11 ms·

GDPR Resource Library

unstatusthequo 8y ago
My firm put out these materials, and having seen a lot of FUD on here, to the point of people closing up shop and other similar "overcorrection" activities, I felt these needed to be shared with the HN community. It kills me to see people closing up shop and throwing their work away out of fear. Definitely watch the videos. I can tell you having done GDPR legal risk assessments for the past few years that if you're only thinking about this now, you're probably too late. The good news is the regulators are 1) going after low hanging fruit first (Facebook, Google, Apple, etc); 2) many of them are in disagreement about enforcement and priorities; 3) much of this is really about pseudo-taxation (hence the 4% of global gross revenue scare tactic); 4) some regulators are going to fight about who "gets to" go after certain companies; 5) if you're a tiny solo shop that does messaging apps, the likelihood of you even being noticed is so slim that closing up shop is really extreme; 6) compliance is probably easier than you think if you are that small.
- malvosenior 8y ago
  Your comment doesn’t do much to assuage my fear. All I see is uneven and arbitrary enforcement of an ill defined system that’s basically an excuse to tax tech companies more. Oh and “if you're only thinking about this now, you're probably too late” GDPR is anti-tech and anti-small business.
  - matthewmacleod 8y ago
    1. You haven’t seen any enforcement 2. Enforcement will likely follow the current path of most national regulators, which is about compliance more than punishment 3. Why do you think it applies to only tech companies? 4. Small companies will find compliance much easier.
  - Nursie 8y ago
    > All I see is uneven and arbitrary enforcement Have we seen any enforcement at all yet?
    - unstatusthequo 8y ago
      Not yet because it's not even in effect until May 25th. Then enforcement can begin. But yes, in the legal industry we expect it to be very uneven enforcement. The German regulator may be more worked up than the Spanish one, for example. And again, it's going to be low hanging fruit. Why would a regulator bring an enforcement action against some solo practitioner making $100k a year to maybe get $4k in fines when they can go after Facebook?
      - maxxxxx 8y ago
        "Why would a regulator bring an enforcement action against some solo practitioner making $100k a year to maybe get $4k in fines when they can go after Facebook?" Because the little guy won't put up much resistance? I think GDPR is a good thing BTW.
      - codexon 8y ago
        Why would they do 4k in fines when they can charge 20 million euro in fines?
        detaro 8y ago
        Because they can't just charge 20 million, and don't want a court explaining them why?
        codexon 8y ago
        Have you even read the GDPR? It literally says this. "4% of annual global turnover or €20 Million (whichever is greater)"
        mrunkel 8y ago
  - orf 8y ago
    It's decidedly pro-consumer[1] though and the full text isn't long[2]. 1. http://www.seyfarth.com/dir_docs/publications/GDPR_Webinar_2_Presentation.pdf http://www.seyfarth.com/dir_docs/publications/GDPR_Webinar_2... 2. https://gdpr-info.eu/ https://gdpr-info.eu/
    - whataretensors 8y ago
      It's 88 pages with 11 chapters of numbered regulations written in legalese. I wonder what you would consider long.
      - mrunkel 8y ago
        You can read and understand the entire thing in under an hour. It's not 88 full 'pages' of text, and what few legal terms they use are either A) defined in other parts of the document or B) easily googable.
        whataretensors 8y ago
        Here's the PDF http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... If you print it you can see 88 pages.
  - unstatusthequo 8y ago
    Well, it's true. Sorry if it doesn't help you, but the regulation was announced almost two years ago. Even some Fortune 1000 companies are way behind on preparing for this.
- themodelplumber 8y ago
  Thank you. It so happens that right before I heard about GDPR I took a FOSS forum I run down for maintenance. I was about to just keep it down, as most of my audience are EU members. But maybe a more nuanced approach is doable.
  - giancarlostoro 8y ago
    I often wondered about these cases. What kind of forum software do you use if you don't mind answering? Maybe someones working on a GDPR compliant plugin or the maintainers in the longer term?
    - themodelplumber 8y ago
      PunBB.
      - giancarlostoro 8y ago
        I think updating the ToS would be part of it and a plugin that allows an admin to delete a user + all their posts / threads would suffice in the context of a forum? It's been ages since I last used PunBB so maybe also delete all their private messages as well. If someone else quoted them it's slightly trickier cause that's someone else's post, but at this point you could tell them they would have to contact you to remove any other posts. I have my suspicion it's not very common for people to ask to be obliterated from online forums having been a user in many for years, it's more common for them to merely abandon their accounts. Again though, the concerns are real, and I wish I had a better answer other than "don't worry, it's highly unlikely anything bad will happen."
  - downandout 8y ago
