7 ms·

I'm a little confused. Who is sending compliance requests? If it's not the ico, there's rely no problem. If it is the ico, ask what needs to change. No lawyers

I'm a little confused. Who is sending compliance requests? If it's not the ico, there's rely no problem. If it is the ico, ask what needs to change. No lawyers required.

danShumway 8y ago
> No lawyers required. Phrases like this just sound weird to me. If there's a risk that someone could sue you over something, from a business perspective I have always been taught that you avoid it, period, until you get a lawyer. I wonder if this is a cultural difference between the US and EU? Might explain some of the different reactions people have had to the legislation.
- Sir_Substance 8y ago
  >If there's a risk that someone could sue you over something, from a business perspective I have always been taught that you avoid it, period, until you get a lawyer. Bad news: If you have a business, people can attempt to sue your business for whatever they want, and you might have to defend against it. There is nothing on the books that says lawsuits have to be reasonable before they can be filed, only that people who abuse the legal system get punished AFTER a court decides they're a moron.
  - ryandrake 8y ago
    Not just businesses. Anyone can get sued for any reason. If your blanket policy really is “I won’t do anything if I risk getting sued” you literally can’t even leave your house.
  - tatersolid 8y ago
    Judges in the US routinely dismiss frivolous cases[1] with prejudice. And in fact even filing a frivolous case can result in fines or jail time for contempt. So no, you can’t in practice sue someone for anything. [1]: https://en.m.wikipedia.org/wiki/Frivolous_litigation https://en.m.wikipedia.org/wiki/Frivolous_litigation
  - Matticus_Rex 8y ago
    Eh... this is way overstated. You don't have to be a lawyer to file a pretty solid 12(b)(6) motion, which gets you through the obviously idiotic suits. I'd rather file one of those than do GDPR compliance documentation.
- subway 8y ago
  Despite all the bluster to the contrary, in the US we avoid accepting responsibility for our actions at all costs. To the point that business schools now effectively teach that the correct strategy is to put your fingers in your ears, and yell "la la la" until somebody actually smacks you.
  - drivingmenuts 8y ago
    The legal climate here is different. If you accept responsibility, you will be sued, by victims for possible monetary losses and/or by prosecutors for possible criminal liability. If you stonewall, you might get sued for (see previous) but you might not if it's too expensive. I don't know if it's a social thing or a legal thing or some combination or what, but apparently it's harder to sue in other parts of the world.
    - tinco 8y ago
      It's not harder, just less profitable.
  - ryanwaggoner 8y ago
    Which business schools are those?
    - trobertson 8y ago
      Harvard Business School and its wannabes.
      - ryanwaggoner 8y ago
        Give me a break. HBS does not teach students anything remotely close to ignoring problems and never taking responsibility for your actions.
- duxup 8y ago
  >If there's a risk that someone could sue you over something That seems like a pretty broad policy... someone could all the time for any reason no matter how good a reason.
  - danShumway 8y ago
    Sure, it's not black and white - it's a scale. We don't lawyer up for literally everything. But we do lawyer up for a lot of things. It's sort of like the "never roll your own security" advice that gets brought out when people ask questions about crypto. To a certain extent, yeah, we do have to roll our own security. Of course developers need to roll their own stuff, at least at the integration level. But as soon as it gets even slightly dangerous, I'm not going to be doing, say, my own XSS filtering. I need a vetted library at that point. I've been taught to think of the law the same way - you don't roll your own legal advice.
    - jopsen 8y ago
      In Europe you don't get big fines for no good reason. And if you've attempted to comply you'll most likely get a warning first. So why not roll your own?
- DanBC 8y ago
  > If there's a risk that someone could sue you over something, Which bit of GDPR introduces that risk?
  - danShumway 8y ago
    Maybe sue isn't the correct term, but you are talking about potentially a 20 million dollar fine. I'm being told that the EU would never pursue that with a small business and they'd just tell you what you need to fix. That also sounds weird to me as an American. I'm not saying it isn't true, just that it's not the way I'm used to thinking about laws.
    - DanBC 8y ago
      European law tends to talk about the maximum available penalty under the worst possible situation. It then gives a list of factors to be taken into account. I'm not sure why that's a bad thing. Look at the US COPPA, with potentially $41,000 per violation. Why isn't this more scary for American website operators? https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions#COPPA%20Enforcement https://www.ftc.gov/tips-advice/business-center/guidance/com... > A court can hold operators who violate the Rule liable for civil penalties of up to $41,484 per violation. The amount of civil penalties a court assesses may turn on a number of factors, including the egregiousness of the violations, whether the operator has previously violated the Rule, the number of children involved, the amount and type of personal information collected, how the information was used, whether it was shared with third parties, and the size of the company. Information about the FTC’s COPPA enforcement actions, including the amounts of civil penalties obtained, can be found by clicking on the Case Highlights link in the FTC’s Business Center. I mean, any US website that's compliant with COPPA should find GDPR to be a doddle. https://corporate.findlaw.com/law-library/ftc-imposes-largest-coppa-civil-penalties-to-date-children-s.html https://corporate.findlaw.com/law-library/ftc-imposes-larges...
      - danShumway 8y ago
