6 ms·

No, that's not the only requirement. At the very least there are additional record keeping steps, policies and procedures to draft, the appointment of a DPO tha

No, that's not the only requirement. At the very least there are additional record keeping steps, policies and procedures to draft, the appointment of a DPO that responds to requests for access or erasure, and the development of the features to fulfill both of those requests. Not to mention the potential risk of doing any of that wrong and dealing with the fallout if you get called on it. One of the sites on this list is the Aiken Standard. We're talking a local newspaper serving Aiken, SC - a city of less than 30,000 people. Even if an EU citizen (or someone traveling in the EU) cared about their local news, it's simply not worth it - that's not their audience.

Drakim 8y ago
Wait, hold on, do you really need to do any of that if you are keeping zero data on people? I assume that kinda organization is only relevant if you are keeping data.
- IanCal 8y ago
  I'm pretty sure the answer here is "no".
- seszett 8y ago
  No, you don't have to. > At the very least there are additional record keeping steps, policies and procedures to draft, the appointment of a DPO that responds to requests for access or erasure, and the development of the features to fulfill both of those requests. * "Record keeping steps" are not needed if you don't keep records (which is what you should do); * "Policies and procedures" are what you should already have, of course, and GDPR didn't change that in any way; * A DPO must be appointed only if processing the personal data of your customers is your core activity; * Developing features to fulfill requests for access or erasure isn't necessary if you don't keep records.
- adventured 8y ago
  A newspaper from Aiken, South Carolina doesn't need to worry about complying with GDPR in any regard what-so-ever, not under any realistic circumstance. It can safely entirely disregard it. The Aiken Standard doesn't have to worry about GDPR just like a small town newspaper in Spain doesn't need to worry about complying with every privacy law that every US state decides to implement in the coming years (following in California's footsteps). There is a vast misunderstanding of how jurisdiction works and how it's going to play out in the near future. The vast majority of the world will disregard GDPR and comply with their own local laws instead. Small and mid size sites from any given country are not going to attempt to comply with 407 different privacy laws from every country/city/state/region/zone/province/whatever around the world. There is no alternative to this future. The sole, sane approach is to disregard Internet privacy laws if they do not apply to you in terms of jurisdiction. You will not be able to comply with the zillions of Internet-focused laws that are going to get created across the globe in the coming decade. GDPR should act as the training wheels for people building online sites/services/businesses to understand jurisdiction.
  - chrismeller 8y ago
    I don't disagree with your point that nothing is ever going to come of it. In the case of an independently-owned local newspaper the EU can "huff and puff" as much as they want and there's not going to realistically be any impact to them. A lot of these "local" papers are owned by large parent companies though, and that becomes a different story all together. Even if you are independent and there's nothing the EU can realistically do to you, it's just one more thing you have to deal with. Figuring out WTF is going on, getting a lawyer to verify that there's nothing they can do to you, etc. etc. There are still some hard costs associated and it's going to distract you from what your company actually does for a while.
- chrismeller 8y ago
  Even writing an IP address in a web server log is considered "keeping data". Most of these news sites also have some form of "create an account to get updates / comment / vote" system, which would absolutely count as "keeping data". At the very least you still need a policy to give people telling them what data you keep and who you share it with. Even if that is nothing and no one, you need to be able to tell them that and you need someone who is responsible for handling those requests when they come in. "Just don't keep anything" is not a sufficient answer.
