5 ms·

When judging a burden to be reasonable or unreasonable for a company are you talking from the perspective of the business owner or simply as a spectator of the

by nickpp 9y ago

When judging a burden to be reasonable or unreasonable for a company are you talking from the perspective of the business owner or simply as a spectator of the whole shit-show? Because things are quite different when you start digging and trying to implement GDPR as opposed to just reading about it.

matthewmacleod 9y ago
Yeah, I’m pretty well-informed about what’s going on, and work for both a data-heavy tech company and a start-up. We’re implementing some changes to deal with the requirements, and it’s fine. I’ve yet to hear from anybody about what specifically is difficult to comply with, beyond “it’s all a mess” or “shit-show” etc.
- Arnt 9y ago
  Invariant Truth Number One: Any irritating issue in any sprint at any scrum shop will be described at shitshow, a mess, etc. Number Two: If your software's a mess, then unanticipated forced changes are a worse mess.
- StupidOne 9y ago
  Firstly - I yet have to get solid definition of "personal data". Is it my name or is it "1.8m tall guy in green T-shirt who is head of team X"? Definition is so blurred (or so board) you can virtually classify any data as personal.
  - hvidgaard 9y ago
    We go by the definition of "if it can be used to build a profile, it's PII". So your example is PII. If you want to store that information, anonymize it and you might actually don't have to do much to comply with GDPR.
    - nickpp 9y ago
      Does that include IP addresses? How do you anonymise it such as you can be sure it cannot "be used to build a profile"?
      - svennek 9y ago
        Why would you keep the ip-adress in the first place? If it is for fraud-prevention, then that is sufficient reason to keep it unanonymised...
        nickpp 9y ago
        3 reasons to keep the IP: statistics, analytics, and fraud prevention. Anonymizing it does not seem to solve anything, since the anonymized version "can be used to build a profile" so "it's PII"...
        hvidgaard 9y ago
        If the information can be used to build a profile linked to me, it's PII. If you do not and cannot link it to me, then it's no longer PII. That is kinda in the name, Personally Identifiable Information. In short, if the collection of information can point to me, it's PII. If it cannot point to me it's not PII.
        StupidOne 9y ago
        Problem is, if we take it to extreme, we are basically playing Cluedo game. Is "18 year old" PII? - no Is "orders pizza every Friday" PII? - no Is "always misspells word cheese" PII? - no Is "leaves 10% tip" PII? - no Combine it and you have PII.
        hvidgaard 9y ago
        And rightfully so. If the collection points to me, then it's PII. Anonymized it might be "is between 18-25 years old", "orders fast food once a week", "tips between 0-10%". Just because something it murky, doesn't mean businesses get to ignore it. The entire point is to force companies to actually think about what their data is and decide if they need to store PII. If they do it have implications. Have a reasonable explanation for choices, and are willing to rectify issues pointed out by consumers and/or DPA.
  - worble 9y ago
    Personal data is any data that can be used to identify the user, so yes "1.8m tall guy in green T-shirt who is head of team X" is absolutely personal data[0] (see specifically "an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;"). In general, and especially if you want to play it safe, any information the user gives you about themselves (this includes things they don't explicitly give you such as IP address) is considered personal data. [0]https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
