICO guidelines: "Where requests are manifestly unfounded or excessive, in particular because they are repetitive, you can: charge a reasonable fee taking into account the administrative costs of providing the information; or refuse to respond." I wonder if that would apply to the letter? [0]: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/ https://ico.org.uk/for-organisations/guide-to-the-general-da... Edit: Formatting
vbsteven 9y ago
Assuming that a SaaS provider is the `processor` in the GDPR. Could it comply to the GDPR by providing the following features through either API or admin panel?: * Trigger json/zip export of all data for $user_id * Delete all data for $user_id * List all events where data for $user_id has been sent to $third_party When building a new SaaS service from in 2018, this does not seem to be that much work if you design your system with these requirements in mind. A simple way to tag every resource in the database with $user_id, and an event log for third party interactions should be enough. Am I missing something?
- merinowool 9y ago
  How do you delete data from backups written to persistent media? When having CQRS/ES architecture (immutable events), how do you delete that data where by definition events can't be modified/deleted. Just two examples, but there is much more.
  - magnat 9y ago
    > How do you delete data from backups written to persistent media? You encrypt each user's data with unique symmetric key and store the key in HSM or other external, rewritable media. When requested, you delete the key for a given user, rendering user data in backups unusable.
    - merinowool 9y ago
      I don't think that is feasible, because you don't know if this data could be easily decrypted in the future. What do you do with existing data written to persistent media?
      - DelightOne 9y ago
        What do you think is reasonable if you say encryption and deletion of said key is not reasonable effort enough?
      - heavenlyblue 9y ago
fuscy 9y ago
This letter is interesting.. and paints a bleak future. What is stopping someone who wants to make easy money (like me) from going on Fiverr and selling my GDPR request letters? Example: 5$ for 5 (could be anything) GDPR request letters to any company of your choosing? This way, a malicious actor can buy thousands of GDPR requests and DDoS anyone but big companies like Google. The cherry on top is that they have 1 month to comply so after they remove the information, I can simply repeat the process after the time limit. So they will eventually have to implement some kind of banning process which will affect their FTUE/onboarding giving the competition an advantage. I bet this is the most basic idea that will appear in the blackhat world where they can probably poison the data compliance of various companies so that their services get shuttered.
- CJefferson 9y ago
  I hope people do send lots of GDPR requests. I plan on doing so myself. The answer is very simple. You should have a simple automated one-click method of knowing where all data relate to each user is, and an automated way of clearing it all. Job done.
  - fuscy 9y ago
    My "business" idea would probably last until the tech stack catches up. At this moment there is no easy way to handle this request for a simple helpdesk clerk without involving some pricier jobs. Even with the tech, it still requires a human (for now) to read the request, understand it and process it. Perhaps the future is AI interpreting the request and doing all the operations automatically or providing the client with a panel that can do all of these without having to contact the company.
    - qw 9y ago
      I guess there is nothing that restricts the amount of information you can send. Why not just document everything and refer to that instead? Is there anything in GDPR that states you need to give a specific answer tailored to the individual customer?
iscsisounddirty 9y ago
That makes no sense, SaaS makes it harder to be compliant with GDPR since you have to rely on other companies to ensure erasure, and compliance. I know of specific companies who were left vulnerable since they had no idea what was being kept on AWS
brockers 9y ago
While I generally applaud the idea, I cannot help but notice that the most likely abuser of users personal data is the governments of the EU itself.

