8 ms·

The GDPR is about 68 to 90 pages depending on which language you're reading it in. It is trying to be futureproof by leaving measures defined in terms of 'curre

The GDPR is about 68 to 90 pages depending on which language you're reading it in. It is trying to be futureproof by leaving measures defined in terms of 'current state of technology', 'reasonable security considering the risk' and other such ambiguous terms. I run a small business and I like this. Just about anybody can read it and understand what rights and requirements are being set out in it. The GDPR specifically refers to the concept of "micro, small and medium-sized enterprises" [GDPR 40p1 and 42p1 use this text; they direct member states about the spirit of the law, referring that the needs of such businesses need to be taken into account]. GDPR 58p2 sets out that regulatory bodies in a member state have the power to issue warnings. As in, if you mess up, unless the mess-up is malicious or excessively negligent, you get a written warning and reasonable time to fix the problem. My government (The Netherlands) has taken the effort, as have a significant number of third parties, of creating a legal document of 3 to 10 pages covering some details, and they generally set out more explicitly that you grant yourself a week or so to fix problems without penalty. Whilst the GDPR is intentionally ambiguous in order to try to be somewhat futureproof and remain short enough to read back to back in an afternoon, it's fairly clear this is perfectly fine. The most strenuous sections of the GDPR involve requests from those whose data you store. If they ask you to supply what data you have of them, and whom you've shared it with, you have to comply. Within reasonable timeframes, and you cannot lie about it. If they ask that you delete this data, you must be capable of doing so, and you must do so within a reasonable timeframe. However, the GDPR is nice enough to grant you exceptions for reasonable measures which nevertheless make it hard to comply. Things like a backup tape are specifically called out. It's okay if data that's been requested to be removed, stays on those. You would have to show that this data is pseudonimized (GDPR-ese for encrypted, pretty much). Any service which has a hard time supporting requests to explain what data you store and where you've stored it, or which cannot delete it from the main service on demand... should indeed just call it a day and shut down. I don't think a service like streetlend would have a hard time supporting such requests, however.

tomxor 8y ago
> The GDPR is about 68 to 90 pages depending on which language you're reading it in [...] I run a small business and I like this. Just about anybody can read it and understand what rights and requirements are being set out in it. I don't run a small business, I make small things on the internet, this is not why I got into tech, I don't want to read 68 pages of yuk. If I made a small site that saves some user data i'd just pull it down too, I don't want the burden of worrying about being sued for some small thing I created, you just wont have it anymore. FB fucked it up for everyone, ultimately people gota learn that when you give data to someone you implicitly entrust them with it. FB had to go and be evil and now the EU is overreaching demanding everyone spend their time bubble wrapping everything... everyone backing them up are the village people taking to the streets with torches and burning shopkeepers after the king was found doing witchcraft. Go burn the king.
- orf 8y ago
  Arguing the EU is overreaching in demanding basic protections its citizens data, and that the only people who support it are... rioters (?) is a pretty vacuous and idiotic argument to make. If you're making something that stores personally identifiable information outside of what you need, and don't care enough to secure it or offer ways for a user to manage that data then yes, take it down. Good riddance. Or, just don't store that data in the first place. If you're storing usernames, passwords and the like then you have nothing to worry about.
  - closeparen 8y ago
    >If you're storing usernames, passwords and the like then you have nothing to worry about. Absolutely false. Anything pertaining to a person in any way is personal data. All default web server installations are GDPR violations, unless nginx grew an "edit the access.log entries pertaining to you" endpoint recently. (Although you can maybe argue "legitimate interest" for web access logging if you invest the time, and implement the right to erasure).
    - tscs37 8y ago
      Webserver logs are totally fine since you need them for information security (ie, finding out who has been spamming your webserver with requests), just use the default NGINX settings, in most distros that means deleting old logs automatically.
  - manigandham 8y ago
    You are incorrect. Even an IP address that dynamically changes with your ISP is considered personal data and is under strict guidelines. You have absolutely have a lot to worry about if you want to be in compliance. Something as simple as running Google Analytics without a processing agreement in place is a liability.
    - stevetrewick 8y ago
      No. This is a fundamental misunderstanding of the law. IP addresses are considered PII if and only if they can actually be legally used to identify an individual. And even where they can be, what on earth are you doing with them that you imagine is non compliance?
x0x0 8y ago
If you think you can understand the GDPR by reading it, that's merely proof you haven't read it. Questions without answers in the GDPR: * how to carry out a legitimate interest balancing test * who is your lead regulator (do you have a lead regulator?) * When do you need a DPO (large scale is left undefined, as is systematic) * How reasonable will any particular regulator be towards inadvertent violations * what precisely counts as the required technical and organizational measures in art24 * how do you define what is one purpose and what is two purposes?
- SaltySolomon 8y ago
  DPO turns almost always into always in the EU because you got more than 10 people that work in HR or Work with Customers.
- pbowyer 8y ago
  That's the nature of law. It's a set of principles, it's not black and white in the way techies want the world to be. Painful when needing to implement? Absolutely (not my favourite either, I want definite answers). The way it is? Yes.
  - aeorgnoieang 8y ago
    > That's the nature of law. Not all laws, nor all legal systems, are equally vague. It would be really helpful if the regulations had been accompanied with a large set of 'example applications' demonstrating how EU members should be expected (or required) to implement the law in specific scenarios. Uncertainty is a real cost too.
- zerostar07 8y ago
  what happens if someone enters identifying information that you did not ask for, e.g. users who use their real name instead of (pseudonymous) username
  - x0x0 8y ago
    off the top of my head, I see no provision in the GDPR for unrequested personal data being treated more laxly than requested...
home_boi 8y ago
> The GDPR is about 68 to 90 pages depending on which language you're reading it in. It is trying to be futureproof by leaving measures defined in terms of 'current state of technology', 'reasonable security considering the risk' and other such ambiguous terms. 1 page or 1,000 pages, most people are not in a position to accurately interpret it and understand what does or does not comply.
- hannasanarion 8y ago
  They would be if they read it. Every complaint I've seen about how the law is obviously going to be misapplied is called out specifically in the text in a way that makes it a non-issue.
  - Kalium 8y ago
    I've read it. It's a wonderfully written document on basic human rights and inter-government interaction. As regulation I can code to, it's a goddamn clusterfuck. It's like someone tried to invent TCP/IP but in the middle there's a paragraph that says something like "appropriate networking stuff happens here and data is reliably moved around!".
    - chii 8y ago
      laws often describes the effect it ought to have, but don't mention how!
- FridgeSeal 8y ago
  They went to great effort to make it readable and not full of legalese, you are really only doing yourself a disservice to not at least try.

