12 ms·

2018 reform of EU data protection rules

132 points by Geekette 8y ago

Geekette 8y ago
An important one to note as it's applicable to all businesses whose customers include EU residents because it addresses the collection and processing of their personal data locally and internationally.
- the_mitsuhiko 8y ago
  I honestly can't wait to ask my local retailer what data they have on me based on their loyalty cards. So far they were exempt from data disclosure laws because they were not an IT company.
  - StavrosK 8y ago
    Ooh, I never thought of that, but now I am very very excited about it myself.
    - amelius 8y ago
      But the answer you get might be less exciting. They might say: "We know you bought A, B, and C". What if they give you only part of what they know? How would you be able to tell if they know more? And even if you could, how would you convince authorities that something is wrong?
      - amelius 8y ago
        Also, they may have data that they just didn't "mine" yet. This may be data that they simply can't give you because it may concern you AND other people.
  - tobltobs 8y ago
    I would assume that he has all the data on you, you ever gave him. What else did you do expect when you signed up for the loyalty program?
    - wlll 8y ago
      > him I think we're probably talking about national chains here. I would imagine stores will use the loyalty cards to profile users, and if they've every stored any of the profiling data then this data will be the data you will be getting.
  - bennyp101 8y ago
    If you are in the UK, you can already ask for the information under the DPA.
    - outsideoflife 8y ago
      But they could charge you a reasonable fee before. Now it will be free!
  - Geekette 8y ago
    Yes, grocery loyalty cards amass an inordinate amount of data on its users based on frequency and nature of use. It's interesting how the lower ticket loyalty schemes (grocery stores, etc) have arguably more powerful info than the higher-end types (air mile clubs, etc) for this reason; you can get more insight on a granular level.
  - yread 8y ago
    I always lose my loyalty card from time to time (it doesn't have any loyalty advantages you just have to have it to get the discounts) and ask for a new one. I wonder if they were able to link them back together
    - amelius 8y ago
      I always switch my loyalty cards with random people I meet on the subway, etc.
    - viraptor 8y ago
      Unless you always pay cash - it should be trivial to link by the payment card number.
      - yread 8y ago
        Do they actually see a card number? Anyway, I have a couple and I have a habit of losing/breaking those as well. I'm just really bad at holding on to cards it seems
    - UncleEntity 8y ago
      I always just use the phone number approach -- give them <local-area-code> 867-5309 an when they ask "yeah, I'm Jenny". Works every time. Last time at the Walgreens they tried to give me a $5 discount but I had to know the zip code assigned to the account so was like "nah, next time."
- donohoe 8y ago
  I do not believe that is correct. Right now, for example, if you are a US business with no offices or employees in EU jurisdiction then there is little the EU can do if you are not GDPR compliant - regardless of whether you deal with EU traffic or not. The EU might wish their laws were global, but that doesn’t make it so. #notalawyer
  - Cthulhu_ 8y ago
    You're not wrong, but, what internet company doesn't operate within the EU? If you operate in the EU, and handle EU citizen's data, you have to conform to the GDPR. I don't think there's many internet companies that would not serve the EU because of it. Although, Google did pull out of China due to the censorship demands and the like.
    - BillinghamJ 8y ago
      If you have users in the EU, but no actual physical or legal presence whatsoever within the EU, technically you "have to" comply. But if you do not do so, there will not be any consequences. As such, effectively it is not in scope and does not need to be considered. However there are cases where you might still run into trouble. For example, if you accept payments from people in the EU, you may well end up being forced to comply via the payment networks' presence in the EU.
    - donohoe 8y ago
      Hmm. You just agreed with me and then disagreed me :) Again, I say this as someone who is implementing GDPR for a US-based company, and is also a EU citizen (Irish) and has sat more meetings with various legal groups than I care to remember (again, stress I'm not a lawyer). It is all about a companies appetite for risk and how tied the are __PHYSICALLY__ to the EU (offices/employees/parent-companies/subsidiaries). This also gets into areas of Extraterritorial Jurisdiction. Any country can claim this over any other territory they wish. But, for the claim to be effective (except by use of force), it must be agreed either with the legal authority of the country. Right now there appears to be none. No one is clearly citing any treaty with the EU as giving them this authority.
- dnomad 8y ago
  This is not true. Just read the regulation. It's pretty clear that unless you're located in the EU or you're pursuing EU residents then the GDPR does not apply to you. Logically, it should be clear that the GDPR cannot apply to any business who an EU citizen stumbles upon and decides to buy something. The entire motivation of the GDPR is to prevent surveillance of EU residents with respect to their actions in the Union.
  - Geekette 8y ago
    Mechanisms of enforcement is another discussion but the regulation clearly asserts the scope of data protection as global; it's applicable to all foreign companies processing data of EU residents, whether the companies are based in the EU or not.
  - Sylos 8y ago
    It is true. Article 3.2 reads: This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: - the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or - the monitoring of their behaviour as far as their behaviour takes place within the Union.
