4 ms·

What worries me most is how little is being said about private-operated sites. I am little Joe running internet forum about space battles with maybe 5 active us

by Ralfp 8y ago

What worries me most is how little is being said about private-operated sites. I am little Joe running internet forum about space battles with maybe 5 active users right now and no more than 100 active members historically. Should I sign data processing agreement with Google because I am using Gmail to send E-mails? Should I hire DPO? Am I risking my house being taken from me to cover multimilion fine because user posted their photo or e-mail 5 years ago and I’ve missed it because I don’t delete user-posted content together with their account?

jacquesm 8y ago
> What worries me most is how little is being said about private-operated sites. If you want I can research the matter in more detail, someone else came up with federated sites like Mastodon nodes and that's another pretty gray area. > I am little Joe running internet forum about space battles with maybe 5 active users right now and no more than 100 active members historically. Ok. > Should I sign data processing agreement with Google because I am using Gmail to send E-mails? No. You could try to stretch the law to include that particular example but from my reading of it this is perfectly acceptable. > Should I hire DPO? No, but you are the de-facto DPO, so if you receive a DSAR then you probably should answer it, though with your user counts I think the chances of that are very small. > Am I risking my house being taken from me to cover multimilion fine because user posted their photo or e-mail 5 years ago and I’ve missed it because I don’t delete user-posted content together with their account? No. But if a regulator should tell you that you should remove a users data (because you refused to for some reason or other) you probably should. The EU does not 'fine first and ask questions later', they will investigate first, warn and then when ignored they will fine. And for a small entity like yours which is more of a hobby than anything else I highly doubt regulators would even bother but you can't rule it out completely. Better increase you comet insurance as well if that's your main worry :)
- Mirioron 8y ago
  >No, but you are the de-facto DPO, so if you receive a DSAR then you probably should answer it, though with your user counts I think the chances of that are very small. I think that we might have this view about it right now, but I could easily see a scenario, where somebody targets you for "harassment" through something like this. Maybe you say something somebody else doesn't like on Twitter and they do that to you.
  - jacquesm 8y ago
    I'll deal with that when it happens. If I'm going to run my business based on everything that could happen with 0.001% probability then I would not get anything done at all.
- Ralfp 8y ago
  Thanks for answers! > You could try to stretch the law to include that particular example but from my reading of it this is perfectly acceptable. But I should still note about the fact in my privacy policy, shouldn't I? Couple other things I've noted when working on GDPR compliance for my forum: - It may be good idea to write in your forum rules that you don't allow users to embed their data outside of forum profile. - Forums accumulate tons of lurker accounts (users that register account but don't post or browse anything) that could be automatically deleted - Forums like to log IP's used by users when they, say, post messages. Those could be overwritten to 0.0.0.0 for items older than X days. I've also been working on privacy policy template for people in my position that I have on GitHub and would love to have any feedback: https://github.com/rafalp/misago-privacy-policy-examples/blob/master/PRIVACY-POLICY.md https://github.com/rafalp/misago-privacy-policy-examples/blo...
  - jacquesm 8y ago
    > But I should still note about the fact in my privacy policy, shouldn't I? Yes, I would disclose any third party that sees all or part of the data, and I would also disclose what reason there is for me to make use of that service. > I've also been working on privacy policy template for people in my position that I have on GitHub and would love to have any feedback: I will do that, but not right now, wildly busy today, but if you drop me a line (jacques@mattheij.com) I promise I will do that within the next couple of days.
- fvdessen 8y ago
  > No, but you are the de-facto DPO The GDPR requires that the DPO must be independent from the organisation, so you can't be 'your own DPO'. On the other hand the DPO is only required when sensitive or large quantities of data are concerned.
  - jacquesm 8y ago
    Yes, you can be if the business is small. Obviously there is a conflict of interest there but it is better to have a conflicted DPO than none at all. Even in a larger company the DPO would report to the CEO and then you'd be back where you started. The only way to really have a DPO independent of the organization is to have the DPO report to the board, and this is in fact done in places where that is warranted. Your literal reading of the law is right but your practical implementation will still have to fit the available maneuvering room and no DPA - one would hope - would insist on bankrupting half the SME's in their country.

