4 ms·

I did some poking around as to what this actually is (and it's probably not for the average site). It's the specifications for how the IAB (Internet Advertisin

I did some poking around as to what this actually is (and it's probably not for the average site). It's the specifications for how the IAB (Internet Advertising Board), which consists of of every organization blocked by your ad blocker, would like publishers to gather consent from people landing on their site. It's a very optimized setup as who they are targeting using this are the big sites that do Real Time Bidding (RTB) for ad slots on their pages. You land on a site and the js for ads loads, calls out to a real time ad marketplace with your info (IP, cookies) and then preset bids ("I'll pay 20c to serve this person an ad for cheese!") all are evaluated and the highest paying gets served on the site (and the marketplace takes a tiny cut). What this framework does is help add user consent and GDPR readiness into the criteria that can be used in this process. So as a publisher if you're trying to meet GDPR requirements you can say: "Only give me ads from places that respect this". As a consumer, this kind of paves the way to just consent to these things once and then use them all over the web (good for UX). If you're just trying to get to grips with GDPR try this Plain English Guide https://blog.varonis.com/gdpr-requirements-list-in-plain-english/ https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...

forgot-my-pw 9y ago
Thanks for the link, it's very easy to read. I still have some questions about data deletion request: - How will this affect invoices that have to be kept for accounting purposes? Even if a customer wishes their data to be removed, we should not remove accounting information. - How will this affect Internet archives and caches? It seems removing all traces of a customer can be a very hard thing to do.
- dmitriid 9y ago
  IANAL If other laws exist that clash with GDPR, those laws take precedence. This question most often comes up specifically with regards to payments and finance. If a law requires you to retain payment/accounting information for three years, you must keep that info for three years, because this is addressed by a more specific law than GDPR.
  - forgot-my-pw 9y ago
    Thank you.
- michaelbuckbee 9y ago
  There's two pieces of this here: 1. If you're legally obligated to keep information, you should keep it. This is one of the "legal bases" of handling personal data. Others are things like they consented to this, you have a legitimate business activity with it, they contracted you to do something with it, etc. 2. The GDPR makes a really clear distinction between personal information (email, name, religion, etc.) and everything else: you need to delete the personal information. So it's not necessary to do a cascading delete of everything the user ever created if they ask for their _personal_ information to be removed. This isn't really GDPR related, but you can see this on Reddit sometimes where comments that a user remain, but the user deleted their account.

forgot-my-pw 9y ago

Thanks for the link, it's very easy to read. I still have some questions about data deletion request: - How will this affect invoices that have to be kept for accounting purposes? Even if a customer wishes their data to be removed, we should not remove accounting information. - How will this affect Internet archives and caches? It seems removing all traces of a customer can be a very hard thing to do.

dmitriid 9y ago
IANAL If other laws exist that clash with GDPR, those laws take precedence. This question most often comes up specifically with regards to payments and finance. If a law requires you to retain payment/accounting information for three years, you must keep that info for three years, because this is addressed by a more specific law than GDPR.
- forgot-my-pw 9y ago
  Thank you.
michaelbuckbee 9y ago
There's two pieces of this here: 1. If you're legally obligated to keep information, you should keep it. This is one of the "legal bases" of handling personal data. Others are things like they consented to this, you have a legitimate business activity with it, they contracted you to do something with it, etc. 2. The GDPR makes a really clear distinction between personal information (email, name, religion, etc.) and everything else: you need to delete the personal information. So it's not necessary to do a cascading delete of everything the user ever created if they ask for their _personal_ information to be removed. This isn't really GDPR related, but you can see this on Reddit sometimes where comments that a user remain, but the user deleted their account.