    What part of his comment gives you any comfort? ALL of the quoted text below looks insanely scary to me when we are taking about potential fines of $20 million: “2) many of [the regulators] are in disagreement about enforcement and priorities; 3) much of this is really about pseudo-taxation.... 4) some regulators are going to fight about who "gets to" go after certain companies;” So it says a) the rules are extremely unclear, even to regulators (which means that each of the 28 countries WILL have different interpretations of GDPR), b) that it WILL be abused to “tax” international companies; and c) each of the countries are so eager to abuse their newly granted “pseudo-taxation” collection powers that they will literally be waiting in line to do so. None of that gives me any comfort.
- weaksauce 8y ago
  Who can bring suit? Is it the customer or the government or both?
  - theoctopus 8y ago
    It's the data protection authority of the country that represents the customer, such as the ICO for the UK.
    - weaksauce 8y ago
      Thanks... another thing I wonder is if this has implications in electronic crime detection. If the data can be irretrievable soon after a deletion request has been made doesn’t that make crimes harder to investigate after the fact? I haven’t done any real research on this so maybe it’s been addressed in the law.
      - Geee 8y ago
        That is exactly why you're allowed and should retain data such as server logs. You don't have to answer to deletion or transfer requests on such data.
        jchw 8y ago
        Most people seem to agree that under GDPR, IP addresses count as personal information and you either need to get rid of IP addresses, or encrypt the data at rest and respond to deletion/retrieval requests. What makes you sure that this is not the case?
        DelightOne 8y ago
        Probably common sense.
        mrunkel 8y ago
        Most people, especially non EU folk, seem to be misinformed. You don't have to purge your system of all PII upon request. An IP address is only considered PII if it can be used with other data to identify a person. If you delete the user's account, you can keep your server logs with IP addresses as long as you have a compelling business reason. That reason is "security and monitoring". Really most of the GDPR is just best practices codified. You are only really in trouble if you are using customer data for purposes that you A) haven't received their consent for and B) aren't what the customer would expect given what they are using your service for.
- gist 8y ago
  > 1) going after low hanging fruit first (Facebook, Google, Apple, etc) I say as a strategy they don't go after those but the middle tier who is less able to put up a fight legally. Perhaps you remember how long it took the Justice Department to fight Microsoft in the 90's. These large corporations have a great deal of brains and legal muscle. It's hard to believe that they will be the initial targets (although anything is possible). The 2nd tier is more likely the ones that will have issues (if any). Most companies aren't even close to this they are probably 7 or 10th tier targets. Some (small company with nominal user base) aren't even going to get noticed. That's the reality. Powerful law firms. Connected people. Even access to powerful US politicians. What's the chance? (Look at what is happening with ZTE now in China). To big to fail. This is not Monsanto dumping chemicals or asbestos type harm anyway. It's like spam (but not because major companies are not abusing that typically). You can do what you want as long as you are not operating an industrial strength spam machine. The emails that you send to your customers for whatever reason w/o even explicit approval will not get you into hot water (sure anything is possible but highly unlikely).
  - unstatusthequo 8y ago
    Quite possibly, though there will be more non-compliance in that slice of companies than regulators and resources to prosecute enforcement actions. Some of this is going to be "security by obscurity" to an extent. Not that any company use that as their strategy, but most should not expect a regulator contact on May 26th.
    - DanBC 8y ago
      >but most should not expect a regulator contact on May 26th. Especially because a bunch of the regulators aren't ready yet. https://twitter.com/bainesy1969/status/997452515825324034 https://twitter.com/bainesy1969/status/997452515825324034
  - madeofpalk 8y ago
    Considering the EU has brought cases against Microsoft, Apple, and Google, I’m not really sure how you get this impression.
- DanHulton 8y ago
  It's wild that you put this resource up to help combat FUD, only to have it run so rampant in your immediate comments.
5706906c06c 8y ago
Why do law firms believe GDPR is a legal issue? Privacy and Security have not been an entirely legal issue, though legal representation is often in the mix when dealing with regulations. I'm curious why GDPR continues to be treated as a legal problem when the regulation is more than clear on its intent and requirements?
- detaro 8y ago
  Because a lot of detailed questions are not obviously more than clear, especially if you have an interest in not just taking the strictest possible reading, and thus people want legal opinions on that. And where those legal opinions strongly disagree, there'll be legal proceedings to have the courts clarify those.
  - 5706906c06c 8y ago
    Fair. I guess it's far more pressing for the Data Controllers versus Processors (my case), so I'll stop with my biased view.

