11 ms·
GDPR guide for developers
- underdeserver 6y agoSkimming, looks like a lot of these are generally good ideas regardless of GDPR. For instance: "Assess the value of adding each dependency. Some commonly used software bricks are only a few lines long. However, each added element is an increase in your system’s attack surface. In the case where a single library offers several functionalities, integrate only the functionalities you actually need. By activating the minimum number of functionalities, you reduce the number of potential bugs that could occur." The context is that an external library can mishandle personal info, but this is true even if you didn't care at all about security and privacy.
- akerro 6y agoThere are also these things quality I bookmarked: https://gdpr.algolia.com/ https://gdpr.algolia.com/ https://gdpr.eu/ https://gdpr.eu/ https://techblog.bozho.net/gdpr-practical-guide-developers/ https://techblog.bozho.net/gdpr-practical-guide-developers/
- fbn79 6y ago100% of our customers would not accept the costs of strictly follow this requirements. They are for sure good advice, but not much practical into everyday web dev life.
- p410n3 6y ago100% of your clients are fine with ignoring current laws? Sounds dystopian
- SiempreViernes 6y agoMaybe they run a fancy bittorrent tracker?
- macns 6y ago>100% of our customers would not accept the costs of strictly follow this requirements. This seems to apply in pre-GDPR codebases which I'm not sure this guide has taken into account. It probably is a lot less costly to architect an application from scratch, therefore easier to justify to a customer.
- skrebbel 6y agoThis site was made by an agency that sells privacy and compliance services. It is in their direct interest to sell the GDPR as an extremely complex problem that you need their help with solving. Laws are generally complex, GDPR isn't really special in that sense; it's just newer than the rest. You can probably draft a similarly complex 16-page document for your country's/state's employment laws too, but that doesn't mean you need to work through all of that mess when hiring your startup's first five employees. In reality, if you honor user data deletion requests, don't track people without asking (with easy "no"), and follow proper modern security practices, you're already so far ahead of the majority of tech businesses wrt the GDPR that you're good. Or at least, that's my impression.
- homarp 6y agocnil is https://en.m.wikipedia.org/wiki/Commission_nationale_de_l%27informatique_et_des_libert%C3%A9s https://en.m.wikipedia.org/wiki/Commission_nationale_de_l%27... its name in french means 'National Commission on Informatics and Liberty', it is an independent French administrative regulatory body whose mission is to ensure that data privacy law is applied to the collection, storage, and use of personal data. Created in 1978. National data protection authority for France.
- skrebbel 6y agoThanks! I was wrong about that one.
- BeniBoy 6y agoThis is a bit saddening to read your take on this guide. The goal is specifically to make the GDPR less daunting and more accessible! I guess it missed the mark. But yeah, the GDPR has to formalize a lot of common sense practices, if you don't consider your user as "data trove" you want to abuse, you will be mostly ok!
- Mirioron 6y ago>you will be mostly ok! But you won't. Mostly OK does not protect you from ruinous lawsuits or investigations. With the way the justice system works on the EU level I would never trust "mostly OK". We had an EU court find that posting factual information about a religion was blasphemy and not protected as freedom of speech as a human right.[0] [0] https://en.wikipedia.org/wiki/E.S._v._Austria_(2018) https://en.wikipedia.org/wiki/E.S._v._Austria_(2018)
- alkonaut 6y agoA competitor might be able to implement a conforming product quicker or easier than you can adapt yours. So a competitor can charge customers less. That in turn will mean your business will disappear, and the conforming implementation will still be around. This is part of the point, isn't it?
- fbn79 6y agoCurrently our known direct competitors GDPR solution is not different from our own. It consist in a standardized policy that resume GDPR rights and adding a checkbox to every registration/contact form to accept that policy. That's all. And I'm sure no one will really read that policy before accepting it. Like no one reads cookie policy before accepting it to close annoying cookie banner in every site they visits.
