16 ms·

> Again, this applies to US companies even if it's a single record of EU personal data. This is part of why I think GDPR is a disaster for startups. It's a mas

> Again, this applies to US companies even if it's a single record of EU personal data. This is part of why I think GDPR is a disaster for startups. It's a massive regulatory burden which big companies will be able to comply with but small startups don't have the legal horsepower to handle. Typical EU regulatory overreach.

dogma1138 9y ago
I don't know why people were downvoting this. GDPR outside of the EU (for purely non-EU entities) is a non sequitur there are zero internal processes to make it work. Lets take the most basic example the GDPR does not apply in a vacuum it's enforced and supported by Data Protection Agencies (DPA) in each member state which are responsible to ensure that companies in those member states comply with EU regulation like the GDPR within the context of local laws and regulations. The DPA is responsible for the application of the GDPR within it's member state (and it's power is limited to that member state only but the GDPR does have a few venues for applying a local DPA directive across member state lines) it's also responsible for handling complaints in that state and it provides directives and advice to both law makers and the industry. If I'm a UK company and need to deal with the GDPR (till Brexit do us part) I work with the ICO which is the UK Data Protection Agency. While other DPA might affect me the ICO is my primary source of both advice and enforcement and any issues that might originate in another DPA would still pass through the ICO. Now I am a company in don't know where lets take Argentina I want to sell to EU customers which DPA do I answer too? which DPA to I ask for advice? How do I arbitrate complaints filed against me and to which DPA do I prove I handled data disclosure requests in a manner compliant with the GDPR? which DPA would know my local laws to ensure if my application with the GDPR was complaint with local data retention and lawful access laws? In fact other than going through my own state/trade department and organizations what venue do I have as a non-EU resident and a non-EU entity to any EU services and resources. The question to all of this is none as a non-EU company there is fuck all you can do even if you want to comply with the GDPR.
- morgante 9y ago
  Yup. It's crazy to me that this law is going into effect without even such basic questions being answered.
- cdancette 9y ago
  You should use more punctuation, your writing is very hard to read and understand (as a non native speaker)
  - dogma1138 9y ago
    Yeah sorry writing on an iPhone is a makes it a bit hard.
- dspillett 9y ago
  > UK company and need to deal with the GDPR (till Brexit do us part) Brexit will make little or no difference unless you refuse to deal with EU citizens in any way the involves you having access to their PII or storing any information about them (including traces of their activity in your product/app/site. GDPR will be carried over post-brexit, and even if it is later revoked by act of parliament and not replaced by something equivalent you'll still need to deal with it if you want to trade with EU citizens. If the UK refused to play ball and somehow blocked us from the punishments for non-compliance we will face inconvenient sanction by other means. GDPR isn't perfect (is any regulation?) and their are certainly significant questions to be answered from the PoV of people operating outside the EU, and even some issues that may still require more clarity for those entirely operating here, but I wholeheartedly welcome it (UK citizen here, FWIW) despite being a data specialist and therefore having a bad nervous-twitch reaction to any idea of a non-soft delete operation!
  - dogma1138 9y ago
    That was a joke, the ICO will continue post Brexit I have no problems from the UK. The GDPR isn't perfect it's just none workable for companies that are not in the EU.
- trumpeta 9y ago
  I'm not a lawyer, but I would think your Argentina company can be in one of 2 states: 1. You have a subsidiary in EU, in which case that is who will get fined or will have to deal with the DPA where it is registered 2. You don't, in which case the EU can not fine you?
  - morgante 9y ago
    I don't think any of this is entirely clear, but from my understanding it seems like the EU wants to apply GDPR even if you don't have an EU presence. In practice, I doubt that they'd get the US to enforce judgements. But it might mean that I can never risk going to Europe again lest I risk having a default judgement enforced against me for one of my businesses.
    - pbhjpbhj 9y ago
      If your store front is accessible to EU based citizens then you have an EU presence.
      - dogma1138 9y ago
        No if you aren’t a legal entity in the EU you have no presence in the EU. If you would push for this the only thing that would happen is that companies would stop accepting orders from the EU. If this is going to be the definition expect a lot of store fronts to be closed to EU residents following May 25th or more likely the first time this precedence will be set in court.
        pbhjpbhj 9y ago
        It seems a direct parallel of being tried for copyright infringement in USA when you have an offshore website - like O'Dwyer who had to bribe himself out of being extradited from UK to face charges of copyright infringement in USA. He'd never been there, didn't have servers there, and was acting legally in his jurisdiction of residence. Similar things happened with USA's actions on Silk Road, KAT, with Kim Dotcom, and I'm sure many other legal situations I'm not aware of. EU is seemingly extending logical contact to be equivalent to entry to a jurisdiction as USA appear to have established is desirable as a facet of inter-national application of law in the internet age. I much prefer the extension of jurisdiction in protection of member states citizens rights than in the service of media conglomerates.
