12 ms·

GDPR articles seem to be getting some traction on HN as everyone is trying to figure out: "Do I need to do something for this? Is so, what?" For a recent proje

GDPR articles seem to be getting some traction on HN as everyone is trying to figure out: "Do I need to do something for this? Is so, what?" For a recent project I read (and translated to plain english) [1] every single article in the GDPR legislation and for our purposes it can be summed up as: "Treat user data like names and emails as if they were credit card numbers" AKA: be paranoid about keeping them, encrypt them, use SSL on your site, respond to requests from people if they ask if you have them, fix them if they're wrong, don't use them if they say you can't. Obviously that's not the entirety of it, but as a working mental model I think it goes a long way. 1 - https://blog.varonis.com/gdpr-requirements-list-in-plain-english/ https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...

iovrthoughtthis 9y ago
This is a GREAT project!! Thanks! Could you make it a git repo so we can field alterations, additions and discussion?
- michaelbuckbee 9y ago
  That's a good thought, right now it's actually a google spreadsheet that I write markdown into the individual cells export as a CSV and then run through a ruby script that turns it into HTML. Which (obviously) sounds insane, but it's significantly better than trying to edit a raw html doc of this size, get feedback, etc.
mstolpm 9y ago
I’d add: Get (documented, active) permission of users to store and use their data, understand that permission is given only for a defined cause/usage (and not indefinitely for everything you right now might not even think of), be prepared to tell users what data you store about them, why and (briefly) how it is used. Be prepared to delete user data on request. Be prepared to show documentation on how you handle the (personal) data. And delete data that is not necessary any longer in regular intervals. And: Don’t share, sell or rent personalized data to any third party without given user consent.
- molf 9y ago
  Be careful with hiding everything behind "consent", because consent cannot be a precondition for providing a service. Put differently: if a user does not consent, you cannot refuse them the service if the data you wanted to collect is not strictly necessary to provide the service. The alternative is to only collect data that is strictly necessary to provide the service. In that case GDPR allows you to collect the data even without explicitly given consent – according to GDPR in that case the user can reasonably expect the data to be necessary to provide the service. (This does not apply to sensitive personal data and biometric/genetic data – then you always need consent.) Quoting GDPR: "Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement." [1] "Consent is presumed not to be freely given [...] if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance." [2] [1] https://gdpr-info.eu/recitals/no-32/ https://gdpr-info.eu/recitals/no-32/ [2] https://gdpr-info.eu/recitals/no-43/ https://gdpr-info.eu/recitals/no-43/
  - nopriorarrests 9y ago
    It raises interesting question. What if some publisher, say, newspaper, can show highly targeted ads for $3 CPM, or generic ads for $1 CPM. Can such publisher claim that collecting data is strictly necessary to provide the service? With threefold difference in ad revenue, that could be actually the case.
    - molf 9y ago
      Good question. This would be an appeal to "legitimate interest" as a legal basis for collecting personal data. GDPR explicitly states that if the legitimate interest is direct marketing, then the user may always object to such processing, and this right must be clearly indicated. [1] https://gdpr-info.eu/art-21-gdpr/ https://gdpr-info.eu/art-21-gdpr/
    - x0x0 9y ago
      I do wonder if you can charge a consent price and a non-consent price, or if that would be fundamentally equivalent to not providing the service?
andy_ppp 9y ago
This is totally awesome! Thank you, it has been sent round the office... I too second the idea of putting this onto GitHub so it can live and be updated as understanding of the requirements increases!
deleted 9y ago
[deleted]
gist 9y ago
> some traction on HN as everyone is trying to figure out: "Do I need to do something for this? Is so, what?" If you are big enough to have to worry about this you are probably a company with plenty of resources to think and comply with this. So it's hard to imagine how many readers of HN are getting their answers on HN (or similar). If you are small time nobody is going to come after you. Sure something could happen and you could also get a traffic ticket going 57 in a 55 zone and a host of other outlier events. > AKA: be paranoid about keeping them, encrypt them, use SSL on your site, respond to requests from people if they ask if you have them, fix them if they're wrong, don't use them if they say you can't. One size fits all advice doesn't make sense in this and in other similar cases. You will spend a great deal of time and effort dealing with 'maybe's' instead of the day to day.
