26 ms·

> Part of the issue, experts say, is the vague regulation has been interpreted in wildly different ways. GDPR consent-request messages vary wildly across sites

> Part of the issue, experts say, is the vague regulation has been interpreted in wildly different ways. GDPR consent-request messages vary wildly across sites What experts? I found the law to be pretty clear and there are plenty of summarized versions out there. What some companies find confusing is that the law has made their core business model illegal and no consent form can save them. You cannot get your users to opt out via a consent form, how many times do people have to repeat this? This is nothing like the cookie law. The only vague part of the law is the fining system which was done on purpose. If you have explicit fines then companies will have to make more money from your private data to cover the explicitly priced fine leading to a worse situation.

scarejunba 8y ago
If it is easy to follow the law, then the cost of a compliance expert on this topic would be low. It is not low. Compliance is expensive, even for companies who don't make their money from data. Therefore, I don't think it's that easy.
- tjoff 8y ago
  It becomes hard when you try to get away with something that goes against the intent of the law. And that is exactly what sites are doing now. And there is noone on earth that will ever believe it isn't deliberate.
  - amarkov 8y ago
    If the GDPR was really intended to forbid business models which require collecting user data for ad targeting, why wouldn't it have just said that?
    - tjoff 8y ago
      Just because X violates GDPR doesn't mean the intent of GDPR is to forbid X.
- TeMPOraL 8y ago
  Not necessarily. It's a seller's market due to huge demand, so prices alone may not be a good indicator of difficulty at this point.
- s73v3r_ 8y ago
  That doesn't follow. It's easy to follow the law, but because a lot of companies were doing things that were against the law, and given that a lot of companies put things off til the last minute, it took a lot of work to come into compliance.
- deleted 8y ago
  [deleted]
tmikaeld 8y ago
What I've found to be "confusing" is that some GDPR consultants say that when a single person cannot be identified in a blob of data, then it's not personal data. While others say the opposite, any data derived from a single individual is still considered personal data.
- merb 8y ago
  well under the eu gdpr no data is called personal data if it is immpossible with the data to identify a person/company/person of law.
- DanBC 8y ago
  GDPR seems clear on this: it's personal data if a natural person can be identified from it using reasonable means.
  - JumpCrisscross 8y ago
    > it's personal data if a natural person can be identified from it using reasonable means I could fit a planet into that "reasonable means" caveat.
    - DanBC 8y ago
      That's a good thing. It means the regulator can't issue instant fines for non-compliance except in the very worst most obvious cases. Because of this planet sized gap they need to ask everyone else to come into compliance before issuing the fine.
      - JumpCrisscross 8y ago
        > It means the regulator can't issue instant fines for non-compliance The regulator interprets the gap. "Planet-sized gap" means the regulator can choose to be lenient or capricious based on their own preferences. That kind of uncertainty is anathema for modern businesses. (It's also beneficial to those who pay to build relationships with said regulators.)
AndrewStephens 8y ago
> What some companies find confusing is that the law has made their core business model illegal and no consent form can save them. Exactly this. Even the big reputable publishers (who wouldn't <em>dream</em> of breaking the law, oh no) accept money from companies directly targeted by the GDPR, who collect copious amounts of data on visitors across multiple sites. Do users on site A consent to company B collecting data through ads, even if they tick a box? Probably not. https://sheep.horse/2018/6/the_eu_general_data_protection_regulation_and_me_%28.html https://sheep.horse/2018/6/the_eu_general_data_protection_re...
existencebox 8y ago
I can't honestly agree. (re: ambiguity of interpretation, and cost being limited only to privacy-violating business models) Two reasons. 1. HN discussions themselves. Literally EVERY TIME this comes up, you see a massive back and forth from various crowds of GDPR; some of whom swear that it's perfectly comprehensible even as significant portions of the conversation are interpreting the same points in a variety of ways. (Are IPs PII? What exceptions can be allowed? What falls under "security requirement"? What forms of data are associated PII? What sort of deanonymization is sufficient? IS it sufficient? are some common questions I saw in the past, not even getting into the wonderful world of third party data processors.) This seems like enough pragmatic evidence that a (to give the benefit of the doubt) educated and professional community hasn't reached consensus, so to say there's a variety of interpretation seems very fair. 2. I implemented GDPR for a small corner of a notable BigCo. I do not consider myself an expert, but I certainly got my marching orders from experts, (The legal teams who interpreted the document and evaluated the implementation methods) and the sheer amount of horsepower put behind finding an interpretation we believed and were confident in was staggering. Granted this is something where we _really wanted to get it right_ but if it were really trivial to interpret I question if the process would have been as intensive as it was. (To preempt the inevitable; our (my team's) business model has _literally nothing_ to do with your data, but we had many of the same confusions/questions that I saw from companies who did, so I'd be hesitant to say that the burden isn't somewhat widespread.)
