7 ms·

GDPR is very good in fact. If you read through it as a person, it is basically the way we should have operated from the start. Reading it while wearing the hat

by Loic 8y ago

GDPR is very good in fact. If you read through it as a person, it is basically the way we should have operated from the start. Reading it while wearing the hat of my role in my company, I can see all the points where we are collecting data without a well defined process and clear understanding from the end users. It is hard to fix this, but it is for my own good as a person.

tokyodude 8y ago
Can you explain to me how the deletion policies work? If you ask for your data to be deleted does that include your address in my contacts? Does it include your messages to me? Does it include your posts that appeared on my feed? In the physical world all of those would be mine. Addresses: It would be my paper address book with your address written in it. Email: would paper letters you sent to me that I keep in my files. Your posts in my feed would be postcards I received from you keep in a scrapbook or shoebox. It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property.
- bryanrasmussen 8y ago
  The things sent digitally from me to you end being my property and end up being your property immediately as long as the sending is not part of some business arrangement, but if it is some business arrangement that business is regulated, and when it becomes your property if ever can be dependent on many different factors of your business.
- willeh 8y ago
  > Can you explain to me how the deletion policies work? Disclaimer: The GDPR hasn't been the law of the land for a year, so there is little precedent. It is fairly simple, the GDPR requires that companies that control identifying information about you (or somehow delegate this), have acceptable reasons for doing so (user consent/other law/etc). When some entity controls your information the GDPR gives you certain rights. The key point here is that the company is controlling your information not you, whereas the scrapbook is under your control. The loss of control of the information creates in my mind a moral obligation to treat it a certain way. One of the rights that the GDPR confers on the data-subject is the having data deleted, this right is not absolute and if you have any other grounds (e.g. AML regulation) for keeping the data then you don't have to delete it. Additionally, deletion doesn't have to be immediately consistent, so you won't have to go into old backups and delete the data there. TL;DR: If someone asks you to remove something, just delete it from your SQL database, and that's it. There are two key costs for startups implementing the GDPR: 1. Privacy by Design - Make some efforts to design the information systems in your company in a way that promotes privacy. 2. Demonstrating compliance - This tasks scales with company size, you might start out with a boilerplate privacy policy, but as you grow want to be more diligent.
  - tokyodude 8y ago
    this doesn't help clarify things at all. you send me an email. I use Gmail. you request Google delete all your data. does google have to delete the email from you that's in my inbox?
- y0ghur7_xxx 8y ago
  > If you ask for your data to be deleted does that include your address in my contacts? If that address is visible to you because I gave you access to my data, then yes. If that address is visible to you because I gave it to you and you put it there by yourself, then no. > Does it include your messages to me? No. Messages I wrote to you are yours. I gave them to you. You can keep them. They get deleted when/if you ask for your account to be deleted. > Does it include your posts that appeared on my feed? Yes. My posts are mine. If I make them public or share them with you, you can look at them, copy them, do what you want with them (depending on the license). If I remove my account they get deleted from my account. If you made a copy for yourself, you can keep the copy. > It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property. As always, ask a lawyer.
  - geocar 8y ago
    > If I remove my account they get deleted from my account. Maybe. There's an argument for the public good that can be appropriate (e.g. a public figure on twitter).
- geocar 8y ago
  > It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property. The ICO gives really good advice on this. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
- belorn 8y ago
  I think that the best way to view the deletion policy is to imagine what would happen if someone stole the data. If it is anything that could get you sued over then that is data that needed to be deleted. This will likely cover a bit more than if it was physical objects. To be fair, most physical paper address books would not include millions/billions of addresses, and would unlikely be stolen by accident. The only one that has billions of paper letters are the post office which is regulated. The physical world is not very different to GDPR if one includes the context of how many book shelves of information is being stored on companies databases.
  - CWuestefeld 8y ago
    I don't think that's correct. A business has the right to retain records that are necessary for them to do business. From the lawyer that advised us in this, his call was that Order History data doesn't need to be expurgated even though it contains the person's name and address, etc. There are any number of business reasons dictating that we need a record of this stuff (e.g., auditing for sales tax compliance; being able to handle customer returns in the future, or fraud claims from the credit card processor).
- Sir_Substance 8y ago
  >If you ask for your data to be deleted does that include your address in my contacts? I'm assuming that "my" in this sentence means a business, since individuals are not subject to GDPR, and that the thrust of your question revolves around, say, a customer support portal. Yes, addresses have to go unless you have a legitimate business reason to keep them. For tax purposes or to prove something in an active court case are both examples of a reason you could keep the address at least temporarily. >Does it include your messages to me? No, they could be anonymised instead. If the messages contain PII you might need to sanitize them. >Does it include your posts that appeared on my feed? Same as the previous question. >It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property. This is defined on, like, the second page of the GDPR document. Article 2 "material scope" point 1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. GDPR kicks in when you start processing this stuff automatically. If you want to handle your entire businesses paperwork via a set of paper ledgers with humans in front of them, that'll make you GDPR immune. Listen man, I read the GDPR document /once/ almost a