config_yml 8y ago
Nice guidelines, seems like for most small businesses it will be straight forward to be GDPR compliant
- tradedash 8y ago
  you are vastly underestimating the ease of implementation
  - outsideoflife 8y ago
    Depends on your business. I didn't find it as hard as PCI compliance for instance
    - saryant 8y ago
      Unless you actually maintain full payment account numbers, PCI compliance pretty much boils down to "I pinky-swear I'm not doing anything wrong" and the rules have virtually no teeth.
  - matthewmacleod 8y ago
    What’s going to be difficult?
- deleted 8y ago
  [deleted]
- donohoe 8y ago
  Maybe if you don't have ads on your site, otherwise its going to be a problem.
  - viraptor 8y ago
    Why do you think so? After you document/publish what information you pass to which network, what problems do you expect related to the ads?
    - 8y ago
bennyp101 8y ago
And for a nice easy to read version of the regulation; http://gdpr-info.eu/ http://gdpr-info.eu/
- deleted 8y ago
  [deleted]
- a_bonobo 8y ago
  With the minor caveat that gdpr-info.eu looks official due to the .eu domain, but is actually run by 'intersoft consulting services AG' as advertising for their consulting service (the content is just the laws of course)
  - bennyp101 8y ago
    True. (although I wouldn't associate .eu with anything being official) I just like it as it is broken up nicely and has links to any relevant recitals and deregations etc
meinstream 8y ago
This guide does not clarify one important question: Does a company in the EU have to apply gdpr guidelines for none European users. If so, this would be a significant disadvantage for all European companies since their none European competitors obviously only have to comply for European users. One scenario in which this would be very relevant: A website needs to show a very long consent form to users that want to use their service, under gdpr regulation. Under gdpr these consent forms are very alarming and they will have a drop-off rate. The drop-off rate of the form will be the competitive advantage of none European companies. Hence, will we see an exodus of European startups from Europe to the US?
- the_mitsuhiko 8y ago
  > This guide does not clarify one important question: Does a company in the EU have to apply gdpr guidelines for none European users Does it really matter? Just give all users a fair treatment.
  - meinstream 8y ago
    +1 for fair user treatment, but the way the laws are written, companies that serve users globally from within the EU will have a hard time competing with their international competitors under the new regulation. I just wonder if European law makers have thought this through.
    - tscs37 8y ago
      I think in the current situation, having strong privacy for all users will be a feature you can bring to the market, especially for US users it can be a big plus since the US doesn't have any comparable privacy law.
      - freeone3000 8y ago
        How do you communicate this? Most people don't care.
Dayshine 8y ago
Enforcement factsheet: https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-role-edpb_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d... Pretty clearly primarily enforced by national regulatory agencies, who are the only ones who can apply fines. It mentions citizens taking companies to court, but https://ec.europa.eu/commission/sites/beta-political/files/data-protection-overview-citizens_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d... says that's for monetary damages, not for fines. This is unchanged from previous laws. Can people stop freaking out now?
- tobltobs 8y ago
  In Germany offenses against the GDPR can cause a "Abmahnung" which do not result in a fine but a charge. There a legions of filthy lawyers waiting for the 25.5.
  - nils-m-holm 8y ago
    This is a big problem here in Germany and might very well be a reason to shut down my site on 5/24.
    - nils-m-holm 8y ago
      Would the downvoters care to explain what offended them? Looking the other way does not help solve a problem.
      - Dayshine 8y ago
        Well, my immediate thoughts in response to that reply were: "Why is some extra law specific to Germany relevant to my comment? This is a discussion about the GDPR, not about national data protection laws."
        nils-m-holm 8y ago
        It's not about national laws, it's about the implementation of the GDPR on a national level (namely C&D letters).
deleted 8y ago
[deleted]
grantlmiller 8y ago
This is a great resource because it is from the EU, provides clear examples, cites the actual legislation and Article 29 Working Party Guidelines (which is the group that is tasked with preparing official opinions on GDPR). I think that if you want to really comprehend something, you should go to the primary source. The GDPR legislation is far more approachable than it seems (as an official 261 page PDF). When the preamble and the mechanical bits about how the GDPR will be governed are removed, the parts that important to companies are only 34 pages long. You can use this to guide your reading: https://www.enterpriseready.io/gdpr/how-to-read-gdpr/ https://www.enterpriseready.io/gdpr/how-to-read-gdpr/
- Silhouette 8y ago
