3 ms·

I keep telling people - the thing that changes with GDPR is that personal data you handle is now still owned by the person and only in your custody as long as t

I keep telling people - the thing that changes with GDPR is that personal data you handle is now still owned by the person and only in your custody as long as they explicitly allow it. All of our infrastucture has to change to honour that. If you cannot honour that change, maybe you shouldn't have been handling personal data. I don't have any knowledge about monal.im (don't know what it is - some kind of im client?), but this person is making some claims: - he needs a data-protection officer: no, only larger orgs handling lots of personal data need this. If he's making an im-client and not servers that store data he certainly doesn't, but I don't know what his setup is. - crash analytics: This can be handled by telling the users clearly that you'll be gathering the data (and defaulting to not gathering if they don't actively approve). As long as you have a proper PURPOSE for gathering and storing the data and don't use it for anything else you're golden. You do have to document this, in case of a review (hyper-unlikely). - Push: he's getting a message and storing the device/ip combination. This seems to be central to the service he's providing. Therefore he can and should put that in the description/terms of his service (as he cannot deliver the service without this). As long as it is clearly explained to the end-user this is fine, and he can keep doing it. If he stores it and does anything with this data other than the central purpose that he informed the end-user of he's in violation. I'd suggest putting it in clear text in front of the end-user and deleting the data as soon as it's no longer needed. Don't do any non-approved analysis on it. If you want to analyse - ask for permission. XMPP federation may be a problem, I agree with that. The problemer here (as I see it) is that each service getting the personal data must only process it for the purposes explicitly agreed to by the end-user and honour any subsequent notifications of rectification and deletion. This is a hard nut to crack indeed.

benjaminl 8y ago
SMTP is federated. Did GDPR outlaw email? I am assuming the answer is no, but would a startup be able to build a SMTP or NNPT like system today? It would be a shame for the GDPR to be yet another force moving the Internet from its historical decentralization reinforcing the current centralization trend.
tobltobs 8y ago
> no, only larger orgs handling lots of personal data need this. I can't find any exemption for small companies in Article 37 of the GDPR. Can you give me a hint what part do you interpret this way?
- advisedwang 8y ago
  Section 1 only requires A DPO when you are operating at "large scale".
  - tobltobs 8y ago
    Article 1 (c): the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or .... What makes you believe that the "large scale" refers to the size of the organisation and not on the amount of processed data.
- DanBC 8y ago
  https://gdpr-info.eu/recitals/no-13/ https://gdpr-info.eu/recitals/no-13/ > To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping. 4In addition, the Union institutions and bodies, and Member States and their supervisory authorities, are encouraged to take account of the specific needs of micro, small and medium-sized enterprises in the application of this Regulation. 5The notion of micro, small and medium-sized enterprises should draw from Article 2 of the Annex to Commission Recommendation 2003/361/EC¹.
wink 8y ago
I think you're lumping together too many things. > I keep telling people - the thing that changes with GDPR is that personal data you handle is now still owned by the person and only in your custody as long as they explicitly allow it. > All of our infrastucture has to change to honour that. If you cannot honour that change, maybe you shouldn't have been handling personal data. What if I didn't want you to visit my website. Sure, by the letter of the law I am collecting PII (your IP address) but I think I can reasonably argue that it's quite a technical feat for a private layperson to go from "sudo apt-get install apache2" to "removing IP addresses from log files". Sure, this is tongue in cheek - but most of that panicking I read was people concerned about their personal websites, especially with the "might be taken as professional work stuff just because of ads or you're blogging about tech as a tech freelancer.." - didn't really hear anyone with a company panic.
- TomasEkeli 8y ago
  If you didn't want visitors to your site you shouldn't have put it on the web. If you want visitors to your site without any strings attached you should serve the content without grabbing and storing anything about the clients. This is called the "technician's responsibility" where I come from. To only track/store/process what is absolutlely necessary, in order to not be liable for the consequences when someone you cannot feasibly stop wants to do something untoward with the date (i.e. unconcented analysis, government extraction of data, breaches)
  - nemothekid 8y ago
    >If you didn't want visitors to your site you shouldn't have put it on the web. This feels dishonest. If, for example, I wish to ban certain people by IP Address, your solution is to take my entire service offline?
  - wink 8y ago
    I disagree on the not puttign it on the web. I know the "logging by default" comes from a different age of the internet, and I'm absolutely for minimizing data collected - but I'm sticking to my opinion that as long as the default of every internet-facing package is logging IP addresses by default, it's not good that private owners have to face problems or a lot of work because of that.
Bizarro 8y ago
I keep telling people - the thing that changes with GDPR is that personal data you handle is now still owned by the person and only in your custody as long as they explicitly allow it. That person doesn't own those bits on that hard drive.
- TomasEkeli 8y ago
  They don't own the bits. They own the data those bits represent. The person/company who does own the bits has to comply with the rights of the owner of the data. How you decide to store it makes little difference as long as it's digital. Fun aside: if you store it on paper you're not beholden to GDPR. Crazy.
  - Bizarro 8y ago
    They don't own the data either. Think about. A person doesn't own the random bits (data) about them that goes through and is stored on various systems they interact with. Under the GDPR in the EU, they might have a right to know what is stored about them on various systems, but they don't "own" that data. That's impossible and doesn't make sense.
  - nalllar 8y ago
    > Fun aside: if you store it on paper you're not beholden to GDPR. Crazy. Do you have a source for this? From some quick googling that doesn't appear to be true. https://www.orsgroup.com/news/compliance/how-the-gdpr-affects-paper-documents https://www.orsgroup.com/news/compliance/how-the-gdpr-affect... https://www.winterhawkconsulting.com/4946-2/ https://www.winterhawkconsulting.com/4946-2/ https://www.p4p.uk.com/gdpr-compliance-paper-documents/ https://www.p4p.uk.com/gdpr-compliance-paper-documents/