- Spearchucker 9y ago
  You use the legislation to guide your internal processes, systems and employee/user education. You ask your legal counsel for advise. Other than what you'd normally do anyway, you'd provide evidence of disclosure only to the DPA that asks. The DPA doesn't care about your local laws - seek local legal counsel instead. To a developer used to systems thinking this should not be rocket science. Most of it is just good practice. Kim Cameron came up with the laws of identity many years ago, which the GDPR is surprisingly similar to.
  - dogma1138 9y ago
    DPA cares for local laws the GDPR does not trump local EU legislation. What court do you use to appeal a complaint or a fine? There are no processes at all for a non-EU entity to function within the GDPR and saying it’s not rocket science isn’t going to change that.
    - Spearchucker 9y ago
      If the ICO (UK) issued a fine, you wouldn't appeal in Spain, would you? Because of course you respond to the DPA that issued the fine or complaint. Am I not understanding your question?
      - dogma1138 9y ago
        We’re not talking about EU companies or entities but non-EU ones. In case of the EU you have your own local DPA other DPA local courts and high courts to appeal too and or work with. As a non-EU entity you get nothing.
        pbhjpbhj 9y ago
        You get the courts that the person you're servicing uses. Like when you sell to someone in a particular country and have to abide by their sales and tax laws.
        9y ago
- vageli 9y ago
  So, given that there's no DPA in the US (as far as I'm aware, there are also none in China, India, Australia, etc), how would the GDPR be enforced against an entity with no physical presence in the EU?
  - dogma1138 9y ago
    On paper it can’t. In practice since the EU expects EU entities to essentially mandate GDPR compliance form their non-EU partners in order to be complaint it’s is pretty simple at least for ecommerce. PayPal could tell you you must comply to accept payments form the EU and likely in the same manner they handle everything which means no guidance, benchmarks or clear directions and it would be up to you to figure it out. By PayPal I don’t mean just PayPal but any other payment processor or service provider which you are dependent on.
nomercy400 9y ago
You suggest an exemption for startups? Wait until a Facebook decides to buy all their 'analytics' from a small startup they funded, basically circumventing the whole GDPR.
- morgante 9y ago
  Laws are not code. You could have the exemption be based on the number of individuals whose data is processed, for example: Facebook can use as many shells as they want, but they'd still need to comply if they want to look at their massive user base, but my small business with a few dozen customers wouldn't need to worry.
the-dude 9y ago
If it is so typical, multiple examples please.
- return1 9y ago
  without trying to be harsh to EU, they do have a bad record. 2 examples: Cookie Law, EU VAT (by common admission it is a system that is impossible to implement correctly)
philipps 9y ago
In light of recent revelations about the way social media companies treat their users’ data and privacy, strong regulation is not “overreach” but “overdue”.
- morgante 9y ago
  The law could have easily been tailored to target large social media companies. Instead it applies to everyone, including tiny businesses who accidentally have one European visitor. I'm strongly considering simply taking down all my old blogs/sites because it's far too much work to deal with GDPR for anything less than a medium-sized business.
  - vincnetas 9y ago
    And then huge media company just creates small subsidiary (tiny business) to "accidentally" collect personal information. Got caught? No problem, close that one, open another...
    - dannyw 9y ago
      There are plenty of laws and legal instruments / concepts (controlling stake, anti-avoidance laws, etc) that stop large companies from doing this.
    - morgante 9y ago
      And that is just as "possible" under the current structure of GDPR.
      - pilsetnieks 9y ago
        Not really. For example, if Facebook Inc. establishes a "Totally not FB LLC" for the purpose of skirting GDPR, Facebook Inc. is still the data controller according to the law, as it is directing the data collection and purpose, even if "Totally not FB LLC" does all of the handling as a data processor. Except now the fine is levied on the total turnover of both companies, not just one.
shawa_a_a 9y ago
What aspects of the law are disastrous for startups? What startups might see as a "massive regulatory burden", I see it as, at long last, a means of finally holding irresponsible companies to account. The spirit of the law is really quite simple; my personal data is an extension of me, and if you want to store or process it, you need a legal basis for doing so, and need to be able to demonstrate this legal basis to me. If your startup is at odds with this, well then perhaps you're not the kind of company the EU wants to be doing business with.
- morgante 9y ago