by Ralfp 8y ago

jacquesm 8y ago

> What worries me most is how little is being said about private-operated sites. If you want I can research the matter in more detail, someone else came up with federated sites like Mastodon nodes and that's another pretty gray area. > I am little Joe running internet forum about space battles with maybe 5 active users right now and no more than 100 active members historically. Ok. > Should I sign data processing agreement with Google because I am using Gmail to send E-mails? No. You could try to stretch the law to include that particular example but from my reading of it this is perfectly acceptable. > Should I hire DPO? No, but you are the de-facto DPO, so if you receive a DSAR then you probably should answer it, though with your user counts I think the chances of that are very small. > Am I risking my house being taken from me to cover multimilion fine because user posted their photo or e-mail 5 years ago and I’ve missed it because I don’t delete user-posted content together with their account? No. But if a regulator should tell you that you should remove a users data (because you refused to for some reason or other) you probably should. The EU does not 'fine first and ask questions later', they will investigate first, warn and then when ignored they will fine. And for a small entity like yours which is more of a hobby than anything else I highly doubt regulators would even bother but you can't rule it out completely. Better increase you comet insurance as well if that's your main worry :)

Mirioron 8y ago
>No, but you are the de-facto DPO, so if you receive a DSAR then you probably should answer it, though with your user counts I think the chances of that are very small. I think that we might have this view about it right now, but I could easily see a scenario, where somebody targets you for "harassment" through something like this. Maybe you say something somebody else doesn't like on Twitter and they do that to you.
- jacquesm 8y ago
  I'll deal with that when it happens. If I'm going to run my business based on everything that could happen with 0.001% probability then I would not get anything done at all.
Ralfp 8y ago
Thanks for answers! > You could try to stretch the law to include that particular example but from my reading of it this is perfectly acceptable. But I should still note about the fact in my privacy policy, shouldn't I? Couple other things I've noted when working on GDPR compliance for my forum: - It may be good idea to write in your forum rules that you don't allow users to embed their data outside of forum profile. - Forums accumulate tons of lurker accounts (users that register account but don't post or browse anything) that could be automatically deleted - Forums like to log IP's used by users when they, say, post messages. Those could be overwritten to 0.0.0.0 for items older than X days. I've also been working on privacy policy template for people in my position that I have on GitHub and would love to have any feedback: https://github.com/rafalp/misago-privacy-policy-examples/blob/master/PRIVACY-POLICY.md https://github.com/rafalp/misago-privacy-policy-examples/blo...
- jacquesm 8y ago
  > But I should still note about the fact in my privacy policy, shouldn't I? Yes, I would disclose any third party that sees all or part of the data, and I would also disclose what reason there is for me to make use of that service. > I've also been working on privacy policy template for people in my position that I have on GitHub and would love to have any feedback: I will do that, but not right now, wildly busy today, but if you drop me a line (jacques@mattheij.com) I promise I will do that within the next couple of days.
fvdessen 8y ago
> No, but you are the de-facto DPO The GDPR requires that the DPO must be independent from the organisation, so you can't be 'your own DPO'. On the other hand the DPO is only required when sensitive or large quantities of data are concerned.
- jacquesm 8y ago
  Yes, you can be if the business is small. Obviously there is a conflict of interest there but it is better to have a conflicted DPO than none at all. Even in a larger company the DPO would report to the CEO and then you'd be back where you started. The only way to really have a DPO independent of the organization is to have the DPO report to the board, and this is in fact done in places where that is warranted. Your literal reading of the law is right but your practical implementation will still have to fit the available maneuvering room and no DPA - one would hope - would insist on bankrupting half the SME's in their country.