- JumpCrisscross 8y ago
  > The legal teams...and the sheer amount of horsepower put behind finding an interpretation we believed and were confident in was staggering You shouldn't be getting down voted. I just went through a GDPR compliance review. We have a service model which is incredibly serious about customer confidentiality. We don't sell ads and, to my recollection, have never even bought them. Still required an army of lawyers. Two top London law firms ended up agreeing to disagree on major points, ultimately concluding the Polish data regulator would probably rule one way and the French the other. Complying with the spirit of a law doesn't mean complying with the statue of it. With GDPR, it's the latter that's a pain in the ass.
sbov 8y ago
Cool. If it's so clear, then are you willing to be held liable if my company is found in violation of it due to your misreading? I'm guessing not. People who are willing to put their reputation on the line, who are paid four figures per hour to understand this stuff, disagree with eachother on interpretations of GDPR.
- JumpCrisscross 8y ago
  > be held liable if my company is found in violation Forget about violations. Even if you're in perfect compliance, any EU resident can complain to their data authorities if they think you're non-compliant. That then prompts a regulatory inquiry, which requires lawyers to competently respond to, which is distracting and expensive.
  - sureaboutthis 8y ago
    Hmm. Maybe we should violate this en masse and overload the system.
    - kybernetikos 8y ago
      That seems to be the approach that is being taken, albeit probably accidentally.
  - pierrebai 8y ago
    Which is different from other civil law in what ways? Anyone can sue you over any civil law. Then teh courts decides. GDPR is not magically different. This is a straw man. The flurry of activities is only driven by companies who keep data about their users. Of course "legitimate" will be defined by the courts. That's the price you have to pay now for all the abuses that have been going on for the past two or three decades. History has shown that to define "legitimate" the text of the law is to open the doors to avoidance. Sorry mate, we can't trust you to be honest. It's too late now.
    - JumpCrisscross 8y ago
tomnipotent 8y ago
No law is clear until it's been argued a few times in court and an army of legal professionals have duked it out. This is why - at least in the US - the branch of government that writes the law is separate from the one that interprets it.
- j16sdiz 8y ago
  (Unlike US) Most of EU use civil law system. Precedent are not binding in civil law system
MarkMc 8y ago
Heres what the UK ICO says: "The GDPR does not define what factors to take into account when deciding if your purpose is a legitimate interest. It could be as simple as it being legitimate to start up a new business activity, or to grow your business." [1] Isn't that a little vague? It seems to imply that if a business can show that collecting your personal information will grow their business, they do not need to provide a way for you to 'opt out'. [1] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
- jiveturkey 8y ago
  Yes, it is a little bit vague. It's intentionally vague. The abuse of LI is designed to be like porn: I'll know it when I see it. It's totally fine for it to be vague. I very much doubt we'll see any cases where the general public disagrees with a DPA ruling of LI applicability. As a business owner, it means you need to strongly justify it and consider if a "reasonable person" would consider your use of LI to be justified. If you have doubt, you should seek consent instead. Do keep in mind, that growing your business by using PD for marketing purposes is explicitly excepted from LI.
  - kybernetikos 8y ago
    > If you have doubt, you should seek consent instead. Consent may not apply: > Consent is presumed not to be freely given if... the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.
Moru 8y ago
If you listen to the experts that are economically invested in the complexity of the law, you risk having more work.
- sfifs 8y ago
  If you don't and some regulator fancies making an example of you, then your shareholders will fire and sue you.
  - bmer 8y ago
    Yeah, especially since we live in countries where corruption is rampant, along with unjust enforcement of regulations that completely violate their spirit. /s
    - sfifs 8y ago
      Are you assuming only European companies do business in Europe? EU prosecutors have a history of going after American tech companies much like US has a history of going after foreign companies - especially Chinese and now European (eg. Volkswagen). This is not about a moral stance, just business risk management.