  I respectfully disagree. This is a terrible resource, which frequently says things that are either mostly vacuous or just plain wrong. For example, here's their page on the right to erasure: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/dealing-citizens/do-we-always-have-delete-personal-data-if-person-asks_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Its opening paragraph reads as if data subjects have an automatic right to have their data deleted unless one of the three exceptions applies. In fact, Article 17 of the GDPR itself grants that right only under a list of specific circumstances, and the exceptions are just that, which is an entirely different situation that will lead to the opposite decision on whether data must be erased in many normal situations. Even the list of exceptions shown isn't complete. For another example, here's their page on demonstrating compliance: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/how-can-i-demonstrate-my-organisation-compliant-gdpr_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... There is literally nothing on that page that would help any business I'm dealing with to demonstrate compliance, unless you count the references to the primary sources at the end. There are a couple of ideas about codes of conduct or certifications that contain no substantial details, and even the vague hints about other things you might have to do don't go into any detail about who does or doesn't, leaving the entire page almost entirely content-free unless you happen to be in an industry where the kind of scheme they mention exists. This sort of "guidance" is everything that is wrong with how the GDPR is being handled. It is verbose, ambiguous, sometimes seriously misleading, and almost entirely non-actionable. I'm actually worse off than I was before I read it, because I know nothing useful now that I didn't know before, I would have been misled by several of the pages such as the one I mentioned above if I hadn't already known better, and that's still half an hour of my life wasted.
donohoe 8y ago
First, I am not a lawyer. I don't even play one on TV. The big question I keep hearing is; I'm in the US (or other non-EU country), does GDPR apply to my company or organization? The shortest possible answer is: Maybe :) The answer is: YES if your company has a physical or legal presence (like an office, employee, parent-company, subsidiary, etc.) in an EU country. The GDPR applies to you and you need to to start reading up ASAP as you only have a few weeks to figure this all out. The answer is likley: NO (but be careful here) if you have no physical or legal presence in the EU. Bonus points if your business isn't really aimed at the EU. The answer is likley still: NO if again, you have no physical or legal presence in the EU but do rely on EU traffic as a direct or significant part of your business. At that point is all about how much risk you're willing to take on as we see how this law is interpreted. Any country can claim this over any other territory they wish. But that doesn't make it true. For the claim to be effective (except by use of force), it must be agreed either with the legal authority of the country. Right now there appears to be none. No one is clearly citing any treaty with the EU as giving them this authority. Disclaimer: This isn't legal advice. This is my personal view on a complicated issue that I'm trying to discuss in order to learn more myself.
- bennyp101 8y ago
  I think the problem for orgs in non EU and non Third Countries is that a lot of EU based orgs will be (or already done so) moving as much as possible to providers that are GDPR compliant - or offer assurances that satisfy the GDPR (Like the Privacy Shield) So by not being compliant, or at least offering a way for orgs that are compelled to follow GDPR to be compliant, they will start to miss out on business from B2B or B2C. Especially after May 25th, there are already radio and TV adverts about it here in the UK, and I imagine that a lot of consumers are going to start questioning this before they use a service
  - donohoe 8y ago
    Yes - and I hope they do! I'm a big fan of this law, but I also see a lot of panic and inaccurate claims being made.
- mattmanser 8y ago
seanalltogether 8y ago
How does this affect server logs? Under the "what is personal data" section they list ip addresses as personal data.
- matthewmacleod 8y ago
  It requires you to have a management and retention policy for server logs which contain personal data.
- bennyp101 8y ago
  Do you have a legitimate reason for storing that data? Probably not, so just stop it from being logged.
  - snowwolf 8y ago
    Yes. One of the key parts of GDPR is breach reporting. Assume you discover your company has been breached. How do you investigate the breach? Discover who was impacted, what was done and by whom? Is that significantly harder/impossible if your logs don't contain IP addresses? Edit: Also consider Log retention. Yahoo discovered a data breach 3 years after it happened. What if they'd only kept logs for 1 year.
  - dwild 8y ago
    Never have been in a DDOS attack? Good luck doing anything without getting the IP. It's useful to know where the requests come from too. You get a bunch of request from IP that come from a specific peer and that peer is saturated? How could you verify that without a log? You want to add CDN to the right locations. Where should you? Really, I think it's just make more sense for any small company to block EU and when you have the means to do it correctly (with the help of a competent DPO), then yeah add that EU in your market.
- dbbk 8y ago
  Don't log ip addresses, or anonymise them.
  - 8y ago
Matticus_Rex 8y ago
PSA: Please make sure you're not relying on HN comments for your understanding of the GDPR if you're the one responsible in your organization. I need to get back to all the panicked questions CS has forwarded to me (the DPO equivalent for my company), but please understand that there's a lot of misunderstanding in every HN thread on this topic.
- akvadrako 8y ago
  To generalise this, there's a lot of misunderstanding in every HN thread on most every topic.
- oblio 8y ago
