5 ms·

The gist of these laws are all the same. Just respect ALL users' data from the start, and you shouldn't have any difficulty with compliance.

clay_the_ripper 7y ago
Totally disagree. Complicate is not the same thing as following the spirit of the rules. Compliance is proving you followed the rules. Totally different. Also, you have to define what you mean by “respecting privacy”. Something that I do on my website, like basic retargeting marketing for abandoned shopping carts doesn’t feel to me like an invasion of privacy. To you, it might. The rules have to be defined clearly.
- mirimir 7y ago
  If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem. If you have a shopping cart, you must collect billing and shipping information. But you don't need to use it for any other purpose.
  - btilly 7y ago
    By your rule, companies should not engage in A/B testing to figure out how to make their sites easier to use. Because that involves tracking users for a purpose that is not actually essential to delivering content and services. Does this outcome make sense to you? (Disclaimer, I have worked in adtech a little bit, but I have worked a lot more with A/B testing.)
    - mirimir 7y ago
      I suspect that A/B testing is doable without collecting user information. Except for the OS, of course. But certainly nothing that's not in server logs.
  - yuliyp 7y ago
    Do you have an error log on your web server? Does that only collect data that is essential or do you do something like log a referer or IP address or user id in hopes that it might be useful un debugging. Is there an access log? What happens if a user asks to delete their data. Do you go back and scrub all such logs? What about if you have a backend service that logs errors about what data it had problems accessing. Or an SQL server that logs bad queries? It's not so straight forward as you make it seem.
    - mirimir 7y ago
      I'm no expert. But typically, when installing web servers, I don't enable logging. I'm more familiar with the issue of logging by VPN services. And I've been assured, by someone who runs one, that logging isn't necessary. Everything can be done in real time, with any "logs" retained briefly in RAM.
      - jkp56 7y ago
        I'm an expert. The correct answer is to not log any PII data. Logging obvious PII because it might be useful in some hypothetical future sounds like plain incompetence. If you really need to log PII, log it separately and set clear policies about how this data is stored, how it's replicated, who can access it. If you need to log some PII IDs in common logs, use some fuzzy hashing: good enough for logs, not good enough to restore the original PII.
        mirimir 7y ago
        Thank you. PII that you don't need can become like radioactive waste. If it gets subpoenaed, and it comes out that you retained and produced it, your reputation may be hosed. But if there's nothing to produce, no problem. That's actually not quite correct. If you're required by law to retain that PII, you'll be hosed if you can't produce it. But then, maybe you should be doing business in a different jurisdiction. I'm thinking of Private Internet Access. To my knowledge, logs have been subpoenaed in two US criminal cases. And they just said that they didn't retain logs. But then, VPN services aren't required to retain logs in the US.
  - jolmg 7y ago
    > If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem. That's pretty ambiguous. For example, I'm pretty sure everything Google does that can be considered against privacy can and is tied to the service they provide as features. The fact they keep a history of everywhere you went to can be used by users to recall the locations they've been too. That Google keeps one's contacts can be used in case you lose your phone and get a new one. That Google uploads your voice to their servers is to improve their speech recognition. All privacy violations can be made "essential" by tying it to a feature.
    - mirimir 7y ago
      That's really stretching the meaning of "essential to delivering content and services". If I search using Google, all I want is the results. If I have Gmail, all I want is an email account. Anything else is clearly extraneous. Edit: And they can always offer more. With clear explanation of what information they'll need to retain. And users can either accept, or decline.
      - jolmg 7y ago