tzs 8y ago
> I found the law to be pretty clear and there are plenty of summarized versions out there. What some companies find confusing is that the law has made their core business model illegal and no consent form can save them. What about Article 27? It's unclear, and you don't have to have a shady business model in order to have no idea how you are supposed to deal with it. All it takes is that your business is not established in the Union. This is the article that requires companies who are not in the Union but are subject to GDPR due to Article 3(2) to appoint a representative in the Union. The representative serves as a contact point that regulators and persons can communicate with instead of the company on all GDPR matters concerning the company. The representative is also required to keep a bunch of metadata about the company's data processing, according t Article 30. According to the recital for this article, "The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor". What does that mean? Some people claim it means that your representative in the Union will be liable for any fines you incur from EU regulators or any damages a plaintiff wins in a private lawsuit over GDPR if the regulator or plaintiff is not able to force you to pay up. Others think it just means that if regulators or plaintiffs serve notice on the representative, that legally counts as if you were served, meaning that if you do not show up at the hearing or trial and lose by default, you cannot try to weasel out by claiming you had no notice of the hearing or trial. In other words, these people think that the representative is very similar to the "registered agent" that many jurisdictions require foreign businesses to have in order to do business in that jurisdiction. Personally, I was leaning toward the latter, as the idea of making the representative liable seemed pretty absurd...but it has been pointed out that in earlier drafts of Article 27 and the recitals, it did in fact actually clearly do so. That language was taken out before the final draft, but was that change because they wanted to remove that aspect, or because they decided "subject to enforcement proceedings" already implied it and they were just tightening the language? This is important because if representatives are actually liable for fines and damages, it is going to be a lot more expensive to hire people to be representatives than it will be if all they have to do is be a contact point and a repository of metadata. For small businesses outside the Union this could be a major expense if they must have a representative, perhaps a big enough expense that it will be worthwhile to just stop doing business in the EU. So we must ask, "Who needs a representative?". The answer, it turns out, involves still more vagueness. Basically, you are excused from needing a representative if you meet three conditions. Two of them most small businesses easily meet as long as they are not doing high volumes of certain particularly sensitive data, and their processing does not result in a risk to "the rights and freedoms of natural persons" (more vagueness!). The third condition is that your processing "is occasional". What is "occasional"? No one seems to know.
shados 8y ago
There are so many ambiguities and confusing situations. Eg: legitimate business use and free accounts. What do you define as the free account user to still be a customer? What if you nuke their account after some inactivity and then they come back? They're going to be pissed. Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun. Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers! It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...)
- Aengeuad 8y ago
  >There are so many ambiguities and confusing situations. Eg: legitimate business use and free accounts. What do you define as the free account user to still be a customer? What if you nuke their account after some inactivity and then they come back? They're going to be pissed. Processing of data is legitimate so long as you still have a reason to process that data, as well as if you have a contractual obligation with the subject to process that data. If that contract involves keeping an account registered indefinitely, until deletion is requested, then so be it. State it clearly and plainly when the user registers an account, and if you're that concerned about the ambiguity of the situation then the solution seems a simple one, no? Allow the user to choose to have their account deleted after a certain period of inactivity, or email users that their accounts will be deleted after lengthy periods of inactivity. It should be noted that 'inactivity' is industry specific, for something like free services online it could be industry standard to keep accounts for years, it's hard to imagine that a user would be upset about having an account they haven't used in 4 years be deleted, and really, do you need to keep that account after 1 year of inactivity? 3 Years? 