145 points by aberoham 9y ago

This post was inspired by "The Nightmare Letter: A Subject Access Request under GDPR" [0]. Which shows the potential scary consequences of subject access requests. There's a lot of FUD around this topic. I've seen posts opinions ranging from "no big deal" to "this is actually good for U.S. SaaS" to "This is going to kill SaaS". It will be interesting to see how enforcement of the GDPR plays out. At the moment, with Facebook transgressions in the news, the pendulum seems to be swinging towards privacy. We'll see how far it swings. [0] https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce...

louthy 9y ago
As a CTO at a European SaaS company I don't particularly find 'The Nightmare Letter' nightmarish at all. If you're doing your job properly then this stuff isn't hard. It's had very little effect on our day-to-day - yeah, it's cost us real cash money in lawyers, and additional training for GDPR, but most of what is going to be legislation we were already doing. As an individual I welcome this legislation - it should really help to stop the shoddy practises that clearly go on (based on the amount outrage I've seen on this issue). GDPR seems, to me, to be proportionate and reasonable. I don't see this helping US SaaS companies, because once GDPR is in-place then I'd consider EU SaaS providers to be more attractive. It's a real selling point that your data isn't leaking or being mismanaged. If anything I see this as a potential boon for the SaaS companies doing their job properly, because the companies that have in-house systems (or have their own bespoke solutions) are going to have to prove those systems themselves - and have all the answers to The Letter. Whereas a good SaaS company can take those problems off their hands.
- ryandrake 9y ago
  Nothing in that nightmare letter seems unreasonable for an end user to want to know, and I'd be hesitant to do business with a company that can't answer those questions about their own business. If those "nightmare" questions are the bar, it's a pretty low bar.
  - amarkov 9y ago
    The issue isn't whether the company has the answers to the questions, but what it costs to assemble those answers in the requested form. You can't respond to detailed legal inquiries by just having customer support copy-paste from documentation; they don't have the expertise required to guarantee a complete and correct answer.
    - qw 9y ago
      Why do they have to copy and paste? Why couldn’t they make a self service tool where they login and get all documentation that is required by law? The law says that you have the right to information, but does it say you have the right to a human responding with only the requested information?
    - heavenlyblue 9y ago
      Just the same way a bank clerk is given a set of security questions so that he could prove your identity and the legal/security departments make sure those questions are relevant and to be trusted. Most of the time you're not speaking to the bank's lawyers when trying to open an account.
- adventured 9y ago
  > I don't see this helping US SaaS companies, because once GDPR is in-place then I'd consider EU SaaS providers to be more attractive. It's a real selling point that your data isn't leaking or being mismanaged. That doesn't make any sense. If GDPR is in place, then US SaaS firms won't be leaking & mismanaging your data, the whole point is they'll have to start complying or else. US SaaS firms will still have a vast advantage because: they're radically larger with far greater financial resources, have a drastically larger VC environment of initial funding, and still have the world's largest homogeneous economy as the base hub to initialize out of and get to huge scale to easily afford to spend anything they need to on compliance. What the EU just did is make the compliance picture far more difficult and complex for small European competitors as a whole. With Brexit, the EU lost 15% of its economic mass, further aggrevating this concept of regulatory & compliance splintering across Europe. The European splintering will only get worse as individual European non-EU nations come up with their own rules on this type of stuff. Salesforce or Workday can more easily comply with a dozen compliance approaches across the whole of Europe, than a given start-up in Portugal or Greece can.
  - heavenlyblue 9y ago
    You're making an argument about the good parts of GDPR into an argument about whether the political system should take sides in terms of business opportunities it gives. Is GDPR good for personal data safety? I think it is. Is GDPR easier for small businesses than for larger ones? No.
- moduspol 9y ago
  > I don't see this helping US SaaS companies, because once GDPR is in-place then I'd consider EU SaaS providers to be more attractive. It's a real selling point that your data isn't leaking or being mismanaged. Does GDPR prevent data from being leaked or mismanaged?
  - heavenlyblue 9y ago
    But it gives a clear way of penalising the company if they are caught doing so (and a clear definition of what "doing so" means).
  - louthy 9y ago