- michaelbuckbee 9y ago
  In general I agree with your assessment, that being said I do think that the GDPR is a decent set of guidelines for putting in place a system that respects user data in a way that clearly has not been happening.
  - deltron3030 9y ago
    Why not prevent personal data from leaking in first place? It's a solution applied at the wrong level, a or wrongly drawn system boundary if you will. The damage it causes is psychological, preventing many EU businesses from starting in first place. They're destroying the food chain for startups (small independent businesses). The EU and politcians are anti UX, they have no clue about the effect of their laws on people.
    - 0xcde4c3db 9y ago
      > Why not prevent personal data from leaking in first place? "The first place" would be not collecting it, an option that companies are seriously considering for nonessential data that they previously collected merely because it was convenient and accepted to do so.
- 9y ago
srj 9y ago
If I have an IRC service that shows quotes from people and has 'last seen' functionality is that covered by GDPR? Some of the users are from EU countries, does that mean those features need to be turned off or have some sort of acceptance exchange with users? Would filtering out EU IP ranges be sufficient, or does this also apply to EU citizens traveling outside of the EU? The referenced page says that asking users to provide a birth date isn't sufficient proof that they're over 16 years of age, how should one verify age for something like an IRC bot?
- akie 9y ago
  IIRC it applies to EU citizens wherever they are, not just people who are on EU territory.
  - briandear 9y ago
    So do American constitutional protections apply to Americans living in France? I am having a hard time understanding GDPR jurisdictional power. US citizens in France aren’t protected by the US Fair Credit Act with French banks, even when those French banks have US subisidiaries because a French company in France isn’t subject to US legal jurisdiction. Even FATCA doesn’t subject a French bank to US law — it subjects French assets in the US to the withholding provisions of US law, meaning, if a French bank has zero US exposure, then FATCA has zero effect. Are Dutch citizens in Oklahoma protected by Dutch narcotics laws? Of course not. They are subject to the jurisdiction in which they are physically present. However, a US citizen can be subject to US laws overseas, however, that’s between the American and the US government — the intermediary country has no involvement unless it’s an extradition request. This idea that EU citizens are protected worldwide is just ridiculous. EU jurisdiction doesn’t extend beyond the EU. The idea that GDPR requests have to be honored by some local ecommerce company in Idaho is just nonsense and not supported by any international legal precedent.
    - molf 9y ago
      > The idea that GDPR requests have to be honored by some local ecommerce company in Idaho is just nonsense and not supported by any international legal precedent. This is true. GDPR would only apply there if they were "offering goods or services, irrespective of whether a payment of the data subject is required, to data subjects in the European Union". [1] This is understood to mean they must be marketing to the EU, for example by offering their site in European languages (apart from English), using European currencies, or using a European domain. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
thomastjeffery 9y ago
> For a recent project, I read Fixed that for you. Usually commas aren't important, but that specific sentence really suffers in readability without it.
Dylan16807 9y ago
It's in some ways worse, because with credit card numbers you can and should avoid storing them at all, but if you need an email that's not an option.
aldoushuxley001 9y ago
Would usernames be included? Seems incredibly taxing to encrypt usernames too but is that what's suggested?
- dane-pgp 9y ago
  The GDPR specifically introduces a class of data called "online identifiers": https://gdpr-info.eu/recitals/no-30/ https://gdpr-info.eu/recitals/no-30/ which includes IP addresses and seems to extend to things like email addresses and usernames. How this will end up affecting functionality and implementations of online services is not yet clear, at least to me.
hanoz 9y ago
> "Treat user data like names and emails as if they were credit card numbers" Most sites' approach to credit card numbers is to not touch them with a barge pole, have a third party receive them instead and never let the business have any sight of them, so it's a bit of a stretch to expect the same treatment for a customer's name and email address.
- zer00eyz 9y ago
