5 ms·

But there is a lot of other PID with this visit - ip address, cookies, browser fingerprint

by AlfeG 9y ago

nopriorarrests 9y ago
Ok, let's say I, as a publisher, don't set user cookie if user hasn't registred/logged in, and don't store IP in logs, and don't do browser fingerprinting. Why can't I load some 3rd party tools? What author is claiming, essentially, that in a mere 2 month from now, you can sue almost any European publisher for data privacy breach. Outrageous claim require outrageous proof.
- TimothyBJacobs 9y ago
  Because almost assuredly the 3rd party tools collect that information and you are responsible for what you put on your website. The article specifically mentions this when talking about data processors and data controllers.
- guitarbill 9y ago
  > Why can't I load some 3rd party tools? You can, you just need assurance that they're also GDPR compliant if you want to be GDPR compliant. If the third-party violates GDPR, but requires your website to run on (e.g. third-party JS, other types of beacons), I think judges are going to have a dim view on that, and so you can't simply claim that it's them, not you. (There may be mitigations, e.g. if you have a contract with them that spells out GDPR compliance, but then they break that - but how many people have contracts for the JS they embed?) Edit: One way this argument could be laid out is that by including such third-parties in your website, you're instructing the browser to load them, and therefore effectively forwarding GDPR-related data to them. Technically, this isn't really too different from a REST API call you'd perform on the server, or an AJAX call (although the server call doesn't necessarily forward e.g. the IP).
  - nopriorarrests 9y ago
    Interesting. I personally use uBlock and "cookie autodelete", which deletes cookies for all sites except the white-listed ones each 5 minutes, automatically. So if your interpretation is correct, and GDPR affects even completely anonymous users, I'll be seeing and clicking "consent box" each time I go read a newspaper or just do general browsing. Like the "we use cookies" stuff, but on steroids. EDIT: but still, I find this hard to believe, tbh. It means no ads served to anonymous users, and this has consequences I can't even imagine.
    - hexaz 9y ago
      You can display ads, just not personalized ones. Might even lead to more static image or text based ads, which have a higher chance of not being blocked by users
      - nopriorarrests 9y ago
        >You can display ads, just not personalized ones Well, it's 2018, and most publishers rely on some 3rd party ad-tech to serve the ads. They don't have direct contracts with advertisers, and definitely has no tech in house. If 3rd party calls are prohibited, their ad revenue disappears overnight. Will be interesting to see how it develops.
    - guitarbill 9y ago
      Of course you can serve ads, they just can't use any personal information or tracking unless people have consented. Ad blockers will still be a thing. As for consent, you have to be able to refuse. A consent box popping up each time would be the dumbest way to do this, but not that different than those full-screen email/newsletter begging boxes we have now.
      - nopriorarrests 9y ago
        Why dumbest? If we agreed that even incognito browsing contains the traces of PII, publisher has to get my consent, explicitly, that's the whole point of GDPR. I see no other option than to do popup window for each new visitor (where new == has no associated cookie). What are other options?
  - written 9y ago
    Also user can require the service to remove his personal information and that means that service provider has to notify services he uses to stop using and remove that PI. How will this work with Google Analytics and things like that? Will random e-shop be required to notify Google to stop using/delete PI for random persons upon request?
- nrb 9y ago
  Just because you aren't doing browser fingerprinting doesn't mean the third-party script you are loading into the user's browser isn't.
paulddraper 9y ago
Noob question How is that person-identitifying information? Seems like it's machine-identifying information. You can't tie it to a real-world name and email (which the top voted comment claims is the essence of GDPR).
- mixedbit 9y ago
  You can tie such visit to a real person. For example, if this is a Facebook user, and your site includes resources from facebook.com, Facebook will know exactly which real person visited your site, and the user did not give you consent to share such info with Facebook.
  - paulddraper 9y ago
    Isn't that in Facebook's court though? They acquired your name, birthdate, address, etc. And they didn't aquire it through your website. Calling IP address or screen size "person" identifying information seems a stretch to me.
    - PeterStuer 9y ago
      No, since you are the controller of your site hosting the Facebook component. Facebook is in that workflow 'merely' a data-processor. Advertising companies have lobbied long and hard to drive an interpretation of the GDPR in which they would be considered a 'controller', resulting in 'nothing changes for the business, realy'. AFAIK, they (thankfully, from a privacy perspective) failed. It realy is very much like environmental regulation. Before things like the EPA etc. came to be, it was a toxic 'everything goes' type of environment. Transition to a regime where businesses are held to data responsibility might be painful at first, but ultimately hugely beneficial to all.
    - zaarn 9y ago
      If you embed a Facebook like button and Facebook loads their scripts into YOUR site then it is YOUR responsibility to make sure Facebook is compliant with the law. The same goes for ad networks. YOU are responsible for making sure the ad network is compliant. If you include a non-GDPR complaint ad network script on your site and somebody complaints, then you are in for it because you were ultimately responsible for that network being able to track the user on YOUR webpage. If Facebook is GDPR compliant and has consent from the user then you are in the clear. If Facebook is not GDPR compliant and tracking people who aren't users then a EU or local court will set up a campfire under their asses (German courts already have). IP addresses are definitely personal data (PII and Personal Data are different, the GDPR defines and cares only about the later, PII is mostly an US term used interchangeably with PD on the internet) German and EU courts have ruled that since an IP can be traced back to a person, it's personal data. Unless you have a good reason to log it (hint: firewall and webserver logs) then you need consent for it.