- alkonaut 6y ago> Like no one reads cookie policy before accepting it to close annoying cookie banner in every site they visits. You shouldn't have to read anything, that's the point. GDPR is the law that recognizes that people will never read, so the only protection possible is to both a) make acceptance explocit and b) make opt out default. That is - If I just "accept" the policy or click accept to enter the website, I must be sure that I only accepted to the minimum you need to perform the business task, and not e.g. 3rd party advertising cookies, regardless of whether those cookies is what keeps the lights on.
- raverbashing 6y agoWhich costs? The costs of not having privacy-invading ads? How much is it costing you to have all the ad cookies and trackers compared to their returns?
- closeparen 6y agoGDPR covers every database, replica, cache, log file, VM snapshot, etc. everywhere. Do you know how to edit an individual out of the Postgres WAL in last week's full disk backup?
- raverbashing 6y agoI don't. That's why that's not how it's usually done You either maintain a deletion list for when you recover backups (which is tricky) or you keep data encrypted with a different key for each user, then delete the key to forget the corresponding information Hence the importance of data minimization and governance
- BeniBoy 6y agoI think the "Prepare for the exercise of people’s rights" part is critical. If you are a software architect, you need to ask yourself: can I delete a single user data across all my infra easily? If not, you might be in trouble a couple a year later when you are hit with thousands of deletion request and technically can't honor them. Another side of tech debt I guess!
- moksly 6y agoYou can answer no to that and still be GDPR compliant. You’re allowed to save personal information that is critical to your business. People can’t buy stuff from you and demand you have their payment data deleted before you charge them, or right after they do a charge back of money paid to you for instance. It’s probably healthy to design systems that are build to let people manage their own data though. I think people will slowly start to expect that of you in the future as more and more solutions start to offer it. In the public sector of Denmark we give people access to all their health data. When I have blood drawn for analysis (not English and I don’t know what it’s called sorry) I can log in and see the results exactly like the doctor sees them. When I’ve been to a doctors consultant and she’s written stuff in my journal I can log in and read it. People are going to want that stuff once they get used to it.
- BeniBoy 6y agoYou are right. The rights of the user depend on the legal basis you choose. This is covered here[1] Basically: * The right to object is not applicable if your processing is based on contract, legal obligation or protection of vital interest * The right to erasure is not applicable in case of a legal obligation or public interest [1]https://github.com/LINCnil/GDPR-Developer-Guide/blob/master/15-Take%20into%20account%20the%20legal%20basis%20in%20the%20technical%20implementation.md#rights-exercises-and-modalities-of-information-to-be-provided-according-to-legal-basis https://github.com/LINCnil/GDPR-Developer-Guide/blob/master/...
- ArnoVW 6y ago.. and since one is obliged to keep 10 years of history for tax auditing reaons, the whole point becomes moot. Yes, you can ask that your avatar image be removed. But they can easily claim that your name, address, bank account number are needed for tax auditing and Know Your Customer purposes. https://en.wikipedia.org/wiki/Know_your_customer https://en.wikipedia.org/wiki/Know_your_customer
- luch 6y agoThe Sheet #16 about cookies and third-party trackers is quite interesting: ## To benefit from the exemption from consent **Subject to a number of conditions**, cookies used for audience measurement are exempt from consent. **These conditions, as specified in the [guidelines on cookies and other trackers](https://www.cnil.fr/en/cookies-and-other-tracking-devices-cnil-publishes-new-guidelines), are**: * To inform users of their use; * To give them the ability to object to their use; * To limit to the following purposes only: * audience measurement; * A/B testing; * Not to cross-check the data processed with other processing (customer files, statistics on visits to other sites, etc.); * To limit the scope of the tracer to a single site or application editor; * To truncate the last byte of the IP address; * To limit the lifetime of the trackers to 13 months. Provided that the conditions are met, **we therefore switch from an opt-in to an opt-out regime**. It is also possible for the same third party (subcontractor) to provide a comparative audience measurement service to multiple publishers, provided that **the data is collected, processed and stored independently for each publisher and that the trackers are independent of each other**. ## In practice **Most large audience measurement offerings do not fall within the scope of the exemption, regardless of their configuration**. That's what I though, when websites welcomes you with a giant popup "Manage your consent" with a gazillion third-party trackers all opt-in (and you need to disable them one by one) they are actually not GDPR-compliant.
