23 ms·

EBCDIC is incompatible with GDPR

294 points by edent 5y ago

gerikson 5y ago
I have to admit, I did not have "EBCDIC" && "GDPR" on my 2021 bingo card.
CoastalCoder 5y ago
Can someone comment on what assumptions those banks are permitted to make regarding names? E.g., can they assume that names can be expressed as a sequence of (current) Unicode characters with some specific maximum length? Can they assume that names have no leading / trailing spaces?
- mqus 5y ago
  I think that it has to be reasonable. Assuming that your French-speaking target region has only names without accents is unreasonable. Assuming a maximum length of 200(?) utf8 codepoints(or even bytes) seems reasonable (defendable) in court. Same for leading/trailing spaces.
  - temac 5y ago
    The longest personal name, according to the Guinness World Records, was 747 characters long, and happened to be in a latin alphabet. So I guess ~ 1000 bytes should be OK. Or even maybe what could be enough to fit 200 arbitrary utf8 codepoints, so 800 bytes. If you want to be safe maybe allow for up to 1000 arbitrary codepoints? :)
    - Smoosh 5y ago
      Oh man, I don't want to be in the queue behind that guy while he spells out his name to the clerk.
- contravariant 5y ago
  I'm somewhat wondering to what extent a bank is required to support storing the names natively. I mean something like "${name} spelled with an acute accent on the e" would be technically a correct description even if it is impractical to use. The GDPR does grant you the right to correct your personal information but doesn't specify how this information is represented. As far as I can tell the GDPR also doesn't grant the customer the right to have their name represented correctly on their bank pass (otherwise everyone with a long surname would require impractically long bank passes), the court only ruled that the inability of the bank to store the name correctly simply isn't an excuse.
- mindcrime 5y ago
  I wonder if there are any limits on this from the GDPR perspective? What if my name has 2^40 characters in it? Are companies required to support that? What if I change my name from whatever it is today (say, "Phillip") to a name that has 2^40 characters? Would the bank be required to accommodate that? etc..
  - PeterisP 5y ago
    In civil law countries (after Brexit, 100% of EU is civil law) generally you can't change your name at will or by simply starting to use it, it usually requires asserting one of specific reasons that (in the eyes of the law) justify a name change, a request to authorities and their approval - which would be denied if you wanted to change your name to something that has 2^40 characters. If you did officially change your name to something interesting, I presume the bank would definitely have to accommodate it; but the restrictive part would be the process of actually changing your name.
  - samus 5y ago
    The GDPR contains language that makes its provisions relative to the current techical state of the art. A bank can clearly not be expected to store all the 2^40 bytes of a person's name :)
- tialaramex 5y ago
  Probably reasonable assumptions. When you're not sure, assume the standard will be reasonableness, because that's what the law assumes when it isn't specified. So, you can make reasonable assumptions. What is reasonable will change, which is fine because the way courts figure out what's reasonable in some particular case is to either have the judge decide, or have a jury decide, and people change too. The nice thing about reasonableness is that you are equipped to make a first pass at judging it yourself, since you are presumably a reasonable person. If you need second guessing, have a team mate consider it, and, if you're worried that your collective idea of "reasonable" might be distorted in an important way, that'll be why your organisation probably encouraged diversity to avoid that. You might say, this seems awful because it isn't precise enough to say, implement it as a Javascript library. That's true, but intentional. Justice will necessarily involve such judgement calls, and trying to evade that by specifying everything precisely with no room for judgement is a bug not a feature.