5 Years? I realise the law is purposely ambiguous here especially when applied to things like user accounts, but it helps to understand that storage limitations and retention plans apply less to things like accounts and more to things like metadata that you may be collecting. It's perfectly reasonable to keep user accounts registered for years even after inactivity for example, it's less reasonable to collect data for marketing campaigns and keep that data for years. Retention limits are also far more relevant to processors of data rather than for controllers of data, if you're a third party service you shouldn't need to keep data for longer than your contract with the controller specifies, however controllers have far more of a legitimate need to process data for longer. The push to have retention limits may as well be seen as a push to anonymise data that no longer needs to be tied to an identified person rather than a need to delete everything that hasn't been touched in 90 days. >Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun. IP addresses become problematic when you can tie them to an identified person, i.e., you're linking user accounts and IP addresses. As far as generic logs go, if the only personal information you're collecting is IP addresses then you shouldn't need to worry too much, treat the logs with some care as they still do contain personal information but don't sweat it too much. Make sure that if your logs are leaked that you inform users (i.e., through a blog post) that logs were leaked and the only personal information contained is IP addresses. IP addresses are one of the easiest things to justify needing to keep as a legitimate interest as well as needing keeping indefinitely, and if only IP addresses are leaked it's not really a big deal. If you have other personal information in your logs, especially if it's linked with more information, i.e., 'ip address 1.2.3.4 who has username asdf searched for jkl; [etc]', you should take steps to justify why you need to keep that extra information and maybe look at implementing a retention limit, or better yet, anonymise some of the extra data after you are finished processing it. If the metadata you're collecting is kept to a minimum and/or anonymised as much as possible, the need for a retention limit drops almost entirely, not that retention limits are entirely needed. >Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers! In every other industry you are responsible for when you choose a shoddy third party vendor who makes a mistake, I fail to see why the tech industry should be any different. I realise there is going to be a lot of teething issues on this particular issue, but part of the reason GDPR has as much scope as it does is because of these clueless third party vendors who misuse and abuse data. Maybe look into using European third party vendors in the future, as they would be just as culpable for their mistakes as you would be and they would be liable for fines too. :-) >It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...) For what it's worth, the GDPR makes explicit exemptions allowing for processing data where you have a legal obligation to do so. There is absolutely no conflict between financial laws and the GDPR in this respect.
red75prime 8y ago
Can I request to remove my face from a stored security camera footage? If not, why?
- synotna 8y ago
  Read about legitimate interest, it's only a few sentences
  - red75prime 8y ago
    The document is 88 pages long. There are 31 mentions of 'legitimate interests'. I'm still not sure that recording everyone who walks past your store 24/7 is legitimate interest.
- CaptainZapp 8y ago
  Security camera footage is overwritten and recycled on a regular basis. As a matter of fact: If you operate secutrity cameras in a public -, or semi public place you need a written procedure why something is captured, what is captured, how long it's kept, who can see the footage and under which conditions the footage is retained. "If not, why?" Because this is not a reasonable request if the footage is anyway deleted after, say, 72 hours.
- Aengeuad 8y ago
  You cannot, part of the reasoning will be that the footage may need to be used in court therefore the integrity of the information needs to be maintained, another reason will be that it would be incredibly impractical and a burden for businesses to erase the faces of everyone that requests it. You cannot request that a business deletes CCTV footage of you either, probably for similar reasons. You can request a copy or to view that footage though. In another comment you posted: >I'm still not sure that recording everyone who walks past your store 24/7 is legitimate interest. Stores and businesses need to display signs for when they are recording in the areas they're recording, inside a store it may be obvious that the store is recording, so a sign may only be needed on a door. Outside of a store you may need more prominent signs. If it's not obvious that the area area is being recorded then even more signs need to be posted still. The degree to which stores and businesses can record outside of their businesses will vary by country, but for the UK the ICO provides information for consumers [0], and businesses [1]. [0] https://ico.org.uk/your-data-matters/cctv/ https://ico.org.uk/your-data-matters/cctv/ [1] https://ico.org.uk/for-organisations/police-justice/ https://ico.org.uk/for-organisations/police-justice/
deleted 8y ago
[deleted]
downandout 8y ago
I found the law to be pretty clear If you think this, you've misinterpreted it. I don't think even the biggest GDPR advocates would claim that it is "pretty clear".