        COPPA is frightening to web operators, at least in the abstract. The majority of web services online at least make a cursory effort to either ban users under the age of 13 from accessing the site or force them to give parental consent. Technically speaking, if you're under 13 you're not really supposed to be on sites like Twitter. The equivalent reaction for GDPR would be if everyone either started making half-hearted efforts to block European users (which isn't what EU wants), or if everyone forced all of their users to agree to the same data collection before they signed up (which as far as I can tell is not legal). From the law: > However, an operator of a general audience site or service that chooses to screen its users for age in a neutral fashion may rely on the age information its users enter, even if that age information is not accurate. This line is basically the entire reason why COPPA is generally not seen as a problem for US businesses.
- jopsen 8y ago
  Only regulators will have the standing to give fines. Don't think anyone can sue. It's like you're driving too fast on the highway, but if it's just you mom complaining and not a police officer you won't get fined :) - that said, we should all respect the speed limit, they are there for a reason.
- bigbugbag 8y ago
  in the EU you cannot get huge amount of money out of nothing, fines are limited to the extent of the damage. So basically much less legal action in the EU and needs for lawyers. Bigger companies do have legal teams, but smaller one can operate without ever needing a lawyer.
- lucb1e 8y ago
  > > No lawyers required. > Phrases like this just sound weird to me. Are you from the USA? Because my best guess is that that's why it sounds weird to you. I almost sued a company (they paid just in time) and even then wouldn't have looked for representation, let alone for issues like these. Just read a blog post or two about GDPR. No lawyers required.
spacebearmakes 8y ago
The owner of the forum received the "Nightmare letter" [1] which he is legally obligated to respond to, which as an open source project does not have the resources to be able to respond to them. [1]: https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce...
- kyberias 8y ago
  To answer that letter takes maybe 5 minutes for a simple forum operator.
  - aw3c2 8y ago
    I host a standard FluxBB forum on a stock Debian apache server. Can you please spent 5 minutes to answer that letter for me?
    - kyberias 8y ago
      I don't want to. It's your forum. Your responsibility.
    - bigbugbag 8y ago
      Show me the letter you received and we'll work from this. You might want to get in touch with fluxBB dev to get a GDPR button extracting the relevant data from the database to avoid the pain of building the db query by hand.
      - aw3c2 8y ago
        Sorry, I was offline. For the sake of this exercise https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce... of course.
- bigbugbag 8y ago
  Open source is totally unrelated to the matter at hands here. Any small operator is having limited resources and GDPR has been thought to allow everyone to answer requests. It gave 2 year to get conformity to something which has been effective since 1995 through a European directive. The forum owner decided to ignore this a do nothing, now he's confronted with the consequences of his choices. But again his reaction is akin to a knee jerk reaction as he is probably in capacity to answer the request while outsourcing to a third party does remove his responsibility and obligation to answer GDPR requests just now it's gonna get a bit more complicated as he has a third party into the loop which is probably not complying either.
michaelbuckbee 8y ago
The forum owner wasn't getting "compliance requests" he was receiving "subject data access requests". Those requests can be: - Please give me all my data - Please delete all my data - Please stop doing things (processing) my data Or some mix of all the above. A site owner (controller) has 30 days from receiving such a request to respond or the person making the request can report them to their Supervisory Authority (ICO is the UK Supervisory Authority, each country in the EU has their own).
- codedokode 8y ago
  So it looks like having a script to delete all user's data can get you out of trouble with any of these letters.
  - DanBC 8y ago
    But it's important to remember the GDPR doesn't give users a right to have all data deleted on request. Processors only have to delete data in certain situations. For example, if you told the user why you collected the data, and you're still using it for that purpose, and you have a legitimate need to continue to do so then you don't need to delete the data. And there's an extra exemption for "exercising the right of freedom of expression and information". https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/
  - bigbugbag 8y ago
    - Please tell me all the data you have on me * furiously delete all user's data * This is probably gonna get you in much more trouble than you could have been initially. For example France has law telling ISP they have to collect and retain customer data and activities for a year to able to retroactively identify who did what online at what time, failing this is not a matter of a report that could lead to warning and then to a fine but years of jail time instead.
    - michaelbuckbee 8y ago
      The GDPR specifically says you don't have to delete the data if you are legally required to keep it for other reasons. Most often this is financial data, but there are plenty of other examples.
013a 8y ago
Have you ever ran a business that, uh, intended to scale beyond one employee and a hobby website? I've never seen a company be threatened with some form of legal attack and not get lawyers involved. Especially with such a new law like the GDPR that has no judicial precedences upon which to build business processes. I've been in companies as small as 4 people, and we still had lawyers on retainer for stuff like this (copyright violations in user hosted content was a big one before GDPR). If you can completely distill a binder of a legal framework down to an "if this then that else this" sentence, you don't understand it, and your hubris is going to kill your company. If you think the correct response is "don't respond, wait until it escalates", you don't understand it and your hubris is going to kill your company. If you're doing anything worthwhile you're going to be bumping up against some law or another, and you can't just ignore it and you can't afford to not understand it. That's why you pay lawyers.
- bigbugbag 8y ago
  GDPR is not new law, it's a mean to enforce a European Directive from 1995. Also there are several privacy precedents in the EU, for example max schrems.