        > If I search using Google, all I want is the results. They also remember your searches to provide personalized results, and many people do like that. > Anything else is clearly extraneous. Isn't the point of a business to provide the best product or service they can (for the price they ask)? What's the point of a business that does the bare minimum? How are they supposed to compete? In any case, the point is that it's not as clear cut to know what violates privacy and what doesn't. To tie it back to your original comment: > The gist of these laws are all the same. Just respect ALL users' data from the start, and you shouldn't have any difficulty with compliance. They aren't necessarily going to be the same. What is to respect all users' data? There's no concrete consensus on what violating privacy consists of. Is saving searches for personalized results consistent across personal devices violating privacy? Some will say yes, others will say no. Also, if you err on the side of caution and avoid providing features, you're going to lose edge. It seems to me that it's very important to a business's survival to know where the borderline is. That's why I would agree with rdlecler1 that > a small startup needs to ensure they comply with hundreds of regulatory jurisdictions if they want to have a chance for survival and peace of mind that they aren't even technically guilty of anything in any one jurisdiction even if in their own eyes they did everything to respect their users' data. The internet probably wouldn't have gotten as big if it weren't for the fact that it's largely lawless. If every geographical region makes their own regulations, only big world corporations will be able to comply.
  - rdlecler1 7y ago
    The IRS may see that differently.
    - mirimir 7y ago
      Good point, perhaps. I'm not familiar with reporting requirements for online sales in business returns. I did manage a small restaurant at one point, and I don't recall that we had to track customer identity.
- atonse 7y ago
  And what's to stop you from selling that data about what was in my shopping cart to a third party? Would you be compelled to notify me, or ask for my permission? After all, I agreed to share that with you in exchange for the product in the shopping cart. But I didn't agree to anything else. It's not for the operator of a website to decide what is an invasion of _my_ privacy. It's for the consumer to decide. And that's precisely why we can't rely on website administrators, or the "recipients" of data to determine whether something is private. I'm one of those website administrators who wholeheartedly welcomes something like GDPR here, even though it would make my job harder. But hey, that's fine. Putting privacy back in the hands of consumers is the right thing to do.
- JohnFen 7y ago
  > Something that I do on my website, like basic retargeting marketing for abandoned shopping carts doesn’t feel to me like an invasion of privacy. It sure does to me. So much so that if it happened to me, I'd be sure to never buy from that site again.
  - reaperducer 7y ago
    I'm with you. I was on a web site with several items in the shopping cart. I went to the bathroom on my way into another room of the house to get my phone to make a payment on my credit card so I could make the purchase. When I got to my phone I already had one of those abandoned cart remarketing e-mails from the company. I went back to my computer and closed the browser tab. No sale, creeps.
bcheung 7y ago
Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous. How do you scan all the logs that might somehow have an association with the requesting user that are in cold storage and alter data on write only archived optical media? You have to make an entire copy of it with those data removed. It's not about just treating customers better. It's government dictating the technical architecture.
- scottlocklin 7y ago
  >Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous. Bummer dude. As an engineer type, I say, bring it on. Hard for me to have much sympathy ZuckerBrin can't afford another island or whatever because they made unethical decisions in the past. And if companies blow up because of it: good, that's the idea. There needs to be consequences.
  - tick_tock_tick 7y ago
    Facebook will be just fine and probably come out ahead. Same with google. They have the money and resource to comply. These kind of regulation that don't take reality into account when written are a god send to large corps.
- dmitriid 7y ago
  > Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous. Boohoo and cry me a river. Good riddance. Other companies who take care of customer data from the start will take over. > It's government dictating the technical architecture. No, the government doesn’t dictate technical architecture. The government dictates: be careful with personal data.
- mahmoudimus 7y ago
  Just a shameless plug here -- we've been building a super developer friendly product to allow your application to comply w/ these laws with minimal (and sometimes NO code changes). You can email me directly mahmoud - @ - verygoodsecurity.com (https://verygoodsecurity.com/ https://verygoodsecurity.com/) and I can show you how it works. Our idea is that complying w/ data security & privacy laws should be a devops shift + costs to keep up w/ them shouldn't stop us, as developers, from keeping us just as productive in our application development lifecycle. We're still trying to figure out the right pricing structure for smaller companies, so if you have any insight there, I'm very interested to hear it.
opportune 7y ago
