10 ms·

EU parliaments website in violation of GDPR

74 points by mgliwka 8y ago

repolfx 8y ago
This is a reasonable observation but I doubt anyone will care. Moreover it misses the point of GDPR. The goal is not to improve people's privacy. It's too vague to achieve that. Obviously the EU doesn't care as even its own websites aren't in compliance - assuming this guy's definition of compliance is the same as theirs. How likely is it the rest of the EU's operations are? Zero likelyhood of that. But that's OK. GDPR doesn't even have a concrete notion of what privacy or personal information actually are. The goal is not to improve privacy, that's just a fig leaf. The goal is to grant the EU large new powers over the private sector and in particular over American tech firms, who will repeatedly be fined and treated as, effectively, a new source of tax income. GDPR is so vague and open ended that there's no way they can ever be compliant, meaning the EU has a new source of cash for years to come. Very useful at a time when they are asking for budget increases despite years of austerity, and facing a budget hole due to Brexit, and member states are getting upset at their financial demands. GDPR enforcement will be very similar to EU anti-trust policy - deeply political and immediately controversial. It is best understood not as a law but as a political move, sort of like how China uses laws against pornography to justify blocking foreign search engines, or how it uses a law against 'spreading rumours' to censor domestic social media.
- yulaow 8y ago
  This is stupid, if they wanted to give the finger to American tech firms they could have wrote the GDPR as affecting only foreign firms using EU citizen data without requiring the same level of control over the EU-based tech firms, far easier.
  - Xeoncross 8y ago
    Fining everyone makes sense to me. Why limit income? Cities do the same non-discriminate ticketing/fining as well.
  - frockington 8y ago
    Are there any EU based tech firms? As an American I honestly can't think of any besides Nokia and that's more manufacturing
    - Vogtinator 8y ago
      Quite a lot. Most sell software and support and not cloud services or similiar though.
    - chunkyslink 8y ago
      Some music based ones that I use daily - spotify.com - soundcloud.com - mixcloud.com Others - Raspberry Pi - Wix.com
    - diggan 8y ago
      Makes sense, as Americans tend to live in a bubble :) Some of them from the top of my head, that you might or might not recognize: Asos, JustEat, Skyscanner, SoundCloud, LastFM, DailyMotion, Raspberry PI (foundation more than company though), Shazam, Mojang, Skype, King, Spotify, Klarna, Trivago, Xing and BlaBlaCar. I'm pretty sure some of these are quite popular in even the US. (maybe some of them are not having their HQ in EU anymore, but they certainly had at one point)
      - orf 8y ago
        And SAP, with 22 billion Euros in revenue
      - repolfx 8y ago
        You probably shouldn't insult Americans and then make statements you already know to be erroneous. As you are apparently well aware, Skype is owned by Microsoft. It's an American product now (from the perspective of who pays any fines). Mojang sold to Microsoft. It and Minecraft are owned by the Americans now. Asos is an online fashion and beauty retailer. Having a website doesn't make you a tech firm. Ditto for JustEat. Raspberry Pi - as you note - isn't even a firm at all, let alone a tech firm. Shazam is in the process of being bought by Apple, although the EU appear to be trying to block it. You tried to name tech firms that are based inside the EU and mostly ended up listing firms that either aren't tech firms by any conventional definition, or are now owned by US companies. I think that proves the original point.
  - menacingly 8y ago
    That's not at all how these things work in the west. You define them as broadly as possible, then arbitrarily enforce them, because that gives you both plausible deniability and the widest potential application of your political power.
    - midasz 8y ago
      It HAS to be broad. The courts will narrow it down (jurisprudence). And why do you think it will be arbitrarily enforced? It isn't even the 25th of may and people are already feeling violated.
      - menacingly 8y ago
        Oh, I don't have a strong opinion on the GDPR and its intent, I was addressing yulaow's simplistic dismissal of what is actually a well-trodden political playbook
- PunchTornado 8y ago