  - josteink 8y ago
    > Even writing an IP address in a web server log is considered "keeping data" No it's not. Stop spreading FUD. If so, every part of every Internet-connected system on earth would be required to be completely redesigned to be GDPR-compliant. Demanding anything like that is not only unreasonable, it's 100% unrealistic. The GDPR is perfectly reasonable legislation and has legroom for obvious operational requirements, like access logs. (If you however mine the access log to derive or track users, that is another matter completely.)
    - oytis 8y ago
      > (If you however mine the access log to derive or track users, that is another matter completely.) So under GDPR you're not allowed to process data you've already got? I wouldn't call this reasonable legislation.
      - marksomnian 8y ago
        If the data was obtained in violation, it follows that any processing, while not technically in violation, wouldn't be looked upon favourably. Furthermore, although IANAL, I suspect that certain classes of processing fall under different rules, therefore the processing could potentially be in violation even if the collection wasn't.
      - Drakim 8y ago
        That seems like some twisted logic. "I was just dumping data in logs, I don't have to care about privacy concerns. Oh, and now I have all this data on my server, since it's already here I surely deserve to process it without caring about privacy concerns!"
IanCal 8y ago
I'm very sure that you do not need to appoint a DPO unless you're over a certain size.
- seszett 8y ago
  It's not a question of size, it's only needed if processing your customers' private data is your core activity, ie. if you operate an ad network that builds personal profiles of people.
- repolfx 8y ago
  Can you back that up? This site claims otherwise: https://www.itgovernance.co.uk/data-protection-officer-dpo-under-the-gdpr https://www.itgovernance.co.uk/data-protection-officer-dpo-u... There is no exemption for small and medium-sized enterprises (SMEs), which has been reaffirmed by the Information Commissioner’s Office (ICO): "I've heard plenty of people talking about there being a DPO exemption for SMEs - this is absolutely not the case." Peter Brown, Senior Technology Officer, Information Commissioner's Office (ICO)
  - pimterry 8y ago
    https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/ https://ico.org.uk/for-organisations/guide-to-the-general-da... is a good summary from the UK gov authority. It's not based on size, but it isn't applicable to most businesses anyway. You need a DPO if: * you are a public authority or body (except for courts acting in their judicial capacity) * your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking) * your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences. Imo, those are all pretty reasonable cases where you should have somebody responsible managing your data privacy. DPOs are for people managing very private data, or profiling people at very large scales. For most businesses, DPOs aren't relevant.
- chrismeller 8y ago
  I'm honestly not sure about the specifics on who legally has to have a DPO, just that it's a thing and a lot of people do. There's also the weird requirement that there be some EU-resident "responsible person" if your organization is not based in the EU that I'm fuzzy on the details of. Even if you can avoid both of those you still need a point person who answers GDPR-related requests. Whether you end up calling that person the DPO (with the legal responsibilities and consequences that comes with) or just the "GDPR Guy" (also known as Ted from Accounting...) it's still something new you have to deal with, train for, etc.
josteink 8y ago
> No, that's not the only requirement. At the very least there are additional record keeping steps, policies and procedures to draft, the appointment of a DPO that responds to requests for access or erasure That only applies if you illegally track users. You know what a simple solution to that is? Yup: Don't illegally track users. Pure magic, I know!