- PeterisP 5y ago
  I believe that the main assumption they can make is that they can use the name on the ID forms issued by the government or, in case of foreign citizens, their passports. Due to history of international diplomacy, the general standard for passports expects that in addition to whatever script the country uses, they will also include the name of the person in English or French - so this is the key source of the problem, as for passports in e.g. Russian you will get an "English" name that you might use, however, you may get passports with names only in French, so you would have to support the English and French alphabets but perhaps not necessarily any others. Regarding trailing spaces etc, IMHO the standard would be "as shown in passport" i.e. trailing spaces definitely would not matter, but spaces and punctuation between words would (e.g. D'Artagnan as a name). I looked for but did not find any specific restrictions on name length. In general, the country will have regulations on what they accept as names in their official IDs, and again you may piggyback on other institutions - as long as you accept everything for which your government have issued documents, you should be fine; and if someone has an interesting case that requires changing the process, let that fight happen between them and the government first.
erk__ 5y ago
Time to break out UTF-EBCDIC! https://en.wikipedia.org/wiki/UTF-EBCDIC https://en.wikipedia.org/wiki/UTF-EBCDIC
- LinAGKar 5y ago
  Thanks, I hate it
- deleted 5y ago
  [deleted]
- justin_oaks 5y ago
  Interesting. It makes a bad system worse to try to make it better.
- Kim_Bruning 5y ago
  truly terrifying!
spullara 5y ago
My brother-in-law has an apostrophe in his last name and almost no systems bother to support it and it is in the character set. If this is an example of an appropriate use of GDPR, wow.
cabalamat 5y ago
If EBCDIC is incompatible with GDPR, then so are machine-readable passports as the format only allows ascii letters A-Z. https://en.wikipedia.org/wiki/Machine-readable_passport#Names https://en.wikipedia.org/wiki/Machine-readable_passport#Name...
- dane-pgp 5y ago
  That seems like a sufficiently different scenario to me (as a non-expert) that I think a court could reasonably reach a different conclusion. Firstly, if a government decides to "comply" with the GDPR by just seizing and revoking your passport, you might not have a case against them as the granting of passports could be considered a Royal Prerogative (or an equivalent under other systems of government) and thus non-justiciable. You might try to claim this is discrimination, but I don't think that "non-ASCII characters in name" is a legally protected class, and of course anyone could change their name to have or avoid non-ASCII characters. Also, if the format is designed to be machine-readable, then arguably the "accuracy" of your name on the passport has to be judged by the machine, not by you as the holder of that name. Moreover, the format is agreed as a consequence of an international treaty, which again might put it beyond the jurisdiction of a domestic court, and if your passport was declared invalid by a nation you were attempting to enter because it contained non-standard characters, that is not something that a domestic court could provide a remedy to.
gpvos 5y ago
More articles should have a "Dance" section.
gpderetta 5y ago
Every problem can be solved with an additional level of indirection. For example use html character entities for characters that are not representable in the DB character set.
- deleted 5y ago
  [deleted]
- caf 5y ago
  And/or rename the existing "Name" field to "Named-based Index Key" and add a new field for Name.
  - FateOfNations 5y ago
    Our just leave it with "Named-based Index Key"... "no sir, we aren't able to correct your name since we don't store names in our database."
jan_Inkepa 5y ago
They don't say what the outcome of the case is? I guess it's still in progress(seems to be 2 years old though)? Really interesting use though! Edit: ah on the linked wiki article it says: > The Court of Appeal of Brussels held that, in accordance with Article 16 GDPR, the data subject has the right for their name to be correctly spelled when processed by the computer systems of the Bank So the plaintiff won, but no word on if/how the bank actually fixed it.
- Luc 5y ago
  The lower court ordered the bank to spell the name correctly. The court of appeal upheld this judgement. Source (Dutch): https://www.gegevensbeschermingsautoriteit.be/publications/arrest-van-9-oktober-2019-van-het-marktenhof.pdf https://www.gegevensbeschermingsautoriteit.be/publications/a... This tweet says it was ING Bank: https://twitter.com/simonhania/status/1270812210584043521 https://twitter.com/simonhania/status/1270812210584043521
  - Deukhoofd 5y ago
    > De geschillenkamer van de GBA heeft deze uitleg als niet afdoende aangezien. Dat een bankinstelling anno 2018 niet bij machte zou zijn om een naam van een klant correct te schrijven onder uitleg dat zij nog gebruik maakt van een informaticasysteem van 1995, werd niet afdoende beschouwd. Ouch. Basically "That you're not able to write a customers name correctly in 2018 because you use a system from 1995 is not an excuse".