  Do you have any examples of cases where American companies were fined unjustly by EU? These companies can attack any fines they receive in the courts.
- blunte 8y ago
  I disagree. I believe it is an attempt to put a stop to (mostly) US collection of EU citizen data - or at least to give EU citizens some ability to control what foreign entities are collecting (and monetizing) about them. The EU uses large fines as a fairly effective threat to dissuade organizations from doing things that the EU believes are not beneficial to its members. Of course it's not perfect, and of course there are political motivations as well... but Europe (and other lower corruption countries, for that matter) have grown tired with the US and its money-above-all behavior. US citizens will benefit from GDPR because it will force some change in behaviors of profit-seeking entities.
- frockington 8y ago
  I have no idea how European court systems work so sorry in advance for what may be stupid questions. What is stopping any company they try to sue from levying investigations against the EU itself if they are not compliant? Does the EU have any sort of executive power that would investigate companys or will it be another VW incident where each company will check the box saying they comply regardless of actual status
  - midasz 8y ago
    Companies cannot sue over GDPR violations (neither can individuals). People can report violations to the GDPR watchdogs who will investigate and could eventually hand out fines.
    - ozim 8y ago
      I think you actually can sue for whatever reason you like but court can say it does not make sense and they will not run the case. It is your responsibility to get enough evidence but it is hard and no one cares enough. If your data was used without your knowledge you might have had some damage and you could request compensation, removal or other way of fixing damage - with court help of course. GDPR violations can be used as base for court case. So GDPR does not really bring anything new because I believe you already could sue companies for selling your data, but in practice it is not possible to get evidence, prove damage, put price on damage, and it takes too long. What changes is that if you don't have all data usages listed for user to view it is enough for some action so offended users can suspect something. If watchdog goes and checks you might be in problem with fines and then with court cases from offended users.
      - Someone 8y ago
        ”I think you actually can sue for whatever reason you like but court can say it does not make sense and they will not run the case.” True. ”It is your responsibility to get enough evidence but it is hard and no one cares enough.” In this case, every “doesn’t comply with the GDPR” case a company starts will be immediately dismissed because: a) you can’t start a lawsuit on the GDPR. The only way is through a national data protection authority. b) even if you could, companies wouldn’t be interested parties in such a case. (By the way, I think the national data protection authorities are the sore spot in the GDPR. I don’t think it is good that they are both prosecutor, jury, and executioner)
- rossdavidh 8y ago
  Another interpretation: IT is really hard, especially for people who don't do it for a living, who thus have less time to learn about it. Writing legislation about IT is equally hard, if not more so. The EU may honestly care about the impact of IT on privacy, but not have the technical ability to write adequately precise legislation about it, or even insure that their own institutional IT is in compliance (assuming it really isn't, and I am not a lawyer). Do not ascribe to conspiracy, what is adequately explained by incompetence.
- midasz 8y ago
  > GDPR is so vague and open ended that there's no way they can ever be compliant This is nonsense. I really don't see what's so difficult to understand. Personal information is information to which the person can be identified.
  - tchock23 8y ago
    The definition of personal information is easy to understand (albeit broad). However, the vagueness seeps in other areas of the regulation. For example, additional restrictions are in place for “large scale” processing of personal information, yet “large scale” is never defined. Is that hundreds, thousands or millions of records? As the owner of a very small SaaS business (that does not sell personal information of its users) I found it tremendously difficult to figure out how to comply given the vagueness of it all.
