10 ms·

As far as I understand, to make this site GDPR compliant you would have to: 1. Get consent when someone creates an account, saying what you do with the data in

As far as I understand, to make this site GDPR compliant you would have to: 1. Get consent when someone creates an account, saying what you do with the data including how you make automatic decision (e.g. which amazon pages you recommend). 2. Allow people to unconsent/delete accounts 3. Have a page that allows a user to download their data. 4. Have a way for them to fix mistakes in that information That doesn't seem that burdensome. In fact some flavor of that is pretty much what you get with standard a standard create account/view account/change account/delete account workflow.

hidiegomariani 8y ago
I agree, this guy seems just to cry with no clear reason whatsoever
- HenryBemis 8y ago
  The guy apart from crying without ever having read those 80 pages (english language text), doesn't see the big picture. The fact that I can force Facebook, Google, etc. to tell me what they are doing with my data (which I btw had given consent to treat like yesterday's newspaper), and subsequently asking the various Cambridge Analytica's the same question, gives the people a power they never had. Now they do. He wants to leave the game? Feel free! He wants people to be completely powerless? Well.. the kitchen has a door. Feel free to open and leave if it gets too hot.
  - WillPostForFood 8y ago
    This is the classic unintended effect of this kind of regulation. It is harder for small and new companies to comply and crowds them out, further entrenching the power and control of Facebook and Google.
    - CrLf 8y ago
      Actually, it's easier for small and especially new companies to comply. Now, maybe they don't want to, but I don't feel any kind of sympathy for cost cutting on my privacy. What you say it's an unintended side effect, I think is very much intended. That's why the GDPR (if it doesn't fail for other reasons) is a very welcome regulation.
    - wyattpeak 8y ago
      That's true, but frankly I'd rather that the large companies I already deal with be forced to interact on better terms than encourage competition by well-meaning startups. Once upon a time Facebook was the fresh new competition. Once upon a time Google took pains to maintain their "Don't be evil" motto. Everyone starts out starry-eyed, keen to destroy the oppressive incumbent. Very few stay that way.
    - acct1771 8y ago
      Dig into the finance compliance fight instead, this is the wrong hill to die on.
    - pwtweet 8y ago
      "It is harder for small and new companies to comply and crowds them out" Show us some proof the GDPR is harder for small and new businesses to comply.
    - pilsetnieks 8y ago
      Yes, regulation changes. Companies that infringe consumer privacy cannot continue business as usual and will be hurt. It's a good thing. McDonald's has it easier to comply with food safety regulations than the cozy mom and pop cafe down the street. Would you be willing to shit your guts out because the ambiance is better there?
      - aeorgnoieang 8y ago
        > McDonald's has it easier to comply with food safety regulations than the cozy mom and pop cafe down the street. Would you be willing to shit your guts out because the ambiance is better there? People cooking for themselves at home aren't required to comply with (the same) food safety regulations. Obviously, you never eat at home or at the home of a friend or relative either, right?
        pilsetnieks 8y ago
        Similarly how food safety regulations don't apply to people's homes, neither does GDPR. It does not apply to processing personal data for personal usage. People collecting phone numbers in their personal phonebooks aren't required to comply with data security and privacy regulations.
  - rdlecler1 8y ago
    So the answer is a blanket law that affects all startups big and small. Think Google & Facebook are going to go out of business because of this? No. Think it’s going to be more difficult and risky for startups?
    - rimliu 8y ago
      How it is going to be difficult for startups? They just need to implement proper practices right from the start.
      - rdlecler1 8y ago