year ago now, and I remember the answers to your questions off the top of my head. I'm not a lawyer either, I'm a software engineer. If someone told you GDPR was complex, they lied to you. The legislation is dead simple and most of the document is actually not about what businesses need to do but about what the EU bureaucrats need to do. You only need to read about half of it, the rest is irrelevant to you. If this matters to you, just go read the damn thing. Trust me, it's a fricking revelation to do so, you'll be staggered by the amount of bullshit people spout about it and the amount of needless fretting and hand-wringing they do once you know how simple it is. Don't get me wrong, the implementation may be hard for some businesses, but I'll also tell you straight up, there are lots of businesses voluntarily making their GDPR implementations harder and more expensive than necessary because they didn't bother actually reading the law and are instead going off third-hand chinese-whisper information, which is a crazy way to run a business.
  - XCabbage 8y ago
    > I'm assuming that "my" in this sentence means a business, since individuals are not subject to GDPR No; tokyodude is asking what happens if you request that (for example) Google erases your data, and he has your email address in his Gmail contacts. Does Google, as the data controller who ultimately stores tokyodude's contact list for him, then have to purge your email address from tokyodude's address book? > Listen man, I read the GDPR document /once/ almost a year ago now, and I remember the answers to your questions off the top of my head. I'm not a lawyer either, I'm a software engineer. This condescension is obnoxious and unwarranted. Just take a look at the complexity of the conditions at https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ dictating when the right to erasure applies. Point (b) seems to suggest that it applies by default if the basis for originally processing the data was the subject's consent... but that the controller can override that if they have another legal ground for processing. So can they just argue they have a "legitimate interest", under article 6(1) point (a), in preserving tokyodude's address book? I have no idea. Meanwhile, point (f), linking to article 8 about children, is saying - I think - that a data controller must honour an erasure request if it's about data they collected from a child, even if they have another legal ground for processing that data. So even if the legitimate interests argument above would hold, if you're a 12-year-old, I think you absolutely can demand that your email address be purged from tokyodude's address book and he can't do anything about it? How about your actual emails to him? Can you demand that Google deletes them from his inbox? As far as I can see, the answer logically ought to be "yes"; Art 17 (1) (f) applies and I don't see any exception that would let Google wriggle out of the obligation. But I'm not sure if any of the above, because this stuff is vague and complicated. If you truly think it's simple, I invite you to walk us through the answers to the scenarios I've explored above, supporting your assertions with relevant references to the text of the law. I do not expect you to be able to do so.
- icebraining 8y ago
  In the physical world all of those would be mine. This is a common misconception, but the GDPR applies to the physical world as well. The regulation only talks about "personal data in a filing system", which is a generic term.
nusq 8y ago
GPDR is essentially some guidelines published by OCDE in 1980 turned into law. So yes we should already be operating like that from the start. I get the feeling that to some countries GPDR is not a big deal and to others is a nightmare, depending on the business culture.
LoSboccacc 8y ago
The real issue with GDPR is that it's extremely under specified and we're left to educate guesses to find out what and what's not illegal until the matter is settled in courts. For example a service provider can collect emails under the Article 6(b) clause to provide its services. But what happens when a user exits the contract? There's a conflict there because the provider need to keep hold of the email (to avoid user cancelling, asking for deletion then registering for another free trial) while the provider might not be holding consent anymore (Article 6(b) no longer applicable and consent subject to withdrawal at any time) Would it be safe to store an hash of the subject for that purpose? Apparently, not: https://www.sciencedirect.com/science/article/pii/S0267364918300153 https://www.sciencedirect.com/science/article/pii/S026736491... So what's the best practice there? We're all taking guesses. And that's not the hallmark of a good law.
- dpwm 8y ago
  > The real issue with GDPR is that it's extremely under specified and we're left to educate guesses to find out what and what's not illegal until the matter is settled in courts. Best practice now may not be best practice in future. Sure, there could be guidance produced. In fact there is, it's just usually by the enforcing bodies. > what happens when a user exits the contract > to avoid user cancelling, asking for deletion then registering for another free trial You can be sued for six years in the UK. Other jurisdictions I'm not so sure about. If you're providing a service and have agreed a jurisdiction and can be sued in that jurisdiction, there's your lawful basis. The right to be forgotten only applies where the basis is purely consent. If you withdraw consent, and consent is the only basis, your data should be deleted. But if you're providing a service, then another basis applies: contract and legitimate business interest. I think you'll find you have a legitimate business interest and a lawful purpose there for maintaining the email addresses -- as long as you don't later change the purpose and include them on a mailing list. > So what's the best practice there? We're all taking guesses. And that's not the hallmark of a good law. It's largely down to the enforcing body. The ICO (UK enforcing body) generally only fine after a major incident or you've failed to stop doing something really bad. Or you've set up a business that is egregiously scummy. You can read the list of fines online. [0] It helps to see it more like fire legislation -- there are many ways to prevent and contain fire. You can seriously reduce the risk of fire and the consequences if one happens. Breaches are similar. If you have a data breach, something's gone wrong. If you're not taking serious mitigation to prevent that from happening, then maybe you shouldn't be taking user data in the first place. [0] https://ico.org.uk/action-weve-taken/enforcement/ https://ico.org.uk/action-weve-taken/enforcement/
hartator 8y ago
The “Right to be Forgotten” is clearly in contradiction with the first though.