    - midasz 8y ago
      Yeah I get that. I googled around a bit and apparently there were concrete figures in the initial draft. I don't know if the EU has a contactperson to whom you can ask these questions, if they do, you can simply ask them to clarify. If you've done that, you're in the clear because you've put in the effort to comply. But yeah in this case they should just give you a number.
      - pjc50 8y ago
        > I don't know if the EU has a contactperson to whom you can ask these questions, if they do, you can simply ask them to clarify. lol of course there isn't an office you can ring to help you with this! If there were we wouldn't be spending quite so much effort working out what it all means.
        M2Ys4U 8y ago
        Each of the 28 member states of the EU has a data protection authority. Those are the people one rings to get advice.
- englishrookie 8y ago
  I'm pretty sure the GDPR is enforced at the national level, by national data protection agencies. The one in the Netherlands is severely understaffed and no match for the lawyers of the likes of Google and Facebook.
- pjc50 8y ago
  This is rather paranoid: remember that enforcement is done by national authorities like the ICO not europe-wide ones. It's not as radically different from the previous data protection principles as people seem to think, and how much enforcement of those was actually seen? > EU anti-trust policy - deeply political and immediately controversial [citation needed]; it's not as if American industrial policy is apolitical and uncontroversial, e.g. https://www.theguardian.com/business/2018/jan/26/bombardier-us-tariffs-imports-uk-trump-jobs-belfast https://www.theguardian.com/business/2018/jan/26/bombardier-...
  - repolfx 8y ago
    It's well known that the Obama administration felt the EU was using anti-trust law to implement protectionism: https://www.wired.com/story/google-big-eu-fine/ https://www.wired.com/story/google-big-eu-fine/ For his part, President Barack Obama called the EU's actions protectionism. "[Americans] have owned the Internet. Our companies have created it, expanded it, perfected it in ways that [European companies] can’t compete," Obama said in an interview with Recode in 2015. "And oftentimes what is portrayed as high-minded positions on issues sometimes is just designed to carve out some of their commercial interests."
- Bizarro 8y ago
  The goal is to grant the EU large new powers over the private sector and in particular over American tech firms, who will repeatedly be fined and treated as, effectively, a new source of tax income I'm guessing the rest of the world will just pull their operations out of the EU and then ignore the law. It obviously has no jurisdiction outside of the EU...despite what EUrocrats and some propaganda here on HN would have you believe. The rest of the world could also impose sanctions on the EU for illegally claiming global jurisdiction.
  - pjc50 8y ago
    The US claims global jurisdiction over e.g. Megaupload without sanctions.
- grey-area 8y ago
  The goal is to grant the EU large new powers over the private sector and in particular over American tech firms, who will repeatedly be fined and treated as, effectively, a new source of tax income. No, it really is intended to provide greater control for citizens over their privacy and data stored by corporations.
PunchTornado 8y ago
I thought IPs are not considered personal identifiable information.
- midasz 8y ago
  It depends. If they can be traced back to a single person, they are. However you also have dynamic IP addresses - multiple people using the same IP.. I wouldn't call it a gross violation.
- kasey_junk 8y ago
  PII is not a concept of GDPR. Whether IPs are considered personal data covered by GDPR is open to interpretation, but most of the experts I've talked to say yes.
  - scrumbledober 8y ago
    As does the official website faq
- muro 8y ago
  Yes it is - it's in the FAQ: https://www.eugdpr.org/gdpr-faqs.html https://www.eugdpr.org/gdpr-faqs.html What constitutes personal data? Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address.
  - M2Ys4U 8y ago
    That is not an official website - if you read the footer you'll see the following text: "Disclaimer: This is not an offical EU Commission or Government resource. This is a education portal and the information contained within this portal does in no way constitute legal advice. Any person who intends to rely upon or use the information contained herein in any way is solely responsible for independently verifying the information and obtaining independent expert advice if required."
