7 ms·

Wait, hold on, do you really need to do any of that if you are keeping zero data on people? I assume that kinda organization is only relevant if you are keeping

by Drakim 8y ago

Wait, hold on, do you really need to do any of that if you are keeping zero data on people? I assume that kinda organization is only relevant if you are keeping data.

IanCal 8y ago
I'm pretty sure the answer here is "no".
seszett 8y ago
No, you don't have to. > At the very least there are additional record keeping steps, policies and procedures to draft, the appointment of a DPO that responds to requests for access or erasure, and the development of the features to fulfill both of those requests. * "Record keeping steps" are not needed if you don't keep records (which is what you should do); * "Policies and procedures" are what you should already have, of course, and GDPR didn't change that in any way; * A DPO must be appointed only if processing the personal data of your customers is your core activity; * Developing features to fulfill requests for access or erasure isn't necessary if you don't keep records.
adventured 8y ago
A newspaper from Aiken, South Carolina doesn't need to worry about complying with GDPR in any regard what-so-ever, not under any realistic circumstance. It can safely entirely disregard it. The Aiken Standard doesn't have to worry about GDPR just like a small town newspaper in Spain doesn't need to worry about complying with every privacy law that every US state decides to implement in the coming years (following in California's footsteps). There is a vast misunderstanding of how jurisdiction works and how it's going to play out in the near future. The vast majority of the world will disregard GDPR and comply with their own local laws instead. Small and mid size sites from any given country are not going to attempt to comply with 407 different privacy laws from every country/city/state/region/zone/province/whatever around the world. There is no alternative to this future. The sole, sane approach is to disregard Internet privacy laws if they do not apply to you in terms of jurisdiction. You will not be able to comply with the zillions of Internet-focused laws that are going to get created across the globe in the coming decade. GDPR should act as the training wheels for people building online sites/services/businesses to understand jurisdiction.
- chrismeller 8y ago
  I don't disagree with your point that nothing is ever going to come of it. In the case of an independently-owned local newspaper the EU can "huff and puff" as much as they want and there's not going to realistically be any impact to them. A lot of these "local" papers are owned by large parent companies though, and that becomes a different story all together. Even if you are independent and there's nothing the EU can realistically do to you, it's just one more thing you have to deal with. Figuring out WTF is going on, getting a lawyer to verify that there's nothing they can do to you, etc. etc. There are still some hard costs associated and it's going to distract you from what your company actually does for a while.
chrismeller 8y ago
Even writing an IP address in a web server log is considered "keeping data". Most of these news sites also have some form of "create an account to get updates / comment / vote" system, which would absolutely count as "keeping data". At the very least you still need a policy to give people telling them what data you keep and who you share it with. Even if that is nothing and no one, you need to be able to tell them that and you need someone who is responsible for handling those requests when they come in. "Just don't keep anything" is not a sufficient answer.
- josteink 8y ago
  > Even writing an IP address in a web server log is considered "keeping data" No it's not. Stop spreading FUD. If so, every part of every Internet-connected system on earth would be required to be completely redesigned to be GDPR-compliant. Demanding anything like that is not only unreasonable, it's 100% unrealistic. The GDPR is perfectly reasonable legislation and has legroom for obvious operational requirements, like access logs. (If you however mine the access log to derive or track users, that is another matter completely.)
  - oytis 8y ago
    > (If you however mine the access log to derive or track users, that is another matter completely.) So under GDPR you're not allowed to process data you've already got? I wouldn't call this reasonable legislation.
    - marksomnian 8y ago
      If the data was obtained in violation, it follows that any processing, while not technically in violation, wouldn't be looked upon favourably. Furthermore, although IANAL, I suspect that certain classes of processing fall under different rules, therefore the processing could potentially be in violation even if the collection wasn't.
    - Drakim 8y ago
      That seems like some twisted logic. "I was just dumping data in logs, I don't have to care about privacy concerns. Oh, and now I have all this data on my server, since it's already here I surely deserve to process it without caring about privacy concerns!"

by Drakim 8y ago

Wait, hold on, do you really need to do any of that if you are keeping zero data on people? I assume that kinda organization is only relevant if you are keeping data.