scarejunba 8y ago

If it is easy to follow the law, then the cost of a compliance expert on this topic would be low. It is not low. Compliance is expensive, even for companies who don't make their money from data. Therefore, I don't think it's that easy.

tjoff 8y ago
It becomes hard when you try to get away with something that goes against the intent of the law. And that is exactly what sites are doing now. And there is noone on earth that will ever believe it isn't deliberate.
- amarkov 8y ago
  If the GDPR was really intended to forbid business models which require collecting user data for ad targeting, why wouldn't it have just said that?
  - tjoff 8y ago
    Just because X violates GDPR doesn't mean the intent of GDPR is to forbid X.
TeMPOraL 8y ago
Not necessarily. It's a seller's market due to huge demand, so prices alone may not be a good indicator of difficulty at this point.
s73v3r_ 8y ago
That doesn't follow. It's easy to follow the law, but because a lot of companies were doing things that were against the law, and given that a lot of companies put things off til the last minute, it took a lot of work to come into compliance.
deleted 8y ago
[deleted]

tmikaeld 8y ago

What I've found to be "confusing" is that some GDPR consultants say that when a single person cannot be identified in a blob of data, then it's not personal data. While others say the opposite, any data derived from a single individual is still considered personal data.

merb 8y ago
well under the eu gdpr no data is called personal data if it is immpossible with the data to identify a person/company/person of law.
DanBC 8y ago
GDPR seems clear on this: it's personal data if a natural person can be identified from it using reasonable means.
- JumpCrisscross 8y ago
  > it's personal data if a natural person can be identified from it using reasonable means I could fit a planet into that "reasonable means" caveat.
  - DanBC 8y ago
    That's a good thing. It means the regulator can't issue instant fines for non-compliance except in the very worst most obvious cases. Because of this planet sized gap they need to ask everyone else to come into compliance before issuing the fine.
    - JumpCrisscross 8y ago
      > It means the regulator can't issue instant fines for non-compliance The regulator interprets the gap. "Planet-sized gap" means the regulator can choose to be lenient or capricious based on their own preferences. That kind of uncertainty is anathema for modern businesses. (It's also beneficial to those who pay to build relationships with said regulators.)

AndrewStephens 8y ago

> What some companies find confusing is that the law has made their core business model illegal and no consent form can save them. Exactly this. Even the big reputable publishers (who wouldn't <em>dream</em> of breaking the law, oh no) accept money from companies directly targeted by the GDPR, who collect copious amounts of data on visitors across multiple sites. Do users on site A consent to company B collecting data through ads, even if they tick a box? Probably not. https://sheep.horse/2018/6/the_eu_general_data_protection_regulation_and_me_%28.html https://sheep.horse/2018/6/the_eu_general_data_protection_re...

existencebox 8y ago

I can't honestly agree. (re: ambiguity of interpretation, and cost being limited only to privacy-violating business models) Two reasons. 1. HN discussions themselves. Literally EVERY TIME this comes up, you see a massive back and forth from various crowds of GDPR; some of whom swear that it's perfectly comprehensible even as significant portions of the conversation are interpreting the same points in a variety of ways. (Are IPs PII? What exceptions can be allowed? What falls under "security requirement"? What forms of data are associated PII? What sort of deanonymization is sufficient? IS it sufficient? are some common questions I saw in the past, not even getting into the wonderful world of third party data processors.) This seems like enough pragmatic evidence that a (to give the benefit of the doubt) educated and professional community hasn't reached consensus, so to say there's a variety of interpretation seems very fair. 2. I implemented GDPR for a small corner of a notable BigCo. I do not consider myself an expert, but I certainly got my marching orders from experts, (The legal teams who interpreted the document and evaluated the implementation methods) and the sheer amount of horsepower put behind finding an interpretation we believed and were confident in was staggering. Granted this is something where we _really wanted to get it right_ but if it were really trivial to interpret I question if the process would have been as intensive as it was. (To preempt the inevitable; our (my team's) business model has _literally nothing_ to do with your data, but we had many of the same confusions/questions that I saw from companies who did, so I'd be hesitant to say that the burden isn't somewhat widespread.)