    - jerf 5y ago
      The court does have a point in this case. There's a huge number of systems in the world that existed in some form in 1995 and were correctly handling names in 2018. It's not like that's some sort of weird case that nobody else has encountered.
      - bawolff 5y ago
        Indeed: Iso 8859-1: 1985 Unicode: 1991 Utf-8: 1992 There is even IBM277 for an ebcdic version.
mjburgess 5y ago
The ruling was that the bank has to change: https://gdprhub.eu/index.php?title=Court_of_Appeal_of_Brussels_-_2019/AR/1006 https://gdprhub.eu/index.php?title=Court_of_Appeal_of_Brusse...
zinekeller 5y ago
.. until it ends with "SWIFT is incompatible with GDPR". (Okay, privacy wise, some might have uneasiness with SWIFT but we're talking about how it can't handle (in this case) characters outside US-ASCII, unless you have negotiated it with the bank you're sending on, which if it's a US bank, is not supported: https://twitter.com/ajlobster/status/735240869859753985 https://twitter.com/ajlobster/status/735240869859753985)
- PeterisP 5y ago
  I'm not sure about the speed and schedule of adoption, but I believe that SWIFT systems across the world (including USA!) are migrating towards ISO 20022 messages which has technical support for characters outside US-ASCII; and requirements such as these are a driving factor to migrate away from the earlier SWIFT MT standards.
  - zinekeller 5y ago
    ... hopefully, but I wouldn't be shocked if the systems can technically receive Unicode-encoded transfers but then "convert" it into ASCII/EBCDIC at their mainframes :/
_pmf_ 5y ago
That's one way to get your account cancelled.
- gpderetta 5y ago
  I'm sure that cancelling accounts of people with "funny" spellings, will definitely not get the bank in trouble for (indirect) discrimination at all.
- gambiting 5y ago
  Not sure about Belgium specifically, but at least in UK the bank can't close your account without a valid court order. They can temporarily suspend it if they suspect you of some crime, but in general a normal checking account cannot be closed by the bank "just because". I'd expect it to work the same way in all of EU.
  - fallingknife 5y ago
    That's great! Should be the same in the US, and also apply to payment processors.
- DarkWiiPlayer 5y ago
  ooof... didn't GDPR also have some strong opinions on retaliation though?
- silon42 5y ago
  Or in the future, getting international payments disabled (including most credit cards).
- PeterisP 5y ago
  Since banking account history has to be stored and provided for literal decades after account closure, they would still have to implement the changes even if that customer left, as they will still be processing his data and have to do it according to the law.
tyteen4a03 5y ago
This ruling is interesting. As a person with names in Chinese, I could technically force my bank to support UTF-8 simply by saying I do not wish to be known as my English name, which is the phonetic spelling of my Chinese one. Now since I'm Hongkongese where my English legal name is as legal as the Chinese one the law might be different but for Chinese people though...
- caf 5y ago
  Same for those with Arabic, Persian, Korean, Thai, Russian ... names
  - egeozcan 5y ago
    Also Greek, Turkish, German, Romanian... Is there any language other than English that can be written 100% by ASCII characters? If you have special letters in your name, you'll have a different name in another country without that letter. My surname is supposed to be Özcan, but it's Ozcan or Oezcan in many official documents. Don't even let me start with the "Turkish iİıI problem"... I mean it's not totally unrecognizable but it's a different name nevertheless. I was talking to a Romanian colleague recently and she told me that most of the country uses some US keyboard layout instead of Romanian and cannot type Romanian letters, so people have 2 names even in their home country.