Drakim 8y ago

Wait, hold on, do you really need to do any of that if you are keeping zero data on people? I assume that kinda organization is only relevant if you are keeping data.

IanCal 8y ago
I'm pretty sure the answer here is "no".
seszett 8y ago
No, you don't have to. > At the very least there are additional record keeping steps, policies and procedures to draft, the appointment of a DPO that responds to requests for access or erasure, and the development of the features to fulfill both of those requests. * "Record keeping steps" are not needed if you don't keep records (which is what you should do); * "Policies and procedures" are what you should already have, of course, and GDPR didn't change that in any way; * A DPO must be appointed only if processing the personal data of your customers is your core activity; * Developing features to fulfill requests for access or erasure isn't necessary if you don't keep records.
adventured 8y ago
A newspaper from Aiken, South Carolina doesn't need to worry about complying with GDPR in any regard what-so-ever, not under any realistic circumstance. It can safely entirely disregard it. The Aiken Standard doesn't have to worry about GDPR just like a small town newspaper in Spain doesn't need to worry about complying with every privacy law that every US state decides to implement in the coming years (following in California's footsteps). There is a vast misunderstanding of how jurisdiction works and how it's going to play out in the near future. The vast majority of the world will disregard GDPR and comply with their own local laws instead. Small and mid size sites from any given country are not going to attempt to comply with 407 different privacy laws from every country/city/state/region/zone/province/whatever around the world. There is no alternative to this future. The sole, sane approach is to disregard Internet privacy laws if they do not apply to you in terms of jurisdiction. You will not be able to comply with the zillions of Internet-focused laws that are going to get created across the globe in the coming decade. GDPR should act as the training wheels for people building online sites/services/businesses to understand jurisdiction.
- chrismeller 8y ago
  I don't disagree with your point that nothing is ever going to come of it. In the case of an independently-owned local newspaper the EU can "huff and puff" as much as they want and there's not going to realistically be any impact to them. A lot of these "local" papers are owned by large parent companies though, and that becomes a different story all together. Even if you are independent and there's nothing the EU can realistically do to you, it's just one more thing you have to deal with. Figuring out WTF is going on, getting a lawyer to verify that there's nothing they can do to you, etc. etc. There are still some hard costs associated and it's going to distract you from what your company actually does for a while.
chrismeller 8y ago
Even writing an IP address in a web server log is considered "keeping data". Most of these news sites also have some form of "create an account to get updates / comment / vote" system, which would absolutely count as "keeping data". At the very least you still need a policy to give people telling them what data you keep and who you share it with. Even if that is nothing and no one, you need to be able to tell them that and you need someone who is responsible for handling those requests when they come in. "Just don't keep anything" is not a sufficient answer.
- josteink 8y ago
  > Even writing an IP address in a web server log is considered "keeping data" No it's not. Stop spreading FUD. If so, every part of every Internet-connected system on earth would be required to be completely redesigned to be GDPR-compliant. Demanding anything like that is not only unreasonable, it's 100% unrealistic. The GDPR is perfectly reasonable legislation and has legroom for obvious operational requirements, like access logs. (If you however mine the access log to derive or track users, that is another matter completely.)
  - oytis 8y ago
    > (If you however mine the access log to derive or track users, that is another matter completely.) So under GDPR you're not allowed to process data you've already got? I wouldn't call this reasonable legislation.
    - marksomnian 8y ago
      If the data was obtained in violation, it follows that any processing, while not technically in violation, wouldn't be looked upon favourably. Furthermore, although IANAL, I suspect that certain classes of processing fall under different rules, therefore the processing could potentially be in violation even if the collection wasn't.
    - Drakim 8y ago
      That seems like some twisted logic. "I was just dumping data in logs, I don't have to care about privacy concerns. Oh, and now I have all this data on my server, since it's already here I surely deserve to process it without caring about privacy concerns!"

IanCal 8y ago

I'm very sure that you do not need to appoint a DPO unless you're over a certain size.

seszett 8y ago
It's not a question of size, it's only needed if processing your customers' private data is your core activity, ie. if you operate an ad network that builds personal profiles of people.
repolfx 8y ago
Can you back that up? This site claims otherwise: https://www.itgovernance.co.uk/data-protection-officer-dpo-under-the-gdpr https://www.itgovernance.co.uk/data-protection-officer-dpo-u... There is no exemption for small and medium-sized enterprises (SMEs), which has been reaffirmed by the Information Commissioner’s Office (ICO): "I've heard plenty of people talking about there being a DPO exemption for SMEs - this is absolutely not the case." Peter Brown, Senior Technology Officer, Information Commissioner's Office (ICO)
- pimterry 8y ago
  https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/ https://ico.org.uk/for-organisations/guide-to-the-general-da... is a good summary from the UK gov authority. It's not based on size, but it isn't applicable to most businesses anyway. You need a DPO if: * you are a public authority or body (except for courts acting in their judicial capacity) * your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking) * your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences. Imo, those are all pretty reasonable cases where you should have somebody responsible managing your data privacy. DPOs are for people managing very private data, or profiling people at very large scales. For most businesses, DPOs aren't relevant.
chrismeller 8y ago
I'm honestly not sure about the specifics on who legally has to have a DPO, just that it's a thing and a lot of people do. There's also the weird requirement that there be some EU-resident "responsible person" if your organization is not based in the EU that I'm fuzzy on the details of. Even if you can avoid both of those you still need a point person who answers GDPR-related requests. Whether you end up calling that person the DPO (with the legal responsibilities and consequences that comes with) or just the "GDPR Guy" (also known as Ted from Accounting...) it's still something new you have to deal with, train for, etc.

josteink 8y ago

> No, that's not the only requirement. At the very least there are additional record keeping steps, policies and procedures to draft, the appointment of a DPO that responds to requests for access or erasure That only applies if you illegally track users. You know what a simple solution to that is? Yup: Don't illegally track users. Pure magic, I know!