5 ms·

> [...] it seems to me that an unintended consequence is that non-technical people hosting forums/blogs etc. will be at risk of GDPR requests that they cannot c

by bhaak 8y ago

> [...] it seems to me that an unintended consequence is that non-technical people hosting forums/blogs etc. will be at risk of GDPR requests that they cannot comply with due to lack of technical skills [...] If it's only due to technical skills then this problem can be solved technically. The forum software needs to enable people to be GDPR compliant. > On a semi-related note: if you are a small SASS operator wanting to comply with such requests, what are you meant to do about your DB backups that contain data that is meant to be forgotten? This hasn't been tested in court, yet. But there are several possible approaches. Like delete on restoration or backing up in slices, so that the personal data becomes anonymous unless you have all the parts. Don't forget that the "right to be forgotten" is not an absolute right. It doesn't trump everything else. Nobody would expect somebody to sue ESA for their "right to be forgotten" for a public message that they could send to ESA to put on a CD on a probe they sent into space and win. First of all, it forces everybody involved with personal data to think about how they handle personal data and inform the users about that. If you state "due to technical limitations, your personal data in backups can't be erased at the time of the request but will be deleted on restoration" up front during the signup of the user, this is already an improvement over the past where nobody knew what happened with their data.

zorga 8y ago
And all of those demands are an unreasonable burden on businesses. Fuck the GDPR, they have no more authority over me than China or North Korea does.
- robdachshund 8y ago
  And others would say it is unreasonable for businesses to store user data without consent and with no way to remove it. Please explain why any arbitrary site should have the ability to store user data without consent and then refuse to delete sensitive information. Are you going to accept liability if that data is leaked? If I walk into a store, can they copy my drivers license and phone number without asking me, and then refuse to wipe my personal data from their systems? I sincerely fail to see the downside with GDPR unless you think you have some assumed right to personal user information. Why does a site need info from me if I do not even have an account? Why do so many sites now insist that simply by visiting I agree to let them store cookies on my device?
  - zorga 8y ago
    I can store anything you give me; that you exposed me to it is consent, it's not your data unless you keep it to yourself. When you walk around a public space, you don't get to control who looks at you and logs it. The products of my labor are mine, and that includes whatever I log in public spaces.
    - robin_reala 8y ago
      Even in the US which is hardly a bastion of consumer privacy that’s not true. If you as a hotel owner stick cameras in every shower you should expect a set of lawsuits, even though that’s your property and the people have knowingly bought a service from you.
      - zorga 8y ago
        A hotel room is not a public space.
        robin_reala 8y ago
        Neither is a store or a website, which were the examples used. But we can translate the same example given to public spaces easily: you install a hidden camera in a grating in a public square and take upskirt shots of women walking over. That’s illegal at a federal level in the US so people absolutely have a legal right to control your ability to do that.
        zorga 8y ago
        Wrong, a store is a public place, they have cameras, more to the point I can take a photo of you in a store and you can't stop me nor do you own it. > take upskirt shots of women walking over. That’s illegal at a federal level in the US Only since 2004, and that's a specific exception that was made and only applies when there is a clear expectation of privacy, i.e. wearing clothes to cover your privates is a clear indication you expect that to be private. That doesn't stop anyone from taking pictures of you you don't like though and it only makes the area under your clothes a private space, it doesn't make the public space your in a private place.
