11 ms·

As much as I like the idea of "right to be forgotten", it seems to me that an unintended consequence is that non-technical people hosting forums/blogs etc. will

by zizee 8y ago

As much as I like the idea of "right to be forgotten", it seems to me that an unintended consequence is that non-technical people hosting forums/blogs etc. will be at risk of GDPR requests that they cannot comply with due to lack of technical skills. This will have a silencing effect for people wanting to operate non-profit sites as they won't be able to afford to comply with such requests. They will be forced to either shutdown, or be in breach of law. Perhaps some people will say "good, if you cannot run a site conforming to all laws of the land then you should shutdown". If you think that, consider this: as these laws pile up it will get more and more difficult to operate, leaving only the very tech/law savvy, and big business. This is not the democratization of information that the web promised oh so many years ago. On a semi-related note: if you are a small SASS operator wanting to comply with such requests, what are you meant to do about your DB backups that contain data that is meant to be forgotten? [edits: punctuation/grammar]

ThePhysicist 8y ago
I think most of the larger forum software providers have implemented functions to comply with GDPR (i.e. delete, restrict and extract user data). Concerning backups: If you have a short turnaround time (e.g. 14 days) it shouldn’t be a problem, the legislation acknowledges the fact that deleting data and ensuring data integrity (also in accordance with GDPR) are sometimes mutually exclusive from a practical point of view. You need to make sure that deletion requests also get honored when restoring from backup though, so ideally you want to store the requests in a third system and check them when you restore backups. Concerning the democratic aspect of participating in the online world I think GDPR actually helps, as before it was not possible to reliably get your own data deleted, rectified or transferred, which is not very democratic either IMHO.
- zizee 8y ago
  Thank you for your thoughtful response and information. I need time to digest this information to see how it affects my opinions, which might take longer than the half life of this discussion, so my apologies in advance for probably not responding :-)
- scoot_718 8y ago
  Lots of software has functionality most users can't use. You might as well tell them that compilers can provide the functions necessary to comply.
  - peteretep 8y ago
    > Lots of software has functionality most users can't use If you are using software to process my personal data, and you don't know how to do that while protecting my personal data, then I'd like you to stop using that software right away.
- DoubleGlazing 8y ago
  >Concerning the democratic aspect of participating in the online world I think GDPR actually helps, as before it was not possible to reliably get your own data deleted, rectified or transferred, which is not very democratic either IMHO This is where the GDPR has really helped me. I posted a comment on a blog critical of a government data sharing initiative. Nothing illegal, or questionable - it was a simple two sentence opinion comment which I posted under my real name. I didn't stop to think for a minute that it would cause me any problems. It did. I discovered that I couldn't get to work on any government projects because when a background check was carried out on me, the above comment was found and according to Revenue (the gov agency responsible for such checks) it indicated that I was hostile to the governments IT plans. I asked the blog owner (same country as me) to please remove the comment, they refused. So I submitted a right to be forgotten request to Google to stop the blog post appearing in searches for my name.
  - theelous3 8y ago
    Ireland? In Ireland, civil servants are not allowed to express political affiliation or opinion, so rather than it being a case of "we don't like what you said", it would be a case of "you said something political, and it persists." I'm not sure if the contract for Revenue is exactly the same as the civil service, but I would presume on this front it is very similar.
    - DoubleGlazing 8y ago
      Yep. There have been three occasions where the IT contracting firm I was working for sent me to work on government IT projects as a contractor. None of them were for Revenue, but it is Revenue who do these checks for all other departments. On one occasion my employer managed to pull a few strings to get me on the project (DSP), on the other two I was told no government work for me (HSE and DoT). On one of the three three occasions I was forwarded an email from Revenue that said "he expresses a desire for personal privacy that indicates he would be unwilling to fully embrace the governments data sharing strategy". I did write to a few news outlets about this, none were interested. Even the ICCL wasn't interested, which really surprised me.
  - 8y ago
zizee 8y ago
Responding to myself: Of course, this could have been the intention all along. It has long been recognized that big business loves difficult to conform with regulations (regardless of their protestations otherwise) because it is hard for smaller competitors to breach the effective moat that heavy/complex regulations provide incumbents.
- johannes1234321 8y ago