benjaminl 8y ago

SMTP is federated. Did GDPR outlaw email? I am assuming the answer is no, but would a startup be able to build a SMTP or NNPT like system today? It would be a shame for the GDPR to be yet another force moving the Internet from its historical decentralization reinforcing the current centralization trend.

tobltobs 8y ago

> no, only larger orgs handling lots of personal data need this. I can't find any exemption for small companies in Article 37 of the GDPR. Can you give me a hint what part do you interpret this way?

advisedwang 8y ago
Section 1 only requires A DPO when you are operating at "large scale".
- tobltobs 8y ago
  Article 1 (c): the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or .... What makes you believe that the "large scale" refers to the size of the organisation and not on the amount of processed data.
DanBC 8y ago
https://gdpr-info.eu/recitals/no-13/ https://gdpr-info.eu/recitals/no-13/ > To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping. 4In addition, the Union institutions and bodies, and Member States and their supervisory authorities, are encouraged to take account of the specific needs of micro, small and medium-sized enterprises in the application of this Regulation. 5The notion of micro, small and medium-sized enterprises should draw from Article 2 of the Annex to Commission Recommendation 2003/361/EC¹.

wink 8y ago

I think you're lumping together too many things. > I keep telling people - the thing that changes with GDPR is that personal data you handle is now still owned by the person and only in your custody as long as they explicitly allow it. > All of our infrastucture has to change to honour that. If you cannot honour that change, maybe you shouldn't have been handling personal data. What if I didn't want you to visit my website. Sure, by the letter of the law I am collecting PII (your IP address) but I think I can reasonably argue that it's quite a technical feat for a private layperson to go from "sudo apt-get install apache2" to "removing IP addresses from log files". Sure, this is tongue in cheek - but most of that panicking I read was people concerned about their personal websites, especially with the "might be taken as professional work stuff just because of ads or you're blogging about tech as a tech freelancer.." - didn't really hear anyone with a company panic.

TomasEkeli 8y ago
If you didn't want visitors to your site you shouldn't have put it on the web. If you want visitors to your site without any strings attached you should serve the content without grabbing and storing anything about the clients. This is called the "technician's responsibility" where I come from. To only track/store/process what is absolutlely necessary, in order to not be liable for the consequences when someone you cannot feasibly stop wants to do something untoward with the date (i.e. unconcented analysis, government extraction of data, breaches)
- nemothekid 8y ago
  >If you didn't want visitors to your site you shouldn't have put it on the web. This feels dishonest. If, for example, I wish to ban certain people by IP Address, your solution is to take my entire service offline?
- wink 8y ago
  I disagree on the not puttign it on the web. I know the "logging by default" comes from a different age of the internet, and I'm absolutely for minimizing data collected - but I'm sticking to my opinion that as long as the default of every internet-facing package is logging IP addresses by default, it's not good that private owners have to face problems or a lot of work because of that.

Bizarro 8y ago

I keep telling people - the thing that changes with GDPR is that personal data you handle is now still owned by the person and only in your custody as long as they explicitly allow it. That person doesn't own those bits on that hard drive.

TomasEkeli 8y ago
They don't own the bits. They own the data those bits represent. The person/company who does own the bits has to comply with the rights of the owner of the data. How you decide to store it makes little difference as long as it's digital. Fun aside: if you store it on paper you're not beholden to GDPR. Crazy.
- Bizarro 8y ago
  They don't own the data either. Think about. A person doesn't own the random bits (data) about them that goes through and is stored on various systems they interact with. Under the GDPR in the EU, they might have a right to know what is stored about them on various systems, but they don't "own" that data. That's impossible and doesn't make sense.
- nalllar 8y ago
  > Fun aside: if you store it on paper you're not beholden to GDPR. Crazy. Do you have a source for this? From some quick googling that doesn't appear to be true. https://www.orsgroup.com/news/compliance/how-the-gdpr-affects-paper-documents https://www.orsgroup.com/news/compliance/how-the-gdpr-affect... https://www.winterhawkconsulting.com/4946-2/ https://www.winterhawkconsulting.com/4946-2/ https://www.p4p.uk.com/gdpr-compliance-paper-documents/ https://www.p4p.uk.com/gdpr-compliance-paper-documents/