4 ms·

Why? Article 2c (excemptions): "by a natural person in the course of a purely personal or household activity"

SyneRyder 8y ago
Some of his blog also discusses his technical work, so it can be debated whether it is or is not "purely personal or household". Either way, it's vaguely worded enough that for someone who doesn't want to deal with compliance and laws and doesn't want to pay a lawyer just to know if they can keep writing a blog, the path of least resistance is just to delete everything.
- svennek 8y ago
  That is crystal clear personal activity to me. Also which protection worthy data does the comments contain? Most likely none.
  - SyneRyder 8y ago
    Email addresses, account user names (especially if they commented by logging in via Twitter account). Personal website URLs if they included it. Maybe IP addresses on the server end but hopefully not. All of those are personally identifiable user data.
    - DanBC 8y ago
      Please stop saying IP addresses are personal data. They might be.
      - SyneRyder 8y ago
        Yes, you are totally correct. It could be personally identifiable if it's a static IP or something, but most often it isn't entirely personal. You are right. I apologize.
    - svennek 8y ago
      And all of those are allowed (usually) due to normal "business-as-usual use" (fraud/spam prevention). And as said, a personal blog is except by definition... (edit: they are allowed, not excempt due to normal-use)
georgebarnett 8y ago
> Why? I doubt these people have actually read the law. Its always easier to overreact and panic, rather than adopt a measured response.
- andygates 8y ago
  That's certainly the traditional response when complaining about Health & Safety legislation. Whine and overreact and get it wrong.
- seszett 8y ago
  I'm pretty sure most overreacting responses I am reading about come from Americans and little-used services. I think many of them might just be trying to get some kind of publicity and sympathy, playing on the "regulation is bad" theme. None of the actual businesses I work with, in Europe, most of which actually do handle personal data, are actually worried or even annoyed (much less considering shutting down). From what I see, these overreactions are also in great part due to a lack of understanding of how law works outside the US - ie. maximum fines are just a maximum, letter of the law is not what counts most, the government isn't out to get you, judges don't have any incentive to extract money from you, etc.
- Mirioron 8y ago
  But that's part of it: it's better to be safe than sorry. Having comments on your blog has very marginal benefits for you, but if you feel the risk is large, then just delete them. No single blog losing comments matters much, but in aggregate it can be a shift in culture to less discussion.
  - georgebarnett 8y ago
    I doubt it. We had plenty of discussion before comments on blogs. If anything, I’d prefer an internet without inane comments from mouth breathers.
dageshi 8y ago
If the blog has ads on it, is it still defined as "purely personal"? If the answer is "I'm not sure", why take the risk?
- DanBC 8y ago
  A blog with ads that isn't compliant with GDPR is probably already not compliant with PECR or DPA.
- svennek 8y ago
  No, but why not skip the ads then? Either you earn pennies (and it shouldn't matter) or you should follow the commercial rules...
  - dageshi 8y ago
    Or block everyone in the EU from your content perhaps, which would also solve the problem.
    - svennek 8y ago
      Except perhaps that BigCorp employees might exit their corporate network from an non-EU address, but they are still EU citizen and hence protected... If you want to block them, you would most likely have to ask them their nationality or require them to attest that they are not from within the EU...
  - Mirioron 8y ago
    Because those "pennies" can and do matter when your monthly income is 500 euros otherwise.

Some of his blog also discusses his technical work, so it can be debated whether it is or is not "purely personal or household". Either way, it's vaguely worded enough that for someone who doesn't want to deal with compliance and laws and doesn't want to pay a lawyer just to know if they can keep writing a blog, the path of least resistance is just to delete everything.

svennek 8y ago
That is crystal clear personal activity to me. Also which protection worthy data does the comments contain? Most likely none.
- SyneRyder 8y ago
  Email addresses, account user names (especially if they commented by logging in via Twitter account). Personal website URLs if they included it. Maybe IP addresses on the server end but hopefully not. All of those are personally identifiable user data.
  - DanBC 8y ago
    Please stop saying IP addresses are personal data. They might be.
    - SyneRyder 8y ago
      Yes, you are totally correct. It could be personally identifiable if it's a static IP or something, but most often it isn't entirely personal. You are right. I apologize.
  - svennek 8y ago
    And all of those are allowed (usually) due to normal "business-as-usual use" (fraud/spam prevention). And as said, a personal blog is except by definition... (edit: they are allowed, not excempt due to normal-use)

georgebarnett 8y ago

> Why? I doubt these people have actually read the law. Its always easier to overreact and panic, rather than adopt a measured response.

andygates 8y ago
That's certainly the traditional response when complaining about Health & Safety legislation. Whine and overreact and get it wrong.
seszett 8y ago
I'm pretty sure most overreacting responses I am reading about come from Americans and little-used services. I think many of them might just be trying to get some kind of publicity and sympathy, playing on the "regulation is bad" theme. None of the actual businesses I work with, in Europe, most of which actually do handle personal data, are actually worried or even annoyed (much less considering shutting down). From what I see, these overreactions are also in great part due to a lack of understanding of how law works outside the US - ie. maximum fines are just a maximum, letter of the law is not what counts most, the government isn't out to get you, judges don't have any incentive to extract money from you, etc.
Mirioron 8y ago
But that's part of it: it's better to be safe than sorry. Having comments on your blog has very marginal benefits for you, but if you feel the risk is large, then just delete them. No single blog losing comments matters much, but in aggregate it can be a shift in culture to less discussion.
- georgebarnett 8y ago
  I doubt it. We had plenty of discussion before comments on blogs. If anything, I’d prefer an internet without inane comments from mouth breathers.

dageshi 8y ago

If the blog has ads on it, is it still defined as "purely personal"? If the answer is "I'm not sure", why take the risk?

DanBC 8y ago
A blog with ads that isn't compliant with GDPR is probably already not compliant with PECR or DPA.
svennek 8y ago
No, but why not skip the ads then? Either you earn pennies (and it shouldn't matter) or you should follow the commercial rules...
- dageshi 8y ago
  Or block everyone in the EU from your content perhaps, which would also solve the problem.
  - svennek 8y ago
    Except perhaps that BigCorp employees might exit their corporate network from an non-EU address, but they are still EU citizen and hence protected... If you want to block them, you would most likely have to ask them their nationality or require them to attest that they are not from within the EU...
- Mirioron 8y ago
  Because those "pennies" can and do matter when your monthly income is 500 euros otherwise.