JumpCrisscross 8y ago
> The legal teams...and the sheer amount of horsepower put behind finding an interpretation we believed and were confident in was staggering You shouldn't be getting down voted. I just went through a GDPR compliance review. We have a service model which is incredibly serious about customer confidentiality. We don't sell ads and, to my recollection, have never even bought them. Still required an army of lawyers. Two top London law firms ended up agreeing to disagree on major points, ultimately concluding the Polish data regulator would probably rule one way and the French the other. Complying with the spirit of a law doesn't mean complying with the statue of it. With GDPR, it's the latter that's a pain in the ass.

sbov 8y ago

Cool. If it's so clear, then are you willing to be held liable if my company is found in violation of it due to your misreading? I'm guessing not. People who are willing to put their reputation on the line, who are paid four figures per hour to understand this stuff, disagree with eachother on interpretations of GDPR.

JumpCrisscross 8y ago
> be held liable if my company is found in violation Forget about violations. Even if you're in perfect compliance, any EU resident can complain to their data authorities if they think you're non-compliant. That then prompts a regulatory inquiry, which requires lawyers to competently respond to, which is distracting and expensive.
- sureaboutthis 8y ago
  Hmm. Maybe we should violate this en masse and overload the system.
  - kybernetikos 8y ago
    That seems to be the approach that is being taken, albeit probably accidentally.
- pierrebai 8y ago
  Which is different from other civil law in what ways? Anyone can sue you over any civil law. Then teh courts decides. GDPR is not magically different. This is a straw man. The flurry of activities is only driven by companies who keep data about their users. Of course "legitimate" will be defined by the courts. That's the price you have to pay now for all the abuses that have been going on for the past two or three decades. History has shown that to define "legitimate" the text of the law is to open the doors to avoidance. Sorry mate, we can't trust you to be honest. It's too late now.
  - JumpCrisscross 8y ago

tomnipotent 8y ago

No law is clear until it's been argued a few times in court and an army of legal professionals have duked it out. This is why - at least in the US - the branch of government that writes the law is separate from the one that interprets it.

j16sdiz 8y ago
(Unlike US) Most of EU use civil law system. Precedent are not binding in civil law system

MarkMc 8y ago

Heres what the UK ICO says: "The GDPR does not define what factors to take into account when deciding if your purpose is a legitimate interest. It could be as simple as it being legitimate to start up a new business activity, or to grow your business." [1] Isn't that a little vague? It seems to imply that if a business can show that collecting your personal information will grow their business, they do not need to provide a way for you to 'opt out'. [1] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ https://ico.org.uk/for-organisations/guide-to-the-general-da...

jiveturkey 8y ago
Yes, it is a little bit vague. It's intentionally vague. The abuse of LI is designed to be like porn: I'll know it when I see it. It's totally fine for it to be vague. I very much doubt we'll see any cases where the general public disagrees with a DPA ruling of LI applicability. As a business owner, it means you need to strongly justify it and consider if a "reasonable person" would consider your use of LI to be justified. If you have doubt, you should seek consent instead. Do keep in mind, that growing your business by using PD for marketing purposes is explicitly excepted from LI.
- kybernetikos 8y ago
  > If you have doubt, you should seek consent instead. Consent may not apply: > Consent is presumed not to be freely given if... the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

Moru 8y ago

If you listen to the experts that are economically invested in the complexity of the law, you risk having more work.

