5 ms·
For many, that lawyer for an afternoon is an additional $1000 out of packet expense on a side project website that wasn't profitable to begin with.
by TomVDB 9y ago
For many, that lawyer for an afternoon is an additional $1000 out of packet expense on a side project website that wasn't profitable to begin with.
- matthewmacleod 9y agoWell then your “side project website” is unsustainable. It’s not complex - we don’t let people away with flouting regulation because it’s burdensome. “It would make me unprofitable” is not a valid reason to ignore health and safety laws, or hygiene laws. “I just want to run a food truck as a side project but not care about making people sick or not” is obviously ludicrous. Why is personal data somehow fair game?
- dleslie 9y agoWhy are you assuming that everything on the internet must be a revenue producing business? Someone doing it for love or passion is now faced with GDPR compliance and the risks and hassle that come with it.
- matthewmacleod 9y agoI am assuming no such thing. Just because you are not making revenue doesn’t mean that you don’t have to abide by regulation. The GDPR is intended to solve a very real and present issue; if you run a side project that deals with personal data, then the fact that it makes no money doesn’t mean that your mistreatment of personal data isn’t harmful!
- dleslie 9y agoI'd rather block all EU IPs than bother to break working technology that is operated and maintained freely. How do you revoke PII from a distributed information system, like anything using a blockchain or distributed version control? You don't.
- matthewmacleod 9y agoYou can. You just need to think about it and have the correct controls in place. If you choose to block all EU IPs instead of implementing the most basic data security and retention policies, then it’s for the best that EU users are not able to use your compromised service.
- dleslie 9y agoYou cannot force peers of any decentralized distributed system to forget data. They can pretend to and appear as compliant peers and yet retain the data.
- matthewmacleod 9y agoThen why are you storing PII on them?
- dleslie 9y agoHave you ever used git and supplied a username and email as your author? That's PII in a distributed service that cannot be revoked.
- nocha 9y agoThat is also PII being used for the purpose it was collected for (identifying a contributor) and I believe falls under Art.6(1)(f) of the GDPR. You would likely have a hard time convincing anybody that you can apply the right to be forgotten to a git repo - especially as that particular processing can be argued to not be requiring consent once you have submitted your commits.
- dleslie 9y agoThe author details are not necessary for the core function of git; the change itself does not need the PII. Moreover, my concern is general for when PII is in such a distributed system; git is just one example of many.
- DanBC 9y agoCan you explain how they managed to cope under the twenty or so years of things like data protection law or eg PECR? Can you explain why they can cope with PECR but can't cope with GDPR?