6 ms·

> The GDPR is about 68 to 90 pages depending on which language you're reading it in [...] I run a small business and I like this. Just about anybody can read it

by tomxor 9y ago

> The GDPR is about 68 to 90 pages depending on which language you're reading it in [...] I run a small business and I like this. Just about anybody can read it and understand what rights and requirements are being set out in it. I don't run a small business, I make small things on the internet, this is not why I got into tech, I don't want to read 68 pages of yuk. If I made a small site that saves some user data i'd just pull it down too, I don't want the burden of worrying about being sued for some small thing I created, you just wont have it anymore. FB fucked it up for everyone, ultimately people gota learn that when you give data to someone you implicitly entrust them with it. FB had to go and be evil and now the EU is overreaching demanding everyone spend their time bubble wrapping everything... everyone backing them up are the village people taking to the streets with torches and burning shopkeepers after the king was found doing witchcraft. Go burn the king.

orf 9y ago
Arguing the EU is overreaching in demanding basic protections its citizens data, and that the only people who support it are... rioters (?) is a pretty vacuous and idiotic argument to make. If you're making something that stores personally identifiable information outside of what you need, and don't care enough to secure it or offer ways for a user to manage that data then yes, take it down. Good riddance. Or, just don't store that data in the first place. If you're storing usernames, passwords and the like then you have nothing to worry about.
- closeparen 9y ago
  >If you're storing usernames, passwords and the like then you have nothing to worry about. Absolutely false. Anything pertaining to a person in any way is personal data. All default web server installations are GDPR violations, unless nginx grew an "edit the access.log entries pertaining to you" endpoint recently. (Although you can maybe argue "legitimate interest" for web access logging if you invest the time, and implement the right to erasure).
  - tscs37 9y ago
    Webserver logs are totally fine since you need them for information security (ie, finding out who has been spamming your webserver with requests), just use the default NGINX settings, in most distros that means deleting old logs automatically.
- manigandham 9y ago
  You are incorrect. Even an IP address that dynamically changes with your ISP is considered personal data and is under strict guidelines. You have absolutely have a lot to worry about if you want to be in compliance. Something as simple as running Google Analytics without a processing agreement in place is a liability.
  - stevetrewick 9y ago
    No. This is a fundamental misunderstanding of the law. IP addresses are considered PII if and only if they can actually be legally used to identify an individual. And even where they can be, what on earth are you doing with them that you imagine is non compliance?
  - Guest9812398 9y ago
    I was thinking about GA (Google Analytics) the other day, and how I can follow the GDPR guidelines. The articles I read, both from Google and other sources said to not use user IDs to identify users without consent, to anonymize IP addresses, and to not send PII information to Google, such as in URLs. Ok, that sounds simply enough, but then... I started thinking about it more. 1. User profiles can't be sent to GA. For example, hacker news has /user?id=JohnDoe for profiles, and that contains a username, which is personal data that should not be shared with GA. Ok, so I could rewrite my profile URLs before sending them to GA without the usernames. 2. I haven't heard a single source mention referrals. If I'm on a user profile on my site and click a link, that's going to send /user?id=JohnDoe to GA as the referral. I would need to overwrite the referrals before sending them to GA as well. 3. What about 404 pages that I make up? What if I visit https://www.example.com/JohnDoe https://www.example.com/JohnDoe? That's sending my personal name to GA again. Hmm, ok, the site could exclude GA from 404 pages. 4. What about search boxes? What if I use the search field on a blog? https://www.example.com/posts?search=JohnDoe https://www.example.com/posts?search=JohnDoe. Hmm, that's my personal data being sent again. Ok, we need to make sure any data from search boxes is now stripped and not sent to GA. 5. What if I manually add a query parameter or modify one? A homepage might have https://www.example.com/?page=2 https://www.example.com/?page=2, but what if I change it to https://www.example.com/?page=JohnDoe https://www.example.com/?page=JohnDoe. Hmm, yes, that's personal data being sent again. I guess I need to validate the page parameter to ensure it's an integer before sending the URL to GA. What if I then type in a personal phone number as the page number?
caf 9y ago
If your small site is saving all that user data in an unsecured S3 bucket then yeah, pulling it down seems like the right idea.
- fogzen 9y ago
  GDPR doesn’t require you protect the data. You can still leave it unprotected as long as you tell them this on some stupid fine print. There’s no damage that GDPR protects you from, and it doesn’t add any liability for stolen, hacked, or misused data. Facebook can do the same shit they were doing under GDPR!