My firm put out these materials, and having seen a lot of FUD on here, to the point of people closing up shop and other similar "overcorrection" activities, I felt these needed to be shared with the HN community. It kills me to see people closing up shop and throwing their work away out of fear. Definitely watch the videos. I can tell you having done GDPR legal risk assessments for the past few years that if you're only thinking about this now, you're probably too late. The good news is the regulators are 1) going after low hanging fruit first (Facebook, Google, Apple, etc); 2) many of them are in disagreement about enforcement and priorities; 3) much of this is really about pseudo-taxation (hence the 4% of global gross revenue scare tactic); 4) some regulators are going to fight about who "gets to" go after certain companies; 5) if you're a tiny solo shop that does messaging apps, the likelihood of you even being noticed is so slim that closing up shop is really extreme; 6) compliance is probably easier than you think if you are that small.

malvosenior 8y ago
Your comment doesn’t do much to assuage my fear. All I see is uneven and arbitrary enforcement of an ill defined system that’s basically an excuse to tax tech companies more. Oh and “if you're only thinking about this now, you're probably too late” GDPR is anti-tech and anti-small business.
- matthewmacleod 8y ago
  1. You haven’t seen any enforcement 2. Enforcement will likely follow the current path of most national regulators, which is about compliance more than punishment 3. Why do you think it applies to only tech companies? 4. Small companies will find compliance much easier.
- Nursie 8y ago
  > All I see is uneven and arbitrary enforcement Have we seen any enforcement at all yet?
  - unstatusthequo 8y ago
    Not yet because it's not even in effect until May 25th. Then enforcement can begin. But yes, in the legal industry we expect it to be very uneven enforcement. The German regulator may be more worked up than the Spanish one, for example. And again, it's going to be low hanging fruit. Why would a regulator bring an enforcement action against some solo practitioner making $100k a year to maybe get $4k in fines when they can go after Facebook?
    - maxxxxx 8y ago
      "Why would a regulator bring an enforcement action against some solo practitioner making $100k a year to maybe get $4k in fines when they can go after Facebook?" Because the little guy won't put up much resistance? I think GDPR is a good thing BTW.
    - codexon 8y ago
      Why would they do 4k in fines when they can charge 20 million euro in fines?
      - detaro 8y ago
        Because they can't just charge 20 million, and don't want a court explaining them why?
        codexon 8y ago
        Have you even read the GDPR? It literally says this. "4% of annual global turnover or €20 Million (whichever is greater)"
        mrunkel 8y ago
- orf 8y ago
  It's decidedly pro-consumer[1] though and the full text isn't long[2]. 1. http://www.seyfarth.com/dir_docs/publications/GDPR_Webinar_2_Presentation.pdf http://www.seyfarth.com/dir_docs/publications/GDPR_Webinar_2... 2. https://gdpr-info.eu/ https://gdpr-info.eu/
  - whataretensors 8y ago
    It's 88 pages with 11 chapters of numbered regulations written in legalese. I wonder what you would consider long.
    - mrunkel 8y ago
      You can read and understand the entire thing in under an hour. It's not 88 full 'pages' of text, and what few legal terms they use are either A) defined in other parts of the document or B) easily googable.
      - whataretensors 8y ago
        Here's the PDF http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... If you print it you can see 88 pages.
- unstatusthequo 8y ago
  Well, it's true. Sorry if it doesn't help you, but the regulation was announced almost two years ago. Even some Fortune 1000 companies are way behind on preparing for this.
themodelplumber 8y ago
Thank you. It so happens that right before I heard about GDPR I took a FOSS forum I run down for maintenance. I was about to just keep it down, as most of my audience are EU members. But maybe a more nuanced approach is doable.
- giancarlostoro 8y ago
  I often wondered about these cases. What kind of forum software do you use if you don't mind answering? Maybe someones working on a GDPR compliant plugin or the maintainers in the longer term?
  - themodelplumber 8y ago
    PunBB.
    - giancarlostoro 8y ago
      I think updating the ToS would be part of it and a plugin that allows an admin to delete a user + all their posts / threads would suffice in the context of a forum? It's been ages since I last used PunBB so maybe also delete all their private messages as well. If someone else quoted them it's slightly trickier cause that's someone else's post, but at this point you could tell them they would have to contact you to remove any other posts. I have my suspicion it's not very common for people to ask to be obliterated from online forums having been a user in many for years, it's more common for them to merely abandon their accounts. Again though, the concerns are real, and I wish I had a better answer other than "don't worry, it's highly unlikely anything bad will happen."
- downandout 8y ago
