4 ms·

> A College student working on a side project with no revenue are treated the same as some massive multi-national. Am I reading this wrong? If the college stud

by takeda 8y ago

> A College student working on a side project with no revenue are treated the same as some massive multi-national. Am I reading this wrong? If the college student creates just a simple page, he/she is already complaint with GDPR. If the student starts collecting personal information, then they need to know what's allowed or not. There are already things that are not legal to do, GDPR just adds private information into that. The treatment of privacy is one of issues where it's pretty much impossible for individual protect from, GDPR tilts the scale in favor of individuals.

spullara 8y ago
Web servers are non-compliant out of the box because they all by default log and store IP addresses of visitors.
- oneplane 8y ago
  There is nothing non-compliant about that. You seem to misunderstand essential vs. data hoarding for advertisement purposes. If you were to keep that data forever, sell it to third parties or profile users based on that logging data, not tell them about it, then yeah, you'd be violating the GDPR. For normal operation system logging is pretty much a requirement for essential operation. That includes most properties of a connection like IP, UA, date, time, URI etc.
  - Semiapies 8y ago
    Which is the answer I see all of 50% of the time. Then, I see "Well, actually it is non-compliant because yadda yadda". My company isn't going to hire international compliance experts to review the operations of every public website we run, and we don't have any that need European visitors. So, best to just block them.
    - oneplane 8y ago
      But what about national compliance experts, do you hire those? Because you have a lot more national compliance on your plate than international...
      - Semiapies 8y ago
        That just emphasises how worthless it would be to spend effort to make sure we're compliant with GDPR. We have better things to do.
        oneplane 8y ago
        And that just emphasises how much you'd rather not worry about user data or telling users about it. You have money to make off of it?
        Semiapies 8y ago
        Meaning what? Our time is finite. Time we spend trying to comply with European regulations, when we have no European presence and seek no European customers, is time taken away from everything else we need to do—including complying with the actual laws we live under.
  - spullara 8y ago
    Without it documented why I am collecting it, how I use it and how I store and delete it, it is non-compliant that I am collecting it at all. I think that you are assuming that they know it is being collected and that they are supposed to use it for something. They don't. It is not essential at all to the operation of the service if you don't actively monitor it. Saying it could potentially be used for some kind of security function seems like a CYA if you aren't actually doing that. Do you disagree with this TLDR of the regulation? https://www.smartsurvey.co.uk/articles/gdpr-compliant-with-data-collection https://www.smartsurvey.co.uk/articles/gdpr-compliant-with-d... Without a bunch of work that hasn't been done I seriously doubt that they can give Right to Access, Right to be Forgotten, Data Portability, Privacy of Design and it does clearly state it is Personal Data.
- ajuc 8y ago
  So the defaults will be changed. It's called software cause it can be changed easily.
  - hk__2 8y ago
    A quick Google search leads to this, for example: https://blog.flyingcircus.io/2018/02/05/new-default-truncated-ip-addresses-in-nginx-access-logs/ https://blog.flyingcircus.io/2018/02/05/new-default-truncate...
    - takeda 8y ago
      I'm finding this: https://law.stackexchange.com/questions/28603/how-to-satisfy-gdprs-consent-requirement-for-ip-logging/28609#28609 https://law.stackexchange.com/questions/28603/how-to-satisfy...
manfredo 8y ago
If a kid makes a meme generator site where you can create a profile and organize your dank memes, then now they have to have a data protection officer, build a system to purge user data, and build a system to get user consent, etc. I can easily see small websites just ignoring GDPR and hoping they fly under the radar. Or, using something like this Cloudflare configuration to block all EU users until they reach a size where achieving GDPR compliance is feasible and worth the effort.
- hk__2 8y ago
  > If a kid makes a meme generator site where you can create a profile and organize your dank memes, then now they have to have a data protection officer, build a system to purge user data No, because that website doesn’t collect personal information. > and build a system to get user consent, etc. You need user consent to send emails or do something with their personal information (i.e. nothing since you don’t hold that information).
  - manfredo 8y ago
    > No, because that website doesn’t collect personal information. Yes it does. It a least records an email address and password to create profiles. And any features like tagging memes, marking memes as favorites, etc. could be argued to constitue personal data. > You need user consent to send emails or do something with their personal information (i.e. nothing since you don’t hold that information). Again, I specified a meme generator site that has at least some user specific personalization.
- viraptor 8y ago
  > they have to have a data protection officer DPO is only needed in specific cases. Dank meme sites don't fit in any of: a) public authority b) monitoring subjects on large scale c) dealing with criminal conviction data. > build a system to get user consent It's called a checkbox. They likely use one to agree to TOS anyway. If you don't have that one, DMCA and COPA is what you should be worried about before GDPR. (If you're based on the US anyway)

by takeda 8y ago

spullara 8y ago

Web servers are non-compliant out of the box because they all by default log and store IP addresses of visitors.