        You clearly don’t run a startup that is affected by these rules. Use cookie? Use Google analytics? Have emails and passwords? Send email to your userlist? Now figure out all the legal consent language, and write your own privacy policy that doesn’t get you a $20m fine for running a blog...
  - fogzen 8y ago
    How does knowing what data Facebook has on you change anything? You already know the data they have by virtue of the fact that you give it to them. I just don’t get what damage this protects you from?
    - scottie_m 8y ago
      What about the data they have on people without accounts on their service, but who they track across sites and through friends? I can keep myself from having an account, but I can’t stop my family and friends, and I can only do my best to block their trackers. I’d like to know what shadow profiles they have on me, despite the fact that I gave them nothing.
      - fogzen 8y ago
        How does knowing they have shadow profiles (if they do) help you? What damage is that knowledge protecting you from?
        scottie_m 8y ago
        To be clear before I answer, you’re acknowledging that this isn’t actually just about data willingly given, right? What does it change? Not much just by knowing, but it can allow for change, including exercising a right to delete that data under GDPR. That is a positive change in my opinion.
        fogzen 8y ago
        Having data on someone doesn’t constitute any kind of damage. So I don’t understand how I benefit from this at all. If my data is hacked, I’m not compensated. If my data is misused, I’m not compensated. Nothing has really changed to protect me from actual damages resulting from personal data collection. But apparently lots of small businesses and startups are now hurt, and Facebook is in a stronger position to collect PII.
        8y ago
- typicalbender 8y ago
  This is an incredibly unfair conclusion. Beyond the time it would make it to make the actual technical changes, he's right in saying that GDPR is written in a very ambiguous way that is going to open up the possibility of litigation that smaller shops will not be equipped to absorb. He's made a calculated decision that for him personally it is not worth the additional legal/financial risk to continue operating the business. GDPR is complicated and we dont know what the enforcement side is going to look like yet.
  - dnomad 8y ago
    It's really funny because the blog post is far more ambiguous than the GDPR. He cites no specific provision of the GDPR, he doesn't quote the law, all he does is offer up the big scary $20m number. It's pure FUD. But since we're throwing out wild speculations it's more than possible this guy was doing something really shady. (He admits to affiliate links which are perfectly fine under GDPR). There would definitely be a market for user data even about who's borrowing what, where. Certainly the vast majority of these "the GDPR killed our free business" are precisely these shady businesses who knew they were dead anyways if they had to actually ask their users for consent in plain language.
  - salvar 8y ago
    What kind of litigation is made more possible with GDPR?
lucb1e 8y ago
Saying that some data that you enter will be shared with Amazon, doesn't seem all that far from reasonable expectations and shouldn't need to be codified in law anyway. So number 1 should be there already. Number 2 could be an "email me if you want your account removed". This will trigger like two emails a year, and you just run a DELETE FROM command. If it becomes more, you make a page. For numbers 3 and 4, see number 2. I expect that this won't be much either. The page doesn't mention a single thing that would be a good reason to quit over GDPR. I think the author was looking for a reasonable-sounding exit, especially since he was operating at a loss (and apparently cared about it, since he was cooperating with Amazon to begin with). What were the previous data protection laws in the UK anyway? In the Netherlands, none of the 4 points above are new. Our data protection law from 2001 also required all of this.
- djsumdog 8y ago
  Poster indicated they weren't making money on it. If you're already operating at a loss and have been for years, the GDPR can be an easy way out .. and if you're literally not making anything and working a full time gig, any changes (even these seemingly trivial ones) do increase the burden to where it's probably not worth it. So the owner might be making an excuse, yes, but I don't blame them as it seems like a legit way out if they wanted to close up.