  The scope of personal data is disastrously large and the guidance is fuzzy at best. Take, for example, my old blog. It has commenting enabled and a standard Apache config (where logs include IP addresses). If I want to comply with GDPR, I have to do a bunch of work around log rotation/encryption, provide tools for old commenters to go back and remove their information, and this is even the simple case that I'm not using any 3rd-party analytics. No part of my "business model" is attempting to profit from personal data yet I have to jump through a bunch of new hoops. My likely solution for projects is to simply block EU traffic going forward.
  - damontal 9y ago
    For Apache can't you just change LogFormat to exclude IPs and delete the old logs?
  - rplnt 9y ago
    IP by itself is not considered private. It's only when you attach it to other identifying data. Anonymous comments are not covered with GDPR.
    - wastedhours 9y ago
      However, is it not thought that because the ISP keeps a log of dynamic IP addresses, these could (in theory) be matched to the IP address of anonymous comments, thus de-anonymise them?
DanBC 9y ago
> It's a massive regulatory burden which big companies will be able to comply with but small startups don't have the legal horsepower to handle. Where's the burden? Only collect the data you need; tell people what you're collecting and why; only keep it for as long as you need; keep it safe. These are not burdens.
- emiliobumachar 9y ago
  They have provided a real-world example elsewhere in the thread. It really seems to support their point: "Take, for example, my old blog. It has commenting enabled and a standard Apache config (where logs include IP addresses). If I want to comply with GDPR, I have to do a bunch of work around log rotation/encryption, provide tools for old commenters to go back and remove their information, and this is even the simple case that I'm not using any 3rd-party analytics."
  - mpfundstein 9y ago
    He can also just choose to not log ip addresses.
    - morgante 9y ago
      Not logging IPs makes debugging and abuse detection much more challenging. Moreover, it is also the current default in most software which touches HTTP requests.
      - krapp 9y ago
        We could make it easier for states to find and prosecute criminals by not requiring warrants and making encryption illegal, but we don't (and we shouldn't) because the peoples' rights are inalienable, whereas the rights of states, corporations and other entities to interfere with that privacy are not. Yes, it would be more challenging, and inconvenient, and probably a massive pain in the ass not to log IPs by default, but if the end result is a weakening of the power of modern social media companies (and political and law enforcement agencies) to exploit people's data for nefarious ends without consequence, then society as a whole, and the web, benefit. Mind you, I don't necessarily believe GDPR is the solution, or that logging IPs is unreasonable, but I do welcome the conversation people seem to be having about who owns their identity.
Drakim 9y ago
It's pretty crazy to me that people can feel this way after things like the Equifax breach. Equifax was sitting on all that data that people didn't even know they were included in, and probably didn't even WANT Equifax to possess. But that's just business as usual, businesses are allowed to do things we consider morally wrong because that's just how things work. And the second a law springs up that helps out the little guy, it's a massive governmental overreach. How dare government actually try to help people, think of all the businesses they are hurting!
- morgante 9y ago
  You're using a non sequitur. Equifax is of course a massive data processor which should be regulated. Choosing to instead regulate every single person who even accidentally has an IP address in their logs somewhere is the overreach. This helps massive corporations (who can afford to comply) and hurts small businesses which cannot.
  - mpfundstein 9y ago
    I never really felt the need to store ips actually
    - tobltobs 9y ago
      You might not, but your webserver did. Or did you change the logging configuration of your webserver to not store or obfuscate IPs in the past?
      - pbhjpbhj 9y ago
        This law suggests a shift to assuming no consent for gathering of PII, only gathering data when you have informed consent and a justifiable business need. In the case of web servers I can't see a problem with not recording IP if you're also gathering PII; or asking for permission in the PII submission; or say dropping the last digits from a dotted-quad as a default.
scaryclam 9y ago
I work for a startup in the EU and will be affected by GDPR. It's a nuisance but not a disaster. In fact, any small company that really can't employ good enough processes to comply is probably doing something very, very wrong.
_o_ 9y ago
It is nice that you think that but actually startups have the least amount of problems regarding GDPR. You can start coding with GDPR in mind (privacy by design) and you will hardly have a lot of problems. Big companies have huge codebases and databases and they will have to integrate privacy into them which is FAR more complicated than any startup can even imagine. On the other side, if you are doing startup where you want to use privacy breaching as a business model, then you shouldnt exist in a first place, so no damage done.
s73v3r_ 9y ago
This is why I don't think it is. For far, far, far too long, startups have treated user data, privacy, and security as an afterthought. Now, they are going to be required to give consideration to those things. This can be nothing but a good thing. The age of "move fast and don't care about user data" is coming to a close, and all should be happy.

