14 ms·
Complete guide to GDPR compliance
- simplysimple 8y agoMy guide to being GDPR compliant: don't do business in the EU. Much simpler.
- scrollaway 8y agoHow not to pay taxes: don't sell anything. It's a foolproof plan really.
- Silhouette 8y agoHow not to pay taxes: don't sell anything. You jest, but this is exactly what at least one of my businesses is about to do. We are in the UK, so Brexit uncertainty dominates any sort of EU-related planning for the next few months. The EU VAT rules for digital sales were already full of complication and red tape, and right now we don't even know whether the existing UK government systems will still be operating after the end of the current quarter on 31 March because it might all disappear with Brexit on 29 March. When we took professional advice on how to prepare for this as well as we can under the circumstances, no-one in the room had any confidence in what little formal guidance exists so far or that the official positions currently set out by either the UK or EU governments will be realistic when the time comes. The consensus (by which I mean "view strongly advocated by literally every professional advisor in the room") was to suspend sales to rEU states until the dust has settled, and just redirect our efforts and finite budgets towards customers elsewhere in the meantime. That will inevitably involve some short term financial cost, but then so would making major changes in our technical systems and accounting practices at short notice to comply with all foreseeable possibilities at the start of April. I don't find it inconceivable that lawyers in places like the US might give similar advice to some clients regarding the GDPR for similar reasons. If the clients are primarily dealing with data subjects outside the EU as well, avoiding the entire area as much as possible might be a reasonable position to take, even if again it's only temporarily until there is more known about the real implications of the GDPR as guidance and the first enforcement actions start to resolve the uncertainties.
- alliecat 8y agoHang on a sec, I'll move my EU-based company's entirely EU customer base as well as all of our EU citizen staff and EU-based suppliers... oh wait.
- hennsen 8y agoThanks for staying away! If you’re not interested in caring about our privacy and personal data concerns, you‘re very welcome to shove your products up to where the sun doesn’t shine...
- Shebanator 8y agoThese kinds of responses are unhelpful. Yes, data protection is incredibly important. That doesn't mean that GDPR as written is a well-done regulation - in point of fact its insanely complicated and its pretty much impossible to know whether or not you comply, even if you store zero data about users. It also doesn't mean that people who don't want to deal with GDPR don't care about privacy. Tarring and feathering someone for such things is lazy and unfair.
- simion314 8y ago>its pretty much impossible to know whether or not you comply, even if you store zero data about users. Can you explain how you store Zero data but you are not sure? Are you referring at the fact that you include third party code or use third party services? The fact that the laws are not simple is because they need to define things very specifically to make it impossible for "clever" people to interpret them different then the "spirit oft he law"
- Shebanator 8y agoServers have logs, which can have a lot of personal data in them. Not all of that logging is under your control, especially if you rely on 3rd party services like AWS. This is a simple example but there are many more.
- scaryclam 8y agoWhat logs are you thinking of? There are none that I can think of that require a lot of personal data. IP address storage is explicitly covered provided you log them for security etc.
- tivert 8y ago> My guide to being GDPR compliant: don't do business in the EU. > Much simpler. As an American, could you please tell me what businesses you run, so that I can make a note to avoid dealing with them in the future? Thanks in advance.
- fixermark 8y agoIt's going to be funny when we learn he works for the IRS. ;)
- simplysimple 8y agoMy company is over and above compliant with the requirements of the GDPR - not because we bothered to give a crap about the EU, but because we did it on our own years in advance, of our own volition and the need for heavy data protection. As an American, I'm suprised you aren't skeptical of a foreign government trying to control what you do.
- matthewmacleod 8y agoSounds amazing, to be honest. I'm quite enjoying the weird interstitial pages from a variety of US-based sites that block EU users. It's like a massive billboard saying "WE ARE USING YOUR DATA IN WAYS THAT YOU DON'T CONTROL", and is a reminder to use other services elsewhere. GDPR is relatively straightforward to comply with, particularly for the simpler kind of sites that don't seem to have bothered. It basically codifies the sort of best practice that should have been in place already, and I'm sure many of us are happy to see that there is movement towards regulating the disastrous dumpster fire of personal data in this way.