  Heh, I'd say that it's even worse than "misunderstanding". Besides honest misunderstanding, there's so much FUD being spread by people on HN who are afraid that their greedy data manipulation plan for a startup has been completely foiled... So much FUD that you definitely feel sometimes that the comments are straight out of http://n-gate.com/ http://n-gate.com/ Caricaturizing (a bit): "HN1: The GDPR takes away our freedom to make tons of money from your private data! Dirty EU commies and their superstate imposing their law worldwide! HN2: The law doesn't apply worldwide and it protects my privacy. Just block users which are geographically in the EU. Also, read the law, it's only 60 page and more readable than most RFCs. HN2: Nah, I'm good, I'll just rely on internet FUD as my main source of info. Dirty EU commie bureaucrats!" PS: Obviously not all comments are misguided, but good God, there's soooooo many which miss the mark by a mile...
  - deleted 8y ago
    [deleted]
  - DonbunEf7 8y ago
    Please do not violate the Prime Directive. Thanks.
    - oblio 8y ago
      > Be civil. Don't say things you wouldn't say face-to-face. Don't be snarky. Comments should get more civil and substantive, not less, as a topic gets more divisive. I was snarky but it is definitely something I would say to you face-to-face. The quality of discussion around the GDPR here on HN was not up to the standard quality. Part of it was because, in my opinion, a lot of people here are entrepreneurs and this made them really subjective and almost blind-sided them to the benefits for users. The GDPR is not perfect but it's a great long term measure, one I hope will be followed (and improved upon!) by other administrations.
cromulen 8y ago
Does anyone have an example of the "documentation of data processing activities"? Edit: Especially in the context of a company that does not handle/store customer data, but only employee info.
- grabeh 8y ago
  https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/documentation/ https://ico.org.uk/for-organisations/guide-to-the-general-da... The above link contains a sample Excel template with details of the various information a record of processing should contain. If you are only processing employee data this should be straightforward. It's a link to the ICO, the UK's data protection authority, but it should be useful regardless of where you are (assuming GDPR applies to you of course!).
LoSboccacc 8y ago
> what is personal data > an Internet Protocol (IP) address; Told ya suckers for months. Keep believing they aren't at your risk. Previously: https://news.ycombinator.com/item?id=16910301 https://news.ycombinator.com/item?id=16910301
- frockington 8y ago
  Can't wait for the pile of lawsuits to appear over this one
0x4f3759df 8y ago
Can the average lawyer get rich off this? Can lawyer A (who is not affiliated with the EU government) sue Company B on behalf of the users and get a payday? For reference, I read a thread where a guy in my town sues businesses for violating the ADA and the settlement is like loser must fix steps and pay plaintiff some compensation. Maybe its this story or maybe its another guy: http://www.startribune.com/st-paul-landlord-wins-case-against-serial-ada-litigant/370215081/ http://www.startribune.com/st-paul-landlord-wins-case-agains... , actually I think its this guy http://www.startribune.com/doctor-lawyer-wheelchair-user-it-s-the-same-person-and-he-s-filing-disability-lawsuits-by-the-bundle/381330311/ http://www.startribune.com/doctor-lawyer-wheelchair-user-it-...
- frockington 8y ago
  Sue every European company on the basis of logging IPs, should be free money for lawyers
tokyodude 8y ago
So .... github, sourceforce, bitbucket. When someone asks to delete their data do all their commits have to be deleted or edited to remove their name from the commit logs? How about changelog if the project has one? Comments from source? I'm guessing you'll say "no, because they agreed to open source their data" but how is that any different from agreeing to so-and-so's terms of service? In the same manor what happens to wikis and wikipedia when a user wants to delete their data? If the data was copied by another user does that data become their's to keep or does that need to be deleted too? Example: Jill sends Karen Jill's address via Facebook. Jill want's all of Jill's data deleted from Facebook. Does Jill's address she sent to Karen have to be deleted? Pictures? Pre-internet that data would be on a piece of paper in Karen's possession. Now it's less clear as it's really in Facebook's possession and Karen just has access to the data on Facebook's servers. As Karen I'd be upset if what I considered my data (my copy of Karen's address) to be deleted but is that clear in the GDPR?
- guitarbill 8y ago
  Let's stop coming up with stupid, stupid examples where you have spend more time thinking about how to troll than thinking how the GDPR applies. (Hint: The right to erasure is not absolute, and applies to personal data.)
  - tokyodude 8y ago
    And what is personal data? this problem exists even without the GDPR, my question is does the GDPR make it law in the EU. In Google Docs if Jill shares a document with Karen and then Jill deletes her account Karen will lose access to the Jill's document. That situation doesn't map to the real world where sharing a document meant Jill sending Karen a physical copy. Personally I consider it a bug given it doesn't fit expectations from the real world. If a document shows up in Karen's files it's Karen's copy of that document. Karen shouldn't have to track which docs are actual copies and which are still considered Jill's. In any case given it's possible to delete Jill's data from Google is Google required to delete the document from Karen's account even if Karen has made a copy? Where is this covered? It's not really Karen's copy, both are Google's copy. It's on their servers. This is not trolling. This is trying to understand the GDPR.
zerostar07 8y ago
The more i read about it the more it seems like gdpr will either - cause an uproar from small and middle-size businesses in europe - not become enforced the facebooks and amazons of the world are already fine so they won't complain.

