4 ms·

> Eh. Cost of 'doing business'. For fun, let's say I visited one of your personal projects websites, say something like a tax estimator, and it uses Google Ana

> Eh. Cost of 'doing business'. For fun, let's say I visited one of your personal projects websites, say something like a tax estimator, and it uses Google Analytics, maybe some web fonts, and let's say you're serving ads on that website so that you can make it support its own web hosting fee. It's also hosted on your own server. Therefore you are storing and processing my data, for someone else, and perhaps for your own internal usage as well to determine if your tax estimator project is worth pursuing or keeping online. Unfortunately when I visited your theoretical side project, you did not inform me that you are storing or processing my personal information! What are you doing with my personal information, like my IP address? I'd like to request a copy of my personal information from your side project. I'd also like to update my personal information as stored on your side project, so that it is kept accurate. I'd also like to request a copy of my personal data be delivered to a third party of my choosing. Have you appointed at data protector officer for this side-project yet? Have you appointed a representative within the EU yet? Can I get a copy of all the contracts you have in place with data processors you may be using? Finally, I'd like to request my personal data from your personal project website, and I'd like you to delete it from your servers and all services that were accessed via your website. Sound good? How's your side project going? Is this onerous yet? This is just a "cost of doing business" with your side project, right?

madeofpalk 8y ago
Heh. Unsure if you got this on a fluke or you know me/looked me up - do you mean my site https://austax.money https://austax.money? I don't have ads though. Look - to be honest, that's probably something I need to think about some time soon. A very realistic probability might be that I can't be bothered looking too much in depth and I'll just shut it down, but I won't be too upset about that. Only think is that I won't go spreading some diatribe around the internet about how EU regulation is killing me. I will acknowledge that it was my own laziness that lead to me shutting down the hobby tool I built a few years ago and no longer have a need for.
- notadoc 8y ago
  Hypothetically, though it looks like you also have side projects that are relevant to the topic. I would assume nearly everyone on HackerNews has or had side projects that are using similar third party data processing, analytics, ads, and perhaps even their own linode hosting such projects, all gathering what GPDR determines is "personal data" like IP addresses, or maybe email addresses and names for signups and so forth. Now do you see why this is a hassle? But really, how do you plan on complying with GPDR for your side projects? > I will acknowledge that it was my own laziness that lead to me shutting down the hobby tool I built a few years ago and no longer have a need for. What if that hobby was ramen profitable? Same decision?
- deleted 8y ago
  [deleted]
dingaling 8y ago
> Is this onerous yet? This is just a "cost of doing business" with your side project, right? If your side project is collecting personal data ( an IP address alone doesn't qualify ) then ethics alone should compel you to comply with such requests, regardless of GDPR. You have appointed yourself custodian of other people's data, but without any responsibility? Hopefully GDPR will result in two changes: 1. Design-time consideration of data management 2. Minimisation of the amount of data collected Both of which would result in better, simpler software.
- notadoc 8y ago
  >( an IP address alone doesn't qualify ) You are wrong. You need to brush up on GDPR. An IP address, metadata, cookie ID, "online identifiers", etc are considered personal data by GDPR, all data that is collected by virtually every single website, service, or app in the world at some level, either directly through an analytics platform, web font, external library, social engagement, ads, affiliate, input form, third party login services, or even the server itself. That is in addition to names, addresses, phone, email addresses, location, social media, health data, etc.

madeofpalk 8y ago

Heh. Unsure if you got this on a fluke or you know me/looked me up - do you mean my site https://austax.money https://austax.money? I don't have ads though. Look - to be honest, that's probably something I need to think about some time soon. A very realistic probability might be that I can't be bothered looking too much in depth and I'll just shut it down, but I won't be too upset about that. Only think is that I won't go spreading some diatribe around the internet about how EU regulation is killing me. I will acknowledge that it was my own laziness that lead to me shutting down the hobby tool I built a few years ago and no longer have a need for.

notadoc 8y ago
Hypothetically, though it looks like you also have side projects that are relevant to the topic. I would assume nearly everyone on HackerNews has or had side projects that are using similar third party data processing, analytics, ads, and perhaps even their own linode hosting such projects, all gathering what GPDR determines is "personal data" like IP addresses, or maybe email addresses and names for signups and so forth. Now do you see why this is a hassle? But really, how do you plan on complying with GPDR for your side projects? > I will acknowledge that it was my own laziness that lead to me shutting down the hobby tool I built a few years ago and no longer have a need for. What if that hobby was ramen profitable? Same decision?
deleted 8y ago
[deleted]

dingaling 8y ago

> Is this onerous yet? This is just a "cost of doing business" with your side project, right? If your side project is collecting personal data ( an IP address alone doesn't qualify ) then ethics alone should compel you to comply with such requests, regardless of GDPR. You have appointed yourself custodian of other people's data, but without any responsibility? Hopefully GDPR will result in two changes: 1. Design-time consideration of data management 2. Minimisation of the amount of data collected Both of which would result in better, simpler software.

notadoc 8y ago
>( an IP address alone doesn't qualify ) You are wrong. You need to brush up on GDPR. An IP address, metadata, cookie ID, "online identifiers", etc are considered personal data by GDPR, all data that is collected by virtually every single website, service, or app in the world at some level, either directly through an analytics platform, web font, external library, social engagement, ads, affiliate, input form, third party login services, or even the server itself. That is in addition to names, addresses, phone, email addresses, location, social media, health data, etc.