  - jcims 8y ago
    Why is it so difficult to take what the site owner says st face value?
- strken 8y ago
  It's just some guy's side project. He probably doesn't make any money on it, doesn't care about the tech stack (which is from 2013), doesn't want to pay a lawyer for advice, and couldn't be bothered working out how to package all the data for release to users. If you administer a free service that takes an hour a month to keep running, and suddenly you're faced with an immediate upfront time cost plus the likelihood of spending many more hours every few months responding to user requests, shutting your service down might be a rational decision when you would otherwise have kept it running.
awalton 8y ago
You know, until someone opportunistically sues you using a legal firm that costs the plaintiff nothing, and then you're out the cost of getting a lawyer and trying to defend that all of your actions and interpretations of the GDPR are correct. And if your business is already small/not making money, you're adding to the hole you're already in. Which, you know, the guy directly cites as the reason he's shutting down if you actually read the site. There's plenty of ambiguity in the GDPR, especially around logging, backups, and third parties (e.g. login through Facebook/Twitter/Google, you know, that thing that five years ago everyone was trying to sell at the way to do user authentication). This guy just decided it's not worth the potential of being sued while we wait for the dust to settle on how those ambiguities shake out (because, honestly, the only way we're going to get those cleared up is if someone is sued and they're made clear by case law).
- bloopernova 8y ago
  Do you know of a good place to read about the GDPR and backups? My concern has been the account deletion provision. Does the GDPR expect us to be able to go back and modify past backups? Years-old tape archives?
  - jopsen 8y ago
    Good question.. I would guess there is no requirement data is wiped. Your file system doesn't wipe data, it just marks it as deleted. At some point it's a technicality, the important part is that you stop using the data. I suspect intent matters more than technicality.
  - lmkg 8y ago
    I get the impression the GDPR expects you to not keep data around forever, as a general best practice. When you collect data, you have to tell your users at collection what your retention policy is (this is part of Right to Transparency). So, right there, you should probably have a retention policy, and "forever, always" isn't really a well-thought-out policy. The Right to Erasure is not as far-reaching as some people seem to think it is. If the Legal Basis of the data collection is Consent, then that consent is revocable and processing (including storage) pretty much has to end as soon as consent is revoked. But if the Legal Basis of collecting the data is something else, and I really feel like 90% of the time in practice it's going to be Legitimate Interest, then the Data Controller gets to balance their own needs against the rights of the Data Subject when handling a Right to Erasure or Right to Object request. And you can probably make a good argument that you don't need to modify back-ups. Your argument is stronger if a) your restore-from-back-up procedure can ignore or delete the user's data during/after restore b) your data retention policy eventually deletes the back-up.
cdjk 8y ago
It's more complicated than that. Want to host the data on aws? You need a documented data processor agreement with them. Same thing with cloudflare and any other service you might want to use. Want to use google analytics or some other javascript? Those cookies aren't required so you need a way to let users opt-in to using those cookies. And opt-out and delete any third party cookies. I'm still not clear on how the regulations expect you to delete third party cookies. Amazon affiliate links also aren't necessary to use the service, and that sets cookies. Have to get consent before users can click on those links. Don't forget that ip addresses are considered personal data. And all of this might have to be written down and documented per Article 30 as well. The organization is smaller than 250 people, so that might be an out, but people are using the site daily so one could argue the processing is not occasional.