I'm a little confused. Who is sending compliance requests? If it's not the ico, there's rely no problem. If it is the ico, ask what needs to change. No lawyers required.

danShumway 8y ago

> No lawyers required. Phrases like this just sound weird to me. If there's a risk that someone could sue you over something, from a business perspective I have always been taught that you avoid it, period, until you get a lawyer. I wonder if this is a cultural difference between the US and EU? Might explain some of the different reactions people have had to the legislation.

Sir_Substance 8y ago
>If there's a risk that someone could sue you over something, from a business perspective I have always been taught that you avoid it, period, until you get a lawyer. Bad news: If you have a business, people can attempt to sue your business for whatever they want, and you might have to defend against it. There is nothing on the books that says lawsuits have to be reasonable before they can be filed, only that people who abuse the legal system get punished AFTER a court decides they're a moron.
- ryandrake 8y ago
  Not just businesses. Anyone can get sued for any reason. If your blanket policy really is “I won’t do anything if I risk getting sued” you literally can’t even leave your house.
- tatersolid 8y ago
  Judges in the US routinely dismiss frivolous cases[1] with prejudice. And in fact even filing a frivolous case can result in fines or jail time for contempt. So no, you can’t in practice sue someone for anything. [1]: https://en.m.wikipedia.org/wiki/Frivolous_litigation https://en.m.wikipedia.org/wiki/Frivolous_litigation
- Matticus_Rex 8y ago
  Eh... this is way overstated. You don't have to be a lawyer to file a pretty solid 12(b)(6) motion, which gets you through the obviously idiotic suits. I'd rather file one of those than do GDPR compliance documentation.
subway 8y ago
Despite all the bluster to the contrary, in the US we avoid accepting responsibility for our actions at all costs. To the point that business schools now effectively teach that the correct strategy is to put your fingers in your ears, and yell "la la la" until somebody actually smacks you.
- drivingmenuts 8y ago
  The legal climate here is different. If you accept responsibility, you will be sued, by victims for possible monetary losses and/or by prosecutors for possible criminal liability. If you stonewall, you might get sued for (see previous) but you might not if it's too expensive. I don't know if it's a social thing or a legal thing or some combination or what, but apparently it's harder to sue in other parts of the world.
  - tinco 8y ago
    It's not harder, just less profitable.
- ryanwaggoner 8y ago
  Which business schools are those?
  - trobertson 8y ago
    Harvard Business School and its wannabes.
    - ryanwaggoner 8y ago
      Give me a break. HBS does not teach students anything remotely close to ignoring problems and never taking responsibility for your actions.
duxup 8y ago
>If there's a risk that someone could sue you over something That seems like a pretty broad policy... someone could all the time for any reason no matter how good a reason.
- danShumway 8y ago
  Sure, it's not black and white - it's a scale. We don't lawyer up for literally everything. But we do lawyer up for a lot of things. It's sort of like the "never roll your own security" advice that gets brought out when people ask questions about crypto. To a certain extent, yeah, we do have to roll our own security. Of course developers need to roll their own stuff, at least at the integration level. But as soon as it gets even slightly dangerous, I'm not going to be doing, say, my own XSS filtering. I need a vetted library at that point. I've been taught to think of the law the same way - you don't roll your own legal advice.
  - jopsen 8y ago
    In Europe you don't get big fines for no good reason. And if you've attempted to comply you'll most likely get a warning first. So why not roll your own?