  Let me re-state what your saying: Most sites are incapable of receiving, storing and handling credit card numbers. This is because the staff building the service either lacks the technical knowhow or the organizational wherewithal to deal with the problem in a successful way. Why should it be any different for emails, names, usernames or passwords (because end users re-use those). If everyone starts acting like this data is important (it is) and valuable (it is and that might decrease with the passage of this law) - we might just get to a better place. In the absence of regulation companies will get away with whatever they can - ethics be dammed.
- noobiemcfoob 9y ago
  So...use oauth?
  - wvenable 9y ago
    Hurrah so now sites won't use their own logins and I'll be forced to let Google or Facebook know every site I want to connect to. That's an improvement?
    - jon_richards 9y ago
      This actually brings up a point that was made in a cambridge analytica post. If personal information is deleted after it has already trained a dimension-reducing model, is it really deleted? If Google and Facebook see everything because of oauth, we can ask them what data they have and tell them to delete it, but they won't be deleting whatever models they've been training about us.
    - 9y ago
noway421 9y ago
That's a fair analogy! I do think having a service like stripe for pii would make things easier. Why would we need first name and email address? As programmer I only need user ID!
- deleted 9y ago
  [deleted]
- xenomachina 9y ago
  I don't think this would be sufficient in many cases. If you store any form of user-generated content, or even a recommendation model generated from a user's past behavior, I'm pretty sure that's also considered personally identifiable information under GDPR, and since it's part of your product, you can't just outsource handling of it. It gets even stickier if that data is intertwined with data from other users, as could be the case in machine learning models or used-generated collaborative projects.
downandout 9y ago
Honestly, the best thing to do if you don’t have a high percentage of EU users/customers is to simply block EU IPs. First it was the completely useless cookie notifications, now it’s GDPR, and nobody knows what the next thing will be - we only know that there will be a next thing (there always is), and that it too will be costly and burdensome to comply with. Unless you derive a significant percentage of your revenue from EU users, it just isn’t worth it to try to keep up with the increasingly demanding whims of a heavy-handed European government.
- Jommi 9y ago
  I love this comment. Waiting for people to take the bait and reply to you!
  - downandout 9y ago
    Take the bait? I’m not saying anything controversial. A large percentage of websites are directed at the home country of their owners anyway, and EU traffic is often incidental and worthless to them. A US dentist or doctor likely has no interest in receiving appointments from people in the EU, for example. An online store based in the US, who would have to charge outlandish shipping rates to ship to the EU, is unlikely to get orders from the EU and thus should have no interest in that traffic. An online message board where nurses in a US city talk to each other probably wouldn’t want to spend the money to comply with GDPR even if the occasional nurse from the EU might pop in with an interesting comment every now and then. So EU traffic means nothing to any of the above example sites, yet all of them will be massively exposed under the GDPR. If I ran a web hosting company, I’d offer EU IP blocking as an optional, free service.
    - Jommi 9y ago
      You don't think it's controversial to tell business to block the other half of the civilized world?
- diamondlovesyou 9y ago
  Ehhhh, I'd leave it as is. Unless you have business licenses in EU countries, EU laws have no legal authority over you. If you do have such licenses, then you're probably big enough to foot the bill and possibly also can't afford to not foot the bill (due to suspended licenses). This privacy thing is, like, their option, man. Even if you and I agree with the EU.
hvidgaard 9y ago
It's a start, but that is only the easy part, where the goal is relatively simple to figure out. You also have to explicitly get legal documents signed if you make a system for companies that "own" the user data. You need to have new procedures for obtaining, storing, using, and delete customer data. This is known as a "code of conduct". You need sufficient logging to aid incident analysis too. I also think a lot of companies are entering a bit of panic mode because there is no clear guideline on what is sensitive data. If you make a booking system, then everything you store is potentially sensitive if you have end user data in it. If you're making IoT devices for the home with cloud access, then you have sensitive data. The conclusion we've reached is fairly simple. If there a even a remote chance that normal day to day use of our systems contains data that can be used to build a profile of a user, then the systems data is considered sensitive.
gregorymichael 9y ago
What constitutes user data?