- EGreg 8y ago
  What is a good primer and checklist on this law?
- ec109685 8y ago
  Be careful about interpreting the law if you aren’t a lawyer: 1) IP addressed aren’t a personal identifier since more than one person can use the same IP 2) Google analytics is a processor of data and the general consent you get from your users can grant you the ability to use google analytics since its use helps you enhance the site and make a better user experience 3) You need a data processor agreement to provide access to data that the processor has collected on your user’s behalf. Given you run your aws services, that should be straightforward to provide access.
  - emidln 8y ago
    If IPs aren’t personal because more than one person can have them, how is the name John Smith a piece of personal information? Anyone can have that name and a lot of people do have that name.
    - ec109685 8y ago
home_boi 8y ago
That's a solid 50 hours of engineering and QA. At a $75/hr contracting rate, that is $3,750 (50 * $75/hr). And that's just the engineering work. The website owner cannot know whether or not the engineering work and website meets the requirements of GDPR by himself. He does not have the ability to interpret the GDPR policies. The website owner would need to consult with a compliance lawyer or expert to assess the website for compliance. I would guess it would take a lawyer 10 hours at minimum (assuming the lawyer is a GDPR expert and already knows GDPR in and out) to assess a website for GDPR compliance, billed at a low $250/hr is $2500.
landryraccoon 8y ago
Are you going to purge all your logs of IP addresses, since those are considered personal information too? Also if your website is ad supported in any way, are you sure they are in compliance, or will you get nailed because your ad provider wasn't completely compliant? https://www.ctrl.blog/entry/gdpr-web-server-logs https://www.ctrl.blog/entry/gdpr-web-server-logs "All of these logs contains personal information by default under the new regulation. IP addresses are specifically defined as personal data per Article 4, Point 1; and Recital 49. The logs can also contain usernames if your web service use them as part of their URL structure, and even the referral information that is logged by default can contain personal information (e.g. unintended collection of sensitive data; like being referred from a sensitive-subject website). If you don’t have a legitimate need to store these logs you should disable logging in your web server. You’re not even allowed to store this type of information without having obtained direct consent for the purposes you intend to store the information" Are you going to either 1) completely disable logging on your webserver or 2) ask for consent just to use a default Apache/Nginx logging configuration? The law makes no technical sense.
- ec109685 8y ago
  You can ask for consent (a trap page) and block access if they don’t give it to you since you need access logs to operate the site.
  - ec109685 8y ago
    E.g. https://mobile.twitter.com/johnnyryan/status/993827965594202112 https://mobile.twitter.com/johnnyryan/status/993827965594202...
- matthewmacleod 8y ago
  Did you miss the whole part of that blog post that talks about legitimate interest?
- acdha 8y ago
  > Are you going to either 1) completely disable logging on your webserver or 2) ask for consent just to use a default Apache/Nginx logging configuration? The law makes no technical sense. 3) Change your webserver not to store IPs or to delete them relatively quickly? The default Apache/Nginx configurations aren't suitable for production in many other ways but most distributions ship them with log rotation enabled which would prevent this from being a problem in the default install.
dominotw 8y ago
Sorry for asking this,What is "their data". Ipadresses, page visit history ?
dleslie 8y ago
How does one revoke consent from an immutable interaction log, like a blockchain or distributed version control system? You don't.
hartator 8y ago
It’s worth noting that HN doesn’t comply to any of the 4 points. Should we should it down? I don’t think so.