    - gpderetta 5y ago
      thinking that ASCII is enough for English is a bit naïve.
      - xxpor 5y ago
        Spelling it that way is a fantastic way to look pretentious.
        WorldMaker 5y ago
        It's at least a little more elementary than that. There are many, many school teachers of young children that will tell you that words like coöperative lost a lot useful disambiguation power when English dropped support for such syllabic markers. I see words written like that and I think of grade school, which seems like the opposite of pretension.
andrewaylett 5y ago
Sounds like the perfect use-case for UTF-7? https://en.wikipedia.org/wiki/UTF-7 https://en.wikipedia.org/wiki/UTF-7 No, I'm not entirely serious.
- krallja 5y ago
  You probably want UTF-EBCDIC instead: https://news.ycombinator.com/item?id=28987256 https://news.ycombinator.com/item?id=28987256
rocqua 5y ago
So, the part of the GDPR the bank was unable to comply with here is the "right to rectification". That suggests that the bank made a 'mistake' when it recorded the name in its system as well as it could. I don't think that should count as a mistake. The information in the bank's system is as good as it could be, so there is nothing to rectify. It feels weird to me when privacy legislation turns out to require supporting UTF-8. I think something in the legal process went wrong here.
- dmitriid 5y ago
  > It feels weird to me when privacy legislation turns out to require supporting UTF-8. No. It requires you to store data correctly. And in the case of a bank storing data incorrectly could have potential ramifications (think two different people, one with diacritics and without). The law doesn't care whether you use UTF-8 or a manually written translation table, or a 15th-century printing press
  - Volundr 5y ago
    > And in the case of a bank storing data incorrectly could have potential ramifications (think two different people, one with diacritics and without). Surely this situation wouldn't cause any issues though right? If they are relying on names as unique identifiers, they've got far bigger problems than a users name being spelled incorrectly.
    - TeMPOraL 5y ago
      No, but banks interact with people - both customers and employees. People interpret names. Errors like this could be used to, for example, impersonate someone (by tricking an employee), or deny someone service (e.g. via a clerk who behaves like a zombie, a protein peripheral of the bank's computer system).
    - gspr 5y ago
      Issues? Depends on what you mean. Maybe not practical issues, but I for sure would be offended if my bank refused to use my actual name. I find this whole ordeal delightful, and applaud the intention of the GDPR and the ways the courts upheld it in this case.
qwerty456127 5y ago
The first comment saying "TrÃ¨s intÃ©ressant !" looks hilarious in this context. I wonder if it has been made to look like this intentionally or not.
- nerdponx 5y ago
  I'm sure it was deliberate. Got a good laugh out of it!
- capitainenemo 5y ago
  Certainly looks like a joke to me, especially given all the correctly rendered text, and the various encoding related comments. Was probably rendered like this. $ echo "très intéressant" | iconv -f iso-8859-1 -t utf-8 trÃ¨s intÃ©ressant
  - murkle 5y ago
    ... and in reverse with this very cool tool (found on HN I think) https://ftfy.vercel.app/?s=tr%C3%83%C2%A8s+int%C3%83%C2%A9ressant https://ftfy.vercel.app/?s=tr%C3%83%C2%A8s+int%C3%83%C2%A9re...
    - capitainenemo 5y ago
      Well... you can do it in reverse with iconv too... $ echo trÃ¨s intÃ©ressant | iconv -f utf-8 -t iso-8859-1 très intéressant Admittedly no autodetection. Luckily EU mangling is usually just one or two encodings.