deleted 8y ago
[deleted]
belorn 8y ago
Reading the GDPR text shows there is a bunch of exceptions for which storing of example IP-addresses can be done without anonymizing or consent, with one of the more clear cut being security. If the processing is done exclusively for security purpose then the site can argue in court that they are in compliance. Compliance with the law is always about context. What is gathered, why and how is it used, and last is there additional factors to consider. Google Analytics in itself is interesting because it is not clear if Google themselves then process the data and for what use, especially for the enterprise version.
- hartator 8y ago
  Google Analytics is not a security tool. You can’t even see what an specific IP has been doing.
  - belorn 8y ago
    Of those exception, security is one and the most clear cut one. The other are more muddy which is why I did not describe them, even if in this case those are more likely to be used than security. The list is as following: 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks. The security exception is then an additional point, Article 6, Paragraph 1, Point F.
adamsurak 8y ago
They'll use legitimate interest as a reason.
deanclatworthy 8y ago
How is this news? Everyone is scrambling to be GDPR-compliant before the due date. Probably the people behind this site also.
- candiodari 8y ago
  Well, if the intent behind the legislation was to protect personal data, presumably they would have modified their own behavior before regulating. But they haven't. Makes things clear. They also control the enforcement mechanism. Let's see if they will modify it to save face or if they'll just ignore it. Or do you think they'll fine the parliament (not that they haven't exempted themselves, of course) ?
  - bkor 8y ago
    > Well, if the intent behind the legislation was to protect personal data Either prove that it isn't or please stop this rhetoric. Thanks
  - Tharkun 8y ago
    You're making the incorrect assumption - deliberately, I presume - that the people writing the legislation have anything to do with how the website operates. You're wrong, of course. The EU(P) is a very large and very complex organization, just like many multinationals. Should they eat their own dog food? Probably. But pretending there's some kind of hypocrisy going on is stretching it.
    - candiodari 8y ago
      Well my opinion is that the EU shouldn't exist. A non-democratic state controlling democratic states seems to me to be a spectacularly bad idea. But I'm a consultant and I've worked and work for these people, mostly indirectly. Let me assure you: there is absolutely no shortage of hypocrisy. You don't need anything more than to walk around their offices and ask what all those weird marking on public and private spaces mean. You'll be disgusted, and cured of any notion that the EU intends to do anything for anyone but themselves. But outside of that, there are clear personal status cult being upheld everywhere around the European organisations, with the biggest distinction between the "fonctionnaires" and everybody else (although as an employee of the commission you're still several rungs above "les gens de la rue" (which does not mean homeless, like in France, it just means normal people of Brussels). And may God help you if you're working for ISS or any of the cleaning companies. At that point your status is so low that people routinely throw things at you just to cool their frustration. This is accepted and normal behavior, despite how incredibly immoral it is. (The "European quarter" of Brussels has a ton of public and private spaces, from "public" parks to a small shopping center (with mostly cafes), and the highly coveted parkings and parking spaces that are reserved, by law, for European officials' use only. So does Woluwe, even if they're a lot better hidden there. To say that these people have no intention to use their power to improve people's lives is absurd when you walk around their offices)
tephra 8y ago
I don't have the text in front of me but I'm pretty sure there is an exception for member states government agencies (if they choose to have the exception). I wouldn't be surprised if this covers EU agencies and institutions as well.
- mgliwka 8y ago
  They're excluded from the fines, but not from the regulation itself.

