5 ms·

Companies still need some basic data for whatever problem they're solving, right? As an example, let's say I want to launch a blogging platform. You need some

Companies still need some basic data for whatever problem they're solving, right? As an example, let's say I want to launch a blogging platform. You need some basic tables (data) like User, Posts, Tags, etc. I'd consider this data the business needs for core business. Does there need to be some GDPR compliance thing? Anecdotally a dumb app I built I was worried about EU visitors and just wanted to block them instead of figure it out (yea yea maybe that's not the right approach but I'm sure the sentiment is common).

sorokod 6y ago
"Does there need to be some GDPR compliance thing?" Sounds like you have to learn something before starting a business.
- jfengel 6y ago
  Unfortunately, that's a big cultural shift that a lot of people appear to be having trouble with. We all really enjoyed the days when we could throw together a project and focus on the fun parts. Then came all of the other things we should worry about -- security and scaling, which are at least technical problems, but then things like privacy, moderation, and even legality. It's fun to put up a file-sharing service; it's less fun to think about the fact that it can be used to share child porn. It's fun to have a new chat site with no filters. It's less fun when people use it to plan crime. We don't want to face that. We want to make it Not Our Problem. And here, now privacy is another one. We used to just gather up user data and we didn't plan to sell it or lose it so why did we care? The Internet is a lot less fun than it used to be. Or rather, we just managed to ignore a lot of the problems, usually because we weren't the ones affected by them. And so we didn't fix them ourselves, so laws got passed instead, which are never as good as what we'd have come up with ourselves. So yeah, it's time for people to learn stuff before starting a business. That's no fun. Too bad.
  - lensopra 6y ago
    Well, on the bright side the UK to departing from GDPR. Maybe other countries will follow suit.
  - sorokod 6y ago
    Not disagreeing but would say this: people's personal data is not a resource to be mined in a for fun or for profit projects without consequences. It wasn't always like this, but it is now and for very good reasons.
dkersten 6y ago
> Does there need to be some GDPR compliance thing? Yes. GDPR is about data protection. If you want to do business in its jurisdiction, then you need to know the laws. In general, GDPR states that you cannot store anything that isn't strictly necessary, unless you outline what you want to collect and what it will be used for in your data policies. You are not allowed to use it for anything else and once its no longer needed for the outlined use, it must be removed. Personally identifiable information has some additional rules (and its important to note that anything could become PII if combined with something else, that would, together, allow for someone to be identified). My own (EU-based) country's data protection websites states: 1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned, or some other legitimate basis laid down by law. 3. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 4. Compliance with these rules shall be subject to control by an independent authority. This means that every individual is entitled to have their personal information protected, used in a fair and legal way, and made available to them when they ask for a copy. If an individual feels that their personal information is wrong, they are entitled to ask for that information to be corrected.
cosmodisk 6y ago
But why were you afraid? I see some US based sites refusing EU visitors due to GDPR,but unless you sell their data down the road, there's not much to be afraid of.

sorokod 6y ago

"Does there need to be some GDPR compliance thing?" Sounds like you have to learn something before starting a business.

jfengel 6y ago
Unfortunately, that's a big cultural shift that a lot of people appear to be having trouble with. We all really enjoyed the days when we could throw together a project and focus on the fun parts. Then came all of the other things we should worry about -- security and scaling, which are at least technical problems, but then things like privacy, moderation, and even legality. It's fun to put up a file-sharing service; it's less fun to think about the fact that it can be used to share child porn. It's fun to have a new chat site with no filters. It's less fun when people use it to plan crime. We don't want to face that. We want to make it Not Our Problem. And here, now privacy is another one. We used to just gather up user data and we didn't plan to sell it or lose it so why did we care? The Internet is a lot less fun than it used to be. Or rather, we just managed to ignore a lot of the problems, usually because we weren't the ones affected by them. And so we didn't fix them ourselves, so laws got passed instead, which are never as good as what we'd have come up with ourselves. So yeah, it's time for people to learn stuff before starting a business. That's no fun. Too bad.
- lensopra 6y ago
  Well, on the bright side the UK to departing from GDPR. Maybe other countries will follow suit.
- sorokod 6y ago
  Not disagreeing but would say this: people's personal data is not a resource to be mined in a for fun or for profit projects without consequences. It wasn't always like this, but it is now and for very good reasons.

dkersten 6y ago

> Does there need to be some GDPR compliance thing? Yes. GDPR is about data protection. If you want to do business in its jurisdiction, then you need to know the laws. In general, GDPR states that you cannot store anything that isn't strictly necessary, unless you outline what you want to collect and what it will be used for in your data policies. You are not allowed to use it for anything else and once its no longer needed for the outlined use, it must be removed. Personally identifiable information has some additional rules (and its important to note that anything could become PII if combined with something else, that would, together, allow for someone to be identified). My own (EU-based) country's data protection websites states: 1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned, or some other legitimate basis laid down by law. 3. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 4. Compliance with these rules shall be subject to control by an independent authority. This means that every individual is entitled to have their personal information protected, used in a fair and legal way, and made available to them when they ask for a copy. If an individual feels that their personal information is wrong, they are entitled to ask for that information to be corrected.

cosmodisk 6y ago

But why were you afraid? I see some US based sites refusing EU visitors due to GDPR,but unless you sell their data down the road, there's not much to be afraid of.