      - rndgermandude 5y ago
        > Luckily EU mangling is usually just one or two encodings. Just to list the iso-8859 parts concerning EU member states: - iso-8859-1 (Latin-1, Western European, including German umlauts, French accents, etc) - iso-8859-2 (Latin-2, Central European, including characters to support Polish, Czech, Slovakian, Hungarian and other) - iso-8859-3 (Latin-3, South European, including characters to support Maltese) - iso-8859-4 (Latin-4, North European, including characters to support the Baltic states) - iso-8859-5 (Latin/Cyrillic, including characters to support Bulgarian) - iso-8859-7 (Latin/Greek, including characters to support Greek) - iso-8859-10 (Latin-6, Nordic, refinement of Latin-4, popular in Baltic states) - iso-8859-13 (Latin-7, Baltic Rim, because -10 was not enough) - iso-8859-15 (Latin-9, basically Latin-1 with the €-sign and some commonly used characters missing in Latin-1) - iso-8859-16 (Latin-10, South-Eastern European, "Intended for Albanian, Croatian, Hungarian, Italian, Polish, Romanian and Slovene, but also Finnish, French, German and Irish Gaelic (new orthography)") And they are all still in use. ;) It seems to me -15 is now more popular than -1, probably because it supports the Euro currency sign.
Aardwolf 5y ago
Makes me wonder what the rules for registered names are: is a registered name a series of characters from an existing writing system, that would hopefully be compatible with Unicode, or is it anything a human being could possibly write on a piece of paper, including something that has no equivalent in any writing system?
- zokier 5y ago
  I don't know about Belgium, but at least Finland has whole committee deciding on what are legal names and what are not https://oikeusministerio-fi.translate.goog/nimilautakunta?_x_tr_sl=fi&_x_tr_tl=en&_x_tr_hl=fi&_x_tr_pto=nui https://oikeusministerio-fi.translate.goog/nimilautakunta?_x...
- samus 5y ago
  Governments usually have their own standards and rules on which names they would recognize and how they would store them. They would reject names that are impossibly long or can only be spelled with homegrown writing systems, same as they would reject stuff like "Fuuk Yu". Edit: on the downside, they would probably also reject many reasonable names.
xfz 5y ago
https://tools.ietf.org/id/draft-msporny-base58-01.html https://tools.ietf.org/id/draft-msporny-base58-01.html
edwinjm 5y ago
Heh, if you're looking for a good example of Technical Debt… Yes, already in 1995 Unicode was an established standard (even Windows 95 started to support it). The bank should have known it would be a requirement in the future.
- coldacid 5y ago
  Unicode's old enough that Windows NT was built to work with it natively. In fact, all the "ANSI" Windows API calls in NT were just wrapper functions around the Unicode equivalents handling Unicode/code-page conversions. And this was 1993.
  - WorldMaker 5y ago
    Yup, in fact the biggest compatibility headaches in NT today stem from how early they adopted it: they made some assumptions about UCS-2 that turned out to be wrong and had to shoehorn in UTF-16 support that mostly works (except when it falls over a cliff). Meanwhile Linux and others waited for UTF-8 to exist and that's become the internet/web's major standard as well and there are some small papercuts interoperating between UTF-16 and UTF-8 that with today's hindsight shouldn't have been so annoying or necessary. Windows might have been better off waiting for UTF-8 itself other than Windows made the right architectural decision for the time when it made that decision and could not have suspected UTF-8 to turn up only a few years later.
    - anthk 5y ago
      > Meanwhile Linux and others waited for UTF-8 UTF-8 was already a thing in Plan9.
      - WorldMaker 5y ago
        UTF-8 was first presented to IETF at Usenix in January 1993. NT 1.0 shipped June 1993 and had been in development for several years before that. The famous "Plan 9 implemented UTF-8 first" thread's most specific date mentioned was September 1992 which only three months more lead time before the standardization notice in January 1993. Are you suggesting the NT Kernel team should have somehow better paid attention to a not-yet-standard from a research laboratory Operating System? It still probably would have been a couple years too late in the design/architecture process even if they had, given the release data in June 1993.
po1nt 5y ago
Imagine you maintain this system and somebody named X Æ A-XII Musk will try to register. Jokes aside. I know a person named exactly like me just with a small diacritic difference. I realize they use secondary identifiers but this is identity theft waiting to happen.