dogma1138 9y ago

I don't know why people were downvoting this. GDPR outside of the EU (for purely non-EU entities) is a non sequitur there are zero internal processes to make it work. Lets take the most basic example the GDPR does not apply in a vacuum it's enforced and supported by Data Protection Agencies (DPA) in each member state which are responsible to ensure that companies in those member states comply with EU regulation like the GDPR within the context of local laws and regulations. The DPA is responsible for the application of the GDPR within it's member state (and it's power is limited to that member state only but the GDPR does have a few venues for applying a local DPA directive across member state lines) it's also responsible for handling complaints in that state and it provides directives and advice to both law makers and the industry. If I'm a UK company and need to deal with the GDPR (till Brexit do us part) I work with the ICO which is the UK Data Protection Agency. While other DPA might affect me the ICO is my primary source of both advice and enforcement and any issues that might originate in another DPA would still pass through the ICO. Now I am a company in don't know where lets take Argentina I want to sell to EU customers which DPA do I answer too? which DPA to I ask for advice? How do I arbitrate complaints filed against me and to which DPA do I prove I handled data disclosure requests in a manner compliant with the GDPR? which DPA would know my local laws to ensure if my application with the GDPR was complaint with local data retention and lawful access laws? In fact other than going through my own state/trade department and organizations what venue do I have as a non-EU resident and a non-EU entity to any EU services and resources. The question to all of this is none as a non-EU company there is fuck all you can do even if you want to comply with the GDPR.