iovrthoughtthis 9y ago

This is a GREAT project!! Thanks! Could you make it a git repo so we can field alterations, additions and discussion?

michaelbuckbee 9y ago
That's a good thought, right now it's actually a google spreadsheet that I write markdown into the individual cells export as a CSV and then run through a ruby script that turns it into HTML. Which (obviously) sounds insane, but it's significantly better than trying to edit a raw html doc of this size, get feedback, etc.

mstolpm 9y ago

I’d add: Get (documented, active) permission of users to store and use their data, understand that permission is given only for a defined cause/usage (and not indefinitely for everything you right now might not even think of), be prepared to tell users what data you store about them, why and (briefly) how it is used. Be prepared to delete user data on request. Be prepared to show documentation on how you handle the (personal) data. And delete data that is not necessary any longer in regular intervals. And: Don’t share, sell or rent personalized data to any third party without given user consent.

molf 9y ago
Be careful with hiding everything behind "consent", because consent cannot be a precondition for providing a service. Put differently: if a user does not consent, you cannot refuse them the service if the data you wanted to collect is not strictly necessary to provide the service. The alternative is to only collect data that is strictly necessary to provide the service. In that case GDPR allows you to collect the data even without explicitly given consent – according to GDPR in that case the user can reasonably expect the data to be necessary to provide the service. (This does not apply to sensitive personal data and biometric/genetic data – then you always need consent.) Quoting GDPR: "Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement." [1] "Consent is presumed not to be freely given [...] if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance." [2] [1] https://gdpr-info.eu/recitals/no-32/ https://gdpr-info.eu/recitals/no-32/ [2] https://gdpr-info.eu/recitals/no-43/ https://gdpr-info.eu/recitals/no-43/
- nopriorarrests 9y ago
  It raises interesting question. What if some publisher, say, newspaper, can show highly targeted ads for $3 CPM, or generic ads for $1 CPM. Can such publisher claim that collecting data is strictly necessary to provide the service? With threefold difference in ad revenue, that could be actually the case.
  - molf 9y ago
    Good question. This would be an appeal to "legitimate interest" as a legal basis for collecting personal data. GDPR explicitly states that if the legitimate interest is direct marketing, then the user may always object to such processing, and this right must be clearly indicated. [1] https://gdpr-info.eu/art-21-gdpr/ https://gdpr-info.eu/art-21-gdpr/
  - x0x0 9y ago
    I do wonder if you can charge a consent price and a non-consent price, or if that would be fundamentally equivalent to not providing the service?

andy_ppp 9y ago

This is totally awesome! Thank you, it has been sent round the office... I too second the idea of putting this onto GitHub so it can live and be updated as understanding of the requirements increases!

deleted 9y ago

[deleted]

gist 9y ago

> some traction on HN as everyone is trying to figure out: "Do I need to do something for this? Is so, what?" If you are big enough to have to worry about this you are probably a company with plenty of resources to think and comply with this. So it's hard to imagine how many readers of HN are getting their answers on HN (or similar). If you are small time nobody is going to come after you. Sure something could happen and you could also get a traffic ticket going 57 in a 55 zone and a host of other outlier events. > AKA: be paranoid about keeping them, encrypt them, use SSL on your site, respond to requests from people if they ask if you have them, fix them if they're wrong, don't use them if they say you can't. One size fits all advice doesn't make sense in this and in other similar cases. You will spend a great deal of time and effort dealing with 'maybe's' instead of the day to day.