tomxor 8y ago

> The GDPR is about 68 to 90 pages depending on which language you're reading it in [...] I run a small business and I like this. Just about anybody can read it and understand what rights and requirements are being set out in it. I don't run a small business, I make small things on the internet, this is not why I got into tech, I don't want to read 68 pages of yuk. If I made a small site that saves some user data i'd just pull it down too, I don't want the burden of worrying about being sued for some small thing I created, you just wont have it anymore. FB fucked it up for everyone, ultimately people gota learn that when you give data to someone you implicitly entrust them with it. FB had to go and be evil and now the EU is overreaching demanding everyone spend their time bubble wrapping everything... everyone backing them up are the village people taking to the streets with torches and burning shopkeepers after the king was found doing witchcraft. Go burn the king.

orf 8y ago
Arguing the EU is overreaching in demanding basic protections its citizens data, and that the only people who support it are... rioters (?) is a pretty vacuous and idiotic argument to make. If you're making something that stores personally identifiable information outside of what you need, and don't care enough to secure it or offer ways for a user to manage that data then yes, take it down. Good riddance. Or, just don't store that data in the first place. If you're storing usernames, passwords and the like then you have nothing to worry about.
- closeparen 8y ago
  >If you're storing usernames, passwords and the like then you have nothing to worry about. Absolutely false. Anything pertaining to a person in any way is personal data. All default web server installations are GDPR violations, unless nginx grew an "edit the access.log entries pertaining to you" endpoint recently. (Although you can maybe argue "legitimate interest" for web access logging if you invest the time, and implement the right to erasure).
  - tscs37 8y ago
    Webserver logs are totally fine since you need them for information security (ie, finding out who has been spamming your webserver with requests), just use the default NGINX settings, in most distros that means deleting old logs automatically.
- manigandham 8y ago
  You are incorrect. Even an IP address that dynamically changes with your ISP is considered personal data and is under strict guidelines. You have absolutely have a lot to worry about if you want to be in compliance. Something as simple as running Google Analytics without a processing agreement in place is a liability.
  - stevetrewick 8y ago
    No. This is a fundamental misunderstanding of the law. IP addresses are considered PII if and only if they can actually be legally used to identify an individual. And even where they can be, what on earth are you doing with them that you imagine is non compliance?

x0x0 8y ago

If you think you can understand the GDPR by reading it, that's merely proof you haven't read it. Questions without answers in the GDPR: * how to carry out a legitimate interest balancing test * who is your lead regulator (do you have a lead regulator?) * When do you need a DPO (large scale is left undefined, as is systematic) * How reasonable will any particular regulator be towards inadvertent violations * what precisely counts as the required technical and organizational measures in art24 * how do you define what is one purpose and what is two purposes?

SaltySolomon 8y ago
DPO turns almost always into always in the EU because you got more than 10 people that work in HR or Work with Customers.
pbowyer 8y ago
That's the nature of law. It's a set of principles, it's not black and white in the way techies want the world to be. Painful when needing to implement? Absolutely (not my favourite either, I want definite answers). The way it is? Yes.
- aeorgnoieang 8y ago
  > That's the nature of law. Not all laws, nor all legal systems, are equally vague. It would be really helpful if the regulations had been accompanied with a large set of 'example applications' demonstrating how EU members should be expected (or required) to implement the law in specific scenarios. Uncertainty is a real cost too.
zerostar07 8y ago
what happens if someone enters identifying information that you did not ask for, e.g. users who use their real name instead of (pseudonymous) username
- x0x0 8y ago
  off the top of my head, I see no provision in the GDPR for unrequested personal data being treated more laxly than requested...

home_boi 8y ago

> The GDPR is about 68 to 90 pages depending on which language you're reading it in. It is trying to be futureproof by leaving measures defined in terms of 'current state of technology', 'reasonable security considering the risk' and other such ambiguous terms. 1 page or 1,000 pages, most people are not in a position to accurately interpret it and understand what does or does not comply.

hannasanarion 8y ago
They would be if they read it. Every complaint I've seen about how the law is obviously going to be misapplied is called out specifically in the text in a way that makes it a non-issue.
- Kalium 8y ago
  I've read it. It's a wonderfully written document on basic human rights and inter-government interaction. As regulation I can code to, it's a goddamn clusterfuck. It's like someone tried to invent TCP/IP but in the middle there's a paragraph that says something like "appropriate networking stuff happens here and data is reliably moved around!".
  - chii 8y ago
    laws often describes the effect it ought to have, but don't mention how!
FridgeSeal 8y ago
They went to great effort to make it readable and not full of legalese, you are really only doing yourself a disservice to not at least try.