3 ms·

My name, my address, my phone number and my credit card details are the same regardless whether you or Epic Games is storing them in a database.

by Hamuko 5y ago

jchw 5y ago
A data breach alone is not a GDPR violation as far as I know. Your data is just as at risk of being exposed no matter what. As far as I can tell the intent of GDPR is to prevent companies from selling or using your data in ways that you did not consent to. However, the bookkeeping requirements quite literally break the internet that existed where one person could run a website. As it turns out, I do not have a Data Protection Officer for my wiki I started in 2008. Does that mean I am not GDPR compliant?
- amichal 5y ago
  And you dont need to have one: .... hiring an actual Data Protection Officer is only required by the GDPR if you meet one of three criteria: * Public authority — The processing of personal data is done by a public body or public authorities, with exemptions granted to courts and other independent judicial authorities. * Large scale, regular monitoring — The processing of personal data is the core activity of an organization who regularly and systematically observes its “data subjects” (which, under the GDPR, means citizens or residents of the EU) on a large scale. * Large-scale special data categories — The processing of specific “special” data categories (as defined by the GDPR) is part of an organization’s core activity and is done on a large scale. https://gdpr.eu/data-protection-officer/ https://gdpr.eu/data-protection-officer/
  - jchw 5y ago
    This is good to know. But while I will admit my mistake, the problem points to a bigger issue, which is, as a layperson and not an expert on European law, I simply do not have the expertise necessary to understand the law and its implications. This is of course true of any website under any jurisdiction, but most laws don’t come with such absurdly vicious teeth, and therefore the risk profile is a lot different. So perhaps my example was misinformed. But that’s kind of the problem: you need to have a lawyer to really be sure of these things. I don’t have a lawyer.
    - amichal 5y ago
      I think the fines/penalty headlines are a big misunderstanding/distraction (which got me too until I had to spend the time on reading the actual law for an actual EU client). They are what happens if you continually, willfully disobey the principal of the laws AND are also proportional to you income (see https://en.wikipedia.org/wiki/Day-fine https://en.wikipedia.org/wiki/Day-fine which are common in some EU countries) If you are a small operator who messes up AND you are in the EU and you ignore strongly worded letters of warning with instructions on what you need to do to comply then you MIGHT be fined/penalized. If you are not making money in the EU than you are seriously unlikely to even be noticed messing up. If you miss-configured the logs on your blog or small non-EU business and kept user ids and IP addresses AND are outside the EU no one will bother you. If a privacy conscious EU citizen contacts you to close an account they made with you or delete your data you have many weeks (90 days i think ultimately) to respond, negotiate and do your best to get it done (and provide them whatever data you may have collected on them) If you have any of a dozen legitimate reasons to have personal data and you clearly explained this to the EU citizens you collected data from you are not going to hear from anyone. e.g. a EU company I work with has extensive logs of their employees changes and updates to data (imagine git commit messages). These are required logs for the business, an ex-employee cannot ask you delete that history under GDPR. Same for their b2b customers. The existence of these logs are made clear up front. It's a regulated requirement that they exist etc. If you decided to sell the log data to a third party as part of some profile of the citizen and you didnt say you intended to do that then you ABSOLUTELY would hear from someone. But I would think you very much should and this is the point. Same principles apply for California Consumer Privacy Act (CCPA) in the US.
- tgsovlerkhgsel 5y ago
  > As it turns out, I do not have a Data Protection Officer for my wiki I started in 2008. Does that mean I am not GDPR compliant? Do you have more than 250 employees? Are you a public authority or body? Are you performing activities that "require regular and systematic monitoring of data subjects on a large scale"? Is your core activity processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences? No? Then no need to have a data protection officer or data protection impact assessment. You still need to implement appropriate safety measures and efforts to follow GDPR, where "appropriate" takes the scope of your processing into account. https://gdpr-info.eu/art-24-gdpr/ https://gdpr-info.eu/art-24-gdpr/, need a legitimate reason for using the data, etc., but all of this is very doable, and you're probably already in compliance if you care the smallest bit about your user's privacy and follow normal best practices like rotating your logs. IIUC (there are two directives and I'm less familiar with the other one) you don't even need a cookie dialog as long as you aren't setting any unnecessary cookies.