- kayodelycaon 5y ago
  I go by Kayodé online (Kay (actually Qué) oh Deh), which isn't the African name Kayode (Ki-oh-Day or Ki-oh-Dee). The number of places that don't support diacritics this is absolutely mind-boggling.
- josephcsible 5y ago
  > Jokes aside. I know a person named exactly like me just with a small diacritic difference. I realize they use secondary identifiers but this is identity theft waiting to happen. I don't see how that really makes identity theft any worse. There's already a ton of people with exactly identical names, and differing only in diacritics isn't any worse than that is.
- FateOfNations 5y ago
  I suspect that kid is going to change his name as soon as he can. Was taking their fantasy name and turning it into something like "Ashton Archangel Musk" too just too pedestrian for them? I unfortunately have a number of people who have the same name as me. Get emails for them sometimes...
cannabis_sam 5y ago
I want to suggest that businesses should be penalized somehow for using “ancient” technology, but then on the other hand you have roman concrete…
- mminer237 5y ago
  You shouldn't penalize stuff for being old. You should penalize stuff for being bad. Not being able to accurately store and represent customers' names is the problem here, not that it's old.
  - cannabis_sam 5y ago
    Yeah, that was my point..
asdfe8988 5y ago
>EBCDIC is an ancient (and much hated) "standard" which should have been fired into the sun a long time ago. It baffles me that it was still being used in 1995 - let alone today. I want a pony.
- BBC-vs-neolibs 5y ago
  That's my que: "Does this mean that Z̷̡̧̢̰͓̪͖̭͙̰̣̱̬̹̙̜̪̣̏̿̏̋͑́̒͑́̒̿̇̈̍̇̌͝͝a̵̡̧͍̘̮̤̙̹͙̦̙͙͖͓̥̟̦͔͒̇̊̊̔̓́͒́̌̈́̑͋̏̏̏̚͘͝͠͝l̶͉̯̱͇̭̭̉̉̈́̿͐̽̒̎̽͌̚͜ģ̸̧̛͙̩̹̰̤̱̖̘̻̪̻̮̫̟̙̲͍̰̻͕̗̫̿̆̃́͗̽̊̽̌̔̂͂̈͊̐̈́̈̈́̈̓̆͌̑́̕͜ǫ̶̢̹̥̮̟͍̔̑̔̽ can finally open a bank account?"
gregw2 5y ago
Transitioning off a long established core mainframe/AS400 app is not necessarily so easy as just changing to UTF-8 as the article author implies. If you have no mainframe or enterprise experience to relate to that observation, consider the effort involved to transition from python 2 to (UTF-8 clean) python 3! That said, I am not even clear from the article which diacritical markings are missing from EBCDIC and if the lawyers arguments to "not change" were legitimate in the way the article implies... you do realize there are hundreds of EBCDIC code pages covering at least all the European languages ... since these are markets which IBM has sold into for 50+ years now, right? I only learned about EBCDIC code pages when trying to proactively properly setup character encoding handling for data extraction from one of my employer's long running AS400s... "Which EBCDIC?" is not that different a headache from "which extended ASCII code page?"... EBCDIC is not just like 7-bit (non extended) ASCII as the article implies.
- toyg 5y ago
  > Transitioning off a long established core mainframe app is not necessarily so easy I don't think the author implied it was easy, just that it should have been done at some point in the 25 years since the system was first implemented. The last paragraph is just an exortation to use Unicode everywhere all the time, today.
- nemoniac 5y ago
  [flagged]
  - meepmorp 5y ago
    Are you implying that the Nazis are responsible for EBCDIC? If not, how does your point relate to the topic at hand?
    - jackjeff 5y ago
      Nah. The Nazis were too busy creating Facebook :)
    - sipos 5y ago
Muromec 5y ago
oh, now I wonder if I can cite GDPR (and Dutch government for their BRP thing) and ask my bank to spell my name in a proper Ukrainian Cyrillic the same way it is done in my id.