DanBC 8y ago
> If there's a risk that someone could sue you over something, Which bit of GDPR introduces that risk?
- danShumway 8y ago
  Maybe sue isn't the correct term, but you are talking about potentially a 20 million dollar fine. I'm being told that the EU would never pursue that with a small business and they'd just tell you what you need to fix. That also sounds weird to me as an American. I'm not saying it isn't true, just that it's not the way I'm used to thinking about laws.
  - DanBC 8y ago
    European law tends to talk about the maximum available penalty under the worst possible situation. It then gives a list of factors to be taken into account. I'm not sure why that's a bad thing. Look at the US COPPA, with potentially $41,000 per violation. Why isn't this more scary for American website operators? https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions#COPPA%20Enforcement https://www.ftc.gov/tips-advice/business-center/guidance/com... > A court can hold operators who violate the Rule liable for civil penalties of up to $41,484 per violation. The amount of civil penalties a court assesses may turn on a number of factors, including the egregiousness of the violations, whether the operator has previously violated the Rule, the number of children involved, the amount and type of personal information collected, how the information was used, whether it was shared with third parties, and the size of the company. Information about the FTC’s COPPA enforcement actions, including the amounts of civil penalties obtained, can be found by clicking on the Case Highlights link in the FTC’s Business Center. I mean, any US website that's compliant with COPPA should find GDPR to be a doddle. https://corporate.findlaw.com/law-library/ftc-imposes-largest-coppa-civil-penalties-to-date-children-s.html https://corporate.findlaw.com/law-library/ftc-imposes-larges...
    - danShumway 8y ago
      COPPA is frightening to web operators, at least in the abstract. The majority of web services online at least make a cursory effort to either ban users under the age of 13 from accessing the site or force them to give parental consent. Technically speaking, if you're under 13 you're not really supposed to be on sites like Twitter. The equivalent reaction for GDPR would be if everyone either started making half-hearted efforts to block European users (which isn't what EU wants), or if everyone forced all of their users to agree to the same data collection before they signed up (which as far as I can tell is not legal). From the law: > However, an operator of a general audience site or service that chooses to screen its users for age in a neutral fashion may rely on the age information its users enter, even if that age information is not accurate. This line is basically the entire reason why COPPA is generally not seen as a problem for US businesses.
jopsen 8y ago
Only regulators will have the standing to give fines. Don't think anyone can sue. It's like you're driving too fast on the highway, but if it's just you mom complaining and not a police officer you won't get fined :) - that said, we should all respect the speed limit, they are there for a reason.
bigbugbag 8y ago
in the EU you cannot get huge amount of money out of nothing, fines are limited to the extent of the damage. So basically much less legal action in the EU and needs for lawyers. Bigger companies do have legal teams, but smaller one can operate without ever needing a lawyer.
lucb1e 8y ago
> > No lawyers required. > Phrases like this just sound weird to me. Are you from the USA? Because my best guess is that that's why it sounds weird to you. I almost sued a company (they paid just in time) and even then wouldn't have looked for representation, let alone for issues like these. Just read a blog post or two about GDPR. No lawyers required.

