7 ms·
I am absolutley speechless about the number of people who seem to consider data protection to be an unreasonable burden for a company. Complying with GDPR is pr
by matthewmacleod 9y ago
I am absolutley speechless about the number of people who seem to consider data protection to be an unreasonable burden for a company. Complying with GDPR is pretty straightforward:
- Don’t keep data unless you have to
- Get explicit consent for keeping data
- Keep the data you have secure
- Allow users to see their data and know how it’s used
- Allow users to delete their data
This is inline with regulation in other fields: worker rights, food hygiene, health and safety etc.
I look forward to seeing your list, because it will be a list of companies you are lucky you will never transact with.
- gcatalfamo 9y agoI don’t agree with you. Here’s the reason, explained better than I would: https://news.ycombinator.com/item?id=16955013 https://news.ycombinator.com/item?id=16955013
- svennek 9y agoHere is my answer to that post... https://news.ycombinator.com/item?id=16956379 https://news.ycombinator.com/item?id=16956379
- matthewmacleod 9y agoThis nails it better than I could. Misuse of personal data has a cost. If companies do not want to deal with data in a responsible way, it is correct that they no longer do business in the EU.
- DanBC 9y ago> The problem is what happens if a legal firm or an agency targets you. Even if you adhered to the spirit of the law, they can dig up evidence that you didn't obey the letter of the law (since GDPR is quite loose and ambiguous). But in that situation the regulator writes to you and asks you to come back into compliance. And so you then either write back and explain that you don't think you're not complying, or you write back with a plan to come back into compliance and ask if that's ok.
- godzillabrennus 9y agoI’m starting a company focused on consumer data. It’ll be opt in. I don’t have a lot of resources. I’ll just use Cloudflare to block Europe until I see if it works as a business elsewhere. If it does then I will add Europe by figuring out how to comply with the GDPR. Europe will get less innovation but have more privacy. Not sure what’s better for society but time will tell.
- midasz 9y ago> Europe will get less innovation but have more privacy You know Europeans can build software too right? The start-up culture is a lot less than in the USA - but we're getting there. Perhaps Americans will also realize the importance of privacy and data protection, and thus opt for European software. It's hard to predict.
- lwansbrough 9y agoUntil your competitors figure out they can sue you for non-compliance in your early stage, then you have to mount a defence proving that your software is in fact compliant, but by then it won't matter - your company is competing with an unrestricted American company that can profit off the data and is ready to acquire your company using the profits.
- hvidgaard 9y agoEU does not work as USA in that regard. No private entity can sue for anything relating to GDPR, that is up to the EU courts and the DPAs. What they can do it highlight issues with the appropriate DPAs and if you make reasonable efforts I doubt that much will come from it.
- leereeves 9y agoThere are many EU countries with enough corruption that a deep pocketed incumbent could "suggest" that a DPA bring suit.
- nickpp 9y agoWhen judging a burden to be reasonable or unreasonable for a company are you talking from the perspective of the business owner or simply as a spectator of the whole shit-show? Because things are quite different when you start digging and trying to implement GDPR as opposed to just reading about it.
- matthewmacleod 9y agoYeah, I’m pretty well-informed about what’s going on, and work for both a data-heavy tech company and a start-up. We’re implementing some changes to deal with the requirements, and it’s fine. I’ve yet to hear from anybody about what specifically is difficult to comply with, beyond “it’s all a mess” or “shit-show” etc.
- Arnt 9y agoInvariant Truth Number One: Any irritating issue in any sprint at any scrum shop will be described at shitshow, a mess, etc. Number Two: If your software's a mess, then unanticipated forced changes are a worse mess.
- StupidOne 9y agoFirstly - I yet have to get solid definition of "personal data". Is it my name or is it "1.8m tall guy in green T-shirt who is head of team X"? Definition is so blurred (or so board) you can virtually classify any data as personal.
- hvidgaard 9y agoWe go by the definition of "if it can be used to build a profile, it's PII". So your example is PII. If you want to store that information, anonymize it and you might actually don't have to do much to comply with GDPR.
- nickpp 9y agoDoes that include IP addresses? How do you anonymise it such as you can be sure it cannot "be used to build a profile"?
- Arnt 9y agoThe point you forgot: - Understand the big ball of legacy you've deployed over the years.
- hvidgaard 9y agoTough luck. Really, it's no excuse not to handle PII properly.
- Arnt 9y agoOh, I agree with that. But the phase-in could have been gentler on the unknown legacy software people do run.
- svennek 9y agoThe regulation has been known for years. BigCorps, I work with, have been working on this for years... If you start now, then you have a problem. Also, I expect there will be quite some years before the book is thrown on companies, that do not willfully disobey the law.. As most new major legislation, there is a long process of dialing it in (for the lack of better terms), and in most north- and western european contries (at least, I don't know that much about eastern and southern european) most regulatory handling is dialogue-based and not fine-based unless you are a black sheep..
- speedplane 9y agoI suspect that there are many contours of the law that European regulators are not entirely decided on. The next few years will be a learning process for them as well as the tech industry (and their lawyers).
- svennek 9y agoSure, that is what I meant by dialing in. But that is a process without fines (unless the companies are entirely unreasonable)... At least here in Denmark, the DPA is really reasonable and willing to work with the companies to get compliance...