This is not true, unless by “respect” you mean “do not collect any at all”. I would argue that you could respect users’ data without implementing data takeout, for instance. I would also argue that cookies not used for tracking do not need disclosure for users to be respected Anyway, the only companies that will end up being able to collect data at all are there very biggest ones. Everyone else will have to just fly under the radar or use some kind of SAAS solution to comply with the patchwork of regulation. Not sure that’s really the desired outcome
Steven_Vellon 7y ago
If there was an easily defined definition of "respecting users data" the we wouldn't be in this situation. Plenty of people think putting a clause in the EULA that says user data can be monetized is being respectful of user data, but this is often prohibited by law. Plenty of people don't think having a tool to dump user data is necessary to respect user data.
- JohnFen 7y ago
  > Plenty of people think putting a clause in the EULA that says user data can be monetized is being respectful of user data Do they really believe that, though? I always thought they were just thinking it was just legal cover to allow them to do whatever they want with the data. Respect doesn't enter into it.
  - Steven_Vellon 7y ago
    What's wrong with it? The End user license agreement is the document explicitly dedicated to explaining how the interaction between the user and the software will work. If a company explains how the data will be used and the user consents to that agreement what is the issue? I don't doubt that there are people that don't bother to read the EULA but thats a leading-a-horse-to-water situation.
    - JohnFen 7y ago
      I didn't say that there was something wrong with it, I said that it doesn't count as being respectful of user data. That said, almost all EULAs and privacy statements I've ever read have not been forthcoming about the use of data. They usually state, in broad terms, that they'll share unspecified user data with mysterious "partners" for nonspecific reasons.
novok 7y ago
The GDPR is pretty bad for under 5 engineer startups. They can be very privacy respecting small businesses that charge for their product, like sql training courseware[0], and wouldn't mind clearing what little personal data they had on you (user server logs, billing info, etc). But being privacy respecting and properly complying with GDPR with audit log systems, etc are 2 different things that require hiring 1 or 2 extra engineers or causing them to pause the companies roadmap as 1 or more people implement government bureaucracy infrastructure for half a year. If they say it's easy and cheap, then they haven't actually tried to do it properly and are exposing themselves to multi-million dollar penalties. [0] https://www.brentozar.com/archive/2017/12/gdpr-stopped-selling-stuff-europe/ https://www.brentozar.com/archive/2017/12/gdpr-stopped-selli...
- zbentley 7y ago
  I've heard this line so many times, but there are vanishingly few examples of companies that really suffered for it ("just don't sell in Europe" implies, to me, that Europe wasn't valuable enough to you as a market to take the time engineering GDPR compliance--and that's just fine). The ones that did crash overwhelmingly seemed to be sketchy data brokers.
  - novok 7y ago
    I think a bunch of them took the "if audited we will probably be screwed unless the enforcing body takes leniency on us" and just kept on going. It opens up everyone to another huge liability but that's business. DPOs only have so many staff to investigate complaints.
tylerl 7y ago
Bullshit. "Respect users data" means different, incompatible things to different people and in different circumstances. You can't "respect" all of them at the same time. Take the data deletion requirement. I know of many instances where users have permanently lost absolutely critical data because of that provision (already found in other privacy laws). When a user (accidentally) indicates they want you to delete their content, the provider has to permanently delete it within a reasonable timeframe, including purge from all backups. Most users don't give a flying f'ck about all this privacy BS, but they care very much about what happened to their Master's thesis. They want a company who will be able to rescue them from their own mistakes. They want dependability. But they get "privacy" instead, and their accidentally wishes that you purge all their stuff gets obeyed. Maybe you call that progress. But it really sucks when you purchase vague hypothetical benefit at the cost of real-world misery.
- mitchdoogle 7y ago
  > "Respect users data" means different, incompatible things to different people and in different circumstances. I admit it was vague phrasing. All I mean by respect peoples' data is to recognize that people should own their own data. You should get explicit permission before collecting it, using it, selling it, etc. At any time it should be just as easy to remove the data as it was for you to collect it. As for any data deletion, I think it makes sense to have a strong warning any time a company has files that the user themselves have uploaded. Perhaps even listing filenames and folders to remind users what's there.