  - biomene 9y ago
    > personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a home address, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer’s IP address. From the Wikipedia article about GDPR [1] [1]: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
    - DanBC 9y ago
      Not "relating to", but "can be used to identify a natural person". An IP addres, for example, isn't automatically personal data. It might be if you can link it with other information that can be used to identify someone.
  - oldcynic 9y ago
    Is it enough to identify a person? Name alone is probably not as many people share names, unless you have an unusual name. Add address and phone number and it will be. IP address on its own is not. Is "1.8m tall guy in green T-shirt who is head of team X" enough to identify them? If so it's personal data. Most of this applied to the Data Protection Act too. GDPR adds some items like biometrics
    - lwansbrough 9y ago
      Everything you mentioned is considered PII according to GDPR.
      - oldcynic 9y ago
        From GDPR itself: Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. My emphasis.
- nickpp 9y ago
  OK. I'll bite. Starting from your list of "straightforward compliance" here are a few things which a small business owner cannot figure our without an expensive lawyer. 1) Define "unless you have to". Am I allowed to keep business correspondence with a bad customer? With a prospective sale? With an old customer who may come back some day? 2) Define "data". Is the IP address any user sends to my site in order to simply access it "personal"? Does that mean I can't have logs? How about backups of those logs? Do I need to change the tools I am using that already generate logs? How straightforward is that? 3) Can I have analytics of my visitor base in order to optimize their experience? To understand churn and conversion rate? 5) Can I have statistics in my apps in order to understand and optimize their usage for the users? 6) Keeping data secure and allowing users to see and delete it will simply require other tools. That is not gonna be cheap or straightforward in any way. Now I am not saying this is impossible. I am just saying that it's expensive and difficult, especially for a small business. NOT straightforward.
  - DanBC 9y ago
    > Is the IP address any user sends to my site in order to simply access it "personal"? No. Something is only personal data if it can be used to identify a natural person.
    - nickpp 9y ago
      Are you willing to defend this answer in a court of law? Many GDPR lawyers disagree...
    - mstolpm 9y ago
      The IP address IS considered personal data by european courts. You can be compliant by either only storing an anonymized IP address (set the last/couple of last to 0) or by not storing the IP logs at all. However, there might be resonable situations where you need the full IP address and the GDPR allows to store it in this case, but only for a specific reason and a limited time, and only if you documented it so the user is aware about the process. Reasons could be fraud protection, consent documentation (mailing list opt-in), error handling and so on ... but not "we don't really need it but store the IP address anyways without informing our users". See here: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... "Examples of personal data: a name and surname; a home address; an email address such as name.surname@company.com; an identification card number; location data (for example the location data function on a mobile phone); an Internet Protocol (IP) address; a cookie ID; the advertising identifier of your phone; data held by a hospital or doctor, which could be a symbol that uniquely identifies a person."