  What part of his comment gives you any comfort? ALL of the quoted text below looks insanely scary to me when we are taking about potential fines of $20 million: “2) many of [the regulators] are in disagreement about enforcement and priorities; 3) much of this is really about pseudo-taxation.... 4) some regulators are going to fight about who "gets to" go after certain companies;” So it says a) the rules are extremely unclear, even to regulators (which means that each of the 28 countries WILL have different interpretations of GDPR), b) that it WILL be abused to “tax” international companies; and c) each of the countries are so eager to abuse their newly granted “pseudo-taxation” collection powers that they will literally be waiting in line to do so. None of that gives me any comfort.
weaksauce 8y ago
Who can bring suit? Is it the customer or the government or both?
- theoctopus 8y ago
  It's the data protection authority of the country that represents the customer, such as the ICO for the UK.
  - weaksauce 8y ago
    Thanks... another thing I wonder is if this has implications in electronic crime detection. If the data can be irretrievable soon after a deletion request has been made doesn’t that make crimes harder to investigate after the fact? I haven’t done any real research on this so maybe it’s been addressed in the law.
    - Geee 8y ago
      That is exactly why you're allowed and should retain data such as server logs. You don't have to answer to deletion or transfer requests on such data.
      - jchw 8y ago
        Most people seem to agree that under GDPR, IP addresses count as personal information and you either need to get rid of IP addresses, or encrypt the data at rest and respond to deletion/retrieval requests. What makes you sure that this is not the case?
        DelightOne 8y ago
        Probably common sense.
        mrunkel 8y ago
        Most people, especially non EU folk, seem to be misinformed. You don't have to purge your system of all PII upon request. An IP address is only considered PII if it can be used with other data to identify a person. If you delete the user's account, you can keep your server logs with IP addresses as long as you have a compelling business reason. That reason is "security and monitoring". Really most of the GDPR is just best practices codified. You are only really in trouble if you are using customer data for purposes that you A) haven't received their consent for and B) aren't what the customer would expect given what they are using your service for.
gist 8y ago
> 1) going after low hanging fruit first (Facebook, Google, Apple, etc) I say as a strategy they don't go after those but the middle tier who is less able to put up a fight legally. Perhaps you remember how long it took the Justice Department to fight Microsoft in the 90's. These large corporations have a great deal of brains and legal muscle. It's hard to believe that they will be the initial targets (although anything is possible). The 2nd tier is more likely the ones that will have issues (if any). Most companies aren't even close to this they are probably 7 or 10th tier targets. Some (small company with nominal user base) aren't even going to get noticed. That's the reality. Powerful law firms. Connected people. Even access to powerful US politicians. What's the chance? (Look at what is happening with ZTE now in China). To big to fail. This is not Monsanto dumping chemicals or asbestos type harm anyway. It's like spam (but not because major companies are not abusing that typically). You can do what you want as long as you are not operating an industrial strength spam machine. The emails that you send to your customers for whatever reason w/o even explicit approval will not get you into hot water (sure anything is possible but highly unlikely).
- unstatusthequo 8y ago
  Quite possibly, though there will be more non-compliance in that slice of companies than regulators and resources to prosecute enforcement actions. Some of this is going to be "security by obscurity" to an extent. Not that any company use that as their strategy, but most should not expect a regulator contact on May 26th.
  - DanBC 8y ago
    >but most should not expect a regulator contact on May 26th. Especially because a bunch of the regulators aren't ready yet. https://twitter.com/bainesy1969/status/997452515825324034 https://twitter.com/bainesy1969/status/997452515825324034
- madeofpalk 8y ago
  Considering the EU has brought cases against Microsoft, Apple, and Google, I’m not really sure how you get this impression.
DanHulton 8y ago
It's wild that you put this resource up to help combat FUD, only to have it run so rampant in your immediate comments.

5706906c06c 8y ago

Why do law firms believe GDPR is a legal issue? Privacy and Security have not been an entirely legal issue, though legal representation is often in the mix when dealing with regulations. I'm curious why GDPR continues to be treated as a legal problem when the regulation is more than clear on its intent and requirements?

detaro 8y ago
Because a lot of detailed questions are not obviously more than clear, especially if you have an interest in not just taking the strictest possible reading, and thus people want legal opinions on that. And where those legal opinions strongly disagree, there'll be legal proceedings to have the courts clarify those.
- 5706906c06c 8y ago
  Fair. I guess it's far more pressing for the Data Controllers versus Processors (my case), so I'll stop with my biased view.