3 ms·

Unfortunately even if you're already handling personal data responsibly, the GDPR still also requires that you be able to provide various documented policies to

Unfortunately even if you're already handling personal data responsibly, the GDPR still also requires that you be able to provide various documented policies to your regulator on demand, still contains lots of ambiguity about how far subject rights can go in practice, still imposes obligations to include lots of extra detail in privacy policies or otherwise provide lots of information and active warnings to data subjects, etc.

ryandrake 9y ago
How about, “Our documented policy is to not collect personal information from users at all.” Assuming it’s true, wouldn’t that be compliant?
- kasey_junk 9y ago
  GDPR also expands what is personal data to include things that are collected as a matter of course such as IP address. You likely have a reason to log that data but GDPR requires that you document it. Further it reaches into your business even if you aren’t trying to do business in the EU, as EU citizens can come to your site without your control. There is a lot to like with GDPR but it absolutely is expansive & easy to have many interpretations.
  - ryandrake 9y ago
    Maybe these things shouldn’t be collected as a matter of course. Should web servers log client IP addresses by default? Why? Does my mail server need to log email addresses of incoming mail by default? “Logging all the things” as default behavior really needs to be a thing of the past. If anyone wants to get their feet wet in open source, there are thousands of high profile projects out there that could use a patch to scrub PII from their logging, and these are probably simple diffs.
    - merinowool 9y ago
      What if you have a forum and users of that forum commit a crime, police asks you to give up their data and you say you don't have any data?
      - wadkar 9y ago
        > you say you don’t have any data? And what’s wrong in telling the truth to the police? Sounds great to me. Also, see how signal responds to such requests.
    - Silhouette 9y ago
      “Logging all the things” as default behavior really needs to be a thing of the past. Maybe, but logging useful things is reasonable. We investigate problems with our systems using server logs. We diagnose various security threats, fraud risks and ToS violations using server logs. We're generally respectful of users' privacy, but we also have a legitimate interest in knowing how our systems are being used and preventing people from doing bad things with them. Those legitimate interests may take precedence over a visitor's right to privacy in some cases, in the same way that you can't tell a government to forget your criminal record or a bank to forget that you owe them money.
- Silhouette 9y ago
  Presumably it would, but since approximately 0% of businesses that actually do anything could make such a statement truthfully, that doesn't help very much.

ryandrake 9y ago

How about, “Our documented policy is to not collect personal information from users at all.” Assuming it’s true, wouldn’t that be compliant?

kasey_junk 9y ago
GDPR also expands what is personal data to include things that are collected as a matter of course such as IP address. You likely have a reason to log that data but GDPR requires that you document it. Further it reaches into your business even if you aren’t trying to do business in the EU, as EU citizens can come to your site without your control. There is a lot to like with GDPR but it absolutely is expansive & easy to have many interpretations.
- ryandrake 9y ago
  Maybe these things shouldn’t be collected as a matter of course. Should web servers log client IP addresses by default? Why? Does my mail server need to log email addresses of incoming mail by default? “Logging all the things” as default behavior really needs to be a thing of the past. If anyone wants to get their feet wet in open source, there are thousands of high profile projects out there that could use a patch to scrub PII from their logging, and these are probably simple diffs.
  - merinowool 9y ago
    What if you have a forum and users of that forum commit a crime, police asks you to give up their data and you say you don't have any data?
    - wadkar 9y ago
      > you say you don’t have any data? And what’s wrong in telling the truth to the police? Sounds great to me. Also, see how signal responds to such requests.
  - Silhouette 9y ago
    “Logging all the things” as default behavior really needs to be a thing of the past. Maybe, but logging useful things is reasonable. We investigate problems with our systems using server logs. We diagnose various security threats, fraud risks and ToS violations using server logs. We're generally respectful of users' privacy, but we also have a legitimate interest in knowing how our systems are being used and preventing people from doing bad things with them. Those legitimate interests may take precedence over a visitor's right to privacy in some cases, in the same way that you can't tell a government to forget your criminal record or a bank to forget that you owe them money.
Silhouette 9y ago
Presumably it would, but since approximately 0% of businesses that actually do anything could make such a statement truthfully, that doesn't help very much.