4 ms·

100% of our customers would not accept the costs of strictly follow this requirements. They are for sure good advice, but not much practical into everyday web d

by fbn79 6y ago

100% of our customers would not accept the costs of strictly follow this requirements. They are for sure good advice, but not much practical into everyday web dev life.

p410n3 6y ago
100% of your clients are fine with ignoring current laws? Sounds dystopian
- SiempreViernes 6y ago
  Maybe they run a fancy bittorrent tracker?
macns 6y ago
>100% of our customers would not accept the costs of strictly follow this requirements. This seems to apply in pre-GDPR codebases which I'm not sure this guide has taken into account. It probably is a lot less costly to architect an application from scratch, therefore easier to justify to a customer.
skrebbel 6y ago
This site was made by an agency that sells privacy and compliance services. It is in their direct interest to sell the GDPR as an extremely complex problem that you need their help with solving. Laws are generally complex, GDPR isn't really special in that sense; it's just newer than the rest. You can probably draft a similarly complex 16-page document for your country's/state's employment laws too, but that doesn't mean you need to work through all of that mess when hiring your startup's first five employees. In reality, if you honor user data deletion requests, don't track people without asking (with easy "no"), and follow proper modern security practices, you're already so far ahead of the majority of tech businesses wrt the GDPR that you're good. Or at least, that's my impression.
- homarp 6y ago
  cnil is https://en.m.wikipedia.org/wiki/Commission_nationale_de_l%27informatique_et_des_libert%C3%A9s https://en.m.wikipedia.org/wiki/Commission_nationale_de_l%27... its name in french means 'National Commission on Informatics and Liberty', it is an independent French administrative regulatory body whose mission is to ensure that data privacy law is applied to the collection, storage, and use of personal data. Created in 1978. National data protection authority for France.
  - skrebbel 6y ago
    Thanks! I was wrong about that one.
- BeniBoy 6y ago
  This is a bit saddening to read your take on this guide. The goal is specifically to make the GDPR less daunting and more accessible! I guess it missed the mark. But yeah, the GDPR has to formalize a lot of common sense practices, if you don't consider your user as "data trove" you want to abuse, you will be mostly ok!
  - Mirioron 6y ago
    >you will be mostly ok! But you won't. Mostly OK does not protect you from ruinous lawsuits or investigations. With the way the justice system works on the EU level I would never trust "mostly OK". We had an EU court find that posting factual information about a religion was blasphemy and not protected as freedom of speech as a human right.[0] [0] https://en.wikipedia.org/wiki/E.S._v._Austria_(2018) https://en.wikipedia.org/wiki/E.S._v._Austria_(2018)
    - detaro 6y ago
      The ECtHR is not an EU institution. If you want to be angry at someone about that case, be primarily angry at Austria for their law. (Although I'd appreciate it too if the EU states gave themselves an updated set of protections in these areas, without some of the compromises the convention has)
alkonaut 6y ago
A competitor might be able to implement a conforming product quicker or easier than you can adapt yours. So a competitor can charge customers less. That in turn will mean your business will disappear, and the conforming implementation will still be around. This is part of the point, isn't it?
- fbn79 6y ago
  Currently our known direct competitors GDPR solution is not different from our own. It consist in a standardized policy that resume GDPR rights and adding a checkbox to every registration/contact form to accept that policy. That's all. And I'm sure no one will really read that policy before accepting it. Like no one reads cookie policy before accepting it to close annoying cookie banner in every site they visits.
  - alkonaut 6y ago
    > Like no one reads cookie policy before accepting it to close annoying cookie banner in every site they visits. You shouldn't have to read anything, that's the point. GDPR is the law that recognizes that people will never read, so the only protection possible is to both a) make acceptance explocit and b) make opt out default. That is - If I just "accept" the policy or click accept to enter the website, I must be sure that I only accepted to the minimum you need to perform the business task, and not e.g. 3rd party advertising cookies, regardless of whether those cookies is what keeps the lights on.
raverbashing 6y ago
Which costs? The costs of not having privacy-invading ads? How much is it costing you to have all the ad cookies and trackers compared to their returns?
- closeparen 6y ago
  GDPR covers every database, replica, cache, log file, VM snapshot, etc. everywhere. Do you know how to edit an individual out of the Postgres WAL in last week's full disk backup?
  - raverbashing 6y ago
    I don't. That's why that's not how it's usually done You either maintain a deletion list for when you recover backups (which is tricky) or you keep data encrypted with a different key for each user, then delete the key to forget the corresponding information Hence the importance of data minimization and governance

by fbn79 6y ago

100% of our customers would not accept the costs of strictly follow this requirements. They are for sure good advice, but not much practical into everyday web dev life.