- gambiting 8y ago
  >> Fuck the GDPR, they have no more authority over me than China or North Korea does. You are probably not trading with North Korea, so ignoring their laws has zero impact on anything. China is already getting more tricky though, although they are not choosing to throw their entire weight behind enforcing their demands abroad(yet). But ignoring the demands of the largest trading block on the planet? That's not going to go well if you do any sort of business with the EU. Unless you can just afford to ignore all EU customers entirely. And no, thank fuck for the GDPR, it's a great legislation.
  - zorga 8y ago
    The EU is not a single trading block; it's many many individual trading blocks all different cultures and languages; the US is the single largest trading block in the world. And no, the GDPR is awful legislation, the notion that every foreign country can simply declare jurisdiction over other countries citizens violates national sovereignty is and flat out disgusting and will not stand.
    - gambiting 8y ago
      1) you're simply wrong, or just don't understand the meaning of the word trading block: https://inshorts.com/m/en/news/european-union-is-worlds-largest-trading-block-1466608087384 https://inshorts.com/m/en/news/european-union-is-worlds-larg... 2) I don't think you understand how GDPR works at all. GDPR says how data about EU citizens has to be processed in a certain way. If you want to do business with EU, you have to comply. If you don't want to comply, you don't get to trade with EU. No one is claiming jurisdiction over other countries - it's simply a matter of agreements. Just like EU respects certain American laws just because it wants to trade with USA and it was requested. It's a mutual thing.
      - zorga 8y ago
        I was quite clear what I meant by trading block, I wasn't aware that was a specific term of art, but that's not what I meant regardless and that's clear from my response. I understand it just fine, perhaps you don't understand what I'm saying. No, if an EU citizen comes to my US website, that does not grant the EU authority over me no matter what they claim. I live under US law, not EU law, not Chinese law, not North Korean law. Those countries are free to pass laws claiming they have jurisdiction over me when I do business with their citizens, but claiming it doesn't make it true. No I do not have to comply, the EU has zero authority over me no matter who I do business with _unless_ I'm in the EU where they can do something about it. They can attempt to stop their citizens from using my website, but it is not upon me to do so. There is no agreement between the US and the EU to respect the GDPR, it's an untested assertion of global authority that cannot stand. The world cannot function if every country can assert every citizen in the world must comply with its laws because their citizens came to my US website. That's a violation of national sovereignty and it will fail when the EU tries to assert that authority and the US courts say, sorry, but no, you don't have jurisdiction over our citizens which is what's going to happen. The EU can and will enforce the GDPR within its borders, that's expected; outside its borders, it has no jurisdiction and no teeth; I don't have to give a damn about EU law while operating my US business in the US. That a visitor comes from someone outside the US does not change that my business is in the US. I do not have to obey other countries laws.
- peteretep 8y ago
  > Fuck the GDPR, they have no more authority over me than China or North Korea does Good luck with that champ
- dspillett 8y ago
  If your business wants to collect my data without providing the safety measures GDPR provides, then fuck your business, I don't want to deal with it or you. Of course if your business doesn't collect our data, there is no issue either way.
  - zorga 8y ago
    Nor do I want to deal with you, so good riddance.
    - dspillett 8y ago
      Excellent. The system works!
- ionised 8y ago
  If this is your attitude, then your business is an unreasonable burden on me and I hope you go under.