  It is quite easy to comply with GDPR - store as little data as needed - protect the data in state of the art ways - make transparent what you store and process and why - establish a process to delete data once it's not needed anymore It is only complicated if you want to build a company around the abuse of data, as common in the ad world.
  - piokoch 8y ago
    How about "data accuracy" - you are obliged to make sure that data you store are accurate and be able to prove that you've asked users to confirm that data are accurate. How about the duty to export user data on request? How about player consent management? Consent updates, etc. Those are not simple thing neither to implement nor to manage, especially if someone will accuse you and you need to prove that you are compliant.
brylie 8y ago
Re: the backups. Rolling backups, e.g daily and weekly, are fairly common. When the request comes in, just acknowledge there will be a time period before the deletion is fully purged from system backups - as is still legal post-GDPR. The user data will still be removed from production data, which is of primary concern.
belorn 8y ago
Backups has many potential exceptions, some being security and archiving for the public, but there is also language like reasonable steps and to not have the data influence any future decisions. But backups has to be stored securely, and the data within can't naturally be used if restored beyond exceptions.
bhaak 8y ago
> [...] it seems to me that an unintended consequence is that non-technical people hosting forums/blogs etc. will be at risk of GDPR requests that they cannot comply with due to lack of technical skills [...] If it's only due to technical skills then this problem can be solved technically. The forum software needs to enable people to be GDPR compliant. > On a semi-related note: if you are a small SASS operator wanting to comply with such requests, what are you meant to do about your DB backups that contain data that is meant to be forgotten? This hasn't been tested in court, yet. But there are several possible approaches. Like delete on restoration or backing up in slices, so that the personal data becomes anonymous unless you have all the parts. Don't forget that the "right to be forgotten" is not an absolute right. It doesn't trump everything else. Nobody would expect somebody to sue ESA for their "right to be forgotten" for a public message that they could send to ESA to put on a CD on a probe they sent into space and win. First of all, it forces everybody involved with personal data to think about how they handle personal data and inform the users about that. If you state "due to technical limitations, your personal data in backups can't be erased at the time of the request but will be deleted on restoration" up front during the signup of the user, this is already an improvement over the past where nobody knew what happened with their data.
- zorga 8y ago
  And all of those demands are an unreasonable burden on businesses. Fuck the GDPR, they have no more authority over me than China or North Korea does.
  - robdachshund 8y ago
    And others would say it is unreasonable for businesses to store user data without consent and with no way to remove it. Please explain why any arbitrary site should have the ability to store user data without consent and then refuse to delete sensitive information. Are you going to accept liability if that data is leaked? If I walk into a store, can they copy my drivers license and phone number without asking me, and then refuse to wipe my personal data from their systems? I sincerely fail to see the downside with GDPR unless you think you have some assumed right to personal user information. Why does a site need info from me if I do not even have an account? Why do so many sites now insist that simply by visiting I agree to let them store cookies on my device?
johnwyles 8y ago
It's not CCP? Because Iceland is not a member of the EU although I suppose they could be subject to this somehow(?)
- tallanvor 8y ago
  Iceland is part of the EEA and is actually subject to EU rules in order to maintain single market access.
JumpCrisscross 8y ago
> They will be forced to either shutdown, or be in breach of law Or just block EU traffic and ensure no seizable assets rest in the bloc.
- deleted 8y ago
  [deleted]
entity345 8y ago
It should be noted that the right of access to personal data held about new is not new to GDPR and has been law in Europe for years. Likewise, existing law requires personal data are not to be kept longer than necessary. For example, in the UK both of the above are law since 1998. And that only implements an EU Directive from 1995. Sometimes I feel that the main effect of the publicity around the GDPR has been for many people to discover existing laws...
Pristina 8y ago
regulation leads to less freedom. yes, it is known.
geocar 8y ago
> On a semi-related note: if you are a small SASS operator wanting to comply with such requests, what are you meant to do about your DB backups that contain data that is meant to be forgotten? You record that these people need to be scrubbed if you restore backups, and you delete old backups. The ICO has excellent guidance on this and other subjects: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/guide-to-data-protectio... > This will have a silencing effect for people wanting to operate non-profit sites as they won't be able to afford to comply with such requests I can't understand what your question is. There's absolutely no reason someone can delete spam from their public forum, but can't delete people's phone numbers from items that are pointed out to them. If they have no search capabilities, and don't use a search capability, they're not required to create one. The GDPR is extremely easy to comply with- European companies have been doing it for a long time (before it gained the force it has now) because it's largely a unification of existing data protection laws.