74 points by mgliwka 8y ago

This is a reasonable observation but I doubt anyone will care. Moreover it misses the point of GDPR. The goal is not to improve people's privacy. It's too vague to achieve that. Obviously the EU doesn't care as even its own websites aren't in compliance - assuming this guy's definition of compliance is the same as theirs. How likely is it the rest of the EU's operations are? Zero likelyhood of that. But that's OK. GDPR doesn't even have a concrete notion of what privacy or personal information actually are. The goal is not to improve privacy, that's just a fig leaf. The goal is to grant the EU large new powers over the private sector and in particular over American tech firms, who will repeatedly be fined and treated as, effectively, a new source of tax income. GDPR is so vague and open ended that there's no way they can ever be compliant, meaning the EU has a new source of cash for years to come. Very useful at a time when they are asking for budget increases despite years of austerity, and facing a budget hole due to Brexit, and member states are getting upset at their financial demands. GDPR enforcement will be very similar to EU anti-trust policy - deeply political and immediately controversial. It is best understood not as a law but as a political move, sort of like how China uses laws against pornography to justify blocking foreign search engines, or how it uses a law against 'spreading rumours' to censor domestic social media.

yulaow 8y ago
This is stupid, if they wanted to give the finger to American tech firms they could have wrote the GDPR as affecting only foreign firms using EU citizen data without requiring the same level of control over the EU-based tech firms, far easier.
- Xeoncross 8y ago
  Fining everyone makes sense to me. Why limit income? Cities do the same non-discriminate ticketing/fining as well.
- frockington 8y ago
  Are there any EU based tech firms? As an American I honestly can't think of any besides Nokia and that's more manufacturing
  - Vogtinator 8y ago
    Quite a lot. Most sell software and support and not cloud services or similiar though.
  - chunkyslink 8y ago
    Some music based ones that I use daily - spotify.com - soundcloud.com - mixcloud.com Others - Raspberry Pi - Wix.com
  - diggan 8y ago
    Makes sense, as Americans tend to live in a bubble :) Some of them from the top of my head, that you might or might not recognize: Asos, JustEat, Skyscanner, SoundCloud, LastFM, DailyMotion, Raspberry PI (foundation more than company though), Shazam, Mojang, Skype, King, Spotify, Klarna, Trivago, Xing and BlaBlaCar. I'm pretty sure some of these are quite popular in even the US. (maybe some of them are not having their HQ in EU anymore, but they certainly had at one point)
    - orf 8y ago
      And SAP, with 22 billion Euros in revenue
    - repolfx 8y ago
      You probably shouldn't insult Americans and then make statements you already know to be erroneous. As you are apparently well aware, Skype is owned by Microsoft. It's an American product now (from the perspective of who pays any fines). Mojang sold to Microsoft. It and Minecraft are owned by the Americans now. Asos is an online fashion and beauty retailer. Having a website doesn't make you a tech firm. Ditto for JustEat. Raspberry Pi - as you note - isn't even a firm at all, let alone a tech firm. Shazam is in the process of being bought by Apple, although the EU appear to be trying to block it. You tried to name tech firms that are based inside the EU and mostly ended up listing firms that either aren't tech firms by any conventional definition, or are now owned by US companies. I think that proves the original point.
- menacingly 8y ago
  That's not at all how these things work in the west. You define them as broadly as possible, then arbitrarily enforce them, because that gives you both plausible deniability and the widest potential application of your political power.
  - midasz 8y ago
    It HAS to be broad. The courts will narrow it down (jurisprudence). And why do you think it will be arbitrarily enforced? It isn't even the 25th of may and people are already feeling violated.
    - menacingly 8y ago
      Oh, I don't have a strong opinion on the GDPR and its intent, I was addressing yulaow's simplistic dismissal of what is actually a well-trodden political playbook
PunchTornado 8y ago
Do you have any examples of cases where American companies were fined unjustly by EU? These companies can attack any fines they receive in the courts.
blunte 8y ago
I disagree. I believe it is an attempt to put a stop to (mostly) US collection of EU citizen data - or at least to give EU citizens some ability to control what foreign entities are collecting (and monetizing) about them. The EU uses large fines as a fairly effective threat to dissuade organizations from doing things that the EU believes are not beneficial to its members. Of course it's not perfect, and of course there are political motivations as well... but Europe (and other lower corruption countries, for that matter) have grown tired with the US and its money-above-all behavior. US citizens will benefit from GDPR because it will force some change in behaviors of profit-seeking entities.
frockington 8y ago
I have no idea how European court systems work so sorry in advance for what may be stupid questions. What is stopping any company they try to sue from levying investigations against the EU itself if they are not compliant? Does the EU have any sort of executive power that would investigate companys or will it be another VW incident where each company will check the box saying they comply regardless of actual status
- midasz 8y ago
  Companies cannot sue over GDPR violations (neither can individuals). People can report violations to the GDPR watchdogs who will investigate and could eventually hand out fines.
  - ozim 8y ago
