6 ms·

> we don't have any special knowledge of what official government-issued ID looks like in every country where we have customers, nor the human resources or auto

> we don't have any special knowledge of what official government-issued ID looks like in every country where we have customers, nor the human resources or automated technology to investigate in detail whether any ID that is sent might be faked. This sounds like one of the risks of doing international business. If you can't follow the laws then don't play.

dmix 7y ago
OP sounds like he was trying hard to navigate and follow the law? The problem is he ended up finding no reasonable solution that both protected his users privacy while also following the rules, and was disturbed by the implications of it all considering it was supposed to protect them in the first place. Those are very valid criticisms. Simply dismissing everyone who shows concern about a law as mere law dodgers or foreign bad actors disinterested in following the local law is unhelpful and borderline anti-intellectual.
- PeterisP 7y ago
  One of the intended goals of GDPR is to reduce the processing of personal data - not only that the companies should do it differently, but that at least half of the companies who currently have my data really shouldn't have it in the first place. It depends on the circumstances of each scenario, but it would be completely reasonable if large numbers of smallish companies acknowledge that they lack the capacity to handle personal data properly and the recommended strategy for GDPR compliance is that they should simply stop requesting and storing that data. Yes, it raises the barriers for entry in areas where that data is absolutely necessary. But it also makes companies think twice whether it's really necessary and worth it, and that's a good thing.
  - JumpCrisscross 7y ago
    > it also makes companies think twice whether it's really necessary and worth it The simple fact that someone has an account at a service can be private information. For anything requiring even a modicum of persistence, keeping these data is tough to avoid. I think most of HN agrees GDPR’s goals are good. It was just sloppily drafted, passed and implemented.
    - AstralStorm 7y ago
      GDPR does not care about privacy. It cares about personal identification. Such as full name and address, and a bunch of other protected things. Why would any random service request, process or more importantly store these?
      - JumpCrisscross 7y ago
        > Why would any random service request, process or more importantly store these? So they can identify users for purposes of complying with GDPR? (For example, to handle the data requests highlighted in this post.)
        PeterisP 7y ago
        The GDPR recitals do not recommend gathering additional data solely to be able to fulfill these requests. See https://gdpr-info.eu/recitals/no-64/ https://gdpr-info.eu/recitals/no-64/ and https://gdpr-info.eu/recitals/no-57/ https://gdpr-info.eu/recitals/no-57/ - the key part is "A controller should not retain personal data for the sole purpose of being able to react to potential requests."
        JumpCrisscross 7y ago
        > The GDPR recitals do not recommend gathering additional data solely to be able to fulfill these requests One, these are non-binding recitals. Two, the conflict between (a) data-furnishing requirements and (b) advice against retaining data that would validate the requestor is exactly the point of this post.
      - SpicyLemonZest 7y ago
        That’s simply not the law. The official guidance (https://gdpr.eu/eu-gdpr-personal-data/ https://gdpr.eu/eu-gdpr-personal-data/) is that even just an IP address or a license plate number are sufficient to count as identifying a person.
  - Silhouette 7y ago
    It depends on the circumstances of each scenario, but it would be completely reasonable if large numbers of smallish companies acknowledge that they lack the capacity to handle personal data properly and the recommended strategy for GDPR compliance is that they should simply stop requesting and storing that data. That's not a reasonable strategy at all. Any company doing more than selling basic goods in person for cash probably needs to process some level of personal data for legitimate reasons. In fact, it will probably be legally required to do so in several respects. It's all very well arguing that you want to reduce processing of personal data, but I think what you really mean is that you want to reduce processing of personal data in ways you don't like. Some amount of processing of personal data about you is always going to be necessary, and indeed essential to your vital interests and the normal functioning of society.
    - PeterisP 7y ago