hidiegomariani 8y ago

I agree, this guy seems just to cry with no clear reason whatsoever

HenryBemis 8y ago
The guy apart from crying without ever having read those 80 pages (english language text), doesn't see the big picture. The fact that I can force Facebook, Google, etc. to tell me what they are doing with my data (which I btw had given consent to treat like yesterday's newspaper), and subsequently asking the various Cambridge Analytica's the same question, gives the people a power they never had. Now they do. He wants to leave the game? Feel free! He wants people to be completely powerless? Well.. the kitchen has a door. Feel free to open and leave if it gets too hot.
- WillPostForFood 8y ago
  This is the classic unintended effect of this kind of regulation. It is harder for small and new companies to comply and crowds them out, further entrenching the power and control of Facebook and Google.
  - CrLf 8y ago
    Actually, it's easier for small and especially new companies to comply. Now, maybe they don't want to, but I don't feel any kind of sympathy for cost cutting on my privacy. What you say it's an unintended side effect, I think is very much intended. That's why the GDPR (if it doesn't fail for other reasons) is a very welcome regulation.
  - wyattpeak 8y ago
    That's true, but frankly I'd rather that the large companies I already deal with be forced to interact on better terms than encourage competition by well-meaning startups. Once upon a time Facebook was the fresh new competition. Once upon a time Google took pains to maintain their "Don't be evil" motto. Everyone starts out starry-eyed, keen to destroy the oppressive incumbent. Very few stay that way.
  - acct1771 8y ago
    Dig into the finance compliance fight instead, this is the wrong hill to die on.
  - pwtweet 8y ago
    "It is harder for small and new companies to comply and crowds them out" Show us some proof the GDPR is harder for small and new businesses to comply.
  - pilsetnieks 8y ago
    Yes, regulation changes. Companies that infringe consumer privacy cannot continue business as usual and will be hurt. It's a good thing. McDonald's has it easier to comply with food safety regulations than the cozy mom and pop cafe down the street. Would you be willing to shit your guts out because the ambiance is better there?
    - aeorgnoieang 8y ago
      > McDonald's has it easier to comply with food safety regulations than the cozy mom and pop cafe down the street. Would you be willing to shit your guts out because the ambiance is better there? People cooking for themselves at home aren't required to comply with (the same) food safety regulations. Obviously, you never eat at home or at the home of a friend or relative either, right?
      - pilsetnieks 8y ago
        Similarly how food safety regulations don't apply to people's homes, neither does GDPR. It does not apply to processing personal data for personal usage. People collecting phone numbers in their personal phonebooks aren't required to comply with data security and privacy regulations.
- rdlecler1 8y ago
  So the answer is a blanket law that affects all startups big and small. Think Google & Facebook are going to go out of business because of this? No. Think it’s going to be more difficult and risky for startups?
  - rimliu 8y ago
    How it is going to be difficult for startups? They just need to implement proper practices right from the start.
    - rdlecler1 8y ago
      You clearly don’t run a startup that is affected by these rules. Use cookie? Use Google analytics? Have emails and passwords? Send email to your userlist? Now figure out all the legal consent language, and write your own privacy policy that doesn’t get you a $20m fine for running a blog...
- fogzen 8y ago
  How does knowing what data Facebook has on you change anything? You already know the data they have by virtue of the fact that you give it to them. I just don’t get what damage this protects you from?
  - scottie_m 8y ago
    What about the data they have on people without accounts on their service, but who they track across sites and through friends? I can keep myself from having an account, but I can’t stop my family and friends, and I can only do my best to block their trackers. I’d like to know what shadow profiles they have on me, despite the fact that I gave them nothing.
    - fogzen 8y ago
      How does knowing they have shadow profiles (if they do) help you? What damage is that knowledge protecting you from?
      - scottie_m 8y ago
        To be clear before I answer, you’re acknowledging that this isn’t actually just about data willingly given, right? What does it change? Not much just by knowing, but it can allow for change, including exercising a right to delete that data under GDPR. That is a positive change in my opinion.
        fogzen 8y ago
        Having data on someone doesn’t constitute any kind of damage. So I don’t understand how I benefit from this at all. If my data is hacked, I’m not compensated. If my data is misused, I’m not compensated. Nothing has really changed to protect me from actual damages resulting from personal data collection. But apparently lots of small businesses and startups are now hurt, and Facebook is in a stronger position to collect PII.
        8y ago
typicalbender 8y ago
This is an incredibly unfair conclusion. Beyond the time it would make it to make the actual technical changes, he's right in saying that GDPR is written in a very ambiguous way that is going to open up the possibility of litigation that smaller shops will not be equipped to absorb. He's made a calculated decision that for him personally it is not worth the additional legal/financial risk to continue operating the business. GDPR is complicated and we dont know what the enforcement side is going to look like yet.
- dnomad 8y ago
  It's really funny because the blog post is far more ambiguous than the GDPR. He cites no specific provision of the GDPR, he doesn't quote the law, all he does is offer up the big scary $20m number. It's pure FUD. But since we're throwing out wild speculations it's more than possible this guy was doing something really shady. (He admits to affiliate links which are perfectly fine under GDPR). There would definitely be a market for user data even about who's borrowing what, where. Certainly the vast majority of these "the GDPR killed our free business" are precisely these shady businesses who knew they were dead anyways if they had to actually ask their users for consent in plain language.
- salvar 8y ago
  What kind of litigation is made more possible with GDPR?