    I think you actually can sue for whatever reason you like but court can say it does not make sense and they will not run the case. It is your responsibility to get enough evidence but it is hard and no one cares enough. If your data was used without your knowledge you might have had some damage and you could request compensation, removal or other way of fixing damage - with court help of course. GDPR violations can be used as base for court case. So GDPR does not really bring anything new because I believe you already could sue companies for selling your data, but in practice it is not possible to get evidence, prove damage, put price on damage, and it takes too long. What changes is that if you don't have all data usages listed for user to view it is enough for some action so offended users can suspect something. If watchdog goes and checks you might be in problem with fines and then with court cases from offended users.
    - Someone 8y ago
      ”I think you actually can sue for whatever reason you like but court can say it does not make sense and they will not run the case.” True. ”It is your responsibility to get enough evidence but it is hard and no one cares enough.” In this case, every “doesn’t comply with the GDPR” case a company starts will be immediately dismissed because: a) you can’t start a lawsuit on the GDPR. The only way is through a national data protection authority. b) even if you could, companies wouldn’t be interested parties in such a case. (By the way, I think the national data protection authorities are the sore spot in the GDPR. I don’t think it is good that they are both prosecutor, jury, and executioner)
rossdavidh 8y ago
Another interpretation: IT is really hard, especially for people who don't do it for a living, who thus have less time to learn about it. Writing legislation about IT is equally hard, if not more so. The EU may honestly care about the impact of IT on privacy, but not have the technical ability to write adequately precise legislation about it, or even insure that their own institutional IT is in compliance (assuming it really isn't, and I am not a lawyer). Do not ascribe to conspiracy, what is adequately explained by incompetence.
midasz 8y ago
> GDPR is so vague and open ended that there's no way they can ever be compliant This is nonsense. I really don't see what's so difficult to understand. Personal information is information to which the person can be identified.
- tchock23 8y ago
  The definition of personal information is easy to understand (albeit broad). However, the vagueness seeps in other areas of the regulation. For example, additional restrictions are in place for “large scale” processing of personal information, yet “large scale” is never defined. Is that hundreds, thousands or millions of records? As the owner of a very small SaaS business (that does not sell personal information of its users) I found it tremendously difficult to figure out how to comply given the vagueness of it all.
  - midasz 8y ago
    Yeah I get that. I googled around a bit and apparently there were concrete figures in the initial draft. I don't know if the EU has a contactperson to whom you can ask these questions, if they do, you can simply ask them to clarify. If you've done that, you're in the clear because you've put in the effort to comply. But yeah in this case they should just give you a number.
    - pjc50 8y ago
      > I don't know if the EU has a contactperson to whom you can ask these questions, if they do, you can simply ask them to clarify. lol of course there isn't an office you can ring to help you with this! If there were we wouldn't be spending quite so much effort working out what it all means.
      - M2Ys4U 8y ago
        Each of the 28 member states of the EU has a data protection authority. Those are the people one rings to get advice.
englishrookie 8y ago
I'm pretty sure the GDPR is enforced at the national level, by national data protection agencies. The one in the Netherlands is severely understaffed and no match for the lawyers of the likes of Google and Facebook.
pjc50 8y ago
This is rather paranoid: remember that enforcement is done by national authorities like the ICO not europe-wide ones. It's not as radically different from the previous data protection principles as people seem to think, and how much enforcement of those was actually seen? > EU anti-trust policy - deeply political and immediately controversial [citation needed]; it's not as if American industrial policy is apolitical and uncontroversial, e.g. https://www.theguardian.com/business/2018/jan/26/bombardier-us-tariffs-imports-uk-trump-jobs-belfast https://www.theguardian.com/business/2018/jan/26/bombardier-...
- repolfx 8y ago
  It's well known that the Obama administration felt the EU was using anti-trust law to implement protectionism: https://www.wired.com/story/google-big-eu-fine/ https://www.wired.com/story/google-big-eu-fine/ For his part, President Barack Obama called the EU's actions protectionism. "[Americans] have owned the Internet. Our companies have created it, expanded it, perfected it in ways that [European companies] can’t compete," Obama said in an interview with Recode in 2015. "And oftentimes what is portrayed as high-minded positions on issues sometimes is just designed to carve out some of their commercial interests."
Bizarro 8y ago
The goal is to grant the EU large new powers over the private sector and in particular over American tech firms, who will repeatedly be fined and treated as, effectively, a new source of tax income I'm guessing the rest of the world will just pull their operations out of the EU and then ignore the law. It obviously has no jurisdiction outside of the EU...despite what EUrocrats and some propaganda here on HN would have you believe. The rest of the world could also impose sanctions on the EU for illegally claiming global jurisdiction.
- pjc50 8y ago
  The US claims global jurisdiction over e.g. Megaupload without sanctions.
grey-area 8y ago
The goal is to grant the EU large new powers over the private sector and in particular over American tech firms, who will repeatedly be fined and treated as, effectively, a new source of tax income. No, it really is intended to provide greater control for citizens over their privacy and data stored by corporations.

