3 ms·

Am in EU, am involved in some compliance stuff and have talked to plenty others at other companies, and it really does seem to be a nothing-to-see-here for all

Am in EU, am involved in some compliance stuff and have talked to plenty others at other companies, and it really does seem to be a nothing-to-see-here for all companies except the sleezy ones.

hvidgaard 8y ago
In all of my research, talking to lawyers, and seminars on GDPR, it is about: 1. Ask permission for collecting data 2. Keep sensitive data safe 3. Restrict access to said data 4. Keep a log of what happens with the data 5. Delete it upon request 6. Have all of the above documented and adhere to the protocol. It's such a none issue unless you're relying on the very thing GDPR is designed to combat. If you not collecting and selling peoples data, and you don't do the above already, see this as a good opportunity to do what you should have been doing all along. There is such an awareness now, that it's the easiest it has ever been to know how to handle sensitive data properly.
- willvarfar 8y ago
  Completely agree with everything you list, and would add that 6. you can't force a user to give up privacy in order to get some other benefit, e.g. you can't offer to unlock some feature in return for more tracking
  - merinowool 8y ago
    Example: How do you ask user for a permission to log access logs (which contain IP address) in the server, so that you can detect spam, ddos and other attacks? How do you store that consent information and what do you do if user doesn't consent? What do you do if user connecting from given IP address wants you to send him data you have collected about him. If people share IP addresses how do you know which log data is about which person?
    - willvarfar 8y ago
      Some entity runs a webserver. This entity has a legitimate business purpose in retaining access logs for e.g. 3 months for e.g. spam and security reasons. This entity just has to document that. This entity can allow a 3rd party service to access these logs so that 3rd party can do whatever needs to be done if it is within the reasons the entity gave for having the data. What neither can do is go use that data for anything other than the said purposes. And if the given reasons are gratuitous and somehow the regulators notice, expect to get a nastygram and have to comply or face fines. Basically what you can't do is collect data for longer than you have a legitimate need for, or cash-in and sell data you've collected. Basically, all said and done, just don't be sleezy and you'll be ok.
      - merinowool 8y ago
        Who defines what is a legitimate business purpose? Let's say I comply with all that, but someone makes a complaint and particularly bitter civil servant judges that the collection is not legitimate, because he doesn't like the content of the website?
        acdha 8y ago
        That’s like arguing that we shouldn’t have laws in case a cop is having a bad day and follows you around writing tickets. This is a legal process like anything else: your standard should be what you’re comfortable defending in court. Being able to show a good faith decision process, compliance with common industry practice, etc. are going to help the case that any lapse was unintentional. If your angry ex is hired by a regulator you’d appeal it but there’s no reason to think that’s a common problem.
        merinowool 8y ago
        But appeal might take forever and by the time it is resolved you file for bankruptcy because the fine ruined the cash flow. I've seen in it many times in the EU, for example in Poland. Civil servants are immune from taking responsibility and if you manage to get any compensation you'll find yourself spending years in courts.
- DanBC 8y ago
  Yes. And even (1) isn't always needed. There are several justifications for processing personal data, and permission is only one of them. (Although for compliance it is the easiest) https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ And (5) has a bunch of caveats. You don't always need to delete data. Right to Erasure: https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/
usrusr 8y ago
Is there even a single thing forbidden under GDPR that wasn't already forbidden before in at least half a dozen member states? In that case, it makes everything easier except for ignoring requirements.
- zaarn 8y ago
  I'm not certain about the other memberstates but to my knowledge the privacy law hasn't changed that much. There is a good increase in the amount of generating an audit log of any privacy sensitive stuff you do and of course the various "Right to be *" variants but those are largely non-issues. German courts already considered a EULA or "check box to consent and get thing" a non-binding consent (to some extend). Largely, if you are running afoul the GDPR in germany there is basically two options A) you rely on adsense a lot and B) you ran afoul the previous laws already. So, overall, I would say that yeah, most of the stuff forbidden by the GDPR was already forbidden. The GDPR grants you new rights and requires corporations to ensure compliance however, that's new. Plus the teeth in form of pretty hefty fine limits. Which is good IMO.