- gaius 8y ago
  The GDPR is extremely easy to comply with It’s really just a slight mental shift. Instead of seeing data as an asset see it as a liability. Once you do that everything comes naturally.
davidgerard 8y ago
quick guide for sysadmins: what I actually do https://reddragdiva.dreamwidth.org/606812.html https://reddragdiva.dreamwidth.org/606812.html
lmm 8y ago
> Perhaps some people will say "good, if you cannot run a site conforming to all laws of the land then you should shutdown". If you think that, consider this: as these laws pile up it will get more and more difficult to operate, leaving only the very tech/law savvy, and big business. Some things are too dangerous to the public to allow part-time hobbyists to do. We don't allow part-time hobby doctors, or lawyers, or banks, or toxic waste disposal services, and most of us think that's the correct tradeoff. GDPR puts processing people's personal data in the same category; given how much damage a careless processor of personal data can cause, that seems appropriate.
- pjc50 8y ago
  You realise this is equivalent to "the decentralised social web cannot be allowed to exist", and heading in the direction of "the public cannot be allowed general purpose computers"? Like with almost every other Directive, the EU has made a huge mistake by not including de minimis exemptions in the regulation. In practice this isn't a problem in most countries because there isn't enforcement against tiny operators either, but the fear and confusion it creates is very real. (On the other hand, without this kind of thing you get phone companies selling your real-time location to criminals. If only there were such a thing as a sense of proportion)
  - lmm 8y ago
    > You realise this is equivalent to "the decentralised social web cannot be allowed to exist" I'd put it as: the decentralised social web cannot be allowed to exist unless and until a way to do robust privacy enforcement on it can be found. > and heading in the direction of "the public cannot be allowed general purpose computers" Slippery slope fallacy. GDPR exists not out of some abstract desire to regulate but as a response to the massive privacy breaches that have directly affected the general public. If and when general purpose computers are shown to have a similar negative effect on society, we can have a conversation about whether regulating them is appropriate given the costs and benefits of doing so.
  - jdietrich 8y ago
    >Like with almost every other Directive, the EU has made a huge mistake by not including de minimis exemptions in the regulation. Proportionality in the GDPR is based on the scale and sensitivity of your data activities. The size of your organisation or your technical capability is irrelevant; if you're not competent to safeguard the data you handle in accordance with the law, the EU doesn't want you to handle it. It's exactly the same principle we'd apply to toxic waste - you're not allowed to dump it in the woods just because you're a small business or a hobbyist. Some examples of why there is no de minimis exemption: A small charity accidentally sent a newsletter using "to" rather than "bcc". In doing so, it accidentally revealed the identities of 56 people who are HIV positive. It was fined £250 by the Information Commissioner's Office, because of the small size of the organisation and because the ICO was satisfied with steps taken to prevent further breaches. https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2015/12/ico-fines-hiv-patient-support-service-for-data-breach/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... A non-profit trade organisation with a single employee worked to facilitate information sharing between construction companies. That information consisted of files on trade unionists, political activists and advocates for health and safety, constituting an effective blacklist of "known troublemakers". The organisation's files were seized by the Information Commissioner's Office, leading to enforcement notices against 14 construction businesses; settlements under the Data Protection Act totalled over £50m. https://en.wikipedia.org/wiki/Consulting_Association https://en.wikipedia.org/wiki/Consulting_Association
Svoka 8y ago
I don't want my private info be gathered by people who have no idea what they're doing. I understand that there's forums/websites run by people who have no idea what they're doing. And regulations like GDPR make sure that services they are using have baseline encryption and guarantees. Like, it should encrypt passwords and private data, don't store it if not necessary and have functionality to delete users. It is not about people running the websites/forums, it is about software they are choosing to use. Baseline should not be "it works", but it should be "it works and provide reasonable level of security". I know it is some work on part of people who have no idea what they're doing, but ultimately it is up to developers to set up CMS and forum engines to comply.

