9 ms·

You know, until someone opportunistically sues you using a legal firm that costs the plaintiff nothing, and then you're out the cost of getting a lawyer and try

You know, until someone opportunistically sues you using a legal firm that costs the plaintiff nothing, and then you're out the cost of getting a lawyer and trying to defend that all of your actions and interpretations of the GDPR are correct. And if your business is already small/not making money, you're adding to the hole you're already in. Which, you know, the guy directly cites as the reason he's shutting down if you actually read the site. There's plenty of ambiguity in the GDPR, especially around logging, backups, and third parties (e.g. login through Facebook/Twitter/Google, you know, that thing that five years ago everyone was trying to sell at the way to do user authentication). This guy just decided it's not worth the potential of being sued while we wait for the dust to settle on how those ambiguities shake out (because, honestly, the only way we're going to get those cleared up is if someone is sued and they're made clear by case law).

bloopernova 8y ago
Do you know of a good place to read about the GDPR and backups? My concern has been the account deletion provision. Does the GDPR expect us to be able to go back and modify past backups? Years-old tape archives?
- jopsen 8y ago
  Good question.. I would guess there is no requirement data is wiped. Your file system doesn't wipe data, it just marks it as deleted. At some point it's a technicality, the important part is that you stop using the data. I suspect intent matters more than technicality.
- lmkg 8y ago
  I get the impression the GDPR expects you to not keep data around forever, as a general best practice. When you collect data, you have to tell your users at collection what your retention policy is (this is part of Right to Transparency). So, right there, you should probably have a retention policy, and "forever, always" isn't really a well-thought-out policy. The Right to Erasure is not as far-reaching as some people seem to think it is. If the Legal Basis of the data collection is Consent, then that consent is revocable and processing (including storage) pretty much has to end as soon as consent is revoked. But if the Legal Basis of collecting the data is something else, and I really feel like 90% of the time in practice it's going to be Legitimate Interest, then the Data Controller gets to balance their own needs against the rights of the Data Subject when handling a Right to Erasure or Right to Object request. And you can probably make a good argument that you don't need to modify back-ups. Your argument is stronger if a) your restore-from-back-up procedure can ignore or delete the user's data during/after restore b) your data retention policy eventually deletes the back-up.
  - jimktrains2 8y ago
    I do I remove data in a WORM store?
    - llukas 8y ago
      Encrypt data with per-user key. Drop key.
      - jimktrains2 8y ago
        So, now I can't run analysis of my logs because they're encrypted? Also, that data is still associated with the user. Is it to the letter of the law to keep it, even if it's unreadable?
        freeone3000 8y ago
        I think you're starting to get the point of the GDPR, yes.
        jimktrains2 8y ago
        The point of the gdpr is that I can't analyze past shipping costs? To optimize how I ship in the future? Also, how does this mesh with pci retention rules. (Yes, they are not law, but it's still an awkward place to be.)
        guitarbill 8y ago
        Ah yes, somebody being overly pedantic and trying to come up with examples to spread FUD. You couldn't possibly anonymize the data and then do the analytics, unheard of.
        jimktrains2 8y ago
        You're assuming that I knew I wanted to do said analysis, or that I would never want to go back to an order's record for more information. (What was ordered, or perhaps the US county someone is in that I need to figure out from the shipping address.) It's not that the analysis can't be done anonymously, but to do so requires foreknowledge of everything you would like to analyze.
- manigandham 8y ago
