5 ms·

> If you followed the spirit of the pre-GDPR rules, you would almost certainly be compliant without much work even for the GDPR.... Have you deleted all of you

> If you followed the spirit of the pre-GDPR rules, you would almost certainly be compliant without much work even for the GDPR.... Have you deleted all of your blog's comments and/or asked everyone who previously commented on your blog for new GDPR compliant consent? Because that's one of the GDPR Graveyard events I'm seeing - people deleting their personal blogs and disabling comments as the easiest way to remain compliant.

svennek 9y ago
Why? Article 2c (excemptions): "by a natural person in the course of a purely personal or household activity"
- SyneRyder 9y ago
  Some of his blog also discusses his technical work, so it can be debated whether it is or is not "purely personal or household". Either way, it's vaguely worded enough that for someone who doesn't want to deal with compliance and laws and doesn't want to pay a lawyer just to know if they can keep writing a blog, the path of least resistance is just to delete everything.
  - svennek 9y ago
    That is crystal clear personal activity to me. Also which protection worthy data does the comments contain? Most likely none.
    - SyneRyder 9y ago
      Email addresses, account user names (especially if they commented by logging in via Twitter account). Personal website URLs if they included it. Maybe IP addresses on the server end but hopefully not. All of those are personally identifiable user data.
      - DanBC 9y ago
        Please stop saying IP addresses are personal data. They might be.
        SyneRyder 9y ago
        Yes, you are totally correct. It could be personally identifiable if it's a static IP or something, but most often it isn't entirely personal. You are right. I apologize.
      - svennek 9y ago
        And all of those are allowed (usually) due to normal "business-as-usual use" (fraud/spam prevention). And as said, a personal blog is except by definition... (edit: they are allowed, not excempt due to normal-use)
- georgebarnett 9y ago
  > Why? I doubt these people have actually read the law. Its always easier to overreact and panic, rather than adopt a measured response.
  - andygates 9y ago
    That's certainly the traditional response when complaining about Health & Safety legislation. Whine and overreact and get it wrong.
  - seszett 9y ago
    I'm pretty sure most overreacting responses I am reading about come from Americans and little-used services. I think many of them might just be trying to get some kind of publicity and sympathy, playing on the "regulation is bad" theme. None of the actual businesses I work with, in Europe, most of which actually do handle personal data, are actually worried or even annoyed (much less considering shutting down). From what I see, these overreactions are also in great part due to a lack of understanding of how law works outside the US - ie. maximum fines are just a maximum, letter of the law is not what counts most, the government isn't out to get you, judges don't have any incentive to extract money from you, etc.
  - Mirioron 9y ago
    But that's part of it: it's better to be safe than sorry. Having comments on your blog has very marginal benefits for you, but if you feel the risk is large, then just delete them. No single blog losing comments matters much, but in aggregate it can be a shift in culture to less discussion.
    - georgebarnett 9y ago
      I doubt it. We had plenty of discussion before comments on blogs. If anything, I’d prefer an internet without inane comments from mouth breathers.
- dageshi 9y ago
  If the blog has ads on it, is it still defined as "purely personal"? If the answer is "I'm not sure", why take the risk?
  - DanBC 9y ago
    A blog with ads that isn't compliant with GDPR is probably already not compliant with PECR or DPA.
  - svennek 9y ago
    No, but why not skip the ads then? Either you earn pennies (and it shouldn't matter) or you should follow the commercial rules...
    - dageshi 9y ago
      Or block everyone in the EU from your content perhaps, which would also solve the problem.
      - svennek 9y ago
        Except perhaps that BigCorp employees might exit their corporate network from an non-EU address, but they are still EU citizen and hence protected... If you want to block them, you would most likely have to ask them their nationality or require them to attest that they are not from within the EU...
    - Mirioron 9y ago
      Because those "pennies" can and do matter when your monthly income is 500 euros otherwise.

svennek 9y ago

Why? Article 2c (excemptions): "by a natural person in the course of a purely personal or household activity"

SyneRyder 9y ago
Some of his blog also discusses his technical work, so it can be debated whether it is or is not "purely personal or household". Either way, it's vaguely worded enough that for someone who doesn't want to deal with compliance and laws and doesn't want to pay a lawyer just to know if they can keep writing a blog, the path of least resistance is just to delete everything.
- svennek 9y ago
  That is crystal clear personal activity to me. Also which protection worthy data does the comments contain? Most likely none.
  - SyneRyder 9y ago
    Email addresses, account user names (especially if they commented by logging in via Twitter account). Personal website URLs if they included it. Maybe IP addresses on the server end but hopefully not. All of those are personally identifiable user data.
    - DanBC 9y ago
      Please stop saying IP addresses are personal data. They might be.
      - SyneRyder 9y ago
        Yes, you are totally correct. It could be personally identifiable if it's a static IP or something, but most often it isn't entirely personal. You are right. I apologize.
    - svennek 9y ago
      And all of those are allowed (usually) due to normal "business-as-usual use" (fraud/spam prevention). And as said, a personal blog is except by definition... (edit: they are allowed, not excempt due to normal-use)
georgebarnett 9y ago
> Why? I doubt these people have actually read the law. Its always easier to overreact and panic, rather than adopt a measured response.
- andygates 9y ago
  That's certainly the traditional response when complaining about Health & Safety legislation. Whine and overreact and get it wrong.
- seszett 9y ago
  I'm pretty sure most overreacting responses I am reading about come from Americans and little-used services. I think many of them might just be trying to get some kind of publicity and sympathy, playing on the "regulation is bad" theme. None of the actual businesses I work with, in Europe, most of which actually do handle personal data, are actually worried or even annoyed (much less considering shutting down). From what I see, these overreactions are also in great part due to a lack of understanding of how law works outside the US - ie. maximum fines are just a maximum, letter of the law is not what counts most, the government isn't out to get you, judges don't have any incentive to extract money from you, etc.
- Mirioron 9y ago
  But that's part of it: it's better to be safe than sorry. Having comments on your blog has very marginal benefits for you, but if you feel the risk is large, then just delete them. No single blog losing comments matters much, but in aggregate it can be a shift in culture to less discussion.
  - georgebarnett 9y ago
    I doubt it. We had plenty of discussion before comments on blogs. If anything, I’d prefer an internet without inane comments from mouth breathers.
dageshi 9y ago
If the blog has ads on it, is it still defined as "purely personal"? If the answer is "I'm not sure", why take the risk?
- DanBC 9y ago
  A blog with ads that isn't compliant with GDPR is probably already not compliant with PECR or DPA.
- svennek 9y ago
  No, but why not skip the ads then? Either you earn pennies (and it shouldn't matter) or you should follow the commercial rules...
  - dageshi 9y ago
    Or block everyone in the EU from your content perhaps, which would also solve the problem.
    - svennek 9y ago
      Except perhaps that BigCorp employees might exit their corporate network from an non-EU address, but they are still EU citizen and hence protected... If you want to block them, you would most likely have to ask them their nationality or require them to attest that they are not from within the EU...
  - Mirioron 9y ago
    Because those "pennies" can and do matter when your monthly income is 500 euros otherwise.