132 points by Geekette 8y ago

An important one to note as it's applicable to all businesses whose customers include EU residents because it addresses the collection and processing of their personal data locally and internationally.

the_mitsuhiko 8y ago
I honestly can't wait to ask my local retailer what data they have on me based on their loyalty cards. So far they were exempt from data disclosure laws because they were not an IT company.
- StavrosK 8y ago
  Ooh, I never thought of that, but now I am very very excited about it myself.
  - amelius 8y ago
    But the answer you get might be less exciting. They might say: "We know you bought A, B, and C". What if they give you only part of what they know? How would you be able to tell if they know more? And even if you could, how would you convince authorities that something is wrong?
    - amelius 8y ago
      Also, they may have data that they just didn't "mine" yet. This may be data that they simply can't give you because it may concern you AND other people.
- tobltobs 8y ago
  I would assume that he has all the data on you, you ever gave him. What else did you do expect when you signed up for the loyalty program?
  - wlll 8y ago
    > him I think we're probably talking about national chains here. I would imagine stores will use the loyalty cards to profile users, and if they've every stored any of the profiling data then this data will be the data you will be getting.
- bennyp101 8y ago
  If you are in the UK, you can already ask for the information under the DPA.
  - outsideoflife 8y ago
    But they could charge you a reasonable fee before. Now it will be free!
- Geekette 8y ago
  Yes, grocery loyalty cards amass an inordinate amount of data on its users based on frequency and nature of use. It's interesting how the lower ticket loyalty schemes (grocery stores, etc) have arguably more powerful info than the higher-end types (air mile clubs, etc) for this reason; you can get more insight on a granular level.
- yread 8y ago
  I always lose my loyalty card from time to time (it doesn't have any loyalty advantages you just have to have it to get the discounts) and ask for a new one. I wonder if they were able to link them back together
  - amelius 8y ago
    I always switch my loyalty cards with random people I meet on the subway, etc.
  - viraptor 8y ago
    Unless you always pay cash - it should be trivial to link by the payment card number.
    - yread 8y ago
      Do they actually see a card number? Anyway, I have a couple and I have a habit of losing/breaking those as well. I'm just really bad at holding on to cards it seems
  - UncleEntity 8y ago
    I always just use the phone number approach -- give them <local-area-code> 867-5309 an when they ask "yeah, I'm Jenny". Works every time. Last time at the Walgreens they tried to give me a $5 discount but I had to know the zip code assigned to the account so was like "nah, next time."
donohoe 8y ago
I do not believe that is correct. Right now, for example, if you are a US business with no offices or employees in EU jurisdiction then there is little the EU can do if you are not GDPR compliant - regardless of whether you deal with EU traffic or not. The EU might wish their laws were global, but that doesn’t make it so. #notalawyer
- Cthulhu_ 8y ago
  You're not wrong, but, what internet company doesn't operate within the EU? If you operate in the EU, and handle EU citizen's data, you have to conform to the GDPR. I don't think there's many internet companies that would not serve the EU because of it. Although, Google did pull out of China due to the censorship demands and the like.
  - BillinghamJ 8y ago
    If you have users in the EU, but no actual physical or legal presence whatsoever within the EU, technically you "have to" comply. But if you do not do so, there will not be any consequences. As such, effectively it is not in scope and does not need to be considered. However there are cases where you might still run into trouble. For example, if you accept payments from people in the EU, you may well end up being forced to comply via the payment networks' presence in the EU.
  - donohoe 8y ago
    Hmm. You just agreed with me and then disagreed me :) Again, I say this as someone who is implementing GDPR for a US-based company, and is also a EU citizen (Irish) and has sat more meetings with various legal groups than I care to remember (again, stress I'm not a lawyer). It is all about a companies appetite for risk and how tied the are __PHYSICALLY__ to the EU (offices/employees/parent-companies/subsidiaries). This also gets into areas of Extraterritorial Jurisdiction. Any country can claim this over any other territory they wish. But, for the claim to be effective (except by use of force), it must be agreed either with the legal authority of the country. Right now there appears to be none. No one is clearly citing any treaty with the EU as giving them this authority.
dnomad 8y ago
This is not true. Just read the regulation. It's pretty clear that unless you're located in the EU or you're pursuing EU residents then the GDPR does not apply to you. Logically, it should be clear that the GDPR cannot apply to any business who an EU citizen stumbles upon and decides to buy something. The entire motivation of the GDPR is to prevent surveillance of EU residents with respect to their actions in the Union.
- Geekette 8y ago
  Mechanisms of enforcement is another discussion but the regulation clearly asserts the scope of data protection as global; it's applicable to all foreign companies processing data of EU residents, whether the companies are based in the EU or not.
- Sylos 8y ago
  It is true. Article 3.2 reads: This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: - the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or - the monitoring of their behaviour as far as their behaviour takes place within the Union.