  - pilsetnieks 9y ago
    Yes, it does require you to protect the data: > (83) In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing and implement measures to mitigate those risks, such as encryption. Those measures should ensure an appropriate level of security, including confidentiality, taking into account the state of the art and the costs of implementation in relation to the risks and the nature of the personal data to be protected. In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage. also: > Section 2, art. 32, Security of processing: > Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: [..]
herold2422 9y ago
> [...] If I made a small site that saves some user data i'd just pull it down too, I don't want the burden of worrying about being sued for some small thing I created, you just wont have it anymore. Actually I think that's a good thing then.
pdkl95 9y ago
> this is not why I got into tech, I don't want to read 68 pages of yuk One of the goals of this law and similar efforts is to make it clear that you need to consider the social, ethical, and legal ramifications of the things you crate. You are not creating neutral things in a vacuum; there is no neutral ground in a burning world[1]. That "small thing on the internet" might be reuniting families that were separated by work or politics, or it might be undermining the support structures of an entire industry or community. Maybe you are creating a social space*, which includes a duty to manage that space to keep so it doesn't become a tool of abuse[2]. Maybe your small site stays small. Obviously you cannot be expected to foresee every potential consequence of your creation, but you at least need to make the effort and catch the low-hanging fruit (e.g. the basic privacy features enforced by the GDPR). [1] http://opentranscripts.org/transcript/no-neutral-ground-burning-world/ http://opentranscripts.org/transcript/no-neutral-ground-burn... [2] http://www.gdcvault.com/play/1024060/Still-Logged-In-What-AR http://www.gdcvault.com/play/1024060/Still-Logged-In-What-AR
- kodablah 9y ago
  > One of the goals of this law and similar efforts is to make it clear that you need to consider the social, ethical, and legal ramifications of the things you create. One often wonders whether lawmakers heed their own advice here with what they create.
  - sbov 9y ago
    In the US, I've always found it humorous that there is no legal penalty for lawmakers continually and knowingly violating the constitution. The worst that happens is they get their bill struck down in court, then their state's legislature can vote in the next law.
    - sitkack 9y ago
      How about 3 strikes for politicians. They do their job poorly, they lose it, regardless of their election status.
threeseed 9y ago
> FB had to go and be evil and now the EU is overreaching demanding everyone spend their time bubble wrapping everything What you call overeaching other's call protecting the interests of consumers.
jake_the_third 9y ago
> FB fucked it up for everyone Nah, just for companies that trade personal information as if it was cattle feed. As an individual, I have no problem with the GDPR. If you won't handle my personal information with proper care, you should shutdown or get sued out of existence. Cheers.
- malvosenior 9y ago
  Or every independent software developer who isn’t doing anything nefarious with your data but doesn’t have the resources to implement a bunch of new, EU mandated features.
  - baq 9y ago
    Your attitude towards my privacy makes me happy you won't be marketing your products in Europe.
  - sitkack 9y ago
    Proper encryption, limited data collection and exposure, and deletion are not fancy features. If this is onerous, it is hard to imagine you are shipping much.
  - matthewmacleod 9y ago
    This features you need to implement are the bare minimum required for good security practices.
  - FridgeSeal 9y ago
    How hard is it to just not collect data that isn't directly related to the running of your business? Do you find yourself accidentally including data sales SDK's? Do you finish your website or app and realise you've accidentally set it up to fingerprint the user, scrape everything you can from them and sell it? If your business is just a tool supported by wanton data scraping are you actually doing anything innovative and worthwhile or are you just making an MVP to pack full of advertising and jump on that bandwagon? If you aren't doing that, then it's just a matter of checking what data you are harvesting and thinking about why you have it and if you really need it. Because if it's actually critical to the running of your business then GDPR does allow you to keep it. If it's not, why waste space, effort and now risk in bothering to harvest and keep it in the first place.
struppi 9y ago
"If I made a small site that saves some user data" Then you already had a ton of legal obligations, you were just not aware of them, since only now everyone is talking about the GDPR. "FB fucked it up for everyone" A lot of the things people are complaining about right now were already illegal, before the GDPR. People were just not caring about it.