      "Any company doing more than selling basic goods in person for cash probably needs to process some level of personal data for legitimate reasons." is a bit tricky, and I'm not certain that it's true. I'd say that many common business processes use personal data for reasons of tradition, but don't really need it. 1) "Selling for cash" - accepting credit cards and wire transfers (paying by check isn't really a thing in most of EU) doesn't necessarily require you to store PII. Yes, you could get cardholder name, but perhaps you shouldn't; just as you (most likely, for PCI DSS reasons) don't handle CC numbers but delegate it to e.g. some merchant gateway service, if you also delegate CC fraud analysis to them, then you don't need any details about the transcaction beyond the amount and ID. 2) "Selling in person" - delivery is tricky, but you can reduce the exposure a lot by having the information be transient. If you're delivering pizza, then you don't need to store every order's phone number and address forever; and if you don't store the delivery data beyond the delivery, then if someone requests all the data you have on them, then you can honestly say "nothing". etc. Of course, details matter, and yes, that definitely don't fit all cases, but it's my feeling that they work in half the cases where companies had my data.
      - pbhjpbhj 7y ago
        >you don't need any details about the transcaction beyond the amount and ID. // That's a lot of trust in the merchant services. "What transaction?", then if all you had was a transaction ID what do you do? Also, to process refunds you need to have payment details. In your second case only store the details if people explicitly want you to. You can do repeat customer discounts by sending vouchers for a later order with the present order confirmation. (You can't restrict discounts to those who give up their PII if I'm reading things right.)
  - deleted 7y ago
    [deleted]
ceejayoz 7y ago
Frankly, no one has the resources to do this reliably, and the identity theft consequences are potentially enormous. It's fairly easy to get a reasonably convincing fake ID. High schoolers manage it all the time.
- PeterisP 7y ago
  That seems weird, from what I see in Europe, ID forgery is quite rare; making a convincing fake ID is about as difficult (or more difficult) as making convincing fake money, as pretty much the same anti-counterfeiting measures are used; and carries about the same consequences as counterfeiting money. It's possible, but not cheap or widespread - there are a bunch of ways how you could get money or stuff with a fake ID, but it's very rare in crime statistics; it's more common to see real IDs (of e.g. homeless people) used in such fraud cases, or having an accomplice employee making fake contracts without IDs. Perhaps it's the issue with the lack of a good centralized ID in USA so you have all kinds of different "ID-like" documents, and some of them are insecure? There's also less motivation for teenagers getting fake IDs - I assume in USA the 21-year alcohol limit is a big driver; but here it's not that big of an issue, plus it's easier and cheaper for a teenager to buy e.g. heroin than a fake ID, and being caught using a counterfeit ID is a crime that risks geeting jail time while buying/possession of small amounts of drugs won't; so using a fake ID is difficult and risky, and so it happens not that often.
  - ceejayoz 7y ago
    Remember that a GDPR request is going to typically come electronically. You won't have a physical item to examine for all its anti-counterfeiting features - you're probably going to have a photograph from a mobile phone to look at.
    - SiempreViernes 7y ago
      To me it sounds a bit dubious that you can both have a valid reason for keeping personal information about someone and not have a valid way of verifying that you are actually communicating with them. What sort of agreement can you enter with someone if you don't know who they are?
_jal 7y ago
> If you can't follow the laws then don't play. This is the subtext of the GDPR. Bluntly, they only want HugeCos providing services on the internet, anyone worth fewer than around 10 digits can suck it. This isn't limited to Europe, of course. Most governments are coming around to the idea that there are too many printing presses.
danShumway 7y ago
> This sounds like one of the risks of doing international business. If you can't follow the laws then don't play. Sure, but while technically correct, this comment doesn't add anything to the conversation. The question isn't whether or not GP should need to follow laws -- it's "what laws should we be passing, and what are the effects of those laws?" It's in Europe's best interest to protect their citizens, given that it currently looks like ~40% of the market is more frightened of refusing a GDPR request then they are of leaking PII. There are lots of ways the EU could address that problem -- harsher penalties, revising how IDs work across member states, releasing more resources for smaller businesses, clarifying more broadly that refusing a GDPR request because of lack of identification is OK. All of these directions have pros and cons.
Silhouette 7y ago
If you can't follow the laws then don't play. That's an unhelpful argument if there is no reasonable way to determine what the laws are and/or to comply with them.