sfifs 8y ago
If you don't and some regulator fancies making an example of you, then your shareholders will fire and sue you.
- bmer 8y ago
  Yeah, especially since we live in countries where corruption is rampant, along with unjust enforcement of regulations that completely violate their spirit. /s
  - sfifs 8y ago
    Are you assuming only European companies do business in Europe? EU prosecutors have a history of going after American tech companies much like US has a history of going after foreign companies - especially Chinese and now European (eg. Volkswagen). This is not about a moral stance, just business risk management.

tzs 8y ago

> I found the law to be pretty clear and there are plenty of summarized versions out there. What some companies find confusing is that the law has made their core business model illegal and no consent form can save them. What about Article 27? It's unclear, and you don't have to have a shady business model in order to have no idea how you are supposed to deal with it. All it takes is that your business is not established in the Union. This is the article that requires companies who are not in the Union but are subject to GDPR due to Article 3(2) to appoint a representative in the Union. The representative serves as a contact point that regulators and persons can communicate with instead of the company on all GDPR matters concerning the company. The representative is also required to keep a bunch of metadata about the company's data processing, according t Article 30. According to the recital for this article, "The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor". What does that mean? Some people claim it means that your representative in the Union will be liable for any fines you incur from EU regulators or any damages a plaintiff wins in a private lawsuit over GDPR if the regulator or plaintiff is not able to force you to pay up. Others think it just means that if regulators or plaintiffs serve notice on the representative, that legally counts as if you were served, meaning that if you do not show up at the hearing or trial and lose by default, you cannot try to weasel out by claiming you had no notice of the hearing or trial. In other words, these people think that the representative is very similar to the "registered agent" that many jurisdictions require foreign businesses to have in order to do business in that jurisdiction. Personally, I was leaning toward the latter, as the idea of making the representative liable seemed pretty absurd...but it has been pointed out that in earlier drafts of Article 27 and the recitals, it did in fact actually clearly do so. That language was taken out before the final draft, but was that change because they wanted to remove that aspect, or because they decided "subject to enforcement proceedings" already implied it and they were just tightening the language? This is important because if representatives are actually liable for fines and damages, it is going to be a lot more expensive to hire people to be representatives than it will be if all they have to do is be a contact point and a repository of metadata. For small businesses outside the Union this could be a major expense if they must have a representative, perhaps a big enough expense that it will be worthwhile to just stop doing business in the EU. So we must ask, "Who needs a representative?". The answer, it turns out, involves still more vagueness. Basically, you are excused from needing a representative if you meet three conditions. Two of them most small businesses easily meet as long as they are not doing high volumes of certain particularly sensitive data, and their processing does not result in a risk to "the rights and freedoms of natural persons" (more vagueness!). The third condition is that your processing "is occasional". What is "occasional"? No one seems to know.

shados 8y ago

There are so many ambiguities and confusing situations. Eg: legitimate business use and free accounts. What do you define as the free account user to still be a customer? What if you nuke their account after some inactivity and then they come back? They're going to be pissed. Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun. Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers! It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...)