    No - but it penalises you if you fail to follow best practice (like not encrypting data at rest for example). So, the incentive to do the right thing is greater seeing as you can be fined a percentage of your turnover.
    - moduspol 9y ago
      Indeed. Just pointing out the clear difference between that and what was stated.
      - louthy 9y ago
        Thanks for clearing that up. I’m sure nobody knew what I meant until I made the clarifying post above. As an individual I am much more likely to trust an organisation that follows GDPR regulations over one that doesn’t. That obviously doesn’t mean they’re never going to have a data breach- but by law they will have to announce it within 3 days, and will face massive fines if negligent - that, to me, is a company I would prefer to give my business to - and was my point. Pedantry doesn’t help.
        moduspol 9y ago
        GDPR is very popular here on HN, but I think it's important to keep a level head about what it actually does and what its real-world effects will be. That is the entire point of this thread, after all. The difference between "not having a breach" and "a legal obligation to announce it within three days" is not semantic. It is absolutely material to the real-world value of GDPR, and claims about it should reflect that.
hectormalot 9y ago
I suspect that the 'nightmare GDPR letter' pushes the boundaries on what the GDPR would probably intent as a reasonable request, and I wonder if it would hold up in court if challenged by one of the companies. I think most of the provisions make a lot of sense if you look at them in a simple way. It's not unreasonable to ask a company: * what information on me do you keep? * what are you using it for? * can you provide me with a copy of my data? (with interesting situations where the data itself might be privacy or competitively sensitive, e.g. can I expect a company to share derived insurance scores with me? what if the data also includes other people's data?) * can you erase my data? As for impact on small SaaS businesses, I think it is relatively limited. .e.g For my SaaS side business I could probably answer the nightmare request within a day, if I would get 1+ request per week we could probably automate the response, with the exception of manual ID validation. Information deletion is something that the app wouldn't handle well at the moment and would be a bit more work. Thinking of it in this way, this is probably only a problem for a) large user bases (in which case I hope companies have the capacity to automate these requests efficiently), and b) data hoarding / ad companies (for which I don't really feel sorry)
- kenbaylor 9y ago
  For any company that is compliant with GDPR (after 25th May 2018), the answers your 4 questions (2 on data collection, other 2 on data subject rights) must already be in their privacy notice on their website, with instructions for how to contact their data protection officer.
wukerplank 9y ago
The privacy laws in my country were nearly as restrictive as GDPR and now they get a bit stricter. No big deal. GDPR is only stating the obvious and actually it is sad that the protection of most private information is not common sense but needs to be enforced with rigorous punishment.
Spearchucker 9y ago
I've had that letter bookmarked for months now, and the thing that worries me most is that for example, as a subject that hasn't ever owned an Android phone, doesn't use Google, Gmail or have a YouTube account - if I send that letter to Google, what stops Google from just straight-out lying to me? How do they prove their honesty to me if they say "we got nothing on you"?
- kenbaylor 9y ago
  This is a key reason why there are data protection officers under GDPR. They report to the highest level of management (mostly the board) and are independent. They are also called mini-regulators. They ensure the company is compliant. If they are not doing their job, (and you are not content with their reply), you then appeal to the Data Protection Authority (DPA, Privacy Regulator in the country). The DPA has full powers of subpoena (and a whole lot more), and are not to be trifled with.
  - chopin 9y ago
    That doesn't help. I'm in a similar position, but I'd like to know which data has eg. Facebook on me. If they write back "you have no account, we have no data on you" how I am to know that this is true (and it is almost certainly not)? With nothing on hand it doesn't make sense to go to a regulator.
    - kenbaylor 9y ago
      There is a process to be followed. If you have the response from the DPO and a reasonable suspicion based on evidence, you can absolutely to to the DPA. If your evidence is strong, that may proceed on that. If not but there are many other similar complaints, they can formally ask the company to 'clarify' issues....which is a very dangerous thing if you are a company that is evasive.
    - heavenlyblue 9y ago
      You have an entity that regularly creates accounts on Facebook, then sends the letters requesting the data Facebook holds for them. For any requests replying those accounts do not exist that entity brings Facebook to court.