by tomxor 9y ago

orf 9y ago

Arguing the EU is overreaching in demanding basic protections its citizens data, and that the only people who support it are... rioters (?) is a pretty vacuous and idiotic argument to make. If you're making something that stores personally identifiable information outside of what you need, and don't care enough to secure it or offer ways for a user to manage that data then yes, take it down. Good riddance. Or, just don't store that data in the first place. If you're storing usernames, passwords and the like then you have nothing to worry about.

closeparen 9y ago
>If you're storing usernames, passwords and the like then you have nothing to worry about. Absolutely false. Anything pertaining to a person in any way is personal data. All default web server installations are GDPR violations, unless nginx grew an "edit the access.log entries pertaining to you" endpoint recently. (Although you can maybe argue "legitimate interest" for web access logging if you invest the time, and implement the right to erasure).
- tscs37 9y ago
  Webserver logs are totally fine since you need them for information security (ie, finding out who has been spamming your webserver with requests), just use the default NGINX settings, in most distros that means deleting old logs automatically.
manigandham 9y ago
You are incorrect. Even an IP address that dynamically changes with your ISP is considered personal data and is under strict guidelines. You have absolutely have a lot to worry about if you want to be in compliance. Something as simple as running Google Analytics without a processing agreement in place is a liability.
- stevetrewick 9y ago
  No. This is a fundamental misunderstanding of the law. IP addresses are considered PII if and only if they can actually be legally used to identify an individual. And even where they can be, what on earth are you doing with them that you imagine is non compliance?
- Guest9812398 9y ago
  I was thinking about GA (Google Analytics) the other day, and how I can follow the GDPR guidelines. The articles I read, both from Google and other sources said to not use user IDs to identify users without consent, to anonymize IP addresses, and to not send PII information to Google, such as in URLs. Ok, that sounds simply enough, but then... I started thinking about it more. 1. User profiles can't be sent to GA. For example, hacker news has /user?id=JohnDoe for profiles, and that contains a username, which is personal data that should not be shared with GA. Ok, so I could rewrite my profile URLs before sending them to GA without the usernames. 2. I haven't heard a single source mention referrals. If I'm on a user profile on my site and click a link, that's going to send /user?id=JohnDoe to GA as the referral. I would need to overwrite the referrals before sending them to GA as well. 3. What about 404 pages that I make up? What if I visit https://www.example.com/JohnDoe https://www.example.com/JohnDoe? That's sending my personal name to GA again. Hmm, ok, the site could exclude GA from 404 pages. 4. What about search boxes? What if I use the search field on a blog? https://www.example.com/posts?search=JohnDoe https://www.example.com/posts?search=JohnDoe. Hmm, that's my personal data being sent again. Ok, we need to make sure any data from search boxes is now stripped and not sent to GA. 5. What if I manually add a query parameter or modify one? A homepage might have https://www.example.com/?page=2 https://www.example.com/?page=2, but what if I change it to https://www.example.com/?page=JohnDoe https://www.example.com/?page=JohnDoe. Hmm, yes, that's personal data being sent again. I guess I need to validate the page parameter to ensure it's an integer before sending the URL to GA. What if I then type in a personal phone number as the page number?

caf 9y ago

If your small site is saving all that user data in an unsecured S3 bucket then yeah, pulling it down seems like the right idea.