by Loic 8y ago

tokyodude 8y ago

Can you explain to me how the deletion policies work? If you ask for your data to be deleted does that include your address in my contacts? Does it include your messages to me? Does it include your posts that appeared on my feed? In the physical world all of those would be mine. Addresses: It would be my paper address book with your address written in it. Email: would paper letters you sent to me that I keep in my files. Your posts in my feed would be postcards I received from you keep in a scrapbook or shoebox. It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property.

bryanrasmussen 8y ago
The things sent digitally from me to you end being my property and end up being your property immediately as long as the sending is not part of some business arrangement, but if it is some business arrangement that business is regulated, and when it becomes your property if ever can be dependent on many different factors of your business.
willeh 8y ago
> Can you explain to me how the deletion policies work? Disclaimer: The GDPR hasn't been the law of the land for a year, so there is little precedent. It is fairly simple, the GDPR requires that companies that control identifying information about you (or somehow delegate this), have acceptable reasons for doing so (user consent/other law/etc). When some entity controls your information the GDPR gives you certain rights. The key point here is that the company is controlling your information not you, whereas the scrapbook is under your control. The loss of control of the information creates in my mind a moral obligation to treat it a certain way. One of the rights that the GDPR confers on the data-subject is the having data deleted, this right is not absolute and if you have any other grounds (e.g. AML regulation) for keeping the data then you don't have to delete it. Additionally, deletion doesn't have to be immediately consistent, so you won't have to go into old backups and delete the data there. TL;DR: If someone asks you to remove something, just delete it from your SQL database, and that's it. There are two key costs for startups implementing the GDPR: 1. Privacy by Design - Make some efforts to design the information systems in your company in a way that promotes privacy. 2. Demonstrating compliance - This tasks scales with company size, you might start out with a boilerplate privacy policy, but as you grow want to be more diligent.
- tokyodude 8y ago
  this doesn't help clarify things at all. you send me an email. I use Gmail. you request Google delete all your data. does google have to delete the email from you that's in my inbox?
y0ghur7_xxx 8y ago
> If you ask for your data to be deleted does that include your address in my contacts? If that address is visible to you because I gave you access to my data, then yes. If that address is visible to you because I gave it to you and you put it there by yourself, then no. > Does it include your messages to me? No. Messages I wrote to you are yours. I gave them to you. You can keep them. They get deleted when/if you ask for your account to be deleted. > Does it include your posts that appeared on my feed? Yes. My posts are mine. If I make them public or share them with you, you can look at them, copy them, do what you want with them (depending on the license). If I remove my account they get deleted from my account. If you made a copy for yourself, you can keep the copy. > It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property. As always, ask a lawyer.
- geocar 8y ago
  > If I remove my account they get deleted from my account. Maybe. There's an argument for the public good that can be appropriate (e.g. a public figure on twitter).
geocar 8y ago
> It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property. The ICO gives really good advice on this. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
belorn 8y ago
I think that the best way to view the deletion policy is to imagine what would happen if someone stole the data. If it is anything that could get you sued over then that is data that needed to be deleted. This will likely cover a bit more than if it was physical objects. To be fair, most physical paper address books would not include millions/billions of addresses, and would unlikely be stolen by accident. The only one that has billions of paper letters are the post office which is regulated. The physical world is not very different to GDPR if one includes the context of how many book shelves of information is being stored on companies databases.
- CWuestefeld 8y ago
  I don't think that's correct. A business has the right to retain records that are necessary for them to do business. From the lawyer that advised us in this, his call was that Order History data doesn't need to be expurgated even though it contains the person's name and address, etc. There are any number of business reasons dictating that we need a record of this stuff (e.g., auditing for sales tax compliance; being able to handle customer returns in the future, or fraud claims from the credit card processor).