- kasey_junk 8y agoIt’s not at all simple for ad supported publishers who are the most prominent users of the blocking. It maybe a case where this is the intended consequence of the law but it wasn’t sold that way ahead of time. European publications are being even more impacted by this as they can’t resort to blocking. It will be very interesting how this impacts the publishers in the next few years.
- JAlexoid 8y agoHere's the kicker - most European online publications were already in compliance. GPDR is only slightly more stringent, than most EU privacy laws on file. The biggest complaints come from foreigners, if you haven't noticed.
- kasey_junk 8y agoNo one knows if they are in compliance or not yet. For instance https://www.bankinfosecurity.com/fresh-gdpr-complaints-take-aim-at-targeted-advertising-a-11487 https://www.bankinfosecurity.com/fresh-gdpr-complaints-take-... outlines a complaint that all of real time bidding that is compliant with the IAB compliance framework is not compliant with GDPR. Major publications, for instance Der Spiegel, which are trying to be compliant by following that standard (and they had to do major work to do so) may find they are out of compliance http://www.spiegel.de/extra/what-we-do-with-your-data-a-1211940.html http://www.spiegel.de/extra/what-we-do-with-your-data-a-1211... Similar complaints have been brought against publishers that used googles compliance framework.
- _rpd 8y ago> GDPR.EU is a website operated by Proton Technologies AG, which is co-funded by Project REP-791727-1 of the Horizon 2020 Framework Programme of the European Union. This is not an official EU Commission or Government resource. The europa.eu webpage concerning GDPR can be found here. Nothing found in this portal constitutes legal advice.
- dpwm 8y agoI'm not sure why you're pointing this out – it could be because it's interesting or it could be as a warning. If as a warning, nothing here seems particularly unreasonable. > GDPR.EU is a website operated by Proton Technologies AG, which is co-funded by Project REP-791727-1 of the Horizon 2020 Framework Programme of the European Union. This is probably a requirement of the funding. > This is not an official EU Commission or Government resource. The europa.eu webpage concerning GDPR can be found here. This seems reasonable. Funded by does not mean endorsed by. Here's the official page. > Nothing found in this portal constitutes legal advice. Realistically it can't be legal advice, even though it's dealing with an area that could get you into legal trouble. It's referring to a directive which has been implemented by member states. Each member state has its own enforcing body, and some will take a more firm approach than others. As for legal advice, in at least some jurisdictions even paid advice is treated as just that – advice – and if you get bad advice, there is little to no realistic prospect of redress. This appears at first glance to be one of the better resources on the GDPR I have seen.
- _rpd 8y agoIt's a warning. The site is authored by a private entity whose only qualification may be that they registered the gdpr.eu domain most quickly. It claims to be a "complete guide to GDPR compliance" but is nothing of the sort. Most pages end with the disclaimer that "nothing found in this portal constitutes legal advice" and to consult a lawyer. Legally, it's quite dangerous since it might give you the feeling of being compliant while still being at risk. "But Proton Technologies AG said ..." isn't going to hold up in court.
- 8y ago
- russley 8y agoIronic that a site about GDPR compliance has 6 potential trackers according to Privacy Badger.
- lmkg 8y agoWhich might be fine, depending on their privacy policy. Let's take a look... Their privacy policy indicates they are claiming Legitimate Interest as the legal basis for using Google Analytics. My network tab also sees hits form ShareThis and Facebook, which are not mentioned in the Privacy Policy. There's a section on Embedded Content, but I don't see any content embedded in the privacy policy itself. https://gdpr.eu/privacy-policy/ https://gdpr.eu/privacy-policy/ I will say this does a good job of being straightforward and readable, and covering what a privacy policy needs to cover. But it's still incomplete with regards to what data is being sent where.