morgante 9y ago
Yup. It's crazy to me that this law is going into effect without even such basic questions being answered.
cdancette 9y ago
You should use more punctuation, your writing is very hard to read and understand (as a non native speaker)
- dogma1138 9y ago
  Yeah sorry writing on an iPhone is a makes it a bit hard.
dspillett 9y ago
> UK company and need to deal with the GDPR (till Brexit do us part) Brexit will make little or no difference unless you refuse to deal with EU citizens in any way the involves you having access to their PII or storing any information about them (including traces of their activity in your product/app/site. GDPR will be carried over post-brexit, and even if it is later revoked by act of parliament and not replaced by something equivalent you'll still need to deal with it if you want to trade with EU citizens. If the UK refused to play ball and somehow blocked us from the punishments for non-compliance we will face inconvenient sanction by other means. GDPR isn't perfect (is any regulation?) and their are certainly significant questions to be answered from the PoV of people operating outside the EU, and even some issues that may still require more clarity for those entirely operating here, but I wholeheartedly welcome it (UK citizen here, FWIW) despite being a data specialist and therefore having a bad nervous-twitch reaction to any idea of a non-soft delete operation!
- dogma1138 9y ago
  That was a joke, the ICO will continue post Brexit I have no problems from the UK. The GDPR isn't perfect it's just none workable for companies that are not in the EU.
trumpeta 9y ago
I'm not a lawyer, but I would think your Argentina company can be in one of 2 states: 1. You have a subsidiary in EU, in which case that is who will get fined or will have to deal with the DPA where it is registered 2. You don't, in which case the EU can not fine you?
- morgante 9y ago
  I don't think any of this is entirely clear, but from my understanding it seems like the EU wants to apply GDPR even if you don't have an EU presence. In practice, I doubt that they'd get the US to enforce judgements. But it might mean that I can never risk going to Europe again lest I risk having a default judgement enforced against me for one of my businesses.
  - pbhjpbhj 9y ago
    If your store front is accessible to EU based citizens then you have an EU presence.
    - dogma1138 9y ago
      No if you aren’t a legal entity in the EU you have no presence in the EU. If you would push for this the only thing that would happen is that companies would stop accepting orders from the EU. If this is going to be the definition expect a lot of store fronts to be closed to EU residents following May 25th or more likely the first time this precedence will be set in court.
      - pbhjpbhj 9y ago
        It seems a direct parallel of being tried for copyright infringement in USA when you have an offshore website - like O'Dwyer who had to bribe himself out of being extradited from UK to face charges of copyright infringement in USA. He'd never been there, didn't have servers there, and was acting legally in his jurisdiction of residence. Similar things happened with USA's actions on Silk Road, KAT, with Kim Dotcom, and I'm sure many other legal situations I'm not aware of. EU is seemingly extending logical contact to be equivalent to entry to a jurisdiction as USA appear to have established is desirable as a facet of inter-national application of law in the internet age. I much prefer the extension of jurisdiction in protection of member states citizens rights than in the service of media conglomerates.
Spearchucker 9y ago
You use the legislation to guide your internal processes, systems and employee/user education. You ask your legal counsel for advise. Other than what you'd normally do anyway, you'd provide evidence of disclosure only to the DPA that asks. The DPA doesn't care about your local laws - seek local legal counsel instead. To a developer used to systems thinking this should not be rocket science. Most of it is just good practice. Kim Cameron came up with the laws of identity many years ago, which the GDPR is surprisingly similar to.
- dogma1138 9y ago
  DPA cares for local laws the GDPR does not trump local EU legislation. What court do you use to appeal a complaint or a fine? There are no processes at all for a non-EU entity to function within the GDPR and saying it’s not rocket science isn’t going to change that.
  - Spearchucker 9y ago
    If the ICO (UK) issued a fine, you wouldn't appeal in Spain, would you? Because of course you respond to the DPA that issued the fine or complaint. Am I not understanding your question?
    - dogma1138 9y ago
      We’re not talking about EU companies or entities but non-EU ones. In case of the EU you have your own local DPA other DPA local courts and high courts to appeal too and or work with. As a non-EU entity you get nothing.
      - pbhjpbhj 9y ago
        You get the courts that the person you're servicing uses. Like when you sell to someone in a particular country and have to abide by their sales and tax laws.
        9y ago
vageli 9y ago
So, given that there's no DPA in the US (as far as I'm aware, there are also none in China, India, Australia, etc), how would the GDPR be enforced against an entity with no physical presence in the EU?
- dogma1138 9y ago
  On paper it can’t. In practice since the EU expects EU entities to essentially mandate GDPR compliance form their non-EU partners in order to be complaint it’s is pretty simple at least for ecommerce. PayPal could tell you you must comply to accept payments form the EU and likely in the same manner they handle everything which means no guidance, benchmarks or clear directions and it would be up to you to figure it out. By PayPal I don’t mean just PayPal but any other payment processor or service provider which you are dependent on.