p410n3 6y ago

100% of your clients are fine with ignoring current laws? Sounds dystopian

SiempreViernes 6y ago
Maybe they run a fancy bittorrent tracker?

macns 6y ago

>100% of our customers would not accept the costs of strictly follow this requirements. This seems to apply in pre-GDPR codebases which I'm not sure this guide has taken into account. It probably is a lot less costly to architect an application from scratch, therefore easier to justify to a customer.

skrebbel 6y ago

This site was made by an agency that sells privacy and compliance services. It is in their direct interest to sell the GDPR as an extremely complex problem that you need their help with solving. Laws are generally complex, GDPR isn't really special in that sense; it's just newer than the rest. You can probably draft a similarly complex 16-page document for your country's/state's employment laws too, but that doesn't mean you need to work through all of that mess when hiring your startup's first five employees. In reality, if you honor user data deletion requests, don't track people without asking (with easy "no"), and follow proper modern security practices, you're already so far ahead of the majority of tech businesses wrt the GDPR that you're good. Or at least, that's my impression.

homarp 6y ago
cnil is https://en.m.wikipedia.org/wiki/Commission_nationale_de_l%27informatique_et_des_libert%C3%A9s https://en.m.wikipedia.org/wiki/Commission_nationale_de_l%27... its name in french means 'National Commission on Informatics and Liberty', it is an independent French administrative regulatory body whose mission is to ensure that data privacy law is applied to the collection, storage, and use of personal data. Created in 1978. National data protection authority for France.
- skrebbel 6y ago
  Thanks! I was wrong about that one.
BeniBoy 6y ago
This is a bit saddening to read your take on this guide. The goal is specifically to make the GDPR less daunting and more accessible! I guess it missed the mark. But yeah, the GDPR has to formalize a lot of common sense practices, if you don't consider your user as "data trove" you want to abuse, you will be mostly ok!
- Mirioron 6y ago
  >you will be mostly ok! But you won't. Mostly OK does not protect you from ruinous lawsuits or investigations. With the way the justice system works on the EU level I would never trust "mostly OK". We had an EU court find that posting factual information about a religion was blasphemy and not protected as freedom of speech as a human right.[0] [0] https://en.wikipedia.org/wiki/E.S._v._Austria_(2018) https://en.wikipedia.org/wiki/E.S._v._Austria_(2018)
  - detaro 6y ago
    The ECtHR is not an EU institution. If you want to be angry at someone about that case, be primarily angry at Austria for their law. (Although I'd appreciate it too if the EU states gave themselves an updated set of protections in these areas, without some of the compromises the convention has)

alkonaut 6y ago

A competitor might be able to implement a conforming product quicker or easier than you can adapt yours. So a competitor can charge customers less. That in turn will mean your business will disappear, and the conforming implementation will still be around. This is part of the point, isn't it?

fbn79 6y ago
Currently our known direct competitors GDPR solution is not different from our own. It consist in a standardized policy that resume GDPR rights and adding a checkbox to every registration/contact form to accept that policy. That's all. And I'm sure no one will really read that policy before accepting it. Like no one reads cookie policy before accepting it to close annoying cookie banner in every site they visits.
- alkonaut 6y ago
  > Like no one reads cookie policy before accepting it to close annoying cookie banner in every site they visits. You shouldn't have to read anything, that's the point. GDPR is the law that recognizes that people will never read, so the only protection possible is to both a) make acceptance explocit and b) make opt out default. That is - If I just "accept" the policy or click accept to enter the website, I must be sure that I only accepted to the minimum you need to perform the business task, and not e.g. 3rd party advertising cookies, regardless of whether those cookies is what keeps the lights on.

raverbashing 6y ago

Which costs? The costs of not having privacy-invading ads? How much is it costing you to have all the ad cookies and trackers compared to their returns?

closeparen 6y ago
GDPR covers every database, replica, cache, log file, VM snapshot, etc. everywhere. Do you know how to edit an individual out of the Postgres WAL in last week's full disk backup?
- raverbashing 6y ago
  I don't. That's why that's not how it's usually done You either maintain a deletion list for when you recover backups (which is tricky) or you keep data encrypted with a different key for each user, then delete the key to forget the corresponding information Hence the importance of data minimization and governance