  Start by reading the actual regulation, provided here in a easy online format without the extraneous formatting: https://gdpr-info.eu/ https://gdpr-info.eu/ If you want a shortcut, you can try the EnterpriseReady site which has a great overview specific to SaaS companies: https://www.enterpriseready.io/gdpr/ https://www.enterpriseready.io/gdpr/ As always though, your best resource is to talk to a lawyer. Do not trust any internet comments about legal decisions for your business.
- cdjk 8y ago
  A reasonable approach that we're following is to have a documented backup retention policy and a procedure to re-delete data for any users who have asked to be deleted when those backups are restored. That retention policy can be longer than 30 days as it's impossible or infeasible to delete individual user data from all the backups. One easy way to do this is with an expiration policy on s3 objects. You need to have an independent backup of those deletion requests though. If you have a years-old tape archive you probably have a massive legal team who is much better equipped to answer this question.
- hjnilsson 8y ago
  There is no need to go back and modify backups. You decide on a timeframe for deletion of backups (ie. X days). You keep a record of deletion requests you receive for X days. If you need to restore to a backup, you delete data again for the users that requested it. Then you delete the backups and records of deletion (or the tables in it that contain personally-identified information) after X days.
  - jimktrains2 8y ago
    > You decide on a timeframe for deletion of backups (ie. X days). You keep a record of deletion requests you receive for X days. If you need to restore to a backup, you delete data again for the users that requested it. All of which requires a good deal of development work.
moreira 8y ago
Unless I'm mistaken, you can't actually sue over your interpretation of the GDPR. You can report companies to the appropriate authority, who can then investigate, and with whom you can communicate. Just like the many other authorities of the kind[1]. [1]: https://www.citizensadvice.org.uk/consumer/get-more-help/how-to-use-an-ombudsman-in-england/ https://www.citizensadvice.org.uk/consumer/get-more-help/how...
- amorphid 8y ago
  Anyone can sue you at anytime for any reason.
  - orf 8y ago
    So this changes nothing then.
    - AlphaSite 8y ago
      No, it gives the government teeth.
      - threeseed 8y ago
        Which is a good thing. If you care about consumer's rights over companies's profits that is.
  - tim333 8y ago
    Yeah but in the EU/UK I'm not sure people sue for this kind of thing. The US is different. In the UK we don't really have class actions, you can only sue for the damage caused to you which in the case of a website like this isn't going to be much and legal fees are expensive making the whole thing not worth while.
    - DevKoala 8y ago
      They do sue for "this kind of thing". A legal team is a necessity to stay in this space nowadays.
riquito 8y ago
> You know, until someone opportunistically sues you using a legal firm that costs the plaintiff nothing, and then you're out the cost of getting a lawyer and trying to defend This has always been true, nothing has changed
- ibeckermayer 8y ago
  And this is a massive injustice. If a person is sued and they come out on top, the suer should be responsible for their legal bills.
  - Clubber 8y ago
    Absolutely. As currently outlined, (big or legal) companies with any legal resources can harass regular people all day long. They can bring a million dollar suit and if you don't defend it, they get a default judgment, meaning they win by default. Defending it can cost a lot. It costs nearly nothing to file a lawsuit too. An example of this in action is the NRAA and patent trolls.
    - rimliu 8y ago
      The world is not all US. And in other parts it is different. E.g. is someone wrongly sues you and they lose they are obliged pay for legal fees too.
  - Hello71 8y ago
    which, of course, is the case in "nearly every Western democracy other than the United States". https://en.wikipedia.org/wiki/English_rule_(attorney%27s_fees) https://en.wikipedia.org/wiki/English_rule_(attorney%27s_fee...