lucb1e 8y ago

Saying that some data that you enter will be shared with Amazon, doesn't seem all that far from reasonable expectations and shouldn't need to be codified in law anyway. So number 1 should be there already. Number 2 could be an "email me if you want your account removed". This will trigger like two emails a year, and you just run a DELETE FROM command. If it becomes more, you make a page. For numbers 3 and 4, see number 2. I expect that this won't be much either. The page doesn't mention a single thing that would be a good reason to quit over GDPR. I think the author was looking for a reasonable-sounding exit, especially since he was operating at a loss (and apparently cared about it, since he was cooperating with Amazon to begin with). What were the previous data protection laws in the UK anyway? In the Netherlands, none of the 4 points above are new. Our data protection law from 2001 also required all of this.

djsumdog 8y ago
Poster indicated they weren't making money on it. If you're already operating at a loss and have been for years, the GDPR can be an easy way out .. and if you're literally not making anything and working a full time gig, any changes (even these seemingly trivial ones) do increase the burden to where it's probably not worth it. So the owner might be making an excuse, yes, but I don't blame them as it seems like a legit way out if they wanted to close up.
- jcims 8y ago
  Why is it so difficult to take what the site owner says st face value?
strken 8y ago
It's just some guy's side project. He probably doesn't make any money on it, doesn't care about the tech stack (which is from 2013), doesn't want to pay a lawyer for advice, and couldn't be bothered working out how to package all the data for release to users. If you administer a free service that takes an hour a month to keep running, and suddenly you're faced with an immediate upfront time cost plus the likelihood of spending many more hours every few months responding to user requests, shutting your service down might be a rational decision when you would otherwise have kept it running.

awalton 8y ago

You know, until someone opportunistically sues you using a legal firm that costs the plaintiff nothing, and then you're out the cost of getting a lawyer and trying to defend that all of your actions and interpretations of the GDPR are correct. And if your business is already small/not making money, you're adding to the hole you're already in. Which, you know, the guy directly cites as the reason he's shutting down if you actually read the site. There's plenty of ambiguity in the GDPR, especially around logging, backups, and third parties (e.g. login through Facebook/Twitter/Google, you know, that thing that five years ago everyone was trying to sell at the way to do user authentication). This guy just decided it's not worth the potential of being sued while we wait for the dust to settle on how those ambiguities shake out (because, honestly, the only way we're going to get those cleared up is if someone is sued and they're made clear by case law).

bloopernova 8y ago
Do you know of a good place to read about the GDPR and backups? My concern has been the account deletion provision. Does the GDPR expect us to be able to go back and modify past backups? Years-old tape archives?
- jopsen 8y ago
  Good question.. I would guess there is no requirement data is wiped. Your file system doesn't wipe data, it just marks it as deleted. At some point it's a technicality, the important part is that you stop using the data. I suspect intent matters more than technicality.
- lmkg 8y ago
  I get the impression the GDPR expects you to not keep data around forever, as a general best practice. When you collect data, you have to tell your users at collection what your retention policy is (this is part of Right to Transparency). So, right there, you should probably have a retention policy, and "forever, always" isn't really a well-thought-out policy. The Right to Erasure is not as far-reaching as some people seem to think it is. If the Legal Basis of the data collection is Consent, then that consent is revocable and processing (including storage) pretty much has to end as soon as consent is revoked. But if the Legal Basis of collecting the data is something else, and I really feel like 90% of the time in practice it's going to be Legitimate Interest, then the Data Controller gets to balance their own needs against the rights of the Data Subject when handling a Right to Erasure or Right to Object request. And you can probably make a good argument that you don't need to modify back-ups. Your argument is stronger if a) your restore-from-back-up procedure can ignore or delete the user's data during/after restore b) your data retention policy eventually deletes the back-up.

cdjk 8y ago

It's more complicated than that. Want to host the data on aws? You need a documented data processor agreement with them. Same thing with cloudflare and any other service you might want to use. Want to use google analytics or some other javascript? Those cookies aren't required so you need a way to let users opt-in to using those cookies. And opt-out and delete any third party cookies. I'm still not clear on how the regulations expect you to delete third party cookies. Amazon affiliate links also aren't necessary to use the service, and that sets cookies. Have to get consent before users can click on those links. Don't forget that ip addresses are considered personal data. And all of this might have to be written down and documented per Article 30 as well. The organization is smaller than 250 people, so that might be an out, but people are using the site daily so one could argue the processing is not occasional.