Am in EU, am involved in some compliance stuff and have talked to plenty others at other companies, and it really does seem to be a nothing-to-see-here for all companies except the sleezy ones.

hvidgaard 8y ago

In all of my research, talking to lawyers, and seminars on GDPR, it is about: 1. Ask permission for collecting data 2. Keep sensitive data safe 3. Restrict access to said data 4. Keep a log of what happens with the data 5. Delete it upon request 6. Have all of the above documented and adhere to the protocol. It's such a none issue unless you're relying on the very thing GDPR is designed to combat. If you not collecting and selling peoples data, and you don't do the above already, see this as a good opportunity to do what you should have been doing all along. There is such an awareness now, that it's the easiest it has ever been to know how to handle sensitive data properly.

willvarfar 8y ago
Completely agree with everything you list, and would add that 6. you can't force a user to give up privacy in order to get some other benefit, e.g. you can't offer to unlock some feature in return for more tracking
- merinowool 8y ago
  Example: How do you ask user for a permission to log access logs (which contain IP address) in the server, so that you can detect spam, ddos and other attacks? How do you store that consent information and what do you do if user doesn't consent? What do you do if user connecting from given IP address wants you to send him data you have collected about him. If people share IP addresses how do you know which log data is about which person?
  - willvarfar 8y ago
    Some entity runs a webserver. This entity has a legitimate business purpose in retaining access logs for e.g. 3 months for e.g. spam and security reasons. This entity just has to document that. This entity can allow a 3rd party service to access these logs so that 3rd party can do whatever needs to be done if it is within the reasons the entity gave for having the data. What neither can do is go use that data for anything other than the said purposes. And if the given reasons are gratuitous and somehow the regulators notice, expect to get a nastygram and have to comply or face fines. Basically what you can't do is collect data for longer than you have a legitimate need for, or cash-in and sell data you've collected. Basically, all said and done, just don't be sleezy and you'll be ok.
    - merinowool 8y ago
      Who defines what is a legitimate business purpose? Let's say I comply with all that, but someone makes a complaint and particularly bitter civil servant judges that the collection is not legitimate, because he doesn't like the content of the website?
      - acdha 8y ago
        That’s like arguing that we shouldn’t have laws in case a cop is having a bad day and follows you around writing tickets. This is a legal process like anything else: your standard should be what you’re comfortable defending in court. Being able to show a good faith decision process, compliance with common industry practice, etc. are going to help the case that any lapse was unintentional. If your angry ex is hired by a regulator you’d appeal it but there’s no reason to think that’s a common problem.
        merinowool 8y ago
        But appeal might take forever and by the time it is resolved you file for bankruptcy because the fine ruined the cash flow. I've seen in it many times in the EU, for example in Poland. Civil servants are immune from taking responsibility and if you manage to get any compensation you'll find yourself spending years in courts.
DanBC 8y ago
Yes. And even (1) isn't always needed. There are several justifications for processing personal data, and permission is only one of them. (Although for compliance it is the easiest) https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ And (5) has a bunch of caveats. You don't always need to delete data. Right to Erasure: https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/

usrusr 8y ago

Is there even a single thing forbidden under GDPR that wasn't already forbidden before in at least half a dozen member states? In that case, it makes everything easier except for ignoring requirements.

zaarn 8y ago
I'm not certain about the other memberstates but to my knowledge the privacy law hasn't changed that much. There is a good increase in the amount of generating an audit log of any privacy sensitive stuff you do and of course the various "Right to be *" variants but those are largely non-issues. German courts already considered a EULA or "check box to consent and get thing" a non-binding consent (to some extend). Largely, if you are running afoul the GDPR in germany there is basically two options A) you rely on adsense a lot and B) you ran afoul the previous laws already. So, overall, I would say that yeah, most of the stuff forbidden by the GDPR was already forbidden. The GDPR grants you new rights and requires corporations to ensure compliance however, that's new. Plus the teeth in form of pretty hefty fine limits. Which is good IMO.