nomercy400 9y ago

You suggest an exemption for startups? Wait until a Facebook decides to buy all their 'analytics' from a small startup they funded, basically circumventing the whole GDPR.

morgante 9y ago
Laws are not code. You could have the exemption be based on the number of individuals whose data is processed, for example: Facebook can use as many shells as they want, but they'd still need to comply if they want to look at their massive user base, but my small business with a few dozen customers wouldn't need to worry.

the-dude 9y ago

If it is so typical, multiple examples please.

return1 9y ago
without trying to be harsh to EU, they do have a bad record. 2 examples: Cookie Law, EU VAT (by common admission it is a system that is impossible to implement correctly)

philipps 9y ago

In light of recent revelations about the way social media companies treat their users’ data and privacy, strong regulation is not “overreach” but “overdue”.

morgante 9y ago
The law could have easily been tailored to target large social media companies. Instead it applies to everyone, including tiny businesses who accidentally have one European visitor. I'm strongly considering simply taking down all my old blogs/sites because it's far too much work to deal with GDPR for anything less than a medium-sized business.
- vincnetas 9y ago
  And then huge media company just creates small subsidiary (tiny business) to "accidentally" collect personal information. Got caught? No problem, close that one, open another...
  - dannyw 9y ago
    There are plenty of laws and legal instruments / concepts (controlling stake, anti-avoidance laws, etc) that stop large companies from doing this.
  - morgante 9y ago
    And that is just as "possible" under the current structure of GDPR.
    - pilsetnieks 9y ago
      Not really. For example, if Facebook Inc. establishes a "Totally not FB LLC" for the purpose of skirting GDPR, Facebook Inc. is still the data controller according to the law, as it is directing the data collection and purpose, even if "Totally not FB LLC" does all of the handling as a data processor. Except now the fine is levied on the total turnover of both companies, not just one.

shawa_a_a 9y ago

What aspects of the law are disastrous for startups? What startups might see as a "massive regulatory burden", I see it as, at long last, a means of finally holding irresponsible companies to account. The spirit of the law is really quite simple; my personal data is an extension of me, and if you want to store or process it, you need a legal basis for doing so, and need to be able to demonstrate this legal basis to me. If your startup is at odds with this, well then perhaps you're not the kind of company the EU wants to be doing business with.

morgante 9y ago
The scope of personal data is disastrously large and the guidance is fuzzy at best. Take, for example, my old blog. It has commenting enabled and a standard Apache config (where logs include IP addresses). If I want to comply with GDPR, I have to do a bunch of work around log rotation/encryption, provide tools for old commenters to go back and remove their information, and this is even the simple case that I'm not using any 3rd-party analytics. No part of my "business model" is attempting to profit from personal data yet I have to jump through a bunch of new hoops. My likely solution for projects is to simply block EU traffic going forward.
- damontal 9y ago
  For Apache can't you just change LogFormat to exclude IPs and delete the old logs?
- rplnt 9y ago
  IP by itself is not considered private. It's only when you attach it to other identifying data. Anonymous comments are not covered with GDPR.
  - wastedhours 9y ago
    However, is it not thought that because the ISP keeps a log of dynamic IP addresses, these could (in theory) be matched to the IP address of anonymous comments, thus de-anonymise them?