by zizee 8y ago

ThePhysicist 8y ago

I think most of the larger forum software providers have implemented functions to comply with GDPR (i.e. delete, restrict and extract user data). Concerning backups: If you have a short turnaround time (e.g. 14 days) it shouldn’t be a problem, the legislation acknowledges the fact that deleting data and ensuring data integrity (also in accordance with GDPR) are sometimes mutually exclusive from a practical point of view. You need to make sure that deletion requests also get honored when restoring from backup though, so ideally you want to store the requests in a third system and check them when you restore backups. Concerning the democratic aspect of participating in the online world I think GDPR actually helps, as before it was not possible to reliably get your own data deleted, rectified or transferred, which is not very democratic either IMHO.

zizee 8y ago
Thank you for your thoughtful response and information. I need time to digest this information to see how it affects my opinions, which might take longer than the half life of this discussion, so my apologies in advance for probably not responding :-)
scoot_718 8y ago
Lots of software has functionality most users can't use. You might as well tell them that compilers can provide the functions necessary to comply.
- peteretep 8y ago
  > Lots of software has functionality most users can't use If you are using software to process my personal data, and you don't know how to do that while protecting my personal data, then I'd like you to stop using that software right away.
DoubleGlazing 8y ago
>Concerning the democratic aspect of participating in the online world I think GDPR actually helps, as before it was not possible to reliably get your own data deleted, rectified or transferred, which is not very democratic either IMHO This is where the GDPR has really helped me. I posted a comment on a blog critical of a government data sharing initiative. Nothing illegal, or questionable - it was a simple two sentence opinion comment which I posted under my real name. I didn't stop to think for a minute that it would cause me any problems. It did. I discovered that I couldn't get to work on any government projects because when a background check was carried out on me, the above comment was found and according to Revenue (the gov agency responsible for such checks) it indicated that I was hostile to the governments IT plans. I asked the blog owner (same country as me) to please remove the comment, they refused. So I submitted a right to be forgotten request to Google to stop the blog post appearing in searches for my name.
- theelous3 8y ago
  Ireland? In Ireland, civil servants are not allowed to express political affiliation or opinion, so rather than it being a case of "we don't like what you said", it would be a case of "you said something political, and it persists." I'm not sure if the contract for Revenue is exactly the same as the civil service, but I would presume on this front it is very similar.
  - DoubleGlazing 8y ago
    Yep. There have been three occasions where the IT contracting firm I was working for sent me to work on government IT projects as a contractor. None of them were for Revenue, but it is Revenue who do these checks for all other departments. On one occasion my employer managed to pull a few strings to get me on the project (DSP), on the other two I was told no government work for me (HSE and DoT). On one of the three three occasions I was forwarded an email from Revenue that said "he expresses a desire for personal privacy that indicates he would be unwilling to fully embrace the governments data sharing strategy". I did write to a few news outlets about this, none were interested. Even the ICCL wasn't interested, which really surprised me.
- 8y ago

zizee 8y ago

Responding to myself: Of course, this could have been the intention all along. It has long been recognized that big business loves difficult to conform with regulations (regardless of their protestations otherwise) because it is hard for smaller competitors to breach the effective moat that heavy/complex regulations provide incumbents.

johannes1234321 8y ago
It is quite easy to comply with GDPR - store as little data as needed - protect the data in state of the art ways - make transparent what you store and process and why - establish a process to delete data once it's not needed anymore It is only complicated if you want to build a company around the abuse of data, as common in the ad world.
- piokoch 8y ago
  How about "data accuracy" - you are obliged to make sure that data you store are accurate and be able to prove that you've asked users to confirm that data are accurate. How about the duty to export user data on request? How about player consent management? Consent updates, etc. Those are not simple thing neither to implement nor to manage, especially if someone will accuse you and you need to prove that you are compliant.