michaelbuckbee 9y ago
In general I agree with your assessment, that being said I do think that the GDPR is a decent set of guidelines for putting in place a system that respects user data in a way that clearly has not been happening.
- deltron3030 9y ago
  Why not prevent personal data from leaking in first place? It's a solution applied at the wrong level, a or wrongly drawn system boundary if you will. The damage it causes is psychological, preventing many EU businesses from starting in first place. They're destroying the food chain for startups (small independent businesses). The EU and politcians are anti UX, they have no clue about the effect of their laws on people.
  - 0xcde4c3db 9y ago
    > Why not prevent personal data from leaking in first place? "The first place" would be not collecting it, an option that companies are seriously considering for nonessential data that they previously collected merely because it was convenient and accepted to do so.
9y ago

srj 9y ago

If I have an IRC service that shows quotes from people and has 'last seen' functionality is that covered by GDPR? Some of the users are from EU countries, does that mean those features need to be turned off or have some sort of acceptance exchange with users? Would filtering out EU IP ranges be sufficient, or does this also apply to EU citizens traveling outside of the EU? The referenced page says that asking users to provide a birth date isn't sufficient proof that they're over 16 years of age, how should one verify age for something like an IRC bot?

akie 9y ago
IIRC it applies to EU citizens wherever they are, not just people who are on EU territory.
- briandear 9y ago
  So do American constitutional protections apply to Americans living in France? I am having a hard time understanding GDPR jurisdictional power. US citizens in France aren’t protected by the US Fair Credit Act with French banks, even when those French banks have US subisidiaries because a French company in France isn’t subject to US legal jurisdiction. Even FATCA doesn’t subject a French bank to US law — it subjects French assets in the US to the withholding provisions of US law, meaning, if a French bank has zero US exposure, then FATCA has zero effect. Are Dutch citizens in Oklahoma protected by Dutch narcotics laws? Of course not. They are subject to the jurisdiction in which they are physically present. However, a US citizen can be subject to US laws overseas, however, that’s between the American and the US government — the intermediary country has no involvement unless it’s an extradition request. This idea that EU citizens are protected worldwide is just ridiculous. EU jurisdiction doesn’t extend beyond the EU. The idea that GDPR requests have to be honored by some local ecommerce company in Idaho is just nonsense and not supported by any international legal precedent.
  - molf 9y ago
    > The idea that GDPR requests have to be honored by some local ecommerce company in Idaho is just nonsense and not supported by any international legal precedent. This is true. GDPR would only apply there if they were "offering goods or services, irrespective of whether a payment of the data subject is required, to data subjects in the European Union". [1] This is understood to mean they must be marketing to the EU, for example by offering their site in European languages (apart from English), using European currencies, or using a European domain. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/

thomastjeffery 9y ago

> For a recent project, I read Fixed that for you. Usually commas aren't important, but that specific sentence really suffers in readability without it.

Dylan16807 9y ago

It's in some ways worse, because with credit card numbers you can and should avoid storing them at all, but if you need an email that's not an option.

aldoushuxley001 9y ago

Would usernames be included? Seems incredibly taxing to encrypt usernames too but is that what's suggested?

dane-pgp 9y ago
The GDPR specifically introduces a class of data called "online identifiers": https://gdpr-info.eu/recitals/no-30/ https://gdpr-info.eu/recitals/no-30/ which includes IP addresses and seems to extend to things like email addresses and usernames. How this will end up affecting functionality and implementations of online services is not yet clear, at least to me.

hanoz 9y ago

> "Treat user data like names and emails as if they were credit card numbers" Most sites' approach to credit card numbers is to not touch them with a barge pole, have a third party receive them instead and never let the business have any sight of them, so it's a bit of a stretch to expect the same treatment for a customer's name and email address.