Sir_Substance 8y ago
>If you ask for your data to be deleted does that include your address in my contacts? I'm assuming that "my" in this sentence means a business, since individuals are not subject to GDPR, and that the thrust of your question revolves around, say, a customer support portal. Yes, addresses have to go unless you have a legitimate business reason to keep them. For tax purposes or to prove something in an active court case are both examples of a reason you could keep the address at least temporarily. >Does it include your messages to me? No, they could be anonymised instead. If the messages contain PII you might need to sanitize them. >Does it include your posts that appeared on my feed? Same as the previous question. >It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property. This is defined on, like, the second page of the GDPR document. Article 2 "material scope" point 1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. GDPR kicks in when you start processing this stuff automatically. If you want to handle your entire businesses paperwork via a set of paper ledgers with humans in front of them, that'll make you GDPR immune. Listen man, I read the GDPR document /once/ almost a year ago now, and I remember the answers to your questions off the top of my head. I'm not a lawyer either, I'm a software engineer. If someone told you GDPR was complex, they lied to you. The legislation is dead simple and most of the document is actually not about what businesses need to do but about what the EU bureaucrats need to do. You only need to read about half of it, the rest is irrelevant to you. If this matters to you, just go read the damn thing. Trust me, it's a fricking revelation to do so, you'll be staggered by the amount of bullshit people spout about it and the amount of needless fretting and hand-wringing they do once you know how simple it is. Don't get me wrong, the implementation may be hard for some businesses, but I'll also tell you straight up, there are lots of businesses voluntarily making their GDPR implementations harder and more expensive than necessary because they didn't bother actually reading the law and are instead going off third-hand chinese-whisper information, which is a crazy way to run a business.
- XCabbage 8y ago
  > I'm assuming that "my" in this sentence means a business, since individuals are not subject to GDPR No; tokyodude is asking what happens if you request that (for example) Google erases your data, and he has your email address in his Gmail contacts. Does Google, as the data controller who ultimately stores tokyodude's contact list for him, then have to purge your email address from tokyodude's address book? > Listen man, I read the GDPR document /once/ almost a year ago now, and I remember the answers to your questions off the top of my head. I'm not a lawyer either, I'm a software engineer. This condescension is obnoxious and unwarranted. Just take a look at the complexity of the conditions at https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ dictating when the right to erasure applies. Point (b) seems to suggest that it applies by default if the basis for originally processing the data was the subject's consent... but that the controller can override that if they have another legal ground for processing. So can they just argue they have a "legitimate interest", under article 6(1) point (a), in preserving tokyodude's address book? I have no idea. Meanwhile, point (f), linking to article 8 about children, is saying - I think - that a data controller must honour an erasure request if it's about data they collected from a child, even if they have another legal ground for processing that data. So even if the legitimate interests argument above would hold, if you're a 12-year-old, I think you absolutely can demand that your email address be purged from tokyodude's address book and he can't do anything about it? How about your actual emails to him? Can you demand that Google deletes them from his inbox? As far as I can see, the answer logically ought to be "yes"; Art 17 (1) (f) applies and I don't see any exception that would let Google wriggle out of the obligation. But I'm not sure if any of the above, because this stuff is vague and complicated. If you truly think it's simple, I invite you to walk us through the answers to the scenarios I've explored above, supporting your assertions with relevant references to the text of the law. I do not expect you to be able to do so.
icebraining 8y ago
In the physical world all of those would be mine. This is a common misconception, but the GDPR applies to the physical world as well. The regulation only talks about "personal data in a filing system", which is a generic term.