IanCal 8y ago

I'm pretty sure the answer here is "no".

seszett 8y ago

No, you don't have to. > At the very least there are additional record keeping steps, policies and procedures to draft, the appointment of a DPO that responds to requests for access or erasure, and the development of the features to fulfill both of those requests. * "Record keeping steps" are not needed if you don't keep records (which is what you should do); * "Policies and procedures" are what you should already have, of course, and GDPR didn't change that in any way; * A DPO must be appointed only if processing the personal data of your customers is your core activity; * Developing features to fulfill requests for access or erasure isn't necessary if you don't keep records.

adventured 8y ago

A newspaper from Aiken, South Carolina doesn't need to worry about complying with GDPR in any regard what-so-ever, not under any realistic circumstance. It can safely entirely disregard it. The Aiken Standard doesn't have to worry about GDPR just like a small town newspaper in Spain doesn't need to worry about complying with every privacy law that every US state decides to implement in the coming years (following in California's footsteps). There is a vast misunderstanding of how jurisdiction works and how it's going to play out in the near future. The vast majority of the world will disregard GDPR and comply with their own local laws instead. Small and mid size sites from any given country are not going to attempt to comply with 407 different privacy laws from every country/city/state/region/zone/province/whatever around the world. There is no alternative to this future. The sole, sane approach is to disregard Internet privacy laws if they do not apply to you in terms of jurisdiction. You will not be able to comply with the zillions of Internet-focused laws that are going to get created across the globe in the coming decade. GDPR should act as the training wheels for people building online sites/services/businesses to understand jurisdiction.

chrismeller 8y ago
I don't disagree with your point that nothing is ever going to come of it. In the case of an independently-owned local newspaper the EU can "huff and puff" as much as they want and there's not going to realistically be any impact to them. A lot of these "local" papers are owned by large parent companies though, and that becomes a different story all together. Even if you are independent and there's nothing the EU can realistically do to you, it's just one more thing you have to deal with. Figuring out WTF is going on, getting a lawyer to verify that there's nothing they can do to you, etc. etc. There are still some hard costs associated and it's going to distract you from what your company actually does for a while.

chrismeller 8y ago

Even writing an IP address in a web server log is considered "keeping data". Most of these news sites also have some form of "create an account to get updates / comment / vote" system, which would absolutely count as "keeping data". At the very least you still need a policy to give people telling them what data you keep and who you share it with. Even if that is nothing and no one, you need to be able to tell them that and you need someone who is responsible for handling those requests when they come in. "Just don't keep anything" is not a sufficient answer.

josteink 8y ago
> Even writing an IP address in a web server log is considered "keeping data" No it's not. Stop spreading FUD. If so, every part of every Internet-connected system on earth would be required to be completely redesigned to be GDPR-compliant. Demanding anything like that is not only unreasonable, it's 100% unrealistic. The GDPR is perfectly reasonable legislation and has legroom for obvious operational requirements, like access logs. (If you however mine the access log to derive or track users, that is another matter completely.)
- oytis 8y ago
  > (If you however mine the access log to derive or track users, that is another matter completely.) So under GDPR you're not allowed to process data you've already got? I wouldn't call this reasonable legislation.
  - marksomnian 8y ago
    If the data was obtained in violation, it follows that any processing, while not technically in violation, wouldn't be looked upon favourably. Furthermore, although IANAL, I suspect that certain classes of processing fall under different rules, therefore the processing could potentially be in violation even if the collection wasn't.
  - Drakim 8y ago
    That seems like some twisted logic. "I was just dumping data in logs, I don't have to care about privacy concerns. Oh, and now I have all this data on my server, since it's already here I surely deserve to process it without caring about privacy concerns!"