4 ms·

Nice guidelines, seems like for most small businesses it will be straight forward to be GDPR compliant

by config_yml 8y ago

tradedash 8y ago
you are vastly underestimating the ease of implementation
- outsideoflife 8y ago
  Depends on your business. I didn't find it as hard as PCI compliance for instance
  - saryant 8y ago
    Unless you actually maintain full payment account numbers, PCI compliance pretty much boils down to "I pinky-swear I'm not doing anything wrong" and the rules have virtually no teeth.
- matthewmacleod 8y ago
  What’s going to be difficult?
deleted 8y ago
[deleted]
donohoe 8y ago
Maybe if you don't have ads on your site, otherwise its going to be a problem.
- viraptor 8y ago
  Why do you think so? After you document/publish what information you pass to which network, what problems do you expect related to the ads?
  - someguy2018 8y ago
    Because I apparently need affirmative check-the-box consent before I can actually use those ad networks. I'm not doing anything shady: all the information I collect and why I collect it has always been in my privacy policy. But making people have to opt-in to see ads on the site is a big problem.
    - viraptor 8y ago
      You can do non-targetted ads without explicit consent as far as I understand. You only need it for the extra personal information use. Sure it's a bit worse for the publishers. (But I'm happy with that)
      - someguy2018 8y ago
        Where would "non-targeted" ads even come from? How can you use an ad network or even run a standard ad server in a way that doesn't share at least the reader's IP Address? Mom and pop publishers who don't have the resources or ability to staff their own ad sales team are going to be in trouble. The big players who can work around this obstacle are going to be fine. I'm not happy about this.
        Angostura 8y ago
        IP address is only personally identifable info if it is coupled with other info that links it to a real person. Storing an IP address by itself and sharing it is not, by itself PII
        someguy2018 8y ago
        No, I'm pretty sure that is incorrect. The EU believes that an IP itself is personally identifiable and it must be secured and processed like any PII [1]. I think you could make a case that the IP being sent to an ad network is an "acceptable" business practice for which you don't need consent, but IANAL. [1] https://www.enterprisetimes.co.uk/2016/10/20/ecj-rules-ip-address-is-pii/ https://www.enterprisetimes.co.uk/2016/10/20/ecj-rules-ip-ad...

Nice guidelines, seems like for most small businesses it will be straight forward to be GDPR compliant

tradedash 8y ago

you are vastly underestimating the ease of implementation

outsideoflife 8y ago
Depends on your business. I didn't find it as hard as PCI compliance for instance
- saryant 8y ago
  Unless you actually maintain full payment account numbers, PCI compliance pretty much boils down to "I pinky-swear I'm not doing anything wrong" and the rules have virtually no teeth.
matthewmacleod 8y ago
What’s going to be difficult?

deleted 8y ago

[deleted]

donohoe 8y ago

Maybe if you don't have ads on your site, otherwise its going to be a problem.

viraptor 8y ago
Why do you think so? After you document/publish what information you pass to which network, what problems do you expect related to the ads?
- someguy2018 8y ago
  Because I apparently need affirmative check-the-box consent before I can actually use those ad networks. I'm not doing anything shady: all the information I collect and why I collect it has always been in my privacy policy. But making people have to opt-in to see ads on the site is a big problem.
  - viraptor 8y ago
    You can do non-targetted ads without explicit consent as far as I understand. You only need it for the extra personal information use. Sure it's a bit worse for the publishers. (But I'm happy with that)
    - someguy2018 8y ago
      Where would "non-targeted" ads even come from? How can you use an ad network or even run a standard ad server in a way that doesn't share at least the reader's IP Address? Mom and pop publishers who don't have the resources or ability to staff their own ad sales team are going to be in trouble. The big players who can work around this obstacle are going to be fine. I'm not happy about this.
      - Angostura 8y ago
        IP address is only personally identifable info if it is coupled with other info that links it to a real person. Storing an IP address by itself and sharing it is not, by itself PII
        someguy2018 8y ago
        No, I'm pretty sure that is incorrect. The EU believes that an IP itself is personally identifiable and it must be secured and processed like any PII [1]. I think you could make a case that the IP being sent to an ad network is an "acceptable" business practice for which you don't need consent, but IANAL. [1] https://www.enterprisetimes.co.uk/2016/10/20/ecj-rules-ip-address-is-pii/ https://www.enterprisetimes.co.uk/2016/10/20/ecj-rules-ip-ad...