EGreg 8y ago
What is a good primer and checklist on this law?
ec109685 8y ago
Be careful about interpreting the law if you aren’t a lawyer: 1) IP addressed aren’t a personal identifier since more than one person can use the same IP 2) Google analytics is a processor of data and the general consent you get from your users can grant you the ability to use google analytics since its use helps you enhance the site and make a better user experience 3) You need a data processor agreement to provide access to data that the processor has collected on your user’s behalf. Given you run your aws services, that should be straightforward to provide access.
- emidln 8y ago
  If IPs aren’t personal because more than one person can have them, how is the name John Smith a piece of personal information? Anyone can have that name and a lot of people do have that name.
  - ec109685 8y ago

home_boi 8y ago

That's a solid 50 hours of engineering and QA. At a $75/hr contracting rate, that is $3,750 (50 * $75/hr). And that's just the engineering work. The website owner cannot know whether or not the engineering work and website meets the requirements of GDPR by himself. He does not have the ability to interpret the GDPR policies. The website owner would need to consult with a compliance lawyer or expert to assess the website for compliance. I would guess it would take a lawyer 10 hours at minimum (assuming the lawyer is a GDPR expert and already knows GDPR in and out) to assess a website for GDPR compliance, billed at a low $250/hr is $2500.

landryraccoon 8y ago

Are you going to purge all your logs of IP addresses, since those are considered personal information too? Also if your website is ad supported in any way, are you sure they are in compliance, or will you get nailed because your ad provider wasn't completely compliant? https://www.ctrl.blog/entry/gdpr-web-server-logs https://www.ctrl.blog/entry/gdpr-web-server-logs "All of these logs contains personal information by default under the new regulation. IP addresses are specifically defined as personal data per Article 4, Point 1; and Recital 49. The logs can also contain usernames if your web service use them as part of their URL structure, and even the referral information that is logged by default can contain personal information (e.g. unintended collection of sensitive data; like being referred from a sensitive-subject website). If you don’t have a legitimate need to store these logs you should disable logging in your web server. You’re not even allowed to store this type of information without having obtained direct consent for the purposes you intend to store the information" Are you going to either 1) completely disable logging on your webserver or 2) ask for consent just to use a default Apache/Nginx logging configuration? The law makes no technical sense.

ec109685 8y ago
You can ask for consent (a trap page) and block access if they don’t give it to you since you need access logs to operate the site.
- ec109685 8y ago
  E.g. https://mobile.twitter.com/johnnyryan/status/993827965594202112 https://mobile.twitter.com/johnnyryan/status/993827965594202...
matthewmacleod 8y ago
Did you miss the whole part of that blog post that talks about legitimate interest?
acdha 8y ago
> Are you going to either 1) completely disable logging on your webserver or 2) ask for consent just to use a default Apache/Nginx logging configuration? The law makes no technical sense. 3) Change your webserver not to store IPs or to delete them relatively quickly? The default Apache/Nginx configurations aren't suitable for production in many other ways but most distributions ship them with log rotation enabled which would prevent this from being a problem in the default install.

dominotw 8y ago

Sorry for asking this,What is "their data". Ipadresses, page visit history ?

dleslie 8y ago

How does one revoke consent from an immutable interaction log, like a blockchain or distributed version control system? You don't.

hartator 8y ago

It’s worth noting that HN doesn’t comply to any of the 4 points. Should we should it down? I don’t think so.