oneplane 8y ago
There is nothing non-compliant about that. You seem to misunderstand essential vs. data hoarding for advertisement purposes. If you were to keep that data forever, sell it to third parties or profile users based on that logging data, not tell them about it, then yeah, you'd be violating the GDPR. For normal operation system logging is pretty much a requirement for essential operation. That includes most properties of a connection like IP, UA, date, time, URI etc.
- Semiapies 8y ago
  Which is the answer I see all of 50% of the time. Then, I see "Well, actually it is non-compliant because yadda yadda". My company isn't going to hire international compliance experts to review the operations of every public website we run, and we don't have any that need European visitors. So, best to just block them.
  - oneplane 8y ago
    But what about national compliance experts, do you hire those? Because you have a lot more national compliance on your plate than international...
    - Semiapies 8y ago
      That just emphasises how worthless it would be to spend effort to make sure we're compliant with GDPR. We have better things to do.
      - oneplane 8y ago
        And that just emphasises how much you'd rather not worry about user data or telling users about it. You have money to make off of it?
        Semiapies 8y ago
        Meaning what? Our time is finite. Time we spend trying to comply with European regulations, when we have no European presence and seek no European customers, is time taken away from everything else we need to do—including complying with the actual laws we live under.
- spullara 8y ago
  Without it documented why I am collecting it, how I use it and how I store and delete it, it is non-compliant that I am collecting it at all. I think that you are assuming that they know it is being collected and that they are supposed to use it for something. They don't. It is not essential at all to the operation of the service if you don't actively monitor it. Saying it could potentially be used for some kind of security function seems like a CYA if you aren't actually doing that. Do you disagree with this TLDR of the regulation? https://www.smartsurvey.co.uk/articles/gdpr-compliant-with-data-collection https://www.smartsurvey.co.uk/articles/gdpr-compliant-with-d... Without a bunch of work that hasn't been done I seriously doubt that they can give Right to Access, Right to be Forgotten, Data Portability, Privacy of Design and it does clearly state it is Personal Data.
ajuc 8y ago
So the defaults will be changed. It's called software cause it can be changed easily.
- hk__2 8y ago
  A quick Google search leads to this, for example: https://blog.flyingcircus.io/2018/02/05/new-default-truncated-ip-addresses-in-nginx-access-logs/ https://blog.flyingcircus.io/2018/02/05/new-default-truncate...
  - takeda 8y ago
    I'm finding this: https://law.stackexchange.com/questions/28603/how-to-satisfy-gdprs-consent-requirement-for-ip-logging/28609#28609 https://law.stackexchange.com/questions/28603/how-to-satisfy...

manfredo 8y ago

If a kid makes a meme generator site where you can create a profile and organize your dank memes, then now they have to have a data protection officer, build a system to purge user data, and build a system to get user consent, etc. I can easily see small websites just ignoring GDPR and hoping they fly under the radar. Or, using something like this Cloudflare configuration to block all EU users until they reach a size where achieving GDPR compliance is feasible and worth the effort.

hk__2 8y ago
> If a kid makes a meme generator site where you can create a profile and organize your dank memes, then now they have to have a data protection officer, build a system to purge user data No, because that website doesn’t collect personal information. > and build a system to get user consent, etc. You need user consent to send emails or do something with their personal information (i.e. nothing since you don’t hold that information).
- manfredo 8y ago
  > No, because that website doesn’t collect personal information. Yes it does. It a least records an email address and password to create profiles. And any features like tagging memes, marking memes as favorites, etc. could be argued to constitue personal data. > You need user consent to send emails or do something with their personal information (i.e. nothing since you don’t hold that information). Again, I specified a meme generator site that has at least some user specific personalization.
viraptor 8y ago
> they have to have a data protection officer DPO is only needed in specific cases. Dank meme sites don't fit in any of: a) public authority b) monitoring subjects on large scale c) dealing with criminal conviction data. > build a system to get user consent It's called a checkbox. They likely use one to agree to TOS anyway. If you don't have that one, DMCA and COPA is what you should be worried about before GDPR. (If you're based on the US anyway)