brylie 8y ago

Re: the backups. Rolling backups, e.g daily and weekly, are fairly common. When the request comes in, just acknowledge there will be a time period before the deletion is fully purged from system backups - as is still legal post-GDPR. The user data will still be removed from production data, which is of primary concern.

belorn 8y ago

Backups has many potential exceptions, some being security and archiving for the public, but there is also language like reasonable steps and to not have the data influence any future decisions. But backups has to be stored securely, and the data within can't naturally be used if restored beyond exceptions.

bhaak 8y ago

> [...] it seems to me that an unintended consequence is that non-technical people hosting forums/blogs etc. will be at risk of GDPR requests that they cannot comply with due to lack of technical skills [...] If it's only due to technical skills then this problem can be solved technically. The forum software needs to enable people to be GDPR compliant. > On a semi-related note: if you are a small SASS operator wanting to comply with such requests, what are you meant to do about your DB backups that contain data that is meant to be forgotten? This hasn't been tested in court, yet. But there are several possible approaches. Like delete on restoration or backing up in slices, so that the personal data becomes anonymous unless you have all the parts. Don't forget that the "right to be forgotten" is not an absolute right. It doesn't trump everything else. Nobody would expect somebody to sue ESA for their "right to be forgotten" for a public message that they could send to ESA to put on a CD on a probe they sent into space and win. First of all, it forces everybody involved with personal data to think about how they handle personal data and inform the users about that. If you state "due to technical limitations, your personal data in backups can't be erased at the time of the request but will be deleted on restoration" up front during the signup of the user, this is already an improvement over the past where nobody knew what happened with their data.

zorga 8y ago
And all of those demands are an unreasonable burden on businesses. Fuck the GDPR, they have no more authority over me than China or North Korea does.
- robdachshund 8y ago
  And others would say it is unreasonable for businesses to store user data without consent and with no way to remove it. Please explain why any arbitrary site should have the ability to store user data without consent and then refuse to delete sensitive information. Are you going to accept liability if that data is leaked? If I walk into a store, can they copy my drivers license and phone number without asking me, and then refuse to wipe my personal data from their systems? I sincerely fail to see the downside with GDPR unless you think you have some assumed right to personal user information. Why does a site need info from me if I do not even have an account? Why do so many sites now insist that simply by visiting I agree to let them store cookies on my device?

johnwyles 8y ago

It's not CCP? Because Iceland is not a member of the EU although I suppose they could be subject to this somehow(?)

tallanvor 8y ago
Iceland is part of the EEA and is actually subject to EU rules in order to maintain single market access.

JumpCrisscross 8y ago

> They will be forced to either shutdown, or be in breach of law Or just block EU traffic and ensure no seizable assets rest in the bloc.

deleted 8y ago
[deleted]

entity345 8y ago

It should be noted that the right of access to personal data held about new is not new to GDPR and has been law in Europe for years. Likewise, existing law requires personal data are not to be kept longer than necessary. For example, in the UK both of the above are law since 1998. And that only implements an EU Directive from 1995. Sometimes I feel that the main effect of the publicity around the GDPR has been for many people to discover existing laws...

Pristina 8y ago

regulation leads to less freedom. yes, it is known.

geocar 8y ago

> On a semi-related note: if you are a small SASS operator wanting to comply with such requests, what are you meant to do about your DB backups that contain data that is meant to be forgotten? You record that these people need to be scrubbed if you restore backups, and you delete old backups. The ICO has excellent guidance on this and other subjects: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/guide-to-data-protectio... > This will have a silencing effect for people wanting to operate non-profit sites as they won't be able to afford to comply with such requests I can't understand what your question is. There's absolutely no reason someone can delete spam from their public forum, but can't delete people's phone numbers from items that are pointed out to them. If they have no search capabilities, and don't use a search capability, they're not required to create one. The GDPR is extremely easy to comply with- European companies have been doing it for a long time (before it gained the force it has now) because it's largely a unification of existing data protection laws.

