3 ms·
You need somebody that knows the regulations and developers that are capable of auditing the whole system. That's added fixed costs, which is an advantage for i
by VMG 8y ago
You need somebody that knows the regulations and developers that are capable of auditing the whole system. That's added fixed costs, which is an advantage for incumbents.
- dvfjsdhgfv 8y agoBut these regulations are not that complicated! Heck, in the EU we've been observing most of them in the last years already. Most things are really straightforward. Things get complicated when your core business is making users' data available to third parties. But it's not different from any other business: if you want to make money in catering for example, you need to read and adhere to relevant laws, too.
- VMG 8y agoIs an IP address PII or not? I have read multiple different interpretations today. Is a hash of an IP address PII?
- dvfjsdhgfv 8y agoIs this really that complex? If it can be linked to the individual, then it is. https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases https://www.whitecase.com/publications/alert/court-confirms-...
- kodablah 8y agoSo IP + timestamp of my ticket system logs is invalid because I also have a timestamp of ticket updates by a user. Actually, just IP because I have a timestamp on the log file. So the latest line has an IP, so I can take the file timestamp and see the latest ticket comment and now I've linked it to an individual. You're right, this is easy. Even easier now that I can't think of a way of storing an IP without the ability to at least correlate the latest one.
- dvfjsdhgfv 8y ago> So IP + timestamp of my ticket system logs is invalid What makes it "invalid"? If you can identify a person by their IP, then the IP becomes a part of their personal data. For most websites it's irrelevant, because people just visit and leave. But if someone signs in with their real name, you just need to update the ToS saying that apart from their other data you also store their IP. How complicated is that?
- kodablah 8y agoOk, just update the ToS. No ability needed to provide opt out of that IP collection? No ability needed to go, upon request, and delete all these IP+timestamp logs that I could use to correlate with their name? Handwaving all of this stuff away as clear and easy is at the least ignorant to real people's concerns and at most willfully dishonest.
- dvfjsdhgfv 8y agoHow can anyone "opt out of that IP collection"? It's not the way the Internet works: logging is an essential part of of its infrastructure (and in certain jurisdictions it's required by law). The only problem is if the IP is associated with personal data. If the user really wants to remove it, they can remove their personal data, and in this way the problem disappears. On the other hand, if you plan to sell the IPs associated with some other data to a third party that can easily link it to people (Google and Facebook can), you may want to consult a lawyer.
- DanBC 8y agoCan you point to the bit of the law that requires website owners to delete data upon request? Or the bit of the law that requires website owners to ask for consent to gather IP addresses?
- VMG 8y agoWriting style can be linked to individuals. Can I still have a forum where users submit text?