  - lagadu 8y ago
    And that is exactly how it works in all EU jurisdictions (and indeed most of the world besides the US)[1]. This is a big reason the US is a far more litigious place than similarly developed countries. [1] http://www.pointoflaw.com/loserpays/overview.php http://www.pointoflaw.com/loserpays/overview.php
caf 8y ago
No-win-no-fee lawyers don't just take any case that walks through the door. The expected value of the case to the lawyers is the probability of winning, multiplied by the minimum of the expected award and the resources the defendant has available to pay, multiplied by the fee percentage that the lawyers are charging, minus the costs involved in litigating the case. In the cases we're considering here, the probability of winning is low, the expected award is low, and the resources available to the defendant are low. They're simply not going to take them on.
- underwater 8y ago
  I’ve been in this situation before, I was sued for copyright infringement for something I shared on my blog by someone who had obviously gone through lawyers until she found someone to take her case. She alleged I colluded with and stole manuscripts from her publisher (I published my content before she did). I knew I was in the right, and had proof to back it up. Then I found out it would cost tens of thousands to take the case to court and then if I won, I could claim the lawsuit was frivolous and sue for legal fees. People can use the legal system to rope you into an expensive game that you don’t want to play. Even if you win, that victory might come at a huge cost financially and emotionally. Irrational and vindictive people can hire lawyers too.
  - caf 8y ago
    Presumably that was in the US. In the UK, which is where StreetLend.com seems to be located, costs are generally awarded to the prevailing party in the judgement.
    - underwater 8y ago
      Yes, it was in the US. I’m not American but unbeknownst to me I moved to the same US state she lived in shortly before she decided to sue me. Even in the case where fees are awarded, there is absolutely zero upside in being sued. The best possible outcome is to tie up tens of thousands of your own money in legal fees, and invest huge amounts of time and energy in a court battle. And of course there is always a risk you could lose the case. For a passion project that is a big investment. I cut my losses, and I’m glad I did.
deleted 8y ago
[deleted]
hannasanarion 8y ago
Sue you for what? Gdpr grants no new right to sue. The only thing that's changed is that if someone emails you saying "delete the stuff on me please" you have to do so unless you have a good excuse. And if you refuse, it goes to arbitration and if you refuse unlawfully, you get a fine. All you have to do to be Gdpr compliant is delete user data when asked. There is no "trap card" provision.
- kasey_junk 8y ago
  This is completely untrue. Deletion is only one of many rights granted under GDPR. Consent collection is a giant new one for instance.
- saudioger 8y ago
  You're talking out of your ass. There's way more than right to delete.
  - GordonS 8y ago
    You're right, there is also (gasp!) the right for users to request all of the data you hold about them, and also (shriek!) to be told how you use their data! I just do not get what there is to complain about here - the GDPR is a good thing for consumers, and as a business owner than gives a damn about privacy, it is not onerous to comply with.
- pilif 8y ago
  >Sue you for what? For having an unfair competitive advantage over competitors who properly follow the law. This is a well-known tactic to get rid of competitors or just companies you don’t like.
lagadu 8y ago
Incorrect. That "someone" cannot sue you over a GDPR claim; only the national entity responsible for that can take complaints, which they analyze and emit a fine if deemed appropriate.
kbart 8y ago
No, EU is not USA, it doesn't work this way here. You can't sue companies for violating GDPR directly as a person, you can only write a complain to authorities that will decide how to proceed (issue a warning, start an investigation, issue a fine etc.)