zer00eyz 9y ago
Let me re-state what your saying: Most sites are incapable of receiving, storing and handling credit card numbers. This is because the staff building the service either lacks the technical knowhow or the organizational wherewithal to deal with the problem in a successful way. Why should it be any different for emails, names, usernames or passwords (because end users re-use those). If everyone starts acting like this data is important (it is) and valuable (it is and that might decrease with the passage of this law) - we might just get to a better place. In the absence of regulation companies will get away with whatever they can - ethics be dammed.
noobiemcfoob 9y ago
So...use oauth?
- wvenable 9y ago
  Hurrah so now sites won't use their own logins and I'll be forced to let Google or Facebook know every site I want to connect to. That's an improvement?
  - jon_richards 9y ago
    This actually brings up a point that was made in a cambridge analytica post. If personal information is deleted after it has already trained a dimension-reducing model, is it really deleted? If Google and Facebook see everything because of oauth, we can ask them what data they have and tell them to delete it, but they won't be deleting whatever models they've been training about us.
  - 9y ago

noway421 9y ago

That's a fair analogy! I do think having a service like stripe for pii would make things easier. Why would we need first name and email address? As programmer I only need user ID!

deleted 9y ago
[deleted]
xenomachina 9y ago
I don't think this would be sufficient in many cases. If you store any form of user-generated content, or even a recommendation model generated from a user's past behavior, I'm pretty sure that's also considered personally identifiable information under GDPR, and since it's part of your product, you can't just outsource handling of it. It gets even stickier if that data is intertwined with data from other users, as could be the case in machine learning models or used-generated collaborative projects.

downandout 9y ago

Honestly, the best thing to do if you don’t have a high percentage of EU users/customers is to simply block EU IPs. First it was the completely useless cookie notifications, now it’s GDPR, and nobody knows what the next thing will be - we only know that there will be a next thing (there always is), and that it too will be costly and burdensome to comply with. Unless you derive a significant percentage of your revenue from EU users, it just isn’t worth it to try to keep up with the increasingly demanding whims of a heavy-handed European government.

Jommi 9y ago
I love this comment. Waiting for people to take the bait and reply to you!
- downandout 9y ago
  Take the bait? I’m not saying anything controversial. A large percentage of websites are directed at the home country of their owners anyway, and EU traffic is often incidental and worthless to them. A US dentist or doctor likely has no interest in receiving appointments from people in the EU, for example. An online store based in the US, who would have to charge outlandish shipping rates to ship to the EU, is unlikely to get orders from the EU and thus should have no interest in that traffic. An online message board where nurses in a US city talk to each other probably wouldn’t want to spend the money to comply with GDPR even if the occasional nurse from the EU might pop in with an interesting comment every now and then. So EU traffic means nothing to any of the above example sites, yet all of them will be massively exposed under the GDPR. If I ran a web hosting company, I’d offer EU IP blocking as an optional, free service.
  - Jommi 9y ago
    You don't think it's controversial to tell business to block the other half of the civilized world?
diamondlovesyou 9y ago
Ehhhh, I'd leave it as is. Unless you have business licenses in EU countries, EU laws have no legal authority over you. If you do have such licenses, then you're probably big enough to foot the bill and possibly also can't afford to not foot the bill (due to suspended licenses). This privacy thing is, like, their option, man. Even if you and I agree with the EU.

hvidgaard 9y ago

It's a start, but that is only the easy part, where the goal is relatively simple to figure out. You also have to explicitly get legal documents signed if you make a system for companies that "own" the user data. You need to have new procedures for obtaining, storing, using, and delete customer data. This is known as a "code of conduct". You need sufficient logging to aid incident analysis too. I also think a lot of companies are entering a bit of panic mode because there is no clear guideline on what is sensitive data. If you make a booking system, then everything you store is potentially sensitive if you have end user data in it. If you're making IoT devices for the home with cloud access, then you have sensitive data. The conclusion we've reached is fairly simple. If there a even a remote chance that normal day to day use of our systems contains data that can be used to build a profile of a user, then the systems data is considered sensitive.

gregorymichael 9y ago

What constitutes user data?