DanBC 9y ago

> It's a massive regulatory burden which big companies will be able to comply with but small startups don't have the legal horsepower to handle. Where's the burden? Only collect the data you need; tell people what you're collecting and why; only keep it for as long as you need; keep it safe. These are not burdens.

emiliobumachar 9y ago
They have provided a real-world example elsewhere in the thread. It really seems to support their point: "Take, for example, my old blog. It has commenting enabled and a standard Apache config (where logs include IP addresses). If I want to comply with GDPR, I have to do a bunch of work around log rotation/encryption, provide tools for old commenters to go back and remove their information, and this is even the simple case that I'm not using any 3rd-party analytics."
- mpfundstein 9y ago
  He can also just choose to not log ip addresses.
  - morgante 9y ago
    Not logging IPs makes debugging and abuse detection much more challenging. Moreover, it is also the current default in most software which touches HTTP requests.
    - krapp 9y ago
      We could make it easier for states to find and prosecute criminals by not requiring warrants and making encryption illegal, but we don't (and we shouldn't) because the peoples' rights are inalienable, whereas the rights of states, corporations and other entities to interfere with that privacy are not. Yes, it would be more challenging, and inconvenient, and probably a massive pain in the ass not to log IPs by default, but if the end result is a weakening of the power of modern social media companies (and political and law enforcement agencies) to exploit people's data for nefarious ends without consequence, then society as a whole, and the web, benefit. Mind you, I don't necessarily believe GDPR is the solution, or that logging IPs is unreasonable, but I do welcome the conversation people seem to be having about who owns their identity.

Drakim 9y ago

It's pretty crazy to me that people can feel this way after things like the Equifax breach. Equifax was sitting on all that data that people didn't even know they were included in, and probably didn't even WANT Equifax to possess. But that's just business as usual, businesses are allowed to do things we consider morally wrong because that's just how things work. And the second a law springs up that helps out the little guy, it's a massive governmental overreach. How dare government actually try to help people, think of all the businesses they are hurting!

morgante 9y ago
You're using a non sequitur. Equifax is of course a massive data processor which should be regulated. Choosing to instead regulate every single person who even accidentally has an IP address in their logs somewhere is the overreach. This helps massive corporations (who can afford to comply) and hurts small businesses which cannot.
- mpfundstein 9y ago
  I never really felt the need to store ips actually
  - tobltobs 9y ago
    You might not, but your webserver did. Or did you change the logging configuration of your webserver to not store or obfuscate IPs in the past?
    - pbhjpbhj 9y ago
      This law suggests a shift to assuming no consent for gathering of PII, only gathering data when you have informed consent and a justifiable business need. In the case of web servers I can't see a problem with not recording IP if you're also gathering PII; or asking for permission in the PII submission; or say dropping the last digits from a dotted-quad as a default.

scaryclam 9y ago

I work for a startup in the EU and will be affected by GDPR. It's a nuisance but not a disaster. In fact, any small company that really can't employ good enough processes to comply is probably doing something very, very wrong.

_o_ 9y ago

It is nice that you think that but actually startups have the least amount of problems regarding GDPR. You can start coding with GDPR in mind (privacy by design) and you will hardly have a lot of problems. Big companies have huge codebases and databases and they will have to integrate privacy into them which is FAR more complicated than any startup can even imagine. On the other side, if you are doing startup where you want to use privacy breaching as a business model, then you shouldnt exist in a first place, so no damage done.

s73v3r_ 9y ago

This is why I don't think it is. For far, far, far too long, startups have treated user data, privacy, and security as an afterthought. Now, they are going to be required to give consideration to those things. This can be nothing but a good thing. The age of "move fast and don't care about user data" is coming to a close, and all should be happy.