10 ms·

Because if your business model is based on selling user data, it doesn't matter if you're a small startup, it absolutely is meant to target you. If you aren't

by beojan 8y ago

Because if your business model is based on selling user data, it doesn't matter if you're a small startup, it absolutely is meant to target you. If you aren't competent at responsibly handling personal data and you want to build a project or startup, pick one that doesn't handle personal data, or put in the effort to learn how to do things properly.

hennsen 8y ago
How does for example a small yoga studio’s email list fit in your examples? Or even just it’s website? Without cookies and login even - the IP adress in the log files alone is considered potential personal data that basically puts people in the need of consulting a lawyer about how to safely deal with that. And makes you a potential target to being sued and getting a lot of hassle. Even found nit guilty in the end, no one will pay days of time and energy needed for defense. And then: What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost? You either have no option to reset passwords, or must do it by phone, which is extremely expensive.
- beojan 8y ago
  > the IP adress in the log files alone is considered potential personal data Stop logging the IP address then. Hopefully default settings in web servers will change. > What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost? That means you have a legitimate interest, so long as you don't send marketing emails to those addresses, or sell them, and so long as you delete them if someone deletes their account. > How does for example a small yoga studio’s email list fit in your examples? If someone signs up to your email list, they've consented to receiving emails. Just don't sell the list, and remove people if they unsubscribe. The only real complication (if you're in the UK, I don't know about other countries) is that there is a fee to register as a data controller. https://ico.org.uk/for-organisations/data-protection-fee/ https://ico.org.uk/for-organisations/data-protection-fee/
  - hennsen 8y ago
    Ip adresses are needed for security anslysis in case of attacks, for example. the thing is not about doing what you propose but that however you‘re doing it, you have a lot of bureaucracy and legal insecurity right now. The examples of wrongdoing you give should be leading to hard measures. But those with good intentions shouldn’t have high bureaucracy costs. To be clear: i don’t say these laws shouldn’t exist. They just should have been targeted at the actual wrongdoers and put smallest possible burden on all with no bad intentions.
    - remus 8y ago
      > Ip adresses are needed for security anslysis in case of attacks, for example. Then you have a legitimate need for the data, so store it for a reasonable length of time and then delete it.
    - ryanlol 8y ago
      >Ip adresses are needed for security anslysis in case of attacks, for example People repeat this a lot, but it sounds like complete nonsense. Why does your business need to perform “security anslysis in case of attacks”? Do you get paid to do that? Why would you need IP addresses for that?
      - jexah 8y ago
        One obvious case is DoS attacks. Rudimentary attacks can be mitigated by blocking IP addresses of the attacker. Another example is logging requests to secure sections of the site and/or server and perform IP blocks on fishy activity.
        beojan 8y ago
        You can do that with a hash of the IP.
        ryanlol 8y ago
        How would this work? You can't just sha256 IPs as that'd be trivial to reverse, no different from storing the plaintext. I don't see why the IPs would ever have to hit the disk for this purpose, just keep them cached in RAM for a few minutes.
- belorn 8y ago
  IP address are permitted under the security exception: Storing personal information in order to protect information or information systems is permitted without need for consent. Using your log files for security explicitly permitted and there is nothing that changed a system administrators job before or after GDPR on this point. If you are using a email list in order to fulfill a contract to your members by informing them about times and so on then that is also permitted by GDPR. If a customer buys a subscription then the company in order to fulfill their side of the contract can then naturally store information to do so. Mailing lists also has had a long history of best practices in order to not get marked as spam by the large email services. Get consent so users don't mark it as spam and allow unsubscribing. If a small yoga studio used a email list for a significant time and not been forced to do shady behavior in order to bypass spam filters, then they are almost guarantied to be compliant with GDRP. Similar an online business has a contract when a customer buy a product or service. In order to fulfill that contract a email address is commonly used. Perfect GDPR compliant. Hard to imagine a online business before GDRP that did not have a contract with customers.
