3 ms·

> GDPR compliance can be extremely expensive to implement... Bullshit. It's trivial to implement. Don't store my personal data. Done. It may be extremely expe

by rlpb 7y ago

> GDPR compliance can be extremely expensive to implement... Bullshit. It's trivial to implement. Don't store my personal data. Done. It may be extremely expensive to store and process my personal data and remain GDPR compliant, if you insist on doing that. And admittedly it may be expensive to store and process others' personal data while excluding EU citizens from that mechanism. But the blanket statement "GDPR compliance can be extremely expensive to implement" is on its own extremely misleading in this context. > And imagine working in an industry where data retention is legally mandated by other jurisdictions... Perhaps, but this is not relevant to a news organisation publishing a general article online from the USA, where (AFAIK) there is no such data retention requirement in any jurisdiction within the USA.

sagebird 7y ago
It is not trivial for publishers who have years of adding advertising and analytics tools to their website to come up with a strategy for peeling these back or checking compliance. If I had a blog, it would be easy for me to check and decide what to remove or modify. But being part of an organization means that most of the shit on a publisher’s network is a manager’s baby project and is going to require meetings, ego stroking, and if you suggest a change then revenue drops, you will be prime suspect. Not to mention months of managers saying — “well we used to have this really great analytics platform that helped me steer this company but now I can’t do my job because so and so deactivated X”. For many of the tools you might have a contract with a company to provide service. They have people specifically hired to be persuasive calling your leadership to try to keep the relationship going, so they will fight to keep you as a customer. I think the interesting thing is that you can’t pass the buck, you are ultimately responsible for providing compliance, not just choosing tools that claim compliance.
- rlpb 7y ago
  > It is not trivial for publishers who have years of adding advertising, advertisement and analytics tools to their website to come up with a strategy for peeling these back or checking compliance. Correct. I did cover this when I said, in the post you are replying to: "...admittedly it may be expensive to store and process others' personal data while excluding EU citizens from that mechanism"
echelon 7y ago
> Bullshit. It's trivial to implement. Don't store my personal data. Done. Tell that to the dozens of engineers that spent months on GDPR compliance at my company. I personally spent two weeks making sure my systems had both export and deletion capability. These systems were engineered for soft delete data retention and maintaining change logs across writes. In several different databases. And offline data warehouses. And feeds consumed by downstream systems. > But the blanket statement "GDPR compliance can be extremely expensive to implement" is on its own extremely misleading in this context. You have no idea what you're talking about. Every system out there handling personal information needs to be re-engineered. Soft deletes, change logs, feeds, plumbing between microservices, data validation logic, primary keys and foreign keys with PII, on and on... it all needs to be changed to handle new APIs: delete and export. That requires a lot of work to do correctly and capture all of the surface area. > Perhaps, but this is not relevant to a news organisation publishing a general article online from the USA Maybe they can't afford to change things? Sure, they might be collecting too much information in order to sell ads, but they have to decide if the EU traffic is worth rebuilding what they already have in place. Don't take a gut value judgement about GDPR being the right thing to do and equate it to being inexpensive. It is not.
- nfoz 7y ago
  > Every system out there handling personal information needs to be re-engineered The complaint is that this website should not be handling any personal information. (Whether you agree with that or not.)
- inlined 7y ago
  News outlets have relied on advertising to make their content accessible and still profitable since the 1830s[0]. It would be in immense industry shift to change from and advertising based model. The GDPR also holds you liable for your outsourced work, which means that any ad network that serves a single malicious ad violating GDPR could make you violate the law. It’s a tough conflict. [0] https://en.m.wikipedia.org/wiki/Penny_press https://en.m.wikipedia.org/wiki/Penny_press
  - rlpb 7y ago

by rlpb 7y ago

sagebird 7y ago

It is not trivial for publishers who have years of adding advertising and analytics tools to their website to come up with a strategy for peeling these back or checking compliance. If I had a blog, it would be easy for me to check and decide what to remove or modify. But being part of an organization means that most of the shit on a publisher’s network is a manager’s baby project and is going to require meetings, ego stroking, and if you suggest a change then revenue drops, you will be prime suspect. Not to mention months of managers saying — “well we used to have this really great analytics platform that helped me steer this company but now I can’t do my job because so and so deactivated X”. For many of the tools you might have a contract with a company to provide service. They have people specifically hired to be persuasive calling your leadership to try to keep the relationship going, so they will fight to keep you as a customer. I think the interesting thing is that you can’t pass the buck, you are ultimately responsible for providing compliance, not just choosing tools that claim compliance.

rlpb 7y ago
> It is not trivial for publishers who have years of adding advertising, advertisement and analytics tools to their website to come up with a strategy for peeling these back or checking compliance. Correct. I did cover this when I said, in the post you are replying to: "...admittedly it may be expensive to store and process others' personal data while excluding EU citizens from that mechanism"

echelon 7y ago

> Bullshit. It's trivial to implement. Don't store my personal data. Done. Tell that to the dozens of engineers that spent months on GDPR compliance at my company. I personally spent two weeks making sure my systems had both export and deletion capability. These systems were engineered for soft delete data retention and maintaining change logs across writes. In several different databases. And offline data warehouses. And feeds consumed by downstream systems. > But the blanket statement "GDPR compliance can be extremely expensive to implement" is on its own extremely misleading in this context. You have no idea what you're talking about. Every system out there handling personal information needs to be re-engineered. Soft deletes, change logs, feeds, plumbing between microservices, data validation logic, primary keys and foreign keys with PII, on and on... it all needs to be changed to handle new APIs: delete and export. That requires a lot of work to do correctly and capture all of the surface area. > Perhaps, but this is not relevant to a news organisation publishing a general article online from the USA Maybe they can't afford to change things? Sure, they might be collecting too much information in order to sell ads, but they have to decide if the EU traffic is worth rebuilding what they already have in place. Don't take a gut value judgement about GDPR being the right thing to do and equate it to being inexpensive. It is not.

nfoz 7y ago
> Every system out there handling personal information needs to be re-engineered The complaint is that this website should not be handling any personal information. (Whether you agree with that or not.)
inlined 7y ago
News outlets have relied on advertising to make their content accessible and still profitable since the 1830s[0]. It would be in immense industry shift to change from and advertising based model. The GDPR also holds you liable for your outsourced work, which means that any ad network that serves a single malicious ad violating GDPR could make you violate the law. It’s a tough conflict. [0] https://en.m.wikipedia.org/wiki/Penny_press https://en.m.wikipedia.org/wiki/Penny_press
- rlpb 7y ago