- Semaphor 6y agoYeah, barely anything is compliant. Though I’ve recently encountered a bunch of sites that are, so maybe things are slowly changing.
- alkonaut 6y agoWhat is the largest GDPR fine yet for a violation specifically about website consents? I have seen some large fines but all seem to be of "backend" violations. It would be nice if there could be a handful of large high profile sites given a huge fine for having one of those annoying popups with everything opted in. There seems to be companies selling blatantly noncompliant GDPR popup tech too. That has got to be the most snake oil thing ever.
- pamperson 6y agoGDPR is a massive inconvenience. in theory it sounds good, in practice you just have to click an annoying number of accept buttons. there should have been more debate around this set of rules not just a diktat top down that is disconnected from reality.
- Nursie 6y ago> in practice you just have to click an annoying number of accept buttons. That's because those sites want to track you, for profit, and they usually want to confuse you into agreeing in the weakest way possible. These popups are entirely unnecessary, if sites would just stop tracking you and allowing third parties to track you.
- Mirioron 6y ago>These popups are entirely unnecessary, if sites would just stop tracking you and allowing third parties to track you. Yeah, who needs money to operate a service anyway. Can't they just be happy that I'm even willing to consume their content?! These websites do that so that they can provide the website in the first place. If they didn't then there would be no website for you to complain about.
- Nursie 6y ago> If they didn't then there would be no website for you to complain about. Oh no, my business model of selling everything I can glean about you in exchange for some recycled 'content' is under threat! Oh noes! If you can't operate without tracking and you can't legitimately and consensually persuade people to participate in it without resorting to dark patterns and hiding controls, your business is no longer viable, sorry. Find a new model or make way for someone else that can.
- diffeomorphism 6y agoYou are entirely free to show adds and to charge money. The popups are only necessary if you additionally want to spy on users.
- slx26 6y agoHope it's not off-topic: what I still don't understand is how with regulations like this an OS like Windows can get away with the things it does. I mean, maybe there's some legal reason, but my common sense can't process it.
- cryptica 6y agoThis is because the real purpose of GDPR is to prevent small startups with few financial resources and no legal team from being able to compete with big corporations with limitless financial resources and top legal teams. This is part of a broader strategy by corporations to create an economic environment which smothers startups before they can even get started. Saves them acquisition costs later. When when politicians get out of office, they have a nice highly paid corporate job waiting for them. As governments keep introducing more regulations, eventually everyone in the world will be breaking some kind of law whenever they do anything at all. That will allow governments to selectively imprison anyone who is working against the personal interests of the political and financial elite.
- deleted 6y ago[deleted]
- CamouflagedKiwi 6y agoThis seems like a great case for Hanlon's razor ("Never attribute to malice that which is adequately explained by stupidity"). Rather than a huge high-level conspiracy between corporations and government, it seems much more likely that the people drafting the law just didn't realise (or didn't care) how much impact it would have on small companies.
- cryptica 6y agoSure, a lot of people in government would also think that way. But there are also many very smart people behind the scenes who are using well-meaning but not-so-smart politicians for their own intelligent agendas. To suggest that armies of highly paid corporate executives are just a bunch of idiots who sit on board meetings and don't deliver any value back to their companies through political manipulation is not credible. We know that they fund think tanks and that they hire politicians after their term finishes - This is not some conspiracy theory, this is a fact. All the incentives are perfectly aligned towards that end. Besides, I don't see how stupidity and evil are mutually exclusive. Historically, they seem to always go hand in hand.
- thrwawayn 6y agoHN is not GDPR compliant. There's no way to get your account deleted. There are only anecdotal stories of someone getting it done via email and those are countered by claims of others of no success.
- anoncake 6y agoDoes HN specifically cater to EU residents in any way?