clay_the_ripper 7y ago

Totally disagree. Complicate is not the same thing as following the spirit of the rules. Compliance is proving you followed the rules. Totally different. Also, you have to define what you mean by “respecting privacy”. Something that I do on my website, like basic retargeting marketing for abandoned shopping carts doesn’t feel to me like an invasion of privacy. To you, it might. The rules have to be defined clearly.

mirimir 7y ago
If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem. If you have a shopping cart, you must collect billing and shipping information. But you don't need to use it for any other purpose.
- btilly 7y ago
  By your rule, companies should not engage in A/B testing to figure out how to make their sites easier to use. Because that involves tracking users for a purpose that is not actually essential to delivering content and services. Does this outcome make sense to you? (Disclaimer, I have worked in adtech a little bit, but I have worked a lot more with A/B testing.)
  - mirimir 7y ago
    I suspect that A/B testing is doable without collecting user information. Except for the OS, of course. But certainly nothing that's not in server logs.
- yuliyp 7y ago
  Do you have an error log on your web server? Does that only collect data that is essential or do you do something like log a referer or IP address or user id in hopes that it might be useful un debugging. Is there an access log? What happens if a user asks to delete their data. Do you go back and scrub all such logs? What about if you have a backend service that logs errors about what data it had problems accessing. Or an SQL server that logs bad queries? It's not so straight forward as you make it seem.
  - mirimir 7y ago
    I'm no expert. But typically, when installing web servers, I don't enable logging. I'm more familiar with the issue of logging by VPN services. And I've been assured, by someone who runs one, that logging isn't necessary. Everything can be done in real time, with any "logs" retained briefly in RAM.
    - jkp56 7y ago
      I'm an expert. The correct answer is to not log any PII data. Logging obvious PII because it might be useful in some hypothetical future sounds like plain incompetence. If you really need to log PII, log it separately and set clear policies about how this data is stored, how it's replicated, who can access it. If you need to log some PII IDs in common logs, use some fuzzy hashing: good enough for logs, not good enough to restore the original PII.
      - mirimir 7y ago
        Thank you. PII that you don't need can become like radioactive waste. If it gets subpoenaed, and it comes out that you retained and produced it, your reputation may be hosed. But if there's nothing to produce, no problem. That's actually not quite correct. If you're required by law to retain that PII, you'll be hosed if you can't produce it. But then, maybe you should be doing business in a different jurisdiction. I'm thinking of Private Internet Access. To my knowledge, logs have been subpoenaed in two US criminal cases. And they just said that they didn't retain logs. But then, VPN services aren't required to retain logs in the US.
- jolmg 7y ago
  > If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem. That's pretty ambiguous. For example, I'm pretty sure everything Google does that can be considered against privacy can and is tied to the service they provide as features. The fact they keep a history of everywhere you went to can be used by users to recall the locations they've been too. That Google keeps one's contacts can be used in case you lose your phone and get a new one. That Google uploads your voice to their servers is to improve their speech recognition. All privacy violations can be made "essential" by tying it to a feature.
  - mirimir 7y ago
    That's really stretching the meaning of "essential to delivering content and services". If I search using Google, all I want is the results. If I have Gmail, all I want is an email account. Anything else is clearly extraneous. Edit: And they can always offer more. With clear explanation of what information they'll need to retain. And users can either accept, or decline.
    - jolmg 7y ago
      > If I search using Google, all I want is the results. They also remember your searches to provide personalized results, and many people do like that. > Anything else is clearly extraneous. Isn't the point of a business to provide the best product or service they can (for the price they ask)? What's the point of a business that does the bare minimum? How are they supposed to compete? In any case, the point is that it's not as clear cut to know what violates privacy and what doesn't. To tie it back to your original comment: > The gist of these laws are all the same. Just respect ALL users' data from the start, and you shouldn't have any difficulty with compliance. They aren't necessarily going to be the same. What is to respect all users' data? There's no concrete consensus on what violating privacy consists of. Is saving searches for personalized results consistent across personal devices violating privacy? Some will say yes, others will say no. Also, if you err on the side of caution and avoid providing features, you're going to lose edge. It seems to me that it's very important to a business's survival to know where the borderline is. That's why I would agree with rdlecler1 that > a small startup needs to ensure they comply with hundreds of regulatory jurisdictions if they want to have a chance for survival and peace of mind that they aren't even technically guilty of anything in any one jurisdiction even if in their own eyes they did everything to respect their users' data. The internet probably wouldn't have gotten as big if it weren't for the fact that it's largely lawless. If every geographical region makes their own regulations, only big world corporations will be able to comply.
- rdlecler1 7y ago
  The IRS may see that differently.
  - mirimir 7y ago
    Good point, perhaps. I'm not familiar with reporting requirements for online sales in business returns. I did manage a small restaurant at one point, and I don't recall that we had to track customer identity.
atonse 7y ago
And what's to stop you from selling that data about what was in my shopping cart to a third party? Would you be compelled to notify me, or ask for my permission? After all, I agreed to share that with you in exchange for the product in the shopping cart. But I didn't agree to anything else. It's not for the operator of a website to decide what is an invasion of _my_ privacy. It's for the consumer to decide. And that's precisely why we can't rely on website administrators, or the "recipients" of data to determine whether something is private. I'm one of those website administrators who wholeheartedly welcomes something like GDPR here, even though it would make my job harder. But hey, that's fine. Putting privacy back in the hands of consumers is the right thing to do.
JohnFen 7y ago
> Something that I do on my website, like basic retargeting marketing for abandoned shopping carts doesn’t feel to me like an invasion of privacy. It sure does to me. So much so that if it happened to me, I'd be sure to never buy from that site again.
- reaperducer 7y ago
  I'm with you. I was on a web site with several items in the shopping cart. I went to the bathroom on my way into another room of the house to get my phone to make a payment on my credit card so I could make the purchase. When I got to my phone I already had one of those abandoned cart remarketing e-mails from the company. I went back to my computer and closed the browser tab. No sale, creeps.

