4 ms·

> They either are mismanaged or are not willing to tell the users what data they are collecting and how they use and monetize this data. And it should worry all

> They either are mismanaged or are not willing to tell the users what data they are collecting and how they use and monetize this data. And it should worry all users, not only users from the EU. I don't know a ton about GDPR, but the article makes it look like it has less to do with Instapaper (aside from risk tolerance) and more to do with the ambiguity of the law. Some relevant quotes: > it’s more than likely to be the GDPR’s data subject access request, which allows any EU resident to request any and all data collected and stored about them. As The Verge reported yesterday, that’s causing companies trouble because it’s not entirely clear right now what information residents will request, what format that information needs to be in, how to locate it and package it, and whether new infrastructure needs to be created to manage this request pipeline. Personal info is a somewhat nebulous concept, and the fact that experts are describing the GDPR as “staggeringly complex” is not making it easy to cover all the bases. > It’s clear that few companies, if any, will be 100 percent compliant when the law goes into effect. But because the fines are so steep — violating GDPR will cost a company 4 percent of its global turnover or $20 million, whichever is larger — no one really wants to be caught non-compliant. So that’s why companies are rushing and, in the case of Instapaper, literally shutting down.

djhworld 8y ago
What...data are they collecting? It's a site that pins articles people have saved, the only piece of user data they should hold would be email address and maybe IP address? Simple to put in policies to expire the IP address data after a reasonable amount of time.
- bthdonohue 8y ago
  We detail the types of information we collect and how we use the data in our privacy policy here: https://www.instapaper.com/privacy https://www.instapaper.com/privacy
  - dmitriid 8y ago
    If that's the only info you collect, it would take you way less than two years to get compliant with GDPR. So there's something you're not telling.
    - deleted 8y ago
      [deleted]
TomK32 8y ago
An email-address to send requests to and someone setting up a process for those requests along with a definition of which data to be returned to the user, all that isn't hard to implement. GDPR has caused some panic that's unnecessary. The violations won't be fined with 4%/€20m (€ not $) right away, there's more steps before that, starting with "a warning in writing in cases of first and non-intentional noncompliance"
- brownbat 8y ago
  > GDPR has caused some panic that's unnecessary. Maybe some companies have overreacted, but dismissing them feels a bit like blaming the user for bad UX. Couldn't you argue that a law that causes a panicked overreaction was a poorly written law in at least one respect, given that laws have a communicative function? Especially if all these complaints were raised well in advance of the passage of the law, so that the drafters had plenty of warning that several groups were struggling to understand the text?
  - TomK32 8y ago
    The regulation was in the making since 2012. Plenty of time I'd say https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Timeline https://en.wikipedia.org/wiki/General_Data_Protection_Regula... The german Wikipedia has a lot more details on the history and development of the regulation: https://de.wikipedia.org/wiki/Datenschutz-Grundverordnung https://de.wikipedia.org/wiki/Datenschutz-Grundverordnung
  - DanBC 8y ago
    Seems pretty clear to me that a lot is taken into account and that the regulators can't go straight to huge fines. https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/
oldcynic 8y ago
> because the fines are so steep — violating GDPR will cost a company Will? The usual misinformation then.
thisisit 8y ago
>> violating GDPR will cost a company 4 percent of its global turnover or $20 million, whichever is larger Isn't there a lower level - 2% and $10 million too? https://www.itgovernance.co.uk/dpa-and-gdpr-penalties https://www.itgovernance.co.uk/dpa-and-gdpr-penalties
- sgift 8y ago
  There are various lower levels. It's "up to". Many of the things GDPR requires have been law in various parts of Europe for a long time (e.g. Germany), sometimes in all of Europe. But the fines were so low that most companies said "eh, who cares" - now enforcement has teeth and it's panic all around.
raverbashing 8y ago
> it’s not entirely clear right now what information residents will request, If they ask for something specific in an informal way, that can be provided But from the GDPRs data portability point of view, it's everything that's linked to the account. Export your Facebook data for a good example of this. HN example: it would be the information in your profile, the links/text you submitted (but not the content of the link itself), the comments (the comment IDs) you upvoted, stories flagged/upvoted (for the lenght of time this is kept, for example, if after a while user ids that upvoted a comment are erased and only the score is kept, that's fine) and maybe some other background information (for example: password hashes/access logs/etc) > what format that information needs to be in, Machine readable format. HTML/XML/JSON is fine. > how to locate it and package it, and whether new infrastructure needs to be created to manage this request pipeline. Well that's not the problem of the law, is it? You know your data scheme. You know whether you can run this in your existing infrastructure or not. for TABLE in YOUR_TABLES SELECT * from TABLE where UserID == $user_id; end for
- kodablah 8y ago
  From the HN example, does this include other comments that referenced my username? What about comments that might have linked to my GitHub profile? What if there are server logs that include my IP and a time which can correlate to when I posted a comment or something? What about this information on Algolia, must I contact them separately? Also, I wasn't aware...I can ask for my password hash? Can I request all of this information be deleted? (genuine questions btw assuming I were in the EU, not trolling)
  - raverbashing 8y ago
    Starting from the end > Can I request all of this information be deleted? Yes, the ones that are on HN. I'm not sure how it works for 3rd parties that obtain your data > does this include other comments that referenced my username? I don't think so, this is unlikely, especially as you didn't create it and HN doesn't link this (as opposed to reddit) > What about comments that might have linked to my GitHub profile? I'd say that being required is even less likely as HN has no way of knowing what's your GH profile GDPR is what they know about you. If they're actively trying to link pasted GH profiles and usernames then this would apply, otherwise no. > What if there are server logs that include my IP and a time which can correlate to when I posted a comment or something? That thing with IPs being PII I'd say this would apply, but then again, this doesn't bring any new information. So if they keep track of users access times then yes, but if this information is rotated, sent to /dev/null then no. You're not obligated to connect all the dots, or track user login times. That being said, IP (especially + times) are PII so better anonymize it and discard once not needed.
seba_dos1 8y ago
> violating GDPR will cost a company 4 percent of its global turnover or $20 million, whichever is larger You forgot "up to, depending of severity of violation".