gtirloni 9y ago

This article feels the need to repurpose the term "on-premises" to mean "self-hosted". From a previous article [0]: In the SaaS context, “on-premise” historically meant deploying a separate instance of your SaaS application to your customer’s server room or data center, behind their firewall. More recently, this term may also include deploying to the customer’s private cloud at a cloud provider like Amazon Web Services or Azure I'm a bit baffled this is necessary. You go from two terms that are widely understood to now having to add a disclaimer every time you say "on-premises". 0 - https://gravitational.com/blog/time-to-reconsider-going-onprem/ https://gravitational.com/blog/time-to-reconsider-going-onpr...

twakefield 9y ago
Point taken. I've struggled with this because we see these terms intermingled in practice. This is probably because most of our customers (SaaS vendors) think of everything that is not traditional multi-tenant SaaS as "on-premise". Also, self-hosted does connote the customer's IT is running the application, where a lot of times we see the vendor running the application (just on customer infrastructure).
- gtirloni 9y ago
  Ah, the vendor running the app on the customer's infrastructure. Got it. Thanks, that makes sense.
amarkov 9y ago
The motivation is that both kinds of "on-premise" create roughly similar engineering challenges. (Your app has to be adaptable to heterogenous execution environments, all your code changes will be in a partially released state for indefinite periods of time, it's hard to immediately diagnose whether a reported problem is your fault or user error...)
threeseed 9y ago
Self hosted may as well be on premise for most companies though. The whole point of SaaS is that someone else manages the app. If you've ever worked in an enterprise you would understand that it can take months/years and significant amounts of money to get an app "installed". Often there needs to be a business case, project and resourcing plans, security and risk reviews, legal compliance checks etc. The infrastructure (cloud versus on premise) is just one part of a dozen and not usually the most challenging.

roomey 9y ago

Genuine question, do people realise Facebook Europe (among others) is headquartered in Ireland, and has to abide by fairly strict rules already? Eg. I can write them and they have to provide me with any personal information they have on me at the moment, for a nominal fee. I could probably get most of the questions on the nightmare letter above answered!

lovich 9y ago
"strict" only applies once they've been punished for violating those rules, which has not happened with those Irish regulations as far as I am aware. Facebook gives some information out, but does not give it all[1] [1]http://www.zdnet.com/article/facebook-releasing-your-personal-data-reveals-our-trade-secrets/ http://www.zdnet.com/article/facebook-releasing-your-persona...
kenbaylor 9y ago
Most of the EU litigation has been against Facebook. They have spent many millions in EU GDPR projects (such as the ability to download all records, which is in the news cycle right now). Under the current legislation, they can be sued by each regulator in each country separately (this has happened to them multiple times). Under the GDPR, they will mostly be sued by just the Irish Data Protection Authority (other EU regulators will funnel issues to the Irish DPA first).
dane-pgp 9y ago
There's one particular aspect of the GDPR which I realised recently could have a significant effect on Facebook. The regulations give users a specific right to data portability, with the wording: "In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible." https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/ Conceivably, a Facebook user could demand that Facebook support automatically sending their Facebook posts to their friends on third party social networks. I imagine that an EU court would not be very sympathetic to Facebook claiming that it isn't technically feasible for a (large, monopolistic, American) company to support this use case when small open source (European?) competitors have implemented the W3C social networking standards (e.g. ActivityPub) with no trouble. Once Facebook is forced by the GDPR to publish data to competing sites, I imagine it will feel compelled to also support receiving data from people on those sites, otherwise the one-way flow of data would put Facebook users at a disadvantage. But then there is basically no reason to use Facebook, as users of competing sites would still be able to see and be seen by their friends on Facebook. This is such a disastrous outcome for Facebook that I wouldn't be surprised if lawyers at Google (or some other big company) were already working on the legal complaints they are going to launch come May, when the GDPR comes into force.