PunchTornado 8y ago

I thought IPs are not considered personal identifiable information.

midasz 8y ago
It depends. If they can be traced back to a single person, they are. However you also have dynamic IP addresses - multiple people using the same IP.. I wouldn't call it a gross violation.
kasey_junk 8y ago
PII is not a concept of GDPR. Whether IPs are considered personal data covered by GDPR is open to interpretation, but most of the experts I've talked to say yes.
- scrumbledober 8y ago
  As does the official website faq
muro 8y ago
Yes it is - it's in the FAQ: https://www.eugdpr.org/gdpr-faqs.html https://www.eugdpr.org/gdpr-faqs.html What constitutes personal data? Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address.
- M2Ys4U 8y ago
  That is not an official website - if you read the footer you'll see the following text: "Disclaimer: This is not an offical EU Commission or Government resource. This is a education portal and the information contained within this portal does in no way constitute legal advice. Any person who intends to rely upon or use the information contained herein in any way is solely responsible for independently verifying the information and obtaining independent expert advice if required."

deleted 8y ago

[deleted]

belorn 8y ago

Reading the GDPR text shows there is a bunch of exceptions for which storing of example IP-addresses can be done without anonymizing or consent, with one of the more clear cut being security. If the processing is done exclusively for security purpose then the site can argue in court that they are in compliance. Compliance with the law is always about context. What is gathered, why and how is it used, and last is there additional factors to consider. Google Analytics in itself is interesting because it is not clear if Google themselves then process the data and for what use, especially for the enterprise version.

hartator 8y ago
Google Analytics is not a security tool. You can’t even see what an specific IP has been doing.
- belorn 8y ago
  Of those exception, security is one and the most clear cut one. The other are more muddy which is why I did not describe them, even if in this case those are more likely to be used than security. The list is as following: 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks. The security exception is then an additional point, Article 6, Paragraph 1, Point F.

adamsurak 8y ago

They'll use legitimate interest as a reason.

deanclatworthy 8y ago

How is this news? Everyone is scrambling to be GDPR-compliant before the due date. Probably the people behind this site also.

candiodari 8y ago
Well, if the intent behind the legislation was to protect personal data, presumably they would have modified their own behavior before regulating. But they haven't. Makes things clear. They also control the enforcement mechanism. Let's see if they will modify it to save face or if they'll just ignore it. Or do you think they'll fine the parliament (not that they haven't exempted themselves, of course) ?
- bkor 8y ago
  > Well, if the intent behind the legislation was to protect personal data Either prove that it isn't or please stop this rhetoric. Thanks
- Tharkun 8y ago
  You're making the incorrect assumption - deliberately, I presume - that the people writing the legislation have anything to do with how the website operates. You're wrong, of course. The EU(P) is a very large and very complex organization, just like many multinationals. Should they eat their own dog food? Probably. But pretending there's some kind of hypocrisy going on is stretching it.
  - candiodari 8y ago
    Well my opinion is that the EU shouldn't exist. A non-democratic state controlling democratic states seems to me to be a spectacularly bad idea. But I'm a consultant and I've worked and work for these people, mostly indirectly. Let me assure you: there is absolutely no shortage of hypocrisy. You don't need anything more than to walk around their offices and ask what all those weird marking on public and private spaces mean. You'll be disgusted, and cured of any notion that the EU intends to do anything for anyone but themselves. But outside of that, there are clear personal status cult being upheld everywhere around the European organisations, with the biggest distinction between the "fonctionnaires" and everybody else (although as an employee of the commission you're still several rungs above "les gens de la rue" (which does not mean homeless, like in France, it just means normal people of Brussels). And may God help you if you're working for ISS or any of the cleaning companies. At that point your status is so low that people routinely throw things at you just to cool their frustration. This is accepted and normal behavior, despite how incredibly immoral it is. (The "European quarter" of Brussels has a ton of public and private spaces, from "public" parks to a small shopping center (with mostly cafes), and the highly coveted parkings and parking spaces that are reserved, by law, for European officials' use only. So does Woluwe, even if they're a lot better hidden there. To say that these people have no intention to use their power to improve people's lives is absurd when you walk around their offices)

tephra 8y ago

I don't have the text in front of me but I'm pretty sure there is an exception for member states government agencies (if they choose to have the exception). I wouldn't be surprised if this covers EU agencies and institutions as well.

mgliwka 8y ago
They're excluded from the fines, but not from the regulation itself.