by bhaak 8y ago

zorga 8y ago

And all of those demands are an unreasonable burden on businesses. Fuck the GDPR, they have no more authority over me than China or North Korea does.

robdachshund 8y ago
And others would say it is unreasonable for businesses to store user data without consent and with no way to remove it. Please explain why any arbitrary site should have the ability to store user data without consent and then refuse to delete sensitive information. Are you going to accept liability if that data is leaked? If I walk into a store, can they copy my drivers license and phone number without asking me, and then refuse to wipe my personal data from their systems? I sincerely fail to see the downside with GDPR unless you think you have some assumed right to personal user information. Why does a site need info from me if I do not even have an account? Why do so many sites now insist that simply by visiting I agree to let them store cookies on my device?
- zorga 8y ago
  I can store anything you give me; that you exposed me to it is consent, it's not your data unless you keep it to yourself. When you walk around a public space, you don't get to control who looks at you and logs it. The products of my labor are mine, and that includes whatever I log in public spaces.
  - robin_reala 8y ago
    Even in the US which is hardly a bastion of consumer privacy that’s not true. If you as a hotel owner stick cameras in every shower you should expect a set of lawsuits, even though that’s your property and the people have knowingly bought a service from you.
    - zorga 8y ago
      A hotel room is not a public space.
      - robin_reala 8y ago
        Neither is a store or a website, which were the examples used. But we can translate the same example given to public spaces easily: you install a hidden camera in a grating in a public square and take upskirt shots of women walking over. That’s illegal at a federal level in the US so people absolutely have a legal right to control your ability to do that.
        zorga 8y ago
        Wrong, a store is a public place, they have cameras, more to the point I can take a photo of you in a store and you can't stop me nor do you own it. > take upskirt shots of women walking over. That’s illegal at a federal level in the US Only since 2004, and that's a specific exception that was made and only applies when there is a clear expectation of privacy, i.e. wearing clothes to cover your privates is a clear indication you expect that to be private. That doesn't stop anyone from taking pictures of you you don't like though and it only makes the area under your clothes a private space, it doesn't make the public space your in a private place.
gambiting 8y ago
>> Fuck the GDPR, they have no more authority over me than China or North Korea does. You are probably not trading with North Korea, so ignoring their laws has zero impact on anything. China is already getting more tricky though, although they are not choosing to throw their entire weight behind enforcing their demands abroad(yet). But ignoring the demands of the largest trading block on the planet? That's not going to go well if you do any sort of business with the EU. Unless you can just afford to ignore all EU customers entirely. And no, thank fuck for the GDPR, it's a great legislation.
- zorga 8y ago
  The EU is not a single trading block; it's many many individual trading blocks all different cultures and languages; the US is the single largest trading block in the world. And no, the GDPR is awful legislation, the notion that every foreign country can simply declare jurisdiction over other countries citizens violates national sovereignty is and flat out disgusting and will not stand.
  - gambiting 8y ago
    1) you're simply wrong, or just don't understand the meaning of the word trading block: https://inshorts.com/m/en/news/european-union-is-worlds-largest-trading-block-1466608087384 https://inshorts.com/m/en/news/european-union-is-worlds-larg... 2) I don't think you understand how GDPR works at all. GDPR says how data about EU citizens has to be processed in a certain way. If you want to do business with EU, you have to comply. If you don't want to comply, you don't get to trade with EU. No one is claiming jurisdiction over other countries - it's simply a matter of agreements. Just like EU respects certain American laws just because it wants to trade with USA and it was requested. It's a mutual thing.
    - zorga 8y ago
      I was quite clear what I meant by trading block, I wasn't aware that was a specific term of art, but that's not what I meant regardless and that's clear from my response. I understand it just fine, perhaps you don't understand what I'm saying. No, if an EU citizen comes to my US website, that does not grant the EU authority over me no matter what they claim. I live under US law, not EU law, not Chinese law, not North Korean law. Those countries are free to pass laws claiming they have jurisdiction over me when I do business with their citizens, but claiming it doesn't make it true. No I do not have to comply, the EU has zero authority over me no matter who I do business with _unless_ I'm in the EU where they can do something about it. They can attempt to stop their citizens from using my website, but it is not upon me to do so. There is no agreement between the US and the EU to respect the GDPR, it's an untested assertion of global authority that cannot stand. The world cannot function if every country can assert every citizen in the world must comply with its laws because their citizens came to my US website. That's a violation of national sovereignty and it will fail when the EU tries to assert that authority and the US courts say, sorry, but no, you don't have jurisdiction over our citizens which is what's going to happen. The EU can and will enforce the GDPR within its borders, that's expected; outside its borders, it has no jurisdiction and no teeth; I don't have to give a damn about EU law while operating my US business in the US. That a visitor comes from someone outside the US does not change that my business is in the US. I do not have to obey other countries laws.
peteretep 8y ago
> Fuck the GDPR, they have no more authority over me than China or North Korea does Good luck with that champ
dspillett 8y ago
If your business wants to collect my data without providing the safety measures GDPR provides, then fuck your business, I don't want to deal with it or you. Of course if your business doesn't collect our data, there is no issue either way.
- zorga 8y ago
  Nor do I want to deal with you, so good riddance.
  - dspillett 8y ago
    Excellent. The system works!
ionised 8y ago
If this is your attitude, then your business is an unreasonable burden on me and I hope you go under.