config_yml 8y ago

Nice guidelines, seems like for most small businesses it will be straight forward to be GDPR compliant

tradedash 8y ago
you are vastly underestimating the ease of implementation
- outsideoflife 8y ago
  Depends on your business. I didn't find it as hard as PCI compliance for instance
  - saryant 8y ago
    Unless you actually maintain full payment account numbers, PCI compliance pretty much boils down to "I pinky-swear I'm not doing anything wrong" and the rules have virtually no teeth.
- matthewmacleod 8y ago
  What’s going to be difficult?
deleted 8y ago
[deleted]
donohoe 8y ago
Maybe if you don't have ads on your site, otherwise its going to be a problem.
- viraptor 8y ago
  Why do you think so? After you document/publish what information you pass to which network, what problems do you expect related to the ads?
  - 8y ago

bennyp101 8y ago

And for a nice easy to read version of the regulation; http://gdpr-info.eu/ http://gdpr-info.eu/

deleted 8y ago
[deleted]
a_bonobo 8y ago
With the minor caveat that gdpr-info.eu looks official due to the .eu domain, but is actually run by 'intersoft consulting services AG' as advertising for their consulting service (the content is just the laws of course)
- bennyp101 8y ago
  True. (although I wouldn't associate .eu with anything being official) I just like it as it is broken up nicely and has links to any relevant recitals and deregations etc

meinstream 8y ago

This guide does not clarify one important question: Does a company in the EU have to apply gdpr guidelines for none European users. If so, this would be a significant disadvantage for all European companies since their none European competitors obviously only have to comply for European users. One scenario in which this would be very relevant: A website needs to show a very long consent form to users that want to use their service, under gdpr regulation. Under gdpr these consent forms are very alarming and they will have a drop-off rate. The drop-off rate of the form will be the competitive advantage of none European companies. Hence, will we see an exodus of European startups from Europe to the US?

the_mitsuhiko 8y ago
> This guide does not clarify one important question: Does a company in the EU have to apply gdpr guidelines for none European users Does it really matter? Just give all users a fair treatment.
- meinstream 8y ago
  +1 for fair user treatment, but the way the laws are written, companies that serve users globally from within the EU will have a hard time competing with their international competitors under the new regulation. I just wonder if European law makers have thought this through.
  - tscs37 8y ago
    I think in the current situation, having strong privacy for all users will be a feature you can bring to the market, especially for US users it can be a big plus since the US doesn't have any comparable privacy law.
    - freeone3000 8y ago
      How do you communicate this? Most people don't care.

Dayshine 8y ago

Enforcement factsheet: https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-role-edpb_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d... Pretty clearly primarily enforced by national regulatory agencies, who are the only ones who can apply fines. It mentions citizens taking companies to court, but https://ec.europa.eu/commission/sites/beta-political/files/data-protection-overview-citizens_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d... says that's for monetary damages, not for fines. This is unchanged from previous laws. Can people stop freaking out now?

tobltobs 8y ago
In Germany offenses against the GDPR can cause a "Abmahnung" which do not result in a fine but a charge. There a legions of filthy lawyers waiting for the 25.5.
- nils-m-holm 8y ago
  This is a big problem here in Germany and might very well be a reason to shut down my site on 5/24.
  - nils-m-holm 8y ago
    Would the downvoters care to explain what offended them? Looking the other way does not help solve a problem.
    - Dayshine 8y ago
      Well, my immediate thoughts in response to that reply were: "Why is some extra law specific to Germany relevant to my comment? This is a discussion about the GDPR, not about national data protection laws."
      - nils-m-holm 8y ago
        It's not about national laws, it's about the implementation of the GDPR on a national level (namely C&D letters).

deleted 8y ago

[deleted]

grantlmiller 8y ago

This is a great resource because it is from the EU, provides clear examples, cites the actual legislation and Article 29 Working Party Guidelines (which is the group that is tasked with preparing official opinions on GDPR). I think that if you want to really comprehend something, you should go to the primary source. The GDPR legislation is far more approachable than it seems (as an official 261 page PDF). When the preamble and the mechanical bits about how the GDPR will be governed are removed, the parts that important to companies are only 34 pages long. You can use this to guide your reading: https://www.enterpriseready.io/gdpr/how-to-read-gdpr/ https://www.enterpriseready.io/gdpr/how-to-read-gdpr/