- bad_user 8y agoExcept Google Analytics cannot be a "legitimate interest". A legitimate interest is one that prevents the service from operating. E.g. if you're a pizza delivery service, you need to use the customer's address, since it's implicit in what the service does and the customer expects you to use their address for the purpose of home delivery. If you block Google Analytics however, in what way will the service be impacted from the perspective of the user experience? There is no impact, even if this costs the business optimization opportunities or money. You can argue that the inability to use Google Analytics can have a long term impact on user experience, but that's not how legitimate interests work. In general, "making more money" or "becoming more popular" are invalid reasons for stating a legitimate interest.
- fixermark 8y agoGDPR compliance doesn't imply that tracking is disallowed, right? The GDPR specifies the allowed, legal protocols for tracking users and consumer behavior on sites.
- richardwhiuk 8y ago
- TotempaaltJ 8y agoThe checklist especially is a great resource IMO: https://gdpr.eu/checklist/ https://gdpr.eu/checklist/ Also shows how much of this is truly just sensible privacy protections.
- smartbit 8y agoA GDPR checklist goes against the basics of GDPR: privacy is a human right not a consumer right. Any site that provides a GDPR checklist should beter be discarded and not given attention.
- frereubu 8y agoIf you want to read an excellent guide on GDPR from a regulatory authority (i.e. an organisation that is actually tasked with implementing the legislation) the UK's ICO website is the best place. It uses plain English as far as possible while not oversimplifying things to the point of uselessness. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- lwyr 8y agoWarning: The privacy notice template on this site (https://gdpr.eu/privacy-notice/ https://gdpr.eu/privacy-notice/) omits basic mandatory elements (e.g. retention periods, right to lodge a complaint). The template's section on cookies is insufficient and misleading. Cookies are regulated by a different law (the ePrivacy Directive) and their explanation does not go into these rules at all. As frereubu notes elsewhere in this thread, the UK regulator's GDPR guide is excellent, and is a much better starting point in my opinion: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- dpwm 8y agoFor those like me that hadn't linked Proton Technologies AG and ProtonMail, it's worth noting that this guide may actually have a service to sell you (ProtonMail). The ICO guide linked by the parent doesn't.
- protonmail 8y agoWe have made some updates to the template so it is now more comprehensive. e-privacy technically is not GDPR, but since it is closely related, we have also incorporated this now.
- pitaj 8y agoAre IP addresses personally identifiable information under GDPR?
- robin_reala 8y agoPII is a US concept, ‘personal data’ is the equivalent in GDPR. But yes, IP addresses are considered personal data.
- pierrefar 8y agoYes, and also cookie IDs. Both are called out as examples in recital 30: “Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.” Source: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A...
- pitaj 8y agoI should have been more clear that I meant IP addresses alone. It seems like this only addresses when IP addresses are combined with other data.
- kasey_junk 8y agoThat particular guidance has provided a lot of gnashing of teeth because some readings of it have an implicit “because” before the final sentence. That is IP addresses are personal data as sometimes they uniquely identify people. The guidance my firm received was to treat them, by themselves, as an ID. YMMV.
- dronescanfly 8y agoDSGVO concerns 'directly' identifying information (Name, SSN...) aswell as 'indirectly' identifying information like IP adresses where the technical possibilities exist to link them back to the person. EVEN if you do not actively link them to the person DSGVO treats them the same way as the directly identifying information
- Tsubasachan 8y agoGDPR is unfortunately a paper tiger I have come to realize. The only thing that impresses Americans is a bit of good old violence. And the EU simply doesn't have the balls to drag executives off their private jets and drop them in a secret prison.
- zorga 8y agoNo any authority over sites not hosted/run in the EU. I'm a US citizen running a business in the US; the EU has no legal authority whatsoever over me. If an EU citizens buys something from my site, as far as I'm concerned they came to the US virtually to do it, and US laws apply here, not EU laws. They can shove their GDPR where the sun doesn't shine.
- wglb 8y agoUnfortunately unless you are explicitly not soliciting business from EU residents, you fall under that regulation. One possible consequence is reputational damage.
