4 ms·

I don't view GDPR to be quite as useless as the author does, but the point about the user having to protect their data themselves is spot on. GDPR only protects

I don't view GDPR to be quite as useless as the author does, but the point about the user having to protect their data themselves is spot on. GDPR only protects you against good actors that are under EU jurisdiction. Everyone else could very well be doing whatever they want with the data you leak. The EU can't fine a Chinese company if the Chinese company has no presence in the EU. Another thing the author doesn't mention is that GDPR sets a minimum amount of cost/effort to run a website that's way beyond the actual hardware cost and the cost of making the website itself. It requires every website operator to be familiar with how GDPR works, because you need to know whether you're collecting personal data (you probably are) and how you need to handle it. Furthermore, if you are collecting personal data then you must respond to emails of users who request to know what data you know about them within a set amount of time. In the case of a small website, such as a forum or blog, I would consider the cost imposed by GDPR to be greater than the cost of making the website itself and renting hardware to run it. I think it disproportionately impacts smaller sites. It essentially leads to small sites simply breaking the law and hoping that nobody complains about them.

marcinzm 8y ago
That's the general issue with regulation, it protects the existing large players in a space by adding a higher barrier to entry for competitors. So now instead of hosting your own forum or website you'll use Squarespace or Discord or Disqus instead.
- pas 8y ago
  You can host your own forum. And if you do it as purely personal activity, then GDPR does not apply.
  - Mirioron 8y ago
    Is running a forum a purely personal activity? I'm not so sure. It certainly won't be if you have any third party services running on it.
    - pas 8y ago
      Why not? You can set up a family forum, to share stories, pictures, etc. That's household-y and personal. Fits the definition from the law pretty well. There's some thinking about what constitutes purely personal activity ( https://ec.europa.eu/justice/article-29/documentation/other-document/files/2013/20130227_statement_dp_annex2_en.pdf https://ec.europa.eu/justice/article-29/documentation/other-... ) usually the test is whether it can potentially reach anyone in the public, is some financial/professional gain for the operator, etc. > I'm not so sure. It certainly won't be if you have any third party services running on it. Those are handled in the text too. Basically the controller / provider / operator of said 3rd party service has to be GDPR compliant, not the user. (So if you fire up a WordPress blog, you probably don't have to worry about it.)
  - marcinzm 8y ago
    As I read it specifically doesn't cover things which are not economic activities and not professional activities. You running a website yourself and not as business may or may not fall into that. It is not necessarily the colloquial definition of personal. A personal website may have donations, may have ads, may act as advertising for your professional career, may be used to find jobs for yourself, may be used by people to trade items to each other, etc, etc. Those may be covered by GDPR and without a lawyer (ie: money) I have no idea.
pas 8y ago
First of all, GDPR does not apply to personal sites. ( https://law.stackexchange.com/a/28086 https://law.stackexchange.com/a/28086 - see current "in force" version of the directive: https://eur-lex.europa.eu/eli/reg/2016/679/oj https://eur-lex.europa.eu/eli/reg/2016/679/oj see recital 18) > [...] GDPR sets a minimum amount of cost/effort to run a website [...] This is simply false. If you want to post something on the 'net, nothing changes. You want to count page downloads? (You know those old school CGI counters.) Nothing changes. You want to know how many individual visits you got? Well, you need to try to distinguish between new and returning visitors, hence you might put a cookie on the visitor's browser/client/useragent, now you need to ask nicely, because it's eerily easy to use that cookie for a lot of other purposes. (Similarly if you would try to use something else, like IP address, and/or browser fingerprinting.) And so on. Yes, I like pretty graphs about visitors (browser screen size distribution, fancy geoip charts, etc), but so do the people that live off the not so innocent usage of this kind of data. And yes, if you collect personal data, then you should be able to protect it. This was always the case, GDPR simply states this and tries to create a mechanism that forces data holders to act accordingly (via the mandatory data breach reporting). Again, similarly, if you handle a lot of data you should be able to accurately take a stock of what kind of data you have about whom, hence the requirement to respond to these inquiries. > I think it disproportionately impacts smaller sites. Agreed. But small sites were always at the mercy of random script kiddies. They always lacked resources to properly handle updates/upgrades, security, data, end-of-life termination, etc. GDPR at least makes WordPress, discourse, and random blog and forum engines able to deal with the reality of how much value their databases represent nowadays.
- Mirioron 8y ago
  >First of all, GDPR does not apply to personal sites. And next to no websites actually fall under this exemption. Furthermore, simply to know that your website falls under this exemption comes with the cost. You must know that your website falls under this exemption, requiring you to know GDPR and/or requiring a lawyer to look it over (high cost). >This is simply false. If you want to post something on the 'net, nothing changes. Simply having to know what GDPR is, what it covers, and whether you fall under it has a cost. So the statement that nothing changes is patently false. Also, I'm pretty sure that by default most software that serves websites would already put you under GDPR, because it collects IP addresses and they're considered personal data. >Agreed. But small sites were always at the mercy of random script kiddies. They always lacked resources to properly handle updates/upgrades, security, data, end-of-life termination, etc. So, because there were other limiting factors for them we might as well make it illegal to run such websites? I guess I can understand why the EU's tech sector is doing so poorly. >Again, similarly, if you handle a lot of data you should be able to accurately take a stock of what kind of data you have about whom, hence the requirement to respond to these inquiries. But it's not about that. It's "if you handle any data then you must constantly be available to tell users what data you have about them". This, ironically, puts people's data at risk, because suddenly you forced website owners to reply to phishing requests. What's the chance that every single website owner everywhere never gives out personal data to the wrong person? I would say that that chance is effectively zero.