fogzen 9y ago
GDPR doesn’t require you protect the data. You can still leave it unprotected as long as you tell them this on some stupid fine print. There’s no damage that GDPR protects you from, and it doesn’t add any liability for stolen, hacked, or misused data. Facebook can do the same shit they were doing under GDPR!
- pilsetnieks 9y ago
  Yes, it does require you to protect the data: > (83) In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing and implement measures to mitigate those risks, such as encryption. Those measures should ensure an appropriate level of security, including confidentiality, taking into account the state of the art and the costs of implementation in relation to the risks and the nature of the personal data to be protected. In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage. also: > Section 2, art. 32, Security of processing: > Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: [..]

herold2422 9y ago

> [...] If I made a small site that saves some user data i'd just pull it down too, I don't want the burden of worrying about being sued for some small thing I created, you just wont have it anymore. Actually I think that's a good thing then.

pdkl95 9y ago

> this is not why I got into tech, I don't want to read 68 pages of yuk One of the goals of this law and similar efforts is to make it clear that you need to consider the social, ethical, and legal ramifications of the things you crate. You are not creating neutral things in a vacuum; there is no neutral ground in a burning world[1]. That "small thing on the internet" might be reuniting families that were separated by work or politics, or it might be undermining the support structures of an entire industry or community. Maybe you are creating a social space*, which includes a duty to manage that space to keep so it doesn't become a tool of abuse[2]. Maybe your small site stays small. Obviously you cannot be expected to foresee every potential consequence of your creation, but you at least need to make the effort and catch the low-hanging fruit (e.g. the basic privacy features enforced by the GDPR). [1] http://opentranscripts.org/transcript/no-neutral-ground-burning-world/ http://opentranscripts.org/transcript/no-neutral-ground-burn... [2] http://www.gdcvault.com/play/1024060/Still-Logged-In-What-AR http://www.gdcvault.com/play/1024060/Still-Logged-In-What-AR

kodablah 9y ago
> One of the goals of this law and similar efforts is to make it clear that you need to consider the social, ethical, and legal ramifications of the things you create. One often wonders whether lawmakers heed their own advice here with what they create.
- sbov 9y ago
  In the US, I've always found it humorous that there is no legal penalty for lawmakers continually and knowingly violating the constitution. The worst that happens is they get their bill struck down in court, then their state's legislature can vote in the next law.
  - sitkack 9y ago
    How about 3 strikes for politicians. They do their job poorly, they lose it, regardless of their election status.

threeseed 9y ago

> FB had to go and be evil and now the EU is overreaching demanding everyone spend their time bubble wrapping everything What you call overeaching other's call protecting the interests of consumers.

jake_the_third 9y ago

> FB fucked it up for everyone Nah, just for companies that trade personal information as if it was cattle feed. As an individual, I have no problem with the GDPR. If you won't handle my personal information with proper care, you should shutdown or get sued out of existence. Cheers.

malvosenior 9y ago
Or every independent software developer who isn’t doing anything nefarious with your data but doesn’t have the resources to implement a bunch of new, EU mandated features.
- baq 9y ago
  Your attitude towards my privacy makes me happy you won't be marketing your products in Europe.
- sitkack 9y ago
  Proper encryption, limited data collection and exposure, and deletion are not fancy features. If this is onerous, it is hard to imagine you are shipping much.
- matthewmacleod 9y ago
  This features you need to implement are the bare minimum required for good security practices.
- FridgeSeal 9y ago
  How hard is it to just not collect data that isn't directly related to the running of your business? Do you find yourself accidentally including data sales SDK's? Do you finish your website or app and realise you've accidentally set it up to fingerprint the user, scrape everything you can from them and sell it? If your business is just a tool supported by wanton data scraping are you actually doing anything innovative and worthwhile or are you just making an MVP to pack full of advertising and jump on that bandwagon? If you aren't doing that, then it's just a matter of checking what data you are harvesting and thinking about why you have it and if you really need it. Because if it's actually critical to the running of your business then GDPR does allow you to keep it. If it's not, why waste space, effort and now risk in bothering to harvest and keep it in the first place.

struppi 9y ago

"If I made a small site that saves some user data" Then you already had a ton of legal obligations, you were just not aware of them, since only now everyone is talking about the GDPR. "FB fucked it up for everyone" A lot of the things people are complaining about right now were already illegal, before the GDPR. People were just not caring about it.