6 ms·
No - you cannot ignore it when you are a small company that's true. But you can (probably, we'll see) ignore it if you don't do shady shit with your customer da
by mnkypete 8y ago
No - you cannot ignore it when you are a small company that's true. But you can (probably, we'll see) ignore it if you don't do shady shit with your customer data. You are allowed to process data, if it's used to fulfill the service you provide. That's reasonable, and probably applies to most of what OP is doing.
- greglindahl 8y agoSo when I get reported, I'll say I didn't worry because some guy on Hacker News said I'd be OK? That's not how it works. You can be as confident as you want without affecting the reasonable worries actual businesses have about this regulation.
- mnkypete 8y agoI have an actual business, thank you. And I did my homework by talking to a lawyer about it. What I got from this talk is, that most of the stuff that is going around is pure panic mode. Please, don't take my words as granted but talk to an actual lawyer. You'll probably even find a free session for startups somewhere in your city, at least in Europe.
- jdietrich 8y agoAsk the regulators. The ICO provide comprehensive guidance documents, a wide range of tools to facilitate compliance and a dedicated helpline for small organisations. They're extremely busy at the moment, but they'll be more than happy to explain your obligations under the GDPR and the best way of achieving compliance. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-the-general-da... https://ico.org.uk/global/contact-us/advice-service-for-small-organisations/ https://ico.org.uk/global/contact-us/advice-service-for-smal...
- nickpp 8y agoICO is just the UK regulator. How about the regulators of the other 28 EU states?
- jdietrich 8y agoThere are specific mechanisms in place to ensure that the regulations are applied consistently, set out in Chapter 7 of the GDPR. https://gdpr-info.eu/chapter-7/ https://gdpr-info.eu/chapter-7/
- tobltobs 8y agoThis is already falling apart. Some countries like Austria already decided to reprove but not to fine offenders. See German article: https://www.heise.de/newsticker/meldung/Keine-Strafen-Oesterreich-zieht-neuem-Datenschutz-die-Zaehne-4031217.html?seite=all https://www.heise.de/newsticker/meldung/Keine-Strafen-Oester...
- jacquesm 8y agoHarmonized. So an ok from one would count pretty heavily when interacting with others.
- kasey_junk 8y agoPoint of order, the ICU is one of many potential regulators & likely not an important one given brexit. What hav the Danish & Belgian regulators been doing lately?
- donatj 8y agoFalse. If you do any sort of logging of network traffic - think server logs - or even backup your database and a single person comes asking for all their data to be removed from all your backups sitting in cold storage, you're in for a world of hurt. The mere act of pulling all my database backups from glacier at once would cost enough to force me to just shut down my personal projects.
- edaemon 8y agoThat's only the case if you store personally identifiable information in your logs. IPs don't count as long as you're collecting them for security purposes and don't have a way to identify a person using the IP. Plus, if you rotate out your logs and clean them up regularly, you don't really need to worry about it. (That's what the EU lawyers at my work told us.) Database backups are only a problem if you save them forever, though it sounds like you are. GDPR generally requires that you regularly archive, rotate out, and clean up old data.
- joering2 8y agoI spent near to $10,000 in 6 lawyers 2 in usa 4 in different european countries and all wrote detailed report for me negating what you just said. IP is one of the most PII identifiable elements of an internet user. Exception is when you can prove such IP is a merely a proxy. please get some other lawyers opinion!!
- edaemon 8y agoNote that I didn't say IPs aren't PII; I said they don't count as long as you are collecting them for the specific purpose of security and don't have any way to identify the person using that IP. Pretty much by definition that is not PII. That came from the legal departments from our German, UK, and French entities.
- kasey_junk 8y agoPII is not the standard for GDPR compliance.