bloopernova 8y ago

Do you know of a good place to read about the GDPR and backups? My concern has been the account deletion provision. Does the GDPR expect us to be able to go back and modify past backups? Years-old tape archives?

jopsen 8y ago
Good question.. I would guess there is no requirement data is wiped. Your file system doesn't wipe data, it just marks it as deleted. At some point it's a technicality, the important part is that you stop using the data. I suspect intent matters more than technicality.
lmkg 8y ago
I get the impression the GDPR expects you to not keep data around forever, as a general best practice. When you collect data, you have to tell your users at collection what your retention policy is (this is part of Right to Transparency). So, right there, you should probably have a retention policy, and "forever, always" isn't really a well-thought-out policy. The Right to Erasure is not as far-reaching as some people seem to think it is. If the Legal Basis of the data collection is Consent, then that consent is revocable and processing (including storage) pretty much has to end as soon as consent is revoked. But if the Legal Basis of collecting the data is something else, and I really feel like 90% of the time in practice it's going to be Legitimate Interest, then the Data Controller gets to balance their own needs against the rights of the Data Subject when handling a Right to Erasure or Right to Object request. And you can probably make a good argument that you don't need to modify back-ups. Your argument is stronger if a) your restore-from-back-up procedure can ignore or delete the user's data during/after restore b) your data retention policy eventually deletes the back-up.
- jimktrains2 8y ago
  I do I remove data in a WORM store?
  - llukas 8y ago
    Encrypt data with per-user key. Drop key.
    - jimktrains2 8y ago
      So, now I can't run analysis of my logs because they're encrypted? Also, that data is still associated with the user. Is it to the letter of the law to keep it, even if it's unreadable?
      - freeone3000 8y ago
        I think you're starting to get the point of the GDPR, yes.
        jimktrains2 8y ago
        The point of the gdpr is that I can't analyze past shipping costs? To optimize how I ship in the future? Also, how does this mesh with pci retention rules. (Yes, they are not law, but it's still an awkward place to be.)
        guitarbill 8y ago
        Ah yes, somebody being overly pedantic and trying to come up with examples to spread FUD. You couldn't possibly anonymize the data and then do the analytics, unheard of.
        jimktrains2 8y ago
        You're assuming that I knew I wanted to do said analysis, or that I would never want to go back to an order's record for more information. (What was ordered, or perhaps the US county someone is in that I need to figure out from the shipping address.) It's not that the analysis can't be done anonymously, but to do so requires foreknowledge of everything you would like to analyze.
manigandham 8y ago
Start by reading the actual regulation, provided here in a easy online format without the extraneous formatting: https://gdpr-info.eu/ https://gdpr-info.eu/ If you want a shortcut, you can try the EnterpriseReady site which has a great overview specific to SaaS companies: https://www.enterpriseready.io/gdpr/ https://www.enterpriseready.io/gdpr/ As always though, your best resource is to talk to a lawyer. Do not trust any internet comments about legal decisions for your business.
cdjk 8y ago
A reasonable approach that we're following is to have a documented backup retention policy and a procedure to re-delete data for any users who have asked to be deleted when those backups are restored. That retention policy can be longer than 30 days as it's impossible or infeasible to delete individual user data from all the backups. One easy way to do this is with an expiration policy on s3 objects. You need to have an independent backup of those deletion requests though. If you have a years-old tape archive you probably have a massive legal team who is much better equipped to answer this question.
hjnilsson 8y ago
There is no need to go back and modify backups. You decide on a timeframe for deletion of backups (ie. X days). You keep a record of deletion requests you receive for X days. If you need to restore to a backup, you delete data again for the users that requested it. Then you delete the backups and records of deletion (or the tables in it that contain personally-identified information) after X days.
- jimktrains2 8y ago
  > You decide on a timeframe for deletion of backups (ie. X days). You keep a record of deletion requests you receive for X days. If you need to restore to a backup, you delete data again for the users that requested it. All of which requires a good deal of development work.

moreira 8y ago

Unless I'm mistaken, you can't actually sue over your interpretation of the GDPR. You can report companies to the appropriate authority, who can then investigate, and with whom you can communicate. Just like the many other authorities of the kind[1]. [1]: https://www.citizensadvice.org.uk/consumer/get-more-help/how-to-use-an-ombudsman-in-england/ https://www.citizensadvice.org.uk/consumer/get-more-help/how...

amorphid 8y ago
Anyone can sue you at anytime for any reason.
- orf 8y ago
  So this changes nothing then.
  - AlphaSite 8y ago
    No, it gives the government teeth.
    - threeseed 8y ago
      Which is a good thing. If you care about consumer's rights over companies's profits that is.
- tim333 8y ago
  Yeah but in the EU/UK I'm not sure people sue for this kind of thing. The US is different. In the UK we don't really have class actions, you can only sue for the damage caused to you which in the case of a website like this isn't going to be much and legal fees are expensive making the whole thing not worth while.
  - DevKoala 8y ago
    They do sue for "this kind of thing". A legal team is a necessity to stay in this space nowadays.

