6 ms·

Considering that large sites with teams of lawyers are failing to follow the rules, how does a small site run by a few regular folks supposed to comply?

seba_dos1 8y ago
"large sites with business models developed around shady stuff GDPR is supposed to protect from" - there, FIFY.
notahacker 8y ago
their business model probably isn't selling user data
quohM0Ho 8y ago
The easiest way to comply is to not collect any PII. That is only a problem for companies that make data collection their core business.
- VMG 8y ago
  or anyone who has a public httpd with default log settings
  - dboreham 8y ago
    Default logging settings retain log files forever?
    - VMG 8y ago
      I don't know how long you are allowed to store PII under GDPR (I'm not a lawyer) This article indicates that default settings are problematic: https://www.ctrl.blog/entry/gdpr-web-server-logs https://www.ctrl.blog/entry/gdpr-web-server-logs > All of these logs contains personal information by default under the new regulation. IP addresses are specifically defined as personal data per Article 4, Point 1; and Recital 49. The logs can also contain usernames if your web service use them as part of their URL structure, and even the referral information that is logged by default can contain personal information (e.g. unintended collection of sensitive data; like being referred from a sensitive-subject website).
      - peteretep 8y ago
        > Article 4, Point 1 Article 4 Point 1 is: > (1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; It is very far from clear that that covers IP addresses, which tend to be recycled, and would need a police warrant + actual evidence to then map to a specific human > and Recital 49 http://www.privacy-regulation.eu/en/r49.htm http://www.privacy-regulation.eu/en/r49.htm Failing to see the relevance
        VMG 8y ago
        https://eugdprcompliant.com/personal-data/ https://eugdprcompliant.com/personal-data/ > [...] The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant. https://privacylawblog.fieldfisher.com/2016/can-a-dynamic-ip-address-constitute-personal-data https://privacylawblog.fieldfisher.com/2016/can-a-dynamic-ip... > What does the GDPR say? > [...] Recital 30 clarifies that "online identifier" includes IP addresses. http://www.privacy-regulation.eu/en/r30.htm http://www.privacy-regulation.eu/en/r30.htm > (30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags.
        quohM0Ho 8y ago
        > It is very far from clear that that covers IP addresses, which tend to be recycled Enter stage left: Address van Six, carrying an EUI64 card in his right hand.
      - dboreham 8y ago
        A quick read of that article suggests to me that it is just wrong.
  - mrweasel 8y ago
    I was actually looking for a way to configure something like filebeat to replace IPs with country codes, before shipping the logs of to a central logging server. On the face of it, it was more trouble than I could be bothered to deal with at the time, but now I may have to take another look.
    - yjftsjthsd-h 8y ago
      For that matter, could you just slice it down to a /16 or /24?
      - mrweasel 8y ago
        That would be equally good. I just want to avoid shipping complete IPs to a log-host.
- rebelde 8y ago
  IP addresses are PII, as defined in the law. Every website you visit gets your IP. HN has yours now, and now had a headache to deal with.
  - TeMPOraL 8y ago
    Reconfigure your server to stop logging IPs, and/or stop storing logs forever. Here, done.
    - ldjb 8y ago
      That's not always possible. A number of shared hosting services will automatically log IP addresses and do not provide a means to prevent logging. Of course, in that situation an argument could be made that the web host is the data controller, but that won't stop people taking legal action against the website's operator.
      - salvar 8y ago
        Was there anything stopping people taking legal action against website operators before GDPR?
        ldjb 8y ago
        No, but with the GDPR, they'd have more of a case, and it's easier to file a complaint. Whether that's a good or bad thing is a matter of perspective.
        salvar 8y ago
        Would they have more of a case even when they direct the complaint to the wrong business?
        ldjb 8y ago
        Whether it's the right business or the wrong business would be something decided upon in court. The prosecution could make the argument that the business in question broke the law. If the defence does not present a strong case and the judge sides with the prosecution, the business could still be reprimanded, regardless of whether they feel it is just or not.
deleted 8y ago
[deleted]
platelminto 8y ago
Because they're not failing due to misunderstanding the law, they're getting sued because their 'compliance' to the GDPR is against the spirit of it, and in most cases is actually in direct violation of multiple clauses. They're trying to follow the letter of the law and remain in the grey areas - if a 'small site run by a few regular folks' isn't doing anything shady, and isn't being basically negligent with their users data, they will be fine.
- makomk 8y ago
  I'm not sure about Facebook due to not using it, but Google's actually one of the less shady companies in this area. At least they do let you opt out of tracking-based advertising. Other sites don't. For instance, I just tried to view a Forbes article and it redirected to an interstitial which defaulted to letting them track me for advertising purposes, then when I changed the setting to only allow essential cookies it made me wait for several minutes with only a Cancel button, then finally redirected every page on the site to a message saying "You have arrived at this page because you have chosen not to consent to the use of cookies that help us provide a great experience (and great content) to you free of charge" and not allowing me to do anything but change my settings back. Journalists are just a lot less willing to criticise the state of the free press than they are to attack companies like Google and Facebook that eat into their collective profits.
toomanybeersies 8y ago
Small sites have it easy because their systems are a lot smaller. It has taken us fairly minimal effort to ensure GDPR compliance. Remember that you don't need automated systems to give users all the information you have or to delete users, it can just be an email form.
nothis 8y ago
The smaller the site (and the newer) the easier it is to comply. Don’t amass mountains of ad data and you’re fine.

seba_dos1 8y ago

"large sites with business models developed around shady stuff GDPR is supposed to protect from" - there, FIFY.

notahacker 8y ago

their business model probably isn't selling user data

quohM0Ho 8y ago

The easiest way to comply is to not collect any PII. That is only a problem for companies that make data collection their core business.