bcheung 7y ago

Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous. How do you scan all the logs that might somehow have an association with the requesting user that are in cold storage and alter data on write only archived optical media? You have to make an entire copy of it with those data removed. It's not about just treating customers better. It's government dictating the technical architecture.

scottlocklin 7y ago
>Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous. Bummer dude. As an engineer type, I say, bring it on. Hard for me to have much sympathy ZuckerBrin can't afford another island or whatever because they made unethical decisions in the past. And if companies blow up because of it: good, that's the idea. There needs to be consequences.
- tick_tock_tick 7y ago
  Facebook will be just fine and probably come out ahead. Same with google. They have the money and resource to comply. These kind of regulation that don't take reality into account when written are a god send to large corps.
dmitriid 7y ago
> Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous. Boohoo and cry me a river. Good riddance. Other companies who take care of customer data from the start will take over. > It's government dictating the technical architecture. No, the government doesn’t dictate technical architecture. The government dictates: be careful with personal data.
mahmoudimus 7y ago
Just a shameless plug here -- we've been building a super developer friendly product to allow your application to comply w/ these laws with minimal (and sometimes NO code changes). You can email me directly mahmoud - @ - verygoodsecurity.com (https://verygoodsecurity.com/ https://verygoodsecurity.com/) and I can show you how it works. Our idea is that complying w/ data security & privacy laws should be a devops shift + costs to keep up w/ them shouldn't stop us, as developers, from keeping us just as productive in our application development lifecycle. We're still trying to figure out the right pricing structure for smaller companies, so if you have any insight there, I'm very interested to hear it.

opportune 7y ago

This is not true, unless by “respect” you mean “do not collect any at all”. I would argue that you could respect users’ data without implementing data takeout, for instance. I would also argue that cookies not used for tracking do not need disclosure for users to be respected Anyway, the only companies that will end up being able to collect data at all are there very biggest ones. Everyone else will have to just fly under the radar or use some kind of SAAS solution to comply with the patchwork of regulation. Not sure that’s really the desired outcome

Steven_Vellon 7y ago

If there was an easily defined definition of "respecting users data" the we wouldn't be in this situation. Plenty of people think putting a clause in the EULA that says user data can be monetized is being respectful of user data, but this is often prohibited by law. Plenty of people don't think having a tool to dump user data is necessary to respect user data.