riquito 8y ago

> You know, until someone opportunistically sues you using a legal firm that costs the plaintiff nothing, and then you're out the cost of getting a lawyer and trying to defend This has always been true, nothing has changed

ibeckermayer 8y ago
And this is a massive injustice. If a person is sued and they come out on top, the suer should be responsible for their legal bills.
- Clubber 8y ago
  Absolutely. As currently outlined, (big or legal) companies with any legal resources can harass regular people all day long. They can bring a million dollar suit and if you don't defend it, they get a default judgment, meaning they win by default. Defending it can cost a lot. It costs nearly nothing to file a lawsuit too. An example of this in action is the NRAA and patent trolls.
  - rimliu 8y ago
    The world is not all US. And in other parts it is different. E.g. is someone wrongly sues you and they lose they are obliged pay for legal fees too.
- Hello71 8y ago
  which, of course, is the case in "nearly every Western democracy other than the United States". https://en.wikipedia.org/wiki/English_rule_(attorney%27s_fees) https://en.wikipedia.org/wiki/English_rule_(attorney%27s_fee...
- lagadu 8y ago
  And that is exactly how it works in all EU jurisdictions (and indeed most of the world besides the US)[1]. This is a big reason the US is a far more litigious place than similarly developed countries. [1] http://www.pointoflaw.com/loserpays/overview.php http://www.pointoflaw.com/loserpays/overview.php

caf 8y ago

No-win-no-fee lawyers don't just take any case that walks through the door. The expected value of the case to the lawyers is the probability of winning, multiplied by the minimum of the expected award and the resources the defendant has available to pay, multiplied by the fee percentage that the lawyers are charging, minus the costs involved in litigating the case. In the cases we're considering here, the probability of winning is low, the expected award is low, and the resources available to the defendant are low. They're simply not going to take them on.

underwater 8y ago
I’ve been in this situation before, I was sued for copyright infringement for something I shared on my blog by someone who had obviously gone through lawyers until she found someone to take her case. She alleged I colluded with and stole manuscripts from her publisher (I published my content before she did). I knew I was in the right, and had proof to back it up. Then I found out it would cost tens of thousands to take the case to court and then if I won, I could claim the lawsuit was frivolous and sue for legal fees. People can use the legal system to rope you into an expensive game that you don’t want to play. Even if you win, that victory might come at a huge cost financially and emotionally. Irrational and vindictive people can hire lawyers too.
- caf 8y ago
  Presumably that was in the US. In the UK, which is where StreetLend.com seems to be located, costs are generally awarded to the prevailing party in the judgement.
  - underwater 8y ago
    Yes, it was in the US. I’m not American but unbeknownst to me I moved to the same US state she lived in shortly before she decided to sue me. Even in the case where fees are awarded, there is absolutely zero upside in being sued. The best possible outcome is to tie up tens of thousands of your own money in legal fees, and invest huge amounts of time and energy in a court battle. And of course there is always a risk you could lose the case. For a passion project that is a big investment. I cut my losses, and I’m glad I did.

deleted 8y ago

[deleted]

hannasanarion 8y ago

Sue you for what? Gdpr grants no new right to sue. The only thing that's changed is that if someone emails you saying "delete the stuff on me please" you have to do so unless you have a good excuse. And if you refuse, it goes to arbitration and if you refuse unlawfully, you get a fine. All you have to do to be Gdpr compliant is delete user data when asked. There is no "trap card" provision.

kasey_junk 8y ago
This is completely untrue. Deletion is only one of many rights granted under GDPR. Consent collection is a giant new one for instance.
saudioger 8y ago
You're talking out of your ass. There's way more than right to delete.
- GordonS 8y ago
  You're right, there is also (gasp!) the right for users to request all of the data you hold about them, and also (shriek!) to be told how you use their data! I just do not get what there is to complain about here - the GDPR is a good thing for consumers, and as a business owner than gives a damn about privacy, it is not onerous to comply with.
pilif 8y ago
>Sue you for what? For having an unfair competitive advantage over competitors who properly follow the law. This is a well-known tactic to get rid of competitors or just companies you don’t like.

lagadu 8y ago

Incorrect. That "someone" cannot sue you over a GDPR claim; only the national entity responsible for that can take complaints, which they analyze and emit a fine if deemed appropriate.

kbart 8y ago

No, EU is not USA, it doesn't work this way here. You can't sue companies for violating GDPR directly as a person, you can only write a complain to authorities that will decide how to proceed (issue a warning, start an investigation, issue a fine etc.)