by nickpp 9y ago

matthewmacleod 9y ago

Yeah, I’m pretty well-informed about what’s going on, and work for both a data-heavy tech company and a start-up. We’re implementing some changes to deal with the requirements, and it’s fine. I’ve yet to hear from anybody about what specifically is difficult to comply with, beyond “it’s all a mess” or “shit-show” etc.

Arnt 9y ago
Invariant Truth Number One: Any irritating issue in any sprint at any scrum shop will be described at shitshow, a mess, etc. Number Two: If your software's a mess, then unanticipated forced changes are a worse mess.
StupidOne 9y ago
Firstly - I yet have to get solid definition of "personal data". Is it my name or is it "1.8m tall guy in green T-shirt who is head of team X"? Definition is so blurred (or so board) you can virtually classify any data as personal.
- hvidgaard 9y ago
  We go by the definition of "if it can be used to build a profile, it's PII". So your example is PII. If you want to store that information, anonymize it and you might actually don't have to do much to comply with GDPR.
  - nickpp 9y ago
    Does that include IP addresses? How do you anonymise it such as you can be sure it cannot "be used to build a profile"?
    - svennek 9y ago
      Why would you keep the ip-adress in the first place? If it is for fraud-prevention, then that is sufficient reason to keep it unanonymised...
      - nickpp 9y ago
        3 reasons to keep the IP: statistics, analytics, and fraud prevention. Anonymizing it does not seem to solve anything, since the anonymized version "can be used to build a profile" so "it's PII"...
        hvidgaard 9y ago
        If the information can be used to build a profile linked to me, it's PII. If you do not and cannot link it to me, then it's no longer PII. That is kinda in the name, Personally Identifiable Information. In short, if the collection of information can point to me, it's PII. If it cannot point to me it's not PII.
        StupidOne 9y ago
        Problem is, if we take it to extreme, we are basically playing Cluedo game. Is "18 year old" PII? - no Is "orders pizza every Friday" PII? - no Is "always misspells word cheese" PII? - no Is "leaves 10% tip" PII? - no Combine it and you have PII.
        hvidgaard 9y ago
        And rightfully so. If the collection points to me, then it's PII. Anonymized it might be "is between 18-25 years old", "orders fast food once a week", "tips between 0-10%". Just because something it murky, doesn't mean businesses get to ignore it. The entire point is to force companies to actually think about what their data is and decide if they need to store PII. If they do it have implications. Have a reasonable explanation for choices, and are willing to rectify issues pointed out by consumers and/or DPA.
- worble 9y ago
  Personal data is any data that can be used to identify the user, so yes "1.8m tall guy in green T-shirt who is head of team X" is absolutely personal data[0] (see specifically "an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;"). In general, and especially if you want to play it safe, any information the user gives you about themselves (this includes things they don't explicitly give you such as IP address) is considered personal data. [0]https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
- biomene 9y ago
  > personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a home address, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer’s IP address. From the Wikipedia article about GDPR [1] [1]: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
  - DanBC 9y ago
    Not "relating to", but "can be used to identify a natural person". An IP addres, for example, isn't automatically personal data. It might be if you can link it with other information that can be used to identify someone.
- oldcynic 9y ago
  Is it enough to identify a person? Name alone is probably not as many people share names, unless you have an unusual name. Add address and phone number and it will be. IP address on its own is not. Is "1.8m tall guy in green T-shirt who is head of team X" enough to identify them? If so it's personal data. Most of this applied to the Data Protection Act too. GDPR adds some items like biometrics
  - lwansbrough 9y ago
    Everything you mentioned is considered PII according to GDPR.
    - oldcynic 9y ago
      From GDPR itself: Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. My emphasis.
nickpp 9y ago
OK. I'll bite. Starting from your list of "straightforward compliance" here are a few things which a small business owner cannot figure our without an expensive lawyer. 1) Define "unless you have to". Am I allowed to keep business correspondence with a bad customer? With a prospective sale? With an old customer who may come back some day? 2) Define "data". Is the IP address any user sends to my site in order to simply access it "personal"? Does that mean I can't have logs? How about backups of those logs? Do I need to change the tools I am using that already generate logs? How straightforward is that? 3) Can I have analytics of my visitor base in order to optimize their experience? To understand churn and conversion rate? 5) Can I have statistics in my apps in order to understand and optimize their usage for the users? 6) Keeping data secure and allowing users to see and delete it will simply require other tools. That is not gonna be cheap or straightforward in any way. Now I am not saying this is impossible. I am just saying that it's expensive and difficult, especially for a small business. NOT straightforward.
- DanBC 9y ago
  > Is the IP address any user sends to my site in order to simply access it "personal"? No. Something is only personal data if it can be used to identify a natural person.
  - nickpp 9y ago
    Are you willing to defend this answer in a court of law? Many GDPR lawyers disagree...
  - mstolpm 9y ago
    The IP address IS considered personal data by european courts. You can be compliant by either only storing an anonymized IP address (set the last/couple of last to 0) or by not storing the IP logs at all. However, there might be resonable situations where you need the full IP address and the GDPR allows to store it in this case, but only for a specific reason and a limited time, and only if you documented it so the user is aware about the process. Reasons could be fraud protection, consent documentation (mailing list opt-in), error handling and so on ... but not "we don't really need it but store the IP address anyways without informing our users". See here: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... "Examples of personal data: a name and surname; a home address; an email address such as name.surname@company.com; an identification card number; location data (for example the location data function on a mobile phone); an Internet Protocol (IP) address; a cookie ID; the advertising identifier of your phone; data held by a hospital or doctor, which could be a symbol that uniquely identifies a person."