  - candiodari 8y ago
    So what you're saying is there's lots of complexity and nuances in how you do this with some commonly done things illegal and others not ... and you should probably consult a lawyer to make sure. Correct ?
    - hennsen 8y ago
      Which is exactly my point put a bit shorter :)
    - zaarn 8y ago
      You don't have to get it all right on the first try. If you get something wrong, the regulatory body will contact you (via letter or email) and tell you what they feel like is not correct (that is the official guidance on how to handle GDPR violations). As long as you do your best to implement the GDPR and interact with the regulatory agency in a friendly and helpful manner then there won't be much need for a lawyer (but do consider that the GDPR being written as it is is also the result of being written in the EU where law is written a bit differently)
- zeta0134 8y ago
  I would sincerely hope that the small Yoga studio is not attempting to custom code their website in this case, in which case the economical solution is for the Yoga studio to use a GDPR compliant website and mailing list toolset, and simply migrate to a different set if they find that they aren't. Now compliance is largely handled by the tool makers, and the Yoga studio can focus on their business case and any custom coded extensions to ensure they remain compliant. (For popular stuff like Apache, compliant configurations are probably already available or will be shortly, once we all figure out if we are allowed to keep logging IP addresses by default.) I'm not sure I understand the email jab; obviously you can store data, you just must obtain consent first, and must allow the data to be deleted on request. That's an opt-in mailing list with an unsubscribe feature that actually works and properly deletes the relevant data. Why should that be difficult for a small business to do right?
  - smokeyj 8y ago
    Many small business rely on wordpress because it's free and hosting is cheap. There's plugins for nearly every functionality you can imagine. Perhaps having them migrate to proprietary systems is the better solution, but I can't help but feel it's a net loss for the World Wide Web.
    - zeta0134 8y ago
      On the contrary, I think this is secretly a benefit. As soon as WordPress updates to include all the necessary tools to be GDPR compliant, every small business using their platform should be able to easily pull those features in with minimal developer work. The common platform is a boon here because it helps everyone work together on the issue, rather than requiring the smaller players to implement a mountain of work by themselves.
  - olalonde 8y ago
    > I would sincerely hope that the small Yoga studio is not attempting to custom code their website in this case, in which case the economical solution is for the Yoga studio to use a GDPR compliant website and mailing list toolset, and simply migrate to a different set if they find that they aren't. You just gave a perfect example of why GDPR will hurt startups and innovation.
rhapsodic 8y ago
>If you aren't competent at responsibly handling personal data and you want to build a project or startup, pick one that doesn't handle personal data, or put in the effort to learn how to do things properly. Or, alternatively, just don't do business where it would put you under the jurisdiction of the GDPR. That's what a lot of companies are doing, and there seems to be a lot of resentment over it.
- beojan 8y ago
  There isn't a law banning the use of Electron instead of learning how to build desktop applications properly, and there's a lot of resentment over people doing that too.
  - rhapsodic 8y ago
    >There isn't a law banning the use of Electron instead of learning how to build desktop applications properly, and there's a lot of resentment over people doing that too. Yeah, and that resentment makes no sense to me either. In both cases it's simply people doing what, in their estimation, makes the best use of their available resources.