gaius 8y ago
The GDPR is extremely easy to comply with It’s really just a slight mental shift. Instead of seeing data as an asset see it as a liability. Once you do that everything comes naturally.

davidgerard 8y ago

quick guide for sysadmins: what I actually do https://reddragdiva.dreamwidth.org/606812.html https://reddragdiva.dreamwidth.org/606812.html

lmm 8y ago

> Perhaps some people will say "good, if you cannot run a site conforming to all laws of the land then you should shutdown". If you think that, consider this: as these laws pile up it will get more and more difficult to operate, leaving only the very tech/law savvy, and big business. Some things are too dangerous to the public to allow part-time hobbyists to do. We don't allow part-time hobby doctors, or lawyers, or banks, or toxic waste disposal services, and most of us think that's the correct tradeoff. GDPR puts processing people's personal data in the same category; given how much damage a careless processor of personal data can cause, that seems appropriate.

pjc50 8y ago
You realise this is equivalent to "the decentralised social web cannot be allowed to exist", and heading in the direction of "the public cannot be allowed general purpose computers"? Like with almost every other Directive, the EU has made a huge mistake by not including de minimis exemptions in the regulation. In practice this isn't a problem in most countries because there isn't enforcement against tiny operators either, but the fear and confusion it creates is very real. (On the other hand, without this kind of thing you get phone companies selling your real-time location to criminals. If only there were such a thing as a sense of proportion)
- lmm 8y ago
  > You realise this is equivalent to "the decentralised social web cannot be allowed to exist" I'd put it as: the decentralised social web cannot be allowed to exist unless and until a way to do robust privacy enforcement on it can be found. > and heading in the direction of "the public cannot be allowed general purpose computers" Slippery slope fallacy. GDPR exists not out of some abstract desire to regulate but as a response to the massive privacy breaches that have directly affected the general public. If and when general purpose computers are shown to have a similar negative effect on society, we can have a conversation about whether regulating them is appropriate given the costs and benefits of doing so.
- jdietrich 8y ago
  >Like with almost every other Directive, the EU has made a huge mistake by not including de minimis exemptions in the regulation. Proportionality in the GDPR is based on the scale and sensitivity of your data activities. The size of your organisation or your technical capability is irrelevant; if you're not competent to safeguard the data you handle in accordance with the law, the EU doesn't want you to handle it. It's exactly the same principle we'd apply to toxic waste - you're not allowed to dump it in the woods just because you're a small business or a hobbyist. Some examples of why there is no de minimis exemption: A small charity accidentally sent a newsletter using "to" rather than "bcc". In doing so, it accidentally revealed the identities of 56 people who are HIV positive. It was fined £250 by the Information Commissioner's Office, because of the small size of the organisation and because the ICO was satisfied with steps taken to prevent further breaches. https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2015/12/ico-fines-hiv-patient-support-service-for-data-breach/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... A non-profit trade organisation with a single employee worked to facilitate information sharing between construction companies. That information consisted of files on trade unionists, political activists and advocates for health and safety, constituting an effective blacklist of "known troublemakers". The organisation's files were seized by the Information Commissioner's Office, leading to enforcement notices against 14 construction businesses; settlements under the Data Protection Act totalled over £50m. https://en.wikipedia.org/wiki/Consulting_Association https://en.wikipedia.org/wiki/Consulting_Association

Svoka 8y ago

I don't want my private info be gathered by people who have no idea what they're doing. I understand that there's forums/websites run by people who have no idea what they're doing. And regulations like GDPR make sure that services they are using have baseline encryption and guarantees. Like, it should encrypt passwords and private data, don't store it if not necessary and have functionality to delete users. It is not about people running the websites/forums, it is about software they are choosing to use. Baseline should not be "it works", but it should be "it works and provide reasonable level of security". I know it is some work on part of people who have no idea what they're doing, but ultimately it is up to developers to set up CMS and forum engines to comply.