CWuestefeld 5y ago
At the time I moved out of New Jersey 8 years ago, the state was still unable to represent my completely vanilla name on my driver's license. My first name is "Christopher", but their computers can't/couldn't handle an 11-character name. It was always truncated on my driver's license. This led to problems when they instituted their trusted ID compliance. When renewing the license we were required to provide some combination of documentation to corroborate our identity, and obviously that documentation needs to match the name shown on the driver's license - and of course mine did not. There was one way out for Christophers like myself. A birth certificate was considered the ultimate truth, so as long as I had a notarized (with the raised seal) birth certificate to prove my identity, they would allow me to renew my license. The State of New Jersey is very awful at IT. My wife, who works in healthcare finance, told me about problems she was having with the State because - get this - their field for what amounts to "Medicaid ID#" was too narrow, so they had to recycle ID#s for new recipients! And to make that worse, they discarded old backup data so when checking the data for a patient several years ago, it's only possible to find that of the latest owner of ID# 12345.
- pickledcods 5y ago
  I have the exact same problem with my European passport. maximum name length, that is total first+middle+surname must be less than 30 characters. Officially I am not who I am.
  - toyg 5y ago
    That's not a limitation of the European format, which is in fact not agreed on in the original resolution [1]. Your country is doing it wrong. In the UK, where the format has been set in 2014 so still in an EU context, the limit is 60 (30 for surnames, 30 for the rest). Interestingly, it looks like we're actually going backwards on this: accented characters have actually been dropped from the main passport page in recent years, to be replaced with ICAO transliterations. Which is shameful, to be honest, since it implies passports are now incomplete as a form of ID (unless the real name is recorded somewhere else). Airline lobbying clearly won the day, years ago. This seems to be a UK-only thing at this point. [1] https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:41981X0919:EN:HTML https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX...
CWuestefeld 5y ago
Question: does the bank have the right to say, "I'm sorry Mr potential customer, but we can't meet your requirements so are unable to give you an account"? Or is it essentially required that everyone doing business must do things like keep all computer systems modernized?
- hyperman1 5y ago
  Belgian law, if I am not mistaken, requires that every Belgian (European?) Inhabitant has access to a basic package. The bank can deny access to credit etc, but an account and a (normal debet) bank card are a right.
- PeterisP 5y ago
  I wanted to say that they should not have that right, however, looking at GDPR, perhaps it's not forbidden after all. However, it's worth noting that it's not just a single exceptional person - Belgium has accented letters in two of their three official languages and names with accents are reasonably common, so if you tried that, you would have to discard many customers, and also those customers would be overwhelmingly from the french-speaking part of the country so that might be treated as explicit discrimination targeting the french-speaking minority community.
- samus 5y ago
  Such a complaint is hard to defend if the customer presents a government-issued identification document. If governments can agree on certain technical standards, even though some of them are actively hostile to each other on other important matters, surely banks can be expected to comply with some of them too. The bank is entitled to use whatever internal representation they like (although they better don't misidentify persons), but they better be able to print the correct name in forms and letters. The embossed name on payment cards is a separate, more troublesome issue. The bank should provide appropriate documentation as evidence if the cardholder's embossed name could not be spelled correctly because of limited technical standards.
retrac 5y ago
In slightly related news, Ontario just last year finally allowed people to use accented characters in their official legal names, birth certificates, and so on. French has been an official language in Ontario for over half a century. The reason it wasn't possible until recently was entirely technical. The systems were limited by ASCII or, yeah, possibly EBCDIC. (I don't have the details.) Still no guidance on how the average government clerk with the very common US-style layout is supposed to type them in, though. https://news.ontario.ca/en/release/58538/ontario-introduces-french-accents-on-drivers-licences-and-ontario-photo-cards https://news.ontario.ca/en/release/58538/ontario-introduces-...