antoncohen 9y ago

This doesn't make a lot of sense. If you are a SaaS provider that has the option of selling your software as on-premises, you are almost certainly a processor not a controller. Put another way, when a consumer goes to a consumer site and gives it personal data, that consumer site is the controller. When the controller uses a third-party SaaS to process or store the data, that third-party is a processor. If you are a controller you need to ensure that your processors are capable of handling GDPR requests, e.g., they can delete specific data for a user or provide a dump for a user. The processor (third-party SaaS) will have to write that capability into their software. Bringing that SaaS software on-premises doesn't change much. It eliminates the processor, but if I'm a controller purchasing some big SaaS-like product to run myself, I'm going to insist it have GDPR features built-in. The third-party SaaS vendor will have to write GDPR feature whether they sell it as SaaS or on-prem.

twakefield 9y ago
Maybe I'm missing the point of your comment but a typical reason for delivering an application on your customer's infrastructure is that they don't want their data to leave their infrastructure. It's usually b-to-b where the customer is typically an enterprise buyer using their own data storage. So, the customer knows how its data is being processed.
- pdpi 9y ago
  The point is that your b2b customer is itself a b2c business that holds customer data in the product you sold them. Irrespective of whether it’s hosted or on-prem, you’re considered a processor in GDPR parlance, and your customer is a controller. Your customer needs to be able to handle consumer GDPR requests, so, if your software ever touches end-user data, it needs to be able to handle whatever those GDPR requests might be
  - rvcdbn 9y ago
    > The point is that your b2b customer is itself a b2c business that holds customer data in the product you sold them. This is not true of most SaaS products I use on daily basis e.g. calendar, gmail, Slack, GitHub, code review tools, CI server, etc.

StreamBright 9y ago

The entire on-prem vs. cloud is orthogonal to GDPR. Your stack either compliant with it or it isnt, regardless if you run on AWS or on OVH.

77pt77 9y ago

Can I just say that my service doesn't cater to EU residents?

gls2ro 9y ago
As I am interpreting the GDPR (IANAL) it is not about what you say, it is about if you have or have not users from EU. See [0] specifically the phrase "It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location" [0] https://www.eugdpr.org/gdpr-faqs.html https://www.eugdpr.org/gdpr-faqs.html
- icebraining 9y ago
  More or less; if you just happen to be accessible from the EU, but have otherwise no connection to the EU at all, you're probably not subject to the GDPR: "In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. (..) the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention" https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/
galvin 9y ago
If you don't target EU customers and you don't have an EU presence, sure. Other businesses who want to be GDPR compliant might not be able to use your service either.
PeterisP 9y ago
Sort of - you have to actually not cater to EU residents, simply saying so might not be sufficient, and (for an exaggerated example) a company implementing a signup screen that says "wink wink nudge nudge press quit if you're from EU" while having 25% of their business income from EU credit cards would be likely treated not as compliance but as malicious evasion. You have to avoid touching personal data of EU residents; various exceptions are understandable (e.g. people using some measures like VPN to circumvent some restriction), but in general if you do somehow happen to have a sizeable amount of such data, then obviously you're "catering to EU residents" in some way no matter what you claim.

marcrosoft 9y ago

I’m not sure why this doesn’t come up more but the EU does not have any authority to force non EU companies to do anything. Please stop pretending that GDPR effects US companies not operating in the EU.

martimarkov 9y ago
Because we live in a global world. Why would you build a startup to only be capable to NOT work in EU. When building a company and you want to have any dealing with EU companies. And there are a lot of those it just makes sense to adopt the most strict framework and deal with it.
- marcrosoft 9y ago
  Oh, because of the internet I can serve a EU customer from the US without EU regulation. Why would a startup setup a nexus in the EU?
  - raquo 9y ago
    GDPR has its own, vague criteria for when it applies, and it's much more inclusive than the typical criteria for a nexus. For example, things like the company actively seeking out clients in EU countries, or offering the service in EU countries' languages, make it more likely that EU will consider the company to be subject to GDPR even if it has no presence in the EU. It seems to me that EU is overstepping their jurisdiction here, but I really don't know how international law works.
    - true_religion 9y ago
      Yes the language clause makes no sense to me. If we add French to support Quebec or Spanish for S. America, we can now be roped into an EU regulation?
      - TeMPOraL 9y ago
        If you make steps to ensure that you're not servicing EU citizens, then I guess not. A little more clarification on that would be welcome.