marcinzm 8y ago

That's the general issue with regulation, it protects the existing large players in a space by adding a higher barrier to entry for competitors. So now instead of hosting your own forum or website you'll use Squarespace or Discord or Disqus instead.

pas 8y ago
You can host your own forum. And if you do it as purely personal activity, then GDPR does not apply.
- Mirioron 8y ago
  Is running a forum a purely personal activity? I'm not so sure. It certainly won't be if you have any third party services running on it.
  - pas 8y ago
    Why not? You can set up a family forum, to share stories, pictures, etc. That's household-y and personal. Fits the definition from the law pretty well. There's some thinking about what constitutes purely personal activity ( https://ec.europa.eu/justice/article-29/documentation/other-document/files/2013/20130227_statement_dp_annex2_en.pdf https://ec.europa.eu/justice/article-29/documentation/other-... ) usually the test is whether it can potentially reach anyone in the public, is some financial/professional gain for the operator, etc. > I'm not so sure. It certainly won't be if you have any third party services running on it. Those are handled in the text too. Basically the controller / provider / operator of said 3rd party service has to be GDPR compliant, not the user. (So if you fire up a WordPress blog, you probably don't have to worry about it.)
- marcinzm 8y ago
  As I read it specifically doesn't cover things which are not economic activities and not professional activities. You running a website yourself and not as business may or may not fall into that. It is not necessarily the colloquial definition of personal. A personal website may have donations, may have ads, may act as advertising for your professional career, may be used to find jobs for yourself, may be used by people to trade items to each other, etc, etc. Those may be covered by GDPR and without a lawyer (ie: money) I have no idea.

pas 8y ago

First of all, GDPR does not apply to personal sites. ( https://law.stackexchange.com/a/28086 https://law.stackexchange.com/a/28086 - see current "in force" version of the directive: https://eur-lex.europa.eu/eli/reg/2016/679/oj https://eur-lex.europa.eu/eli/reg/2016/679/oj see recital 18) > [...] GDPR sets a minimum amount of cost/effort to run a website [...] This is simply false. If you want to post something on the 'net, nothing changes. You want to count page downloads? (You know those old school CGI counters.) Nothing changes. You want to know how many individual visits you got? Well, you need to try to distinguish between new and returning visitors, hence you might put a cookie on the visitor's browser/client/useragent, now you need to ask nicely, because it's eerily easy to use that cookie for a lot of other purposes. (Similarly if you would try to use something else, like IP address, and/or browser fingerprinting.) And so on. Yes, I like pretty graphs about visitors (browser screen size distribution, fancy geoip charts, etc), but so do the people that live off the not so innocent usage of this kind of data. And yes, if you collect personal data, then you should be able to protect it. This was always the case, GDPR simply states this and tries to create a mechanism that forces data holders to act accordingly (via the mandatory data breach reporting). Again, similarly, if you handle a lot of data you should be able to accurately take a stock of what kind of data you have about whom, hence the requirement to respond to these inquiries. > I think it disproportionately impacts smaller sites. Agreed. But small sites were always at the mercy of random script kiddies. They always lacked resources to properly handle updates/upgrades, security, data, end-of-life termination, etc. GDPR at least makes WordPress, discourse, and random blog and forum engines able to deal with the reality of how much value their databases represent nowadays.

Mirioron 8y ago
>First of all, GDPR does not apply to personal sites. And next to no websites actually fall under this exemption. Furthermore, simply to know that your website falls under this exemption comes with the cost. You must know that your website falls under this exemption, requiring you to know GDPR and/or requiring a lawyer to look it over (high cost). >This is simply false. If you want to post something on the 'net, nothing changes. Simply having to know what GDPR is, what it covers, and whether you fall under it has a cost. So the statement that nothing changes is patently false. Also, I'm pretty sure that by default most software that serves websites would already put you under GDPR, because it collects IP addresses and they're considered personal data. >Agreed. But small sites were always at the mercy of random script kiddies. They always lacked resources to properly handle updates/upgrades, security, data, end-of-life termination, etc. So, because there were other limiting factors for them we might as well make it illegal to run such websites? I guess I can understand why the EU's tech sector is doing so poorly. >Again, similarly, if you handle a lot of data you should be able to accurately take a stock of what kind of data you have about whom, hence the requirement to respond to these inquiries. But it's not about that. It's "if you handle any data then you must constantly be available to tell users what data you have about them". This, ironically, puts people's data at risk, because suddenly you forced website owners to reply to phishing requests. What's the chance that every single website owner everywhere never gives out personal data to the wrong person? I would say that that chance is effectively zero.