dmix 7y ago

OP sounds like he was trying hard to navigate and follow the law? The problem is he ended up finding no reasonable solution that both protected his users privacy while also following the rules, and was disturbed by the implications of it all considering it was supposed to protect them in the first place. Those are very valid criticisms. Simply dismissing everyone who shows concern about a law as mere law dodgers or foreign bad actors disinterested in following the local law is unhelpful and borderline anti-intellectual.

PeterisP 7y ago
One of the intended goals of GDPR is to reduce the processing of personal data - not only that the companies should do it differently, but that at least half of the companies who currently have my data really shouldn't have it in the first place. It depends on the circumstances of each scenario, but it would be completely reasonable if large numbers of smallish companies acknowledge that they lack the capacity to handle personal data properly and the recommended strategy for GDPR compliance is that they should simply stop requesting and storing that data. Yes, it raises the barriers for entry in areas where that data is absolutely necessary. But it also makes companies think twice whether it's really necessary and worth it, and that's a good thing.
- JumpCrisscross 7y ago
  > it also makes companies think twice whether it's really necessary and worth it The simple fact that someone has an account at a service can be private information. For anything requiring even a modicum of persistence, keeping these data is tough to avoid. I think most of HN agrees GDPR’s goals are good. It was just sloppily drafted, passed and implemented.
  - AstralStorm 7y ago
    GDPR does not care about privacy. It cares about personal identification. Such as full name and address, and a bunch of other protected things. Why would any random service request, process or more importantly store these?
    - JumpCrisscross 7y ago
      > Why would any random service request, process or more importantly store these? So they can identify users for purposes of complying with GDPR? (For example, to handle the data requests highlighted in this post.)
      - PeterisP 7y ago
        The GDPR recitals do not recommend gathering additional data solely to be able to fulfill these requests. See https://gdpr-info.eu/recitals/no-64/ https://gdpr-info.eu/recitals/no-64/ and https://gdpr-info.eu/recitals/no-57/ https://gdpr-info.eu/recitals/no-57/ - the key part is "A controller should not retain personal data for the sole purpose of being able to react to potential requests."
        JumpCrisscross 7y ago
        > The GDPR recitals do not recommend gathering additional data solely to be able to fulfill these requests One, these are non-binding recitals. Two, the conflict between (a) data-furnishing requirements and (b) advice against retaining data that would validate the requestor is exactly the point of this post.
    - SpicyLemonZest 7y ago
      That’s simply not the law. The official guidance (https://gdpr.eu/eu-gdpr-personal-data/ https://gdpr.eu/eu-gdpr-personal-data/) is that even just an IP address or a license plate number are sufficient to count as identifying a person.
- Silhouette 7y ago
  It depends on the circumstances of each scenario, but it would be completely reasonable if large numbers of smallish companies acknowledge that they lack the capacity to handle personal data properly and the recommended strategy for GDPR compliance is that they should simply stop requesting and storing that data. That's not a reasonable strategy at all. Any company doing more than selling basic goods in person for cash probably needs to process some level of personal data for legitimate reasons. In fact, it will probably be legally required to do so in several respects. It's all very well arguing that you want to reduce processing of personal data, but I think what you really mean is that you want to reduce processing of personal data in ways you don't like. Some amount of processing of personal data about you is always going to be necessary, and indeed essential to your vital interests and the normal functioning of society.
  - PeterisP 7y ago
    "Any company doing more than selling basic goods in person for cash probably needs to process some level of personal data for legitimate reasons." is a bit tricky, and I'm not certain that it's true. I'd say that many common business processes use personal data for reasons of tradition, but don't really need it. 1) "Selling for cash" - accepting credit cards and wire transfers (paying by check isn't really a thing in most of EU) doesn't necessarily require you to store PII. Yes, you could get cardholder name, but perhaps you shouldn't; just as you (most likely, for PCI DSS reasons) don't handle CC numbers but delegate it to e.g. some merchant gateway service, if you also delegate CC fraud analysis to them, then you don't need any details about the transcaction beyond the amount and ID. 2) "Selling in person" - delivery is tricky, but you can reduce the exposure a lot by having the information be transient. If you're delivering pizza, then you don't need to store every order's phone number and address forever; and if you don't store the delivery data beyond the delivery, then if someone requests all the data you have on them, then you can honestly say "nothing". etc. Of course, details matter, and yes, that definitely don't fit all cases, but it's my feeling that they work in half the cases where companies had my data.
    - pbhjpbhj 7y ago
      >you don't need any details about the transcaction beyond the amount and ID. // That's a lot of trust in the merchant services. "What transaction?", then if all you had was a transaction ID what do you do? Also, to process refunds you need to have payment details. In your second case only store the details if people explicitly want you to. You can do repeat customer discounts by sending vouchers for a later order with the present order confirmation. (You can't restrict discounts to those who give up their PII if I'm reading things right.)
- deleted 7y ago
  [deleted]