But there is a lot of other PID with this visit - ip address, cookies, browser fingerprint

by AlfeG 9y ago

But there is a lot of other PID with this visit - ip address, cookies, browser fingerprint

Ok, let's say I, as a publisher, don't set user cookie if user hasn't registred/logged in, and don't store IP in logs, and don't do browser fingerprinting. Why can't I load some 3rd party tools? What author is claiming, essentially, that in a mere 2 month from now, you can sue almost any European publisher for data privacy breach. Outrageous claim require outrageous proof.

TimothyBJacobs 9y ago
Because almost assuredly the 3rd party tools collect that information and you are responsible for what you put on your website. The article specifically mentions this when talking about data processors and data controllers.
guitarbill 9y ago
> Why can't I load some 3rd party tools? You can, you just need assurance that they're also GDPR compliant if you want to be GDPR compliant. If the third-party violates GDPR, but requires your website to run on (e.g. third-party JS, other types of beacons), I think judges are going to have a dim view on that, and so you can't simply claim that it's them, not you. (There may be mitigations, e.g. if you have a contract with them that spells out GDPR compliance, but then they break that - but how many people have contracts for the JS they embed?) Edit: One way this argument could be laid out is that by including such third-parties in your website, you're instructing the browser to load them, and therefore effectively forwarding GDPR-related data to them. Technically, this isn't really too different from a REST API call you'd perform on the server, or an AJAX call (although the server call doesn't necessarily forward e.g. the IP).
- nopriorarrests 9y ago
  Interesting. I personally use uBlock and "cookie autodelete", which deletes cookies for all sites except the white-listed ones each 5 minutes, automatically. So if your interpretation is correct, and GDPR affects even completely anonymous users, I'll be seeing and clicking "consent box" each time I go read a newspaper or just do general browsing. Like the "we use cookies" stuff, but on steroids. EDIT: but still, I find this hard to believe, tbh. It means no ads served to anonymous users, and this has consequences I can't even imagine.
  - hexaz 9y ago
    You can display ads, just not personalized ones. Might even lead to more static image or text based ads, which have a higher chance of not being blocked by users
    - nopriorarrests 9y ago
      >You can display ads, just not personalized ones Well, it's 2018, and most publishers rely on some 3rd party ad-tech to serve the ads. They don't have direct contracts with advertisers, and definitely has no tech in house. If 3rd party calls are prohibited, their ad revenue disappears overnight. Will be interesting to see how it develops.
  - guitarbill 9y ago
    Of course you can serve ads, they just can't use any personal information or tracking unless people have consented. Ad blockers will still be a thing. As for consent, you have to be able to refuse. A consent box popping up each time would be the dumbest way to do this, but not that different than those full-screen email/newsletter begging boxes we have now.
    - nopriorarrests 9y ago
      Why dumbest? If we agreed that even incognito browsing contains the traces of PII, publisher has to get my consent, explicitly, that's the whole point of GDPR. I see no other option than to do popup window for each new visitor (where new == has no associated cookie). What are other options?
- written 9y ago
  Also user can require the service to remove his personal information and that means that service provider has to notify services he uses to stop using and remove that PI. How will this work with Google Analytics and things like that? Will random e-shop be required to notify Google to stop using/delete PI for random persons upon request?
nrb 9y ago
Just because you aren't doing browser fingerprinting doesn't mean the third-party script you are loading into the user's browser isn't.

paulddraper 9y ago

Noob question How is that person-identitifying information? Seems like it's machine-identifying information. You can't tie it to a real-world name and email (which the top voted comment claims is the essence of GDPR).

mixedbit 9y ago
You can tie such visit to a real person. For example, if this is a Facebook user, and your site includes resources from facebook.com, Facebook will know exactly which real person visited your site, and the user did not give you consent to share such info with Facebook.
- paulddraper 9y ago
  Isn't that in Facebook's court though? They acquired your name, birthdate, address, etc. And they didn't aquire it through your website. Calling IP address or screen size "person" identifying information seems a stretch to me.
  - PeterStuer 9y ago
    No, since you are the controller of your site hosting the Facebook component. Facebook is in that workflow 'merely' a data-processor. Advertising companies have lobbied long and hard to drive an interpretation of the GDPR in which they would be considered a 'controller', resulting in 'nothing changes for the business, realy'. AFAIK, they (thankfully, from a privacy perspective) failed. It realy is very much like environmental regulation. Before things like the EPA etc. came to be, it was a toxic 'everything goes' type of environment. Transition to a regime where businesses are held to data responsibility might be painful at first, but ultimately hugely beneficial to all.
  - zaarn 9y ago
    If you embed a Facebook like button and Facebook loads their scripts into YOUR site then it is YOUR responsibility to make sure Facebook is compliant with the law. The same goes for ad networks. YOU are responsible for making sure the ad network is compliant. If you include a non-GDPR complaint ad network script on your site and somebody complaints, then you are in for it because you were ultimately responsible for that network being able to track the user on YOUR webpage. If Facebook is GDPR compliant and has consent from the user then you are in the clear. If Facebook is not GDPR compliant and tracking people who aren't users then a EU or local court will set up a campfire under their asses (German courts already have). IP addresses are definitely personal data (PII and Personal Data are different, the GDPR defines and cares only about the later, PII is mostly an US term used interchangeably with PD on the internet) German and EU courts have ruled that since an IP can be traced back to a person, it's personal data. Unless you have a good reason to log it (hint: firewall and webserver logs) then you need consent for it.