andy_ppp 9y ago

Just slightly off topic, has anyone done an opinionated legal analysis of what GDPR means in the context of delivering a complex application. For example let’s say a recruitment company internal system. I think business people and lawyers alone struggle to grasp the meaning and spirit of the rules.

barry0079 9y ago

According to ICO guidelines: "Where requests are manifestly unfounded or excessive, in particular because they are repetitive, you can: charge a reasonable fee taking into account the administrative costs of providing the information; or refuse to respond." I wonder if that would apply to the letter? [0]: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/ https://ico.org.uk/for-organisations/guide-to-the-general-da... Edit: Formatting

vbsteven 9y ago

Assuming that a SaaS provider is the `processor` in the GDPR. Could it comply to the GDPR by providing the following features through either API or admin panel?: * Trigger json/zip export of all data for $user_id * Delete all data for $user_id * List all events where data for $user_id has been sent to $third_party When building a new SaaS service from in 2018, this does not seem to be that much work if you design your system with these requirements in mind. A simple way to tag every resource in the database with $user_id, and an event log for third party interactions should be enough. Am I missing something?

merinowool 9y ago
How do you delete data from backups written to persistent media? When having CQRS/ES architecture (immutable events), how do you delete that data where by definition events can't be modified/deleted. Just two examples, but there is much more.
- magnat 9y ago
  > How do you delete data from backups written to persistent media? You encrypt each user's data with unique symmetric key and store the key in HSM or other external, rewritable media. When requested, you delete the key for a given user, rendering user data in backups unusable.
  - merinowool 9y ago
    I don't think that is feasible, because you don't know if this data could be easily decrypted in the future. What do you do with existing data written to persistent media?
    - DelightOne 9y ago
      What do you think is reasonable if you say encryption and deletion of said key is not reasonable effort enough?
    - heavenlyblue 9y ago

fuscy 9y ago

This letter is interesting.. and paints a bleak future. What is stopping someone who wants to make easy money (like me) from going on Fiverr and selling my GDPR request letters? Example: 5$ for 5 (could be anything) GDPR request letters to any company of your choosing? This way, a malicious actor can buy thousands of GDPR requests and DDoS anyone but big companies like Google. The cherry on top is that they have 1 month to comply so after they remove the information, I can simply repeat the process after the time limit. So they will eventually have to implement some kind of banning process which will affect their FTUE/onboarding giving the competition an advantage. I bet this is the most basic idea that will appear in the blackhat world where they can probably poison the data compliance of various companies so that their services get shuttered.

CJefferson 9y ago
I hope people do send lots of GDPR requests. I plan on doing so myself. The answer is very simple. You should have a simple automated one-click method of knowing where all data relate to each user is, and an automated way of clearing it all. Job done.
- fuscy 9y ago
  My "business" idea would probably last until the tech stack catches up. At this moment there is no easy way to handle this request for a simple helpdesk clerk without involving some pricier jobs. Even with the tech, it still requires a human (for now) to read the request, understand it and process it. Perhaps the future is AI interpreting the request and doing all the operations automatically or providing the client with a panel that can do all of these without having to contact the company.
  - qw 9y ago
    I guess there is nothing that restricts the amount of information you can send. Why not just document everything and refer to that instead? Is there anything in GDPR that states you need to give a specific answer tailored to the individual customer?

iscsisounddirty 9y ago

That makes no sense, SaaS makes it harder to be compliant with GDPR since you have to rely on other companies to ensure erasure, and compliance. I know of specific companies who were left vulnerable since they had no idea what was being kept on AWS

brockers 9y ago

While I generally applaud the idea, I cannot help but notice that the most likely abuser of users personal data is the governments of the EU itself.