ceejayoz 7y ago

Frankly, no one has the resources to do this reliably, and the identity theft consequences are potentially enormous. It's fairly easy to get a reasonably convincing fake ID. High schoolers manage it all the time.

PeterisP 7y ago
That seems weird, from what I see in Europe, ID forgery is quite rare; making a convincing fake ID is about as difficult (or more difficult) as making convincing fake money, as pretty much the same anti-counterfeiting measures are used; and carries about the same consequences as counterfeiting money. It's possible, but not cheap or widespread - there are a bunch of ways how you could get money or stuff with a fake ID, but it's very rare in crime statistics; it's more common to see real IDs (of e.g. homeless people) used in such fraud cases, or having an accomplice employee making fake contracts without IDs. Perhaps it's the issue with the lack of a good centralized ID in USA so you have all kinds of different "ID-like" documents, and some of them are insecure? There's also less motivation for teenagers getting fake IDs - I assume in USA the 21-year alcohol limit is a big driver; but here it's not that big of an issue, plus it's easier and cheaper for a teenager to buy e.g. heroin than a fake ID, and being caught using a counterfeit ID is a crime that risks geeting jail time while buying/possession of small amounts of drugs won't; so using a fake ID is difficult and risky, and so it happens not that often.
- ceejayoz 7y ago
  Remember that a GDPR request is going to typically come electronically. You won't have a physical item to examine for all its anti-counterfeiting features - you're probably going to have a photograph from a mobile phone to look at.
  - SiempreViernes 7y ago
    To me it sounds a bit dubious that you can both have a valid reason for keeping personal information about someone and not have a valid way of verifying that you are actually communicating with them. What sort of agreement can you enter with someone if you don't know who they are?

_jal 7y ago

> If you can't follow the laws then don't play. This is the subtext of the GDPR. Bluntly, they only want HugeCos providing services on the internet, anyone worth fewer than around 10 digits can suck it. This isn't limited to Europe, of course. Most governments are coming around to the idea that there are too many printing presses.

danShumway 7y ago

> This sounds like one of the risks of doing international business. If you can't follow the laws then don't play. Sure, but while technically correct, this comment doesn't add anything to the conversation. The question isn't whether or not GP should need to follow laws -- it's "what laws should we be passing, and what are the effects of those laws?" It's in Europe's best interest to protect their citizens, given that it currently looks like ~40% of the market is more frightened of refusing a GDPR request then they are of leaking PII. There are lots of ways the EU could address that problem -- harsher penalties, revising how IDs work across member states, releasing more resources for smaller businesses, clarifying more broadly that refusing a GDPR request because of lack of identification is OK. All of these directions have pros and cons.

Silhouette 7y ago

If you can't follow the laws then don't play. That's an unhelpful argument if there is no reasonable way to determine what the laws are and/or to comply with them.