djhworld 8y ago

What...data are they collecting? It's a site that pins articles people have saved, the only piece of user data they should hold would be email address and maybe IP address? Simple to put in policies to expire the IP address data after a reasonable amount of time.

bthdonohue 8y ago
We detail the types of information we collect and how we use the data in our privacy policy here: https://www.instapaper.com/privacy https://www.instapaper.com/privacy
- dmitriid 8y ago
  If that's the only info you collect, it would take you way less than two years to get compliant with GDPR. So there's something you're not telling.
  - deleted 8y ago
    [deleted]

TomK32 8y ago

An email-address to send requests to and someone setting up a process for those requests along with a definition of which data to be returned to the user, all that isn't hard to implement. GDPR has caused some panic that's unnecessary. The violations won't be fined with 4%/€20m (€ not $) right away, there's more steps before that, starting with "a warning in writing in cases of first and non-intentional noncompliance"

brownbat 8y ago
> GDPR has caused some panic that's unnecessary. Maybe some companies have overreacted, but dismissing them feels a bit like blaming the user for bad UX. Couldn't you argue that a law that causes a panicked overreaction was a poorly written law in at least one respect, given that laws have a communicative function? Especially if all these complaints were raised well in advance of the passage of the law, so that the drafters had plenty of warning that several groups were struggling to understand the text?
- TomK32 8y ago
  The regulation was in the making since 2012. Plenty of time I'd say https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Timeline https://en.wikipedia.org/wiki/General_Data_Protection_Regula... The german Wikipedia has a lot more details on the history and development of the regulation: https://de.wikipedia.org/wiki/Datenschutz-Grundverordnung https://de.wikipedia.org/wiki/Datenschutz-Grundverordnung
- DanBC 8y ago
  Seems pretty clear to me that a lot is taken into account and that the regulators can't go straight to huge fines. https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/

oldcynic 8y ago

> because the fines are so steep — violating GDPR will cost a company Will? The usual misinformation then.

thisisit 8y ago

>> violating GDPR will cost a company 4 percent of its global turnover or $20 million, whichever is larger Isn't there a lower level - 2% and $10 million too? https://www.itgovernance.co.uk/dpa-and-gdpr-penalties https://www.itgovernance.co.uk/dpa-and-gdpr-penalties

sgift 8y ago
There are various lower levels. It's "up to". Many of the things GDPR requires have been law in various parts of Europe for a long time (e.g. Germany), sometimes in all of Europe. But the fines were so low that most companies said "eh, who cares" - now enforcement has teeth and it's panic all around.

raverbashing 8y ago

> it’s not entirely clear right now what information residents will request, If they ask for something specific in an informal way, that can be provided But from the GDPRs data portability point of view, it's everything that's linked to the account. Export your Facebook data for a good example of this. HN example: it would be the information in your profile, the links/text you submitted (but not the content of the link itself), the comments (the comment IDs) you upvoted, stories flagged/upvoted (for the lenght of time this is kept, for example, if after a while user ids that upvoted a comment are erased and only the score is kept, that's fine) and maybe some other background information (for example: password hashes/access logs/etc) > what format that information needs to be in, Machine readable format. HTML/XML/JSON is fine. > how to locate it and package it, and whether new infrastructure needs to be created to manage this request pipeline. Well that's not the problem of the law, is it? You know your data scheme. You know whether you can run this in your existing infrastructure or not. for TABLE in YOUR_TABLES SELECT * from TABLE where UserID == $user_id; end for

kodablah 8y ago
From the HN example, does this include other comments that referenced my username? What about comments that might have linked to my GitHub profile? What if there are server logs that include my IP and a time which can correlate to when I posted a comment or something? What about this information on Algolia, must I contact them separately? Also, I wasn't aware...I can ask for my password hash? Can I request all of this information be deleted? (genuine questions btw assuming I were in the EU, not trolling)
- raverbashing 8y ago
  Starting from the end > Can I request all of this information be deleted? Yes, the ones that are on HN. I'm not sure how it works for 3rd parties that obtain your data > does this include other comments that referenced my username? I don't think so, this is unlikely, especially as you didn't create it and HN doesn't link this (as opposed to reddit) > What about comments that might have linked to my GitHub profile? I'd say that being required is even less likely as HN has no way of knowing what's your GH profile GDPR is what they know about you. If they're actively trying to link pasted GH profiles and usernames then this would apply, otherwise no. > What if there are server logs that include my IP and a time which can correlate to when I posted a comment or something? That thing with IPs being PII I'd say this would apply, but then again, this doesn't bring any new information. So if they keep track of users access times then yes, but if this information is rotated, sent to /dev/null then no. You're not obligated to connect all the dots, or track user login times. That being said, IP (especially + times) are PII so better anonymize it and discard once not needed.

seba_dos1 8y ago

> violating GDPR will cost a company 4 percent of its global turnover or $20 million, whichever is larger You forgot "up to, depending of severity of violation".