My name, my address, my phone number and my credit card details are the same regardless whether you or Epic Games is storing them in a database.

by Hamuko 5y ago

My name, my address, my phone number and my credit card details are the same regardless whether you or Epic Games is storing them in a database.

jchw 5y ago

A data breach alone is not a GDPR violation as far as I know. Your data is just as at risk of being exposed no matter what. As far as I can tell the intent of GDPR is to prevent companies from selling or using your data in ways that you did not consent to. However, the bookkeeping requirements quite literally break the internet that existed where one person could run a website. As it turns out, I do not have a Data Protection Officer for my wiki I started in 2008. Does that mean I am not GDPR compliant?

amichal 5y ago
And you dont need to have one: .... hiring an actual Data Protection Officer is only required by the GDPR if you meet one of three criteria: * Public authority — The processing of personal data is done by a public body or public authorities, with exemptions granted to courts and other independent judicial authorities. * Large scale, regular monitoring — The processing of personal data is the core activity of an organization who regularly and systematically observes its “data subjects” (which, under the GDPR, means citizens or residents of the EU) on a large scale. * Large-scale special data categories — The processing of specific “special” data categories (as defined by the GDPR) is part of an organization’s core activity and is done on a large scale. https://gdpr.eu/data-protection-officer/ https://gdpr.eu/data-protection-officer/
- jchw 5y ago
  This is good to know. But while I will admit my mistake, the problem points to a bigger issue, which is, as a layperson and not an expert on European law, I simply do not have the expertise necessary to understand the law and its implications. This is of course true of any website under any jurisdiction, but most laws don’t come with such absurdly vicious teeth, and therefore the risk profile is a lot different. So perhaps my example was misinformed. But that’s kind of the problem: you need to have a lawyer to really be sure of these things. I don’t have a lawyer.
  - amichal 5y ago
    I think the fines/penalty headlines are a big misunderstanding/distraction (which got me too until I had to spend the time on reading the actual law for an actual EU client). They are what happens if you continually, willfully disobey the principal of the laws AND are also proportional to you income (see https://en.wikipedia.org/wiki/Day-fine https://en.wikipedia.org/wiki/Day-fine which are common in some EU countries) If you are a small operator who messes up AND you are in the EU and you ignore strongly worded letters of warning with instructions on what you need to do to comply then you MIGHT be fined/penalized. If you are not making money in the EU than you are seriously unlikely to even be noticed messing up. If you miss-configured the logs on your blog or small non-EU business and kept user ids and IP addresses AND are outside the EU no one will bother you. If a privacy conscious EU citizen contacts you to close an account they made with you or delete your data you have many weeks (90 days i think ultimately) to respond, negotiate and do your best to get it done (and provide them whatever data you may have collected on them) If you have any of a dozen legitimate reasons to have personal data and you clearly explained this to the EU citizens you collected data from you are not going to hear from anyone. e.g. a EU company I work with has extensive logs of their employees changes and updates to data (imagine git commit messages). These are required logs for the business, an ex-employee cannot ask you delete that history under GDPR. Same for their b2b customers. The existence of these logs are made clear up front. It's a regulated requirement that they exist etc. If you decided to sell the log data to a third party as part of some profile of the citizen and you didnt say you intended to do that then you ABSOLUTELY would hear from someone. But I would think you very much should and this is the point. Same principles apply for California Consumer Privacy Act (CCPA) in the US.
tgsovlerkhgsel 5y ago
> As it turns out, I do not have a Data Protection Officer for my wiki I started in 2008. Does that mean I am not GDPR compliant? Do you have more than 250 employees? Are you a public authority or body? Are you performing activities that "require regular and systematic monitoring of data subjects on a large scale"? Is your core activity processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences? No? Then no need to have a data protection officer or data protection impact assessment. You still need to implement appropriate safety measures and efforts to follow GDPR, where "appropriate" takes the scope of your processing into account. https://gdpr-info.eu/art-24-gdpr/ https://gdpr-info.eu/art-24-gdpr/, need a legitimate reason for using the data, etc., but all of this is very doable, and you're probably already in compliance if you care the smallest bit about your user's privacy and follow normal best practices like rotating your logs. IIUC (there are two directives and I'm less familiar with the other one) you don't even need a cookie dialog as long as you aren't setting any unnecessary cookies.