5 ms·

This is so incredibly tonedeaf: do you honestly think that small hobby-scale websites have a privacy policy?

by TomVDB 8y ago

synotna 8y ago
Do you believe that hobbyists must not follow laws & regulations when they interact with the public?
- TomVDB 8y ago
  Do you believe that anyone who has a hobby website with a forum needs an official privacy document, presumably vetted by a lawyer.
  - codedokode 8y ago
    What if a forum owner receives a DMCA letter, or a letter from NSA? You do not really need to consult a lawyer to remove copyrighted material or something else that is illegal.
    - speedplane 8y ago
      A single DMCA notice is relatively easy to deal with. Even though a startup owner probably "should" consult with a lawyer, you don't need to if the take-down request is clear and the material is either clearly infringing or not. There are gray areas, but they are rare. A letter from the NSA is a completely different story. You definitely need to hire a lawyer, probably an expensive one. One NSA letter could easily shut down a small startup.
  - DanBC 8y ago
    Why do you think the document needs to be vetted by a lawyer? The regulation makes repeated reference to proportionality. > Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. 2Those measures shall be reviewed and updated where necessary. For a simple forum this is a simple privacy policy. And forums should already have something like this if they're complying with EG US COPPA or similar.
- LoSboccacc 8y ago
  Private and general aviation have a different set of regulations. Small and large aircraft have a different set if regulations. I’ll let you figure out the rest.
  - DanBC 8y ago
    GDPR is not applicaple to personal or household activities https://gdpr-info.eu/recitals/no-18/ https://gdpr-info.eu/recitals/no-18/ > This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. 2Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. 3However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.
Jommi 8y ago
What? So just because you're small scale you can ignore people's privacy?
- TomVDB 8y ago
  There’s a big difference between ignoring somebody’s privacy and having an official lawyered document that spells them out. I’m sorry that this is a distinction you weren’t able to make.
  - DanBC 8y ago
    It doesn't have to be lawyered.
    - jtbayly 8y ago
      Excuse me? How in the world am I supposed to know if it is sufficient for GDPR without a lawyer?
      - DanBC 8y ago
        The context is a small forum that doesn't gather much user data and doesn't do weird things with it. The forum owner should create a simple privacy policy that details what information is gathered; why it's gathered; how long it's kept; and how to correct mistakes. If someone does report the forum to the regulator all that'll happen is that a letter will be written asking the forum to come back into compliance, and giving advice about doing so. GDPR makes many references to proportionality. It also mentions standard practice. EG here: https://gdpr-info.eu/art-24-gdpr/ https://gdpr-info.eu/art-24-gdpr/ > Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. 2Those measures shall be reviewed and updated where necessary. > Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller. > Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the controller.
DanBC 8y ago
How are they complying with eg US COPPA, which carries a penalty of $40,000 per infringement?
bigbugbag 8y ago
Yes. because it's a legal requirement when you collect personal data.

This is so incredibly tonedeaf: do you honestly think that small hobby-scale websites have a privacy policy?

by TomVDB 8y ago

This is so incredibly tonedeaf: do you honestly think that small hobby-scale websites have a privacy policy?

synotna 8y ago

Do you believe that hobbyists must not follow laws & regulations when they interact with the public?

TomVDB 8y ago
Do you believe that anyone who has a hobby website with a forum needs an official privacy document, presumably vetted by a lawyer.
- codedokode 8y ago
  What if a forum owner receives a DMCA letter, or a letter from NSA? You do not really need to consult a lawyer to remove copyrighted material or something else that is illegal.
  - speedplane 8y ago
    A single DMCA notice is relatively easy to deal with. Even though a startup owner probably "should" consult with a lawyer, you don't need to if the take-down request is clear and the material is either clearly infringing or not. There are gray areas, but they are rare. A letter from the NSA is a completely different story. You definitely need to hire a lawyer, probably an expensive one. One NSA letter could easily shut down a small startup.
- DanBC 8y ago
  Why do you think the document needs to be vetted by a lawyer? The regulation makes repeated reference to proportionality. > Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. 2Those measures shall be reviewed and updated where necessary. For a simple forum this is a simple privacy policy. And forums should already have something like this if they're complying with EG US COPPA or similar.
LoSboccacc 8y ago
Private and general aviation have a different set of regulations. Small and large aircraft have a different set if regulations. I’ll let you figure out the rest.
- DanBC 8y ago
  GDPR is not applicaple to personal or household activities https://gdpr-info.eu/recitals/no-18/ https://gdpr-info.eu/recitals/no-18/ > This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. 2Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. 3However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.

Jommi 8y ago

What? So just because you're small scale you can ignore people's privacy?

TomVDB 8y ago
There’s a big difference between ignoring somebody’s privacy and having an official lawyered document that spells them out. I’m sorry that this is a distinction you weren’t able to make.
- DanBC 8y ago
  It doesn't have to be lawyered.
  - jtbayly 8y ago
    Excuse me? How in the world am I supposed to know if it is sufficient for GDPR without a lawyer?
    - DanBC 8y ago
      The context is a small forum that doesn't gather much user data and doesn't do weird things with it. The forum owner should create a simple privacy policy that details what information is gathered; why it's gathered; how long it's kept; and how to correct mistakes. If someone does report the forum to the regulator all that'll happen is that a letter will be written asking the forum to come back into compliance, and giving advice about doing so. GDPR makes many references to proportionality. It also mentions standard practice. EG here: https://gdpr-info.eu/art-24-gdpr/ https://gdpr-info.eu/art-24-gdpr/ > Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. 2Those measures shall be reviewed and updated where necessary. > Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller. > Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the controller.

DanBC 8y ago

How are they complying with eg US COPPA, which carries a penalty of $40,000 per infringement?

bigbugbag 8y ago

Yes. because it's a legal requirement when you collect personal data.