- zorga 8y agoNo I don't, I'm not an EU citizen and have no EU physical presence; they can claim whatever they want, they have no jurisdiction over me, I am not subject to EU laws no matter what the GDPR tries to assert. It's toothless, they have no enforcement mechanism on a US citizen in the US. I'm am not subject to the laws of every country that asserts it so; I'm subject to the laws of the US only.
- ghwst 8y agoWhile GDPR is supposed to apply to any controller processing personal data where the processing activities are related to the offering of goods or service to data subjects in the Union, I believe it is fair to say that we have no idea yet how this will exactly be enforced outside of the EU (when it is enforced) until the first attempts appear. It's true that this extra-territorial scope is a bold move when it comes to international law. I see a trend in the latest EU regulations that would suggest they are not close to abandoning this idea.
- ghego1 8y agoA much better and complete checklist tool is available at https://autoprivacy.eu https://autoprivacy.eu
- zorga 8y agoSimple, block the EU, problem solved.
- adminu 8y agoA market of 512M well situated people surely is not an issue to ignore, great business advice here...
- zorga 8y agoIt's not a market of 512M, it's many small markets of different languages and different cultures that all need to be targeted individually whereas the US is actually a much larger market of a single culture. Focusing on the big mono language mono culture market instead of chasing dozens of smaller markets that require much more effort in internationalization is actually good business advice.
- ionised 8y agoIt is a single market. That's the whole point of the EEA. Your personal interpretation of the situation is irrelevant.
- zorga 8y agoFrom a business standpoint trying to market goods, no, it isn't. That's just a fact. Every culture has to be marketed to differently, they are different markets.
- JAlexoid 8y agoUS is actually not a single market. At least, not as much as you'd like to believe.
- zorga 8y agoThere are regions, but they all speak the same language and use the same date formats: you do not have to internationalize or target your app, it is thus a single market. Not remotely so in the EU.
- grantlmiller 8y agoif you're running a SaaS or software company, we compiled an abridged version of the full GDPR text that is only 34 pages in this format, very easy to consume: https://www.enterpriseready.io/GDPR-abridged-text-for-SaaS-Cos.pdf https://www.enterpriseready.io/GDPR-abridged-text-for-SaaS-C... if you want to read the full thing, we created a quick guide for understanding which sections you might want to skim: https://www.enterpriseready.io/gdpr/how-to-read-gdpr/ https://www.enterpriseready.io/gdpr/how-to-read-gdpr/
- marcrosoft 8y agoI can't believe people would even consider foreign laws apply to US small businesses that operate solely in the U.S. Edit: no you don't need a guide on how to comply. No you don't need to pay some consultant to see if you are compliant. Simply ignore. Edit 2: to comply means you except all foreign laws and rule.
- robin_reala 8y agoYou’re welcome to ignore it if you like, but compliance doesn’t mean ‘accepting foreign rule’ if you look at it as a compilation of good practices for user privacy.
- bad_user 8y agoThey have Google Analytics enables without consent and in the privacy policy they claim this: >> “Google Analytics does not identify individual users or associate your IP address with any other data held by Google.” This is wrong, GA may anonymize IPs, however they drop a tracking cookie in order to identify unique visitors. Tracking cookies under the GDPR fall under “personal data”, even if they are pseudo-anonymous. Also note that usage of Google Analytics cannot be a “legitimate purpose”. So is this legal what they are doing? Or what am I missing?
- protonmail 8y agoIn the sense of art. 6 §1 (f) GDPR, there is nothing preventing analytics to be justified by a legitimate interest. Recital 47 also says the processing of personal data for direct marketing purposes can be carried out for legitimate interests. Per the e-privacy directive, we provide notice that there is a cookie. The updated Privacy notice is now supplemented with extra information.
- oytis 8y agoOh, so now strangers can claim their rights on my mailbox, good times. I'm happy I'm a private person (and that lawgivers decided to spare ordinary people for now).