nusq 8y ago

GPDR is essentially some guidelines published by OCDE in 1980 turned into law. So yes we should already be operating like that from the start. I get the feeling that to some countries GPDR is not a big deal and to others is a nightmare, depending on the business culture.

LoSboccacc 8y ago

The real issue with GDPR is that it's extremely under specified and we're left to educate guesses to find out what and what's not illegal until the matter is settled in courts. For example a service provider can collect emails under the Article 6(b) clause to provide its services. But what happens when a user exits the contract? There's a conflict there because the provider need to keep hold of the email (to avoid user cancelling, asking for deletion then registering for another free trial) while the provider might not be holding consent anymore (Article 6(b) no longer applicable and consent subject to withdrawal at any time) Would it be safe to store an hash of the subject for that purpose? Apparently, not: https://www.sciencedirect.com/science/article/pii/S0267364918300153 https://www.sciencedirect.com/science/article/pii/S026736491... So what's the best practice there? We're all taking guesses. And that's not the hallmark of a good law.

dpwm 8y ago
> The real issue with GDPR is that it's extremely under specified and we're left to educate guesses to find out what and what's not illegal until the matter is settled in courts. Best practice now may not be best practice in future. Sure, there could be guidance produced. In fact there is, it's just usually by the enforcing bodies. > what happens when a user exits the contract > to avoid user cancelling, asking for deletion then registering for another free trial You can be sued for six years in the UK. Other jurisdictions I'm not so sure about. If you're providing a service and have agreed a jurisdiction and can be sued in that jurisdiction, there's your lawful basis. The right to be forgotten only applies where the basis is purely consent. If you withdraw consent, and consent is the only basis, your data should be deleted. But if you're providing a service, then another basis applies: contract and legitimate business interest. I think you'll find you have a legitimate business interest and a lawful purpose there for maintaining the email addresses -- as long as you don't later change the purpose and include them on a mailing list. > So what's the best practice there? We're all taking guesses. And that's not the hallmark of a good law. It's largely down to the enforcing body. The ICO (UK enforcing body) generally only fine after a major incident or you've failed to stop doing something really bad. Or you've set up a business that is egregiously scummy. You can read the list of fines online. [0] It helps to see it more like fire legislation -- there are many ways to prevent and contain fire. You can seriously reduce the risk of fire and the consequences if one happens. Breaches are similar. If you have a data breach, something's gone wrong. If you're not taking serious mitigation to prevent that from happening, then maybe you shouldn't be taking user data in the first place. [0] https://ico.org.uk/action-weve-taken/enforcement/ https://ico.org.uk/action-weve-taken/enforcement/

hartator 8y ago

The “Right to be Forgotten” is clearly in contradiction with the first though.