Silhouette 8y ago
I respectfully disagree. This is a terrible resource, which frequently says things that are either mostly vacuous or just plain wrong. For example, here's their page on the right to erasure: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/dealing-citizens/do-we-always-have-delete-personal-data-if-person-asks_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Its opening paragraph reads as if data subjects have an automatic right to have their data deleted unless one of the three exceptions applies. In fact, Article 17 of the GDPR itself grants that right only under a list of specific circumstances, and the exceptions are just that, which is an entirely different situation that will lead to the opposite decision on whether data must be erased in many normal situations. Even the list of exceptions shown isn't complete. For another example, here's their page on demonstrating compliance: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/how-can-i-demonstrate-my-organisation-compliant-gdpr_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... There is literally nothing on that page that would help any business I'm dealing with to demonstrate compliance, unless you count the references to the primary sources at the end. There are a couple of ideas about codes of conduct or certifications that contain no substantial details, and even the vague hints about other things you might have to do don't go into any detail about who does or doesn't, leaving the entire page almost entirely content-free unless you happen to be in an industry where the kind of scheme they mention exists. This sort of "guidance" is everything that is wrong with how the GDPR is being handled. It is verbose, ambiguous, sometimes seriously misleading, and almost entirely non-actionable. I'm actually worse off than I was before I read it, because I know nothing useful now that I didn't know before, I would have been misled by several of the pages such as the one I mentioned above if I hadn't already known better, and that's still half an hour of my life wasted.

donohoe 8y ago

First, I am not a lawyer. I don't even play one on TV. The big question I keep hearing is; I'm in the US (or other non-EU country), does GDPR apply to my company or organization? The shortest possible answer is: Maybe :) The answer is: YES if your company has a physical or legal presence (like an office, employee, parent-company, subsidiary, etc.) in an EU country. The GDPR applies to you and you need to to start reading up ASAP as you only have a few weeks to figure this all out. The answer is likley: NO (but be careful here) if you have no physical or legal presence in the EU. Bonus points if your business isn't really aimed at the EU. The answer is likley still: NO if again, you have no physical or legal presence in the EU but do rely on EU traffic as a direct or significant part of your business. At that point is all about how much risk you're willing to take on as we see how this law is interpreted. Any country can claim this over any other territory they wish. But that doesn't make it true. For the claim to be effective (except by use of force), it must be agreed either with the legal authority of the country. Right now there appears to be none. No one is clearly citing any treaty with the EU as giving them this authority. Disclaimer: This isn't legal advice. This is my personal view on a complicated issue that I'm trying to discuss in order to learn more myself.

bennyp101 8y ago
I think the problem for orgs in non EU and non Third Countries is that a lot of EU based orgs will be (or already done so) moving as much as possible to providers that are GDPR compliant - or offer assurances that satisfy the GDPR (Like the Privacy Shield) So by not being compliant, or at least offering a way for orgs that are compelled to follow GDPR to be compliant, they will start to miss out on business from B2B or B2C. Especially after May 25th, there are already radio and TV adverts about it here in the UK, and I imagine that a lot of consumers are going to start questioning this before they use a service
- donohoe 8y ago
  Yes - and I hope they do! I'm a big fan of this law, but I also see a lot of panic and inaccurate claims being made.
mattmanser 8y ago

seanalltogether 8y ago

How does this affect server logs? Under the "what is personal data" section they list ip addresses as personal data.

matthewmacleod 8y ago
It requires you to have a management and retention policy for server logs which contain personal data.
bennyp101 8y ago
Do you have a legitimate reason for storing that data? Probably not, so just stop it from being logged.
- snowwolf 8y ago
  Yes. One of the key parts of GDPR is breach reporting. Assume you discover your company has been breached. How do you investigate the breach? Discover who was impacted, what was done and by whom? Is that significantly harder/impossible if your logs don't contain IP addresses? Edit: Also consider Log retention. Yahoo discovered a data breach 3 years after it happened. What if they'd only kept logs for 1 year.
- dwild 8y ago
  Never have been in a DDOS attack? Good luck doing anything without getting the IP. It's useful to know where the requests come from too. You get a bunch of request from IP that come from a specific peer and that peer is saturated? How could you verify that without a log? You want to add CDN to the right locations. Where should you? Really, I think it's just make more sense for any small company to block EU and when you have the means to do it correctly (with the help of a competent DPO), then yeah add that EU in your market.
dbbk 8y ago
Don't log ip addresses, or anonymise them.
- 8y ago

Matticus_Rex 8y ago

PSA: Please make sure you're not relying on HN comments for your understanding of the GDPR if you're the one responsible in your organization. I need to get back to all the panicked questions CS has forwarded to me (the DPO equivalent for my company), but please understand that there's a lot of misunderstanding in every HN thread on this topic.