VMG 8y ago
or anyone who has a public httpd with default log settings
- dboreham 8y ago
  Default logging settings retain log files forever?
  - VMG 8y ago
    I don't know how long you are allowed to store PII under GDPR (I'm not a lawyer) This article indicates that default settings are problematic: https://www.ctrl.blog/entry/gdpr-web-server-logs https://www.ctrl.blog/entry/gdpr-web-server-logs > All of these logs contains personal information by default under the new regulation. IP addresses are specifically defined as personal data per Article 4, Point 1; and Recital 49. The logs can also contain usernames if your web service use them as part of their URL structure, and even the referral information that is logged by default can contain personal information (e.g. unintended collection of sensitive data; like being referred from a sensitive-subject website).
    - peteretep 8y ago
      > Article 4, Point 1 Article 4 Point 1 is: > (1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; It is very far from clear that that covers IP addresses, which tend to be recycled, and would need a police warrant + actual evidence to then map to a specific human > and Recital 49 http://www.privacy-regulation.eu/en/r49.htm http://www.privacy-regulation.eu/en/r49.htm Failing to see the relevance
      - VMG 8y ago
        https://eugdprcompliant.com/personal-data/ https://eugdprcompliant.com/personal-data/ > [...] The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant. https://privacylawblog.fieldfisher.com/2016/can-a-dynamic-ip-address-constitute-personal-data https://privacylawblog.fieldfisher.com/2016/can-a-dynamic-ip... > What does the GDPR say? > [...] Recital 30 clarifies that "online identifier" includes IP addresses. http://www.privacy-regulation.eu/en/r30.htm http://www.privacy-regulation.eu/en/r30.htm > (30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags.
      - quohM0Ho 8y ago
        > It is very far from clear that that covers IP addresses, which tend to be recycled Enter stage left: Address van Six, carrying an EUI64 card in his right hand.
    - dboreham 8y ago
      A quick read of that article suggests to me that it is just wrong.
- mrweasel 8y ago
  I was actually looking for a way to configure something like filebeat to replace IPs with country codes, before shipping the logs of to a central logging server. On the face of it, it was more trouble than I could be bothered to deal with at the time, but now I may have to take another look.
  - yjftsjthsd-h 8y ago
    For that matter, could you just slice it down to a /16 or /24?
    - mrweasel 8y ago
      That would be equally good. I just want to avoid shipping complete IPs to a log-host.
rebelde 8y ago
IP addresses are PII, as defined in the law. Every website you visit gets your IP. HN has yours now, and now had a headache to deal with.
- TeMPOraL 8y ago
  Reconfigure your server to stop logging IPs, and/or stop storing logs forever. Here, done.
  - ldjb 8y ago
    That's not always possible. A number of shared hosting services will automatically log IP addresses and do not provide a means to prevent logging. Of course, in that situation an argument could be made that the web host is the data controller, but that won't stop people taking legal action against the website's operator.
    - salvar 8y ago
      Was there anything stopping people taking legal action against website operators before GDPR?
      - ldjb 8y ago
        No, but with the GDPR, they'd have more of a case, and it's easier to file a complaint. Whether that's a good or bad thing is a matter of perspective.
        salvar 8y ago
        Would they have more of a case even when they direct the complaint to the wrong business?
        ldjb 8y ago
        Whether it's the right business or the wrong business would be something decided upon in court. The prosecution could make the argument that the business in question broke the law. If the defence does not present a strong case and the judge sides with the prosecution, the business could still be reprimanded, regardless of whether they feel it is just or not.

deleted 8y ago

[deleted]

platelminto 8y ago

Because they're not failing due to misunderstanding the law, they're getting sued because their 'compliance' to the GDPR is against the spirit of it, and in most cases is actually in direct violation of multiple clauses. They're trying to follow the letter of the law and remain in the grey areas - if a 'small site run by a few regular folks' isn't doing anything shady, and isn't being basically negligent with their users data, they will be fine.

makomk 8y ago
I'm not sure about Facebook due to not using it, but Google's actually one of the less shady companies in this area. At least they do let you opt out of tracking-based advertising. Other sites don't. For instance, I just tried to view a Forbes article and it redirected to an interstitial which defaulted to letting them track me for advertising purposes, then when I changed the setting to only allow essential cookies it made me wait for several minutes with only a Cancel button, then finally redirected every page on the site to a message saying "You have arrived at this page because you have chosen not to consent to the use of cookies that help us provide a great experience (and great content) to you free of charge" and not allowing me to do anything but change my settings back. Journalists are just a lot less willing to criticise the state of the free press than they are to attack companies like Google and Facebook that eat into their collective profits.

toomanybeersies 8y ago

Small sites have it easy because their systems are a lot smaller. It has taken us fairly minimal effort to ensure GDPR compliance. Remember that you don't need automated systems to give users all the information you have or to delete users, it can just be an email form.

nothis 8y ago

The smaller the site (and the newer) the easier it is to comply. Don’t amass mountains of ad data and you’re fine.