- askvictor 9y agoFor company; sure. For a non-profit org, or for a smaller company in the field, the compliance costs might just be that extra burden that causes them to shut down. That's not to say the GDPR is a bad thing, but it's just a reality, that when retro-fitting it onto existing systems, will cause some of them to need to shut down, for better or worse. Change sometimes breaks things.
- huhtenberg 9y agoIs visitor's IP address a "data"? If yes, you can't have a web server log.
- worble 9y ago>you can't have a web server log Yes you can, you just need to take all possible precations to keep that data safe, which by and large means encrypting it properly and ensuring only people who need to have access to it have access to it.
- DanBC 9y agoAn IP address is only personal data if you can link it with other stuff to identify a natural person. If your weblogs are used to prevent crime (fraud, for example), you're allowed to keep them. People are making the mistake of thinking that "user permission" is the only reason you can keep data, but that's not true.
- megaman22 9y agoHow far does this go, though? For example, on my silly little blog, I've got logging for each http request that records the url hit, the ip address, and a browser user agent. I can trace that session through, and have a pretty good fingerprint of that user from that alone. If that person goes and sends me an email or leaves a comment with some tidbit of information that correlates (name, where they are from, email, what post they were reading, etc), have I now accidentally collected enough information that it violates GPDR?
- PuffinBlue 9y agoWhat do you mean 'violates GDPR'? GDPR doesn't necessarily make having such info illegal. It's more what you do with it and how you inform and allow the individual to control/delete it.
- extra88 9y agoSay the HN logs the ip, URL visited, and the referrer: 123.123.123.123 200 https://news.ycombinator.com/user?id=DanBC https://news.ycombinator.com/user?id=DanBC referrer https://news.ycombinator.com/news https://news.ycombinator.com/news 123.123.123.123 200 https://news.ycombinator.com/changepw https://news.ycombinator.com/changepw referrer https://news.ycombinator.com/user?id=DanBC https://news.ycombinator.com/user?id=DanBC This log now links this ip address to user account DanBC (since the change password link is only present on the page when the user themselves visits it). Your user page has information that identifies you as a natural person. Now what? It seems like anyone could be entitled to collect the logs to prevent fraud (and abuse). What about providing people with "their" data if they request it? If they want to delete their account, does that include deleting these lines in the logs?
- donttrack 9y agoI agree. It seems like people are mostly just looking for a reason to whine about the EU. There are lots of good reasons to whine about EU. I think the GDPR is not one of them.
- DanBC 9y agoYes. And some of the things that are shutting down probably wouldn't have come under GDPR compliance anyway (they were personal projects, not run as a business) or were aready violating existing law such as PECR.
- lwansbrough 9y agoThe burden is not about the technical processes of data protection. That is the least of my concern. The burden comes in the form of administration, continuous compliance (it is much more than what you listed!), managing takedown requests (especially when it's hard to verify a user's identity), and yes, getting sued, or having a lawsuit threatened. These are all real burdens that have nothing to do with the technical application of data security. So far the only response to real lawsuit concerns I've heard from GDPR defenders is "oh we don't sue people in the EU" -- WHAT? "Your honour, I was under the impression I wouldn't be sued, which is why I didn't make specific considerations for subsection 16 of article 6." sounds like a pretty shit defence to me.
- tripletao 9y agoThe defenders of the GDPR mostly have great faith in their government to enforce vague regulations in a reasonable manner. They're probably right, but: (a) That weakens the rule of law. It transfers power from the elected officials who draft and vote on laws to the agencies that enforce them. Most Americans think that's bad, and I agree. (Like, now that Trump is the American president, are you happy or sad that he finds his power limited by the judiciary? How sure are you that your own governments' regulators will always be staffed by people whose judgment you trust?) (b) The extraterritoriality is weird. Let's say Turkey passed a law banning criticism of Erdogan on any website accessible to people in Turkey, and tried to enforce a judgment against an EU national running such a website in the EU. I hope we'd then all agree that's not how international law works. What's the difference between that and the GDPR? Is it just that you think data privacy is good, and banning criticism of Erdogan is bad? I agree, but what's the legal framework here? What countries do you think have the right to impose a similar burden on the EU?
- dangerface 9y ago"Get explicit consent for keeping data" Thats the problem the internet runs on data and who decides what data is personal. For the past 20 years the MPAA has argued that IP's are personally identifiable and have won this argument in court cases, of course this is silly as it would make the internet illegal but that wont stop someone who has no idea how the internet works. The EU has tried to fix privacy on the internet before with explicit consent of cookies, now every website tells you they can use cookies and gets a default ok, I agree, go away popup, from every user in the EU. Will this stop facebook from spying on people tracking stuff that has nothing to do with facebook like who you phone? Nope, they make billions from spying on you and will spend a few million on lawyers to find them a loop hole. Edit: Someone in the office just had to accept a new privacy policy from Office 365, I assume its because of GDPR. The privacy policy was 25,000 words long, we don't have the legal knowledge or time to read and understand that. We have work to do so it was just accepted blindly. What data did he explicitly consent to Microsoft keeping? Without a team of expensive lawyers we don't and won't know.
- FabianBeiner 9y agoYes. YES. YES!
- deleted 9y ago[deleted]
- aregsarkissian 9y agoIt's not the burden that is the main issue. While complying may add more cost and complexity, the real issue is the additional risk of the possibility of getting sued for improper implementation.