5 ms·

Ask HN: What do I need to do to make my blog GDPR compliant?

• damau 5y ago
  --Not Legal Advice Trying to avoid google analytics personally, but as you added them to your site you need a policy. You are the custodian and are sharing information to google through you. As you are the Data Controller: https://www.gdprsummary.com/gdpr-definitions/data-controller/ https://www.gdprsummary.com/gdpr-definitions/data-controller.... https://piwik.pro/blog/is-google-analytics-gdpr-compliant/#2)-you-still-have-to-collect-consents-even-if-you-don’t-want-to-process-personal-data https://piwik.pro/blog/is-google-analytics-gdpr-compliant/#2... Depending on the information logged by your nginx server, you may also need a policy. IP for instance is one thing you might need to cover.
• kenniskrag 5y ago
  (no legal advise) I think you also have to provide a postal address on the website (I think that also applies without gdpr) https://www.termsfeed.com/blog/privacy-policy-contact-information/amp/ https://www.termsfeed.com/blog/privacy-policy-contact-inform...
  • egonschiele 5y ago
    That link says “ Any business in the world that collects personal information from people in the EU (even if it's just an IP address) will be required to comply with the following General Data Protection Regulation (GDPR) Privacy Policy stipulations” but I am not a business. So can I assume it doesn’t apply to me?
    • schiederme 5y ago
      It’s miss leading. Everyone who collects personal data (IP Addresses for example), is required to have a privacy policy and to be complaint with the GDPR. At least when you have EU visitors. There are free generators for policy’s. For personal use they are enough.
    • mytailorisrich 5y ago
      An IP address is not personal information in itself. It is sensitive information, though, so it should be processed in a secure way as a matter of best practice.
      • tubularhells 5y ago
        It is PII under German and Dutch law.
• schiederme 5y ago
  Google Analytics and Logs are bad /o\ (as in compliance stuff). If you have readers in the EU and/or you are living in the EU, you are required to have a privacy policy. This (https://www.iubenda.com/en/help/8385-gdpr-for-bloggers https://www.iubenda.com/en/help/8385-gdpr-for-bloggers) article and this (https://adventurebagging.co.uk/2018/05/gdpr-guide-for-bloggers/ https://adventurebagging.co.uk/2018/05/gdpr-guide-for-blogge...) is looking like a good read. You could also be required to have data processing contracts. Some local privacy protection offices have good information about GDPR for small blogs and sometimes you can even ask them directly. no legal advice
• mytailorisrich 5y ago
  You do not say in which country you are and in which country your website is hosted. If you are outside of the EU (e.g. US), I'd say the simplest is to ignore. Frankly, even if you are in the EU I would probably ignore that email if it's from some random person.
• deleted 5y ago
  [deleted]
• Tomte 5y ago
  You mean this one? Seems to be spam/trolling/whatever. My name is #REDACTED#, and I am a resident of Roanoke, Virginia. I have a few questions about your process for responding to General Data Protection Regulation (GDPR) data access requests: Would you process a GDPR data access request from me even though I am not a resident of the European Union? Do you process GDPR data access requests via email, a website, or telephone? If via a website, what is the URL I should go to? What personal information do I have to submit for you to verify and process a GDPR data access request? What information do you provide in response to a GDPR data access request? To be clear, I am not submitting a data access request at this time. My questions are about your process for when I do submit a request. Thank you in advance for your answers to these questions. If there is a better contact for processing GDPR requests regarding 2uo.de, I kindly ask that you forward my request to them. I look forward to your reply without undue delay and at most within one month of this email, as required by Article 12 of GDPR. You need to have a privacy policy, legally (nobody will really care if you're just having a private blog). Take a look at mine: https://www.2uo.de/privacy/ https://www.2uo.de/privacy/ (but this is without GA). If you have server logs and Google Analytics, you'd write that you need the logs for problem debugging and Google Analytics to improve your web site. Both are legitimate interests, and you don't need any kind of pop-up or so. Removing GA is a good idea anyway, if you don't really use it (like most small private blogs who implement it, just because it's easy – I used to do that, too).
  • egonschiele 5y ago
    That's the one! Good to know it's spam. I removed GA and added a privacy page. Thanks!
    • mytailorisrich 5y ago
      There is no reason to reply to such email in any case. Clearly nothing good can come of it. Use GA if you want to.
• ancymon 5y ago
  Your personal blog? I think GDPR usually is applicable only for businesses. For example you don't need to adhere to GDPR when saving new contact on your phone. Maybe personal website might fall into such category as well.
• paulcole 5y ago
  Unless you have a real audience in Europe, just block European traffic.
• leipert 5y ago
  Not a lawyer. If you do not need GA why use it? It is a separate connection your visitors browser needs to open and it is a connection to a third party. If you want analytics, there are some privacy options, for example Umami. See also here: https://github.com/0xnr/awesome-analytics https://github.com/0xnr/awesome-analytics You could also disable the Nginx logs from logging IP addresses and then you should be fine. Maybe adding a simple site saying that you do not retain any IPs or other information, you can prevent these emails in the future. Edit: Nice looking website.
• deleted 5y ago
  [deleted]