by beojan 8y ago

hennsen 8y ago

How does for example a small yoga studio’s email list fit in your examples? Or even just it’s website? Without cookies and login even - the IP adress in the log files alone is considered potential personal data that basically puts people in the need of consulting a lawyer about how to safely deal with that. And makes you a potential target to being sued and getting a lot of hassle. Even found nit guilty in the end, no one will pay days of time and energy needed for defense. And then: What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost? You either have no option to reset passwords, or must do it by phone, which is extremely expensive.

beojan 8y ago
> the IP adress in the log files alone is considered potential personal data Stop logging the IP address then. Hopefully default settings in web servers will change. > What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost? That means you have a legitimate interest, so long as you don't send marketing emails to those addresses, or sell them, and so long as you delete them if someone deletes their account. > How does for example a small yoga studio’s email list fit in your examples? If someone signs up to your email list, they've consented to receiving emails. Just don't sell the list, and remove people if they unsubscribe. The only real complication (if you're in the UK, I don't know about other countries) is that there is a fee to register as a data controller. https://ico.org.uk/for-organisations/data-protection-fee/ https://ico.org.uk/for-organisations/data-protection-fee/
- hennsen 8y ago
  Ip adresses are needed for security anslysis in case of attacks, for example. the thing is not about doing what you propose but that however you‘re doing it, you have a lot of bureaucracy and legal insecurity right now. The examples of wrongdoing you give should be leading to hard measures. But those with good intentions shouldn’t have high bureaucracy costs. To be clear: i don’t say these laws shouldn’t exist. They just should have been targeted at the actual wrongdoers and put smallest possible burden on all with no bad intentions.
  - remus 8y ago
    > Ip adresses are needed for security anslysis in case of attacks, for example. Then you have a legitimate need for the data, so store it for a reasonable length of time and then delete it.
  - ryanlol 8y ago
    >Ip adresses are needed for security anslysis in case of attacks, for example People repeat this a lot, but it sounds like complete nonsense. Why does your business need to perform “security anslysis in case of attacks”? Do you get paid to do that? Why would you need IP addresses for that?
    - jexah 8y ago
      One obvious case is DoS attacks. Rudimentary attacks can be mitigated by blocking IP addresses of the attacker. Another example is logging requests to secure sections of the site and/or server and perform IP blocks on fishy activity.
      - beojan 8y ago
        You can do that with a hash of the IP.
        ryanlol 8y ago
        How would this work? You can't just sha256 IPs as that'd be trivial to reverse, no different from storing the plaintext. I don't see why the IPs would ever have to hit the disk for this purpose, just keep them cached in RAM for a few minutes.
belorn 8y ago
IP address are permitted under the security exception: Storing personal information in order to protect information or information systems is permitted without need for consent. Using your log files for security explicitly permitted and there is nothing that changed a system administrators job before or after GDPR on this point. If you are using a email list in order to fulfill a contract to your members by informing them about times and so on then that is also permitted by GDPR. If a customer buys a subscription then the company in order to fulfill their side of the contract can then naturally store information to do so. Mailing lists also has had a long history of best practices in order to not get marked as spam by the large email services. Get consent so users don't mark it as spam and allow unsubscribing. If a small yoga studio used a email list for a significant time and not been forced to do shady behavior in order to bypass spam filters, then they are almost guarantied to be compliant with GDRP. Similar an online business has a contract when a customer buy a product or service. In order to fulfill that contract a email address is commonly used. Perfect GDPR compliant. Hard to imagine a online business before GDRP that did not have a contract with customers.
- candiodari 8y ago
  So what you're saying is there's lots of complexity and nuances in how you do this with some commonly done things illegal and others not ... and you should probably consult a lawyer to make sure. Correct ?
  - hennsen 8y ago
    Which is exactly my point put a bit shorter :)
  - zaarn 8y ago
    You don't have to get it all right on the first try. If you get something wrong, the regulatory body will contact you (via letter or email) and tell you what they feel like is not correct (that is the official guidance on how to handle GDPR violations). As long as you do your best to implement the GDPR and interact with the regulatory agency in a friendly and helpful manner then there won't be much need for a lawyer (but do consider that the GDPR being written as it is is also the result of being written in the EU where law is written a bit differently)
zeta0134 8y ago
I would sincerely hope that the small Yoga studio is not attempting to custom code their website in this case, in which case the economical solution is for the Yoga studio to use a GDPR compliant website and mailing list toolset, and simply migrate to a different set if they find that they aren't. Now compliance is largely handled by the tool makers, and the Yoga studio can focus on their business case and any custom coded extensions to ensure they remain compliant. (For popular stuff like Apache, compliant configurations are probably already available or will be shortly, once we all figure out if we are allowed to keep logging IP addresses by default.) I'm not sure I understand the email jab; obviously you can store data, you just must obtain consent first, and must allow the data to be deleted on request. That's an opt-in mailing list with an unsubscribe feature that actually works and properly deletes the relevant data. Why should that be difficult for a small business to do right?
- smokeyj 8y ago
  Many small business rely on wordpress because it's free and hosting is cheap. There's plugins for nearly every functionality you can imagine. Perhaps having them migrate to proprietary systems is the better solution, but I can't help but feel it's a net loss for the World Wide Web.
  - zeta0134 8y ago
    On the contrary, I think this is secretly a benefit. As soon as WordPress updates to include all the necessary tools to be GDPR compliant, every small business using their platform should be able to easily pull those features in with minimal developer work. The common platform is a boon here because it helps everyone work together on the issue, rather than requiring the smaller players to implement a mountain of work by themselves.
- olalonde 8y ago
  > I would sincerely hope that the small Yoga studio is not attempting to custom code their website in this case, in which case the economical solution is for the Yoga studio to use a GDPR compliant website and mailing list toolset, and simply migrate to a different set if they find that they aren't. You just gave a perfect example of why GDPR will hurt startups and innovation.

rhapsodic 8y ago

>If you aren't competent at responsibly handling personal data and you want to build a project or startup, pick one that doesn't handle personal data, or put in the effort to learn how to do things properly. Or, alternatively, just don't do business where it would put you under the jurisdiction of the GDPR. That's what a lot of companies are doing, and there seems to be a lot of resentment over it.

beojan 8y ago
There isn't a law banning the use of Electron instead of learning how to build desktop applications properly, and there's a lot of resentment over people doing that too.
- rhapsodic 8y ago
  >There isn't a law banning the use of Electron instead of learning how to build desktop applications properly, and there's a lot of resentment over people doing that too. Yeah, and that resentment makes no sense to me either. In both cases it's simply people doing what, in their estimation, makes the best use of their available resources.