akvadrako 8y ago
To generalise this, there's a lot of misunderstanding in every HN thread on most every topic.
oblio 8y ago
Heh, I'd say that it's even worse than "misunderstanding". Besides honest misunderstanding, there's so much FUD being spread by people on HN who are afraid that their greedy data manipulation plan for a startup has been completely foiled... So much FUD that you definitely feel sometimes that the comments are straight out of http://n-gate.com/ http://n-gate.com/ Caricaturizing (a bit): "HN1: The GDPR takes away our freedom to make tons of money from your private data! Dirty EU commies and their superstate imposing their law worldwide! HN2: The law doesn't apply worldwide and it protects my privacy. Just block users which are geographically in the EU. Also, read the law, it's only 60 page and more readable than most RFCs. HN2: Nah, I'm good, I'll just rely on internet FUD as my main source of info. Dirty EU commie bureaucrats!" PS: Obviously not all comments are misguided, but good God, there's soooooo many which miss the mark by a mile...
- deleted 8y ago
  [deleted]
- DonbunEf7 8y ago
  Please do not violate the Prime Directive. Thanks.
  - oblio 8y ago
    > Be civil. Don't say things you wouldn't say face-to-face. Don't be snarky. Comments should get more civil and substantive, not less, as a topic gets more divisive. I was snarky but it is definitely something I would say to you face-to-face. The quality of discussion around the GDPR here on HN was not up to the standard quality. Part of it was because, in my opinion, a lot of people here are entrepreneurs and this made them really subjective and almost blind-sided them to the benefits for users. The GDPR is not perfect but it's a great long term measure, one I hope will be followed (and improved upon!) by other administrations.

cromulen 8y ago

Does anyone have an example of the "documentation of data processing activities"? Edit: Especially in the context of a company that does not handle/store customer data, but only employee info.

grabeh 8y ago
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/documentation/ https://ico.org.uk/for-organisations/guide-to-the-general-da... The above link contains a sample Excel template with details of the various information a record of processing should contain. If you are only processing employee data this should be straightforward. It's a link to the ICO, the UK's data protection authority, but it should be useful regardless of where you are (assuming GDPR applies to you of course!).

LoSboccacc 8y ago

> what is personal data > an Internet Protocol (IP) address; Told ya suckers for months. Keep believing they aren't at your risk. Previously: https://news.ycombinator.com/item?id=16910301 https://news.ycombinator.com/item?id=16910301

frockington 8y ago
Can't wait for the pile of lawsuits to appear over this one

0x4f3759df 8y ago

Can the average lawyer get rich off this? Can lawyer A (who is not affiliated with the EU government) sue Company B on behalf of the users and get a payday? For reference, I read a thread where a guy in my town sues businesses for violating the ADA and the settlement is like loser must fix steps and pay plaintiff some compensation. Maybe its this story or maybe its another guy: http://www.startribune.com/st-paul-landlord-wins-case-against-serial-ada-litigant/370215081/ http://www.startribune.com/st-paul-landlord-wins-case-agains... , actually I think its this guy http://www.startribune.com/doctor-lawyer-wheelchair-user-it-s-the-same-person-and-he-s-filing-disability-lawsuits-by-the-bundle/381330311/ http://www.startribune.com/doctor-lawyer-wheelchair-user-it-...

frockington 8y ago
Sue every European company on the basis of logging IPs, should be free money for lawyers

tokyodude 8y ago

So .... github, sourceforce, bitbucket. When someone asks to delete their data do all their commits have to be deleted or edited to remove their name from the commit logs? How about changelog if the project has one? Comments from source? I'm guessing you'll say "no, because they agreed to open source their data" but how is that any different from agreeing to so-and-so's terms of service? In the same manor what happens to wikis and wikipedia when a user wants to delete their data? If the data was copied by another user does that data become their's to keep or does that need to be deleted too? Example: Jill sends Karen Jill's address via Facebook. Jill want's all of Jill's data deleted from Facebook. Does Jill's address she sent to Karen have to be deleted? Pictures? Pre-internet that data would be on a piece of paper in Karen's possession. Now it's less clear as it's really in Facebook's possession and Karen just has access to the data on Facebook's servers. As Karen I'd be upset if what I considered my data (my copy of Karen's address) to be deleted but is that clear in the GDPR?

guitarbill 8y ago
Let's stop coming up with stupid, stupid examples where you have spend more time thinking about how to troll than thinking how the GDPR applies. (Hint: The right to erasure is not absolute, and applies to personal data.)
- tokyodude 8y ago
  And what is personal data? this problem exists even without the GDPR, my question is does the GDPR make it law in the EU. In Google Docs if Jill shares a document with Karen and then Jill deletes her account Karen will lose access to the Jill's document. That situation doesn't map to the real world where sharing a document meant Jill sending Karen a physical copy. Personally I consider it a bug given it doesn't fit expectations from the real world. If a document shows up in Karen's files it's Karen's copy of that document. Karen shouldn't have to track which docs are actual copies and which are still considered Jill's. In any case given it's possible to delete Jill's data from Google is Google required to delete the document from Karen's account even if Karen has made a copy? Where is this covered? It's not really Karen's copy, both are Google's copy. It's on their servers. This is not trolling. This is trying to understand the GDPR.

zerostar07 8y ago

The more i read about it the more it seems like gdpr will either - cause an uproar from small and middle-size businesses in europe - not become enforced the facebooks and amazons of the world are already fine so they won't complain.