spacebearmakes 8y ago

The owner of the forum received the "Nightmare letter" [1] which he is legally obligated to respond to, which as an open source project does not have the resources to be able to respond to them. [1]: https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce...

kyberias 8y ago
To answer that letter takes maybe 5 minutes for a simple forum operator.
- aw3c2 8y ago
  I host a standard FluxBB forum on a stock Debian apache server. Can you please spent 5 minutes to answer that letter for me?
  - kyberias 8y ago
    I don't want to. It's your forum. Your responsibility.
  - bigbugbag 8y ago
    Show me the letter you received and we'll work from this. You might want to get in touch with fluxBB dev to get a GDPR button extracting the relevant data from the database to avoid the pain of building the db query by hand.
    - aw3c2 8y ago
      Sorry, I was offline. For the sake of this exercise https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce... of course.
bigbugbag 8y ago
Open source is totally unrelated to the matter at hands here. Any small operator is having limited resources and GDPR has been thought to allow everyone to answer requests. It gave 2 year to get conformity to something which has been effective since 1995 through a European directive. The forum owner decided to ignore this a do nothing, now he's confronted with the consequences of his choices. But again his reaction is akin to a knee jerk reaction as he is probably in capacity to answer the request while outsourcing to a third party does remove his responsibility and obligation to answer GDPR requests just now it's gonna get a bit more complicated as he has a third party into the loop which is probably not complying either.

michaelbuckbee 8y ago

The forum owner wasn't getting "compliance requests" he was receiving "subject data access requests". Those requests can be: - Please give me all my data - Please delete all my data - Please stop doing things (processing) my data Or some mix of all the above. A site owner (controller) has 30 days from receiving such a request to respond or the person making the request can report them to their Supervisory Authority (ICO is the UK Supervisory Authority, each country in the EU has their own).

codedokode 8y ago
So it looks like having a script to delete all user's data can get you out of trouble with any of these letters.
- DanBC 8y ago
  But it's important to remember the GDPR doesn't give users a right to have all data deleted on request. Processors only have to delete data in certain situations. For example, if you told the user why you collected the data, and you're still using it for that purpose, and you have a legitimate need to continue to do so then you don't need to delete the data. And there's an extra exemption for "exercising the right of freedom of expression and information". https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/
- bigbugbag 8y ago
  - Please tell me all the data you have on me * furiously delete all user's data * This is probably gonna get you in much more trouble than you could have been initially. For example France has law telling ISP they have to collect and retain customer data and activities for a year to able to retroactively identify who did what online at what time, failing this is not a matter of a report that could lead to warning and then to a fine but years of jail time instead.
  - michaelbuckbee 8y ago
    The GDPR specifically says you don't have to delete the data if you are legally required to keep it for other reasons. Most often this is financial data, but there are plenty of other examples.

013a 8y ago

Have you ever ran a business that, uh, intended to scale beyond one employee and a hobby website? I've never seen a company be threatened with some form of legal attack and not get lawyers involved. Especially with such a new law like the GDPR that has no judicial precedences upon which to build business processes. I've been in companies as small as 4 people, and we still had lawyers on retainer for stuff like this (copyright violations in user hosted content was a big one before GDPR). If you can completely distill a binder of a legal framework down to an "if this then that else this" sentence, you don't understand it, and your hubris is going to kill your company. If you think the correct response is "don't respond, wait until it escalates", you don't understand it and your hubris is going to kill your company. If you're doing anything worthwhile you're going to be bumping up against some law or another, and you can't just ignore it and you can't afford to not understand it. That's why you pay lawyers.

bigbugbag 8y ago
GDPR is not new law, it's a mean to enforce a European Directive from 1995. Also there are several privacy precedents in the EU, for example max schrems.