JohnFen 7y ago
> Plenty of people think putting a clause in the EULA that says user data can be monetized is being respectful of user data Do they really believe that, though? I always thought they were just thinking it was just legal cover to allow them to do whatever they want with the data. Respect doesn't enter into it.
- Steven_Vellon 7y ago
  What's wrong with it? The End user license agreement is the document explicitly dedicated to explaining how the interaction between the user and the software will work. If a company explains how the data will be used and the user consents to that agreement what is the issue? I don't doubt that there are people that don't bother to read the EULA but thats a leading-a-horse-to-water situation.
  - JohnFen 7y ago
    I didn't say that there was something wrong with it, I said that it doesn't count as being respectful of user data. That said, almost all EULAs and privacy statements I've ever read have not been forthcoming about the use of data. They usually state, in broad terms, that they'll share unspecified user data with mysterious "partners" for nonspecific reasons.

novok 7y ago

The GDPR is pretty bad for under 5 engineer startups. They can be very privacy respecting small businesses that charge for their product, like sql training courseware[0], and wouldn't mind clearing what little personal data they had on you (user server logs, billing info, etc). But being privacy respecting and properly complying with GDPR with audit log systems, etc are 2 different things that require hiring 1 or 2 extra engineers or causing them to pause the companies roadmap as 1 or more people implement government bureaucracy infrastructure for half a year. If they say it's easy and cheap, then they haven't actually tried to do it properly and are exposing themselves to multi-million dollar penalties. [0] https://www.brentozar.com/archive/2017/12/gdpr-stopped-selling-stuff-europe/ https://www.brentozar.com/archive/2017/12/gdpr-stopped-selli...

zbentley 7y ago
I've heard this line so many times, but there are vanishingly few examples of companies that really suffered for it ("just don't sell in Europe" implies, to me, that Europe wasn't valuable enough to you as a market to take the time engineering GDPR compliance--and that's just fine). The ones that did crash overwhelmingly seemed to be sketchy data brokers.
- novok 7y ago
  I think a bunch of them took the "if audited we will probably be screwed unless the enforcing body takes leniency on us" and just kept on going. It opens up everyone to another huge liability but that's business. DPOs only have so many staff to investigate complaints.

tylerl 7y ago

Bullshit. "Respect users data" means different, incompatible things to different people and in different circumstances. You can't "respect" all of them at the same time. Take the data deletion requirement. I know of many instances where users have permanently lost absolutely critical data because of that provision (already found in other privacy laws). When a user (accidentally) indicates they want you to delete their content, the provider has to permanently delete it within a reasonable timeframe, including purge from all backups. Most users don't give a flying f'ck about all this privacy BS, but they care very much about what happened to their Master's thesis. They want a company who will be able to rescue them from their own mistakes. They want dependability. But they get "privacy" instead, and their accidentally wishes that you purge all their stuff gets obeyed. Maybe you call that progress. But it really sucks when you purchase vague hypothetical benefit at the cost of real-world misery.

mitchdoogle 7y ago
> "Respect users data" means different, incompatible things to different people and in different circumstances. I admit it was vague phrasing. All I mean by respect peoples' data is to recognize that people should own their own data. You should get explicit permission before collecting it, using it, selling it, etc. At any time it should be just as easy to remove the data as it was for you to collect it. As for any data deletion, I think it makes sense to have a strong warning any time a company has files that the user themselves have uploaded. Perhaps even listing filenames and folders to remind users what's there.