Aengeuad 8y ago
>There are so many ambiguities and confusing situations. Eg: legitimate business use and free accounts. What do you define as the free account user to still be a customer? What if you nuke their account after some inactivity and then they come back? They're going to be pissed. Processing of data is legitimate so long as you still have a reason to process that data, as well as if you have a contractual obligation with the subject to process that data. If that contract involves keeping an account registered indefinitely, until deletion is requested, then so be it. State it clearly and plainly when the user registers an account, and if you're that concerned about the ambiguity of the situation then the solution seems a simple one, no? Allow the user to choose to have their account deleted after a certain period of inactivity, or email users that their accounts will be deleted after lengthy periods of inactivity. It should be noted that 'inactivity' is industry specific, for something like free services online it could be industry standard to keep accounts for years, it's hard to imagine that a user would be upset about having an account they haven't used in 4 years be deleted, and really, do you need to keep that account after 1 year of inactivity? 3 Years? 5 Years? I realise the law is purposely ambiguous here especially when applied to things like user accounts, but it helps to understand that storage limitations and retention plans apply less to things like accounts and more to things like metadata that you may be collecting. It's perfectly reasonable to keep user accounts registered for years even after inactivity for example, it's less reasonable to collect data for marketing campaigns and keep that data for years. Retention limits are also far more relevant to processors of data rather than for controllers of data, if you're a third party service you shouldn't need to keep data for longer than your contract with the controller specifies, however controllers have far more of a legitimate need to process data for longer. The push to have retention limits may as well be seen as a push to anonymise data that no longer needs to be tied to an identified person rather than a need to delete everything that hasn't been touched in 90 days. >Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun. IP addresses become problematic when you can tie them to an identified person, i.e., you're linking user accounts and IP addresses. As far as generic logs go, if the only personal information you're collecting is IP addresses then you shouldn't need to worry too much, treat the logs with some care as they still do contain personal information but don't sweat it too much. Make sure that if your logs are leaked that you inform users (i.e., through a blog post) that logs were leaked and the only personal information contained is IP addresses. IP addresses are one of the easiest things to justify needing to keep as a legitimate interest as well as needing keeping indefinitely, and if only IP addresses are leaked it's not really a big deal. If you have other personal information in your logs, especially if it's linked with more information, i.e., 'ip address 1.2.3.4 who has username asdf searched for jkl; [etc]', you should take steps to justify why you need to keep that extra information and maybe look at implementing a retention limit, or better yet, anonymise some of the extra data after you are finished processing it. If the metadata you're collecting is kept to a minimum and/or anonymised as much as possible, the need for a retention limit drops almost entirely, not that retention limits are entirely needed. >Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers! In every other industry you are responsible for when you choose a shoddy third party vendor who makes a mistake, I fail to see why the tech industry should be any different. I realise there is going to be a lot of teething issues on this particular issue, but part of the reason GDPR has as much scope as it does is because of these clueless third party vendors who misuse and abuse data. Maybe look into using European third party vendors in the future, as they would be just as culpable for their mistakes as you would be and they would be liable for fines too. :-) >It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...) For what it's worth, the GDPR makes explicit exemptions allowing for processing data where you have a legal obligation to do so. There is absolutely no conflict between financial laws and the GDPR in this respect.

red75prime 8y ago

Can I request to remove my face from a stored security camera footage? If not, why?

synotna 8y ago
Read about legitimate interest, it's only a few sentences
- red75prime 8y ago
  The document is 88 pages long. There are 31 mentions of 'legitimate interests'. I'm still not sure that recording everyone who walks past your store 24/7 is legitimate interest.
CaptainZapp 8y ago
Security camera footage is overwritten and recycled on a regular basis. As a matter of fact: If you operate secutrity cameras in a public -, or semi public place you need a written procedure why something is captured, what is captured, how long it's kept, who can see the footage and under which conditions the footage is retained. "If not, why?" Because this is not a reasonable request if the footage is anyway deleted after, say, 72 hours.
Aengeuad 8y ago
You cannot, part of the reasoning will be that the footage may need to be used in court therefore the integrity of the information needs to be maintained, another reason will be that it would be incredibly impractical and a burden for businesses to erase the faces of everyone that requests it. You cannot request that a business deletes CCTV footage of you either, probably for similar reasons. You can request a copy or to view that footage though. In another comment you posted: >I'm still not sure that recording everyone who walks past your store 24/7 is legitimate interest. Stores and businesses need to display signs for when they are recording in the areas they're recording, inside a store it may be obvious that the store is recording, so a sign may only be needed on a door. Outside of a store you may need more prominent signs. If it's not obvious that the area area is being recorded then even more signs need to be posted still. The degree to which stores and businesses can record outside of their businesses will vary by country, but for the UK the ICO provides information for consumers [0], and businesses [1]. [0] https://ico.org.uk/your-data-matters/cctv/ https://ico.org.uk/your-data-matters/cctv/ [1] https://ico.org.uk/for-organisations/police-justice/ https://ico.org.uk/for-organisations/police-justice/

deleted 8y ago

[deleted]

downandout 8y ago

I found the law to be pretty clear If you think this, you've misinterpreted it. I don't think even the biggest GDPR advocates would claim that it is "pretty clear".