- gspr 5y ago
  What I don't understand when I hear stories like these is why the hell not just use someone else's solution? Surely neighboring Québec had this sorted out ages ago – why not just duplicated whatever they did? Problem solved in no time. Going further, I wonder why for example the EU doesn't try to get schemes going that facilitate the copying of IT solutions between member states. Why does every country have to reinvent the wheel?
  - coldacid 5y ago
    I think even the Quebecois hate the French-Canadian keyboard layout. Certainly it's incredibly hated here in Ontario.
    - kps 5y ago
      https://en.wikipedia.org/wiki/CSA_keyboard https://en.wikipedia.org/wiki/CSA_keyboard is just awful — it uses ‘right Control’ as a graphic-shift modifier for most characters, instead of AltGraph/Option. (It also uses AltGraph/Option for some common characters like []<> and for French «».) You can't find a better example of government committee work anywhere.
    - toyg 5y ago
      You mean the Québécois, surely (sorry, couldn't resist - on topic for the thread...)
dhosek 5y ago
One of the fun things about EBCDIC is that 370 assembler has opcode-level support for converting an EBCDIC-encoded numeric string into an integer (and maybe the other way around too, it's been a while). This is one of two things I remember about my now-ancient 370 assembler knowledge. The other is that there is no built-in support for maintaining a call stack. It is up to each subroutine to handle this and there were some weird declarations around this to indicate whether a subroutine was reentrant, the definition of which escapes me now. And people shouldn't criticize EBCDIC too much, after all Windows still dumps a lot of crap in legacy 8-bit coding that can cause applications to break (there was a recent post on HN about someone being unable to run the IntelliJ debugger because of an accent in their username). At least EBCDIC is clear about its limitations.¹ ⸻⸻⸻ 1. I'd be remiss if I didn't point out one other EBCDIC weirdness: It has two vertical bars, | and ¦ which always caused complications in translations between EBCDIC and ASCII. IIRC, ¦ was the more common symbol in EBCDIC coding but some converters wanted to translate | to | instead (or maybe it was the other way around—the last time I did IBM big metal was 30 years ago).
- toyg 5y ago
  > there was a recent post on HN about someone being unable to run the IntelliJ debugger because of an accent That's not Windows, that's JVM weirdness. Using the right calls, this sort of thing has been fine in Windows for some time.
  - dhosek 5y ago
    It's JVM weirdness on Windows. This isn't a problem on Linux or MacOS where file paths won't be in some arbitrary encoding. This ends up biting a lot of other cross-platform software as well and is why Rust has OSString, but for code in, say, C/C++ it ends up being a major pain point (the TeX development team often end up dealing with this sort of issue).
    - breakingcups 5y ago
      File paths on Windows aren't in some arbitrary encoding either?
N19PEDL2 5y ago
If the bank still relies on legacy software and IT standards, well it's just its fault. They cannot expect people with diacritics or other non-ASCII characters in their name just to spell it incorrectly because their systems do not support Unicode in the twenty-twenties. Maybe their IT team had other priorities than replacing EBCDIC with Unicode (or whatever they find more appropriate for their systems), but this is an indicator of poor interest in technological progress by the bank itself. It reminds me some banks that gave millions to Microsoft to keep ATMs running Windows XP after its end of life. Edit: I elaborated a bit more and I realized that it might be more difficult than just replace the character encoding standard to a more modern one. For example, the name of the account owner likely needs to match exactly the holder name on the credit card associated with the account, and I'm not sure if diacritics can be embossed correctly on the card.
oldie 5y ago
Remember all the ghastliness with code pages that sprang up around Ascii, such that systems configured for different languages didn't agree about what characters most code points were supposed to represent? Well, good news: Ebcdic supports that. For example, here's a code page that can represent all the characters you're likely to need in French: https://en.everybodywiki.com/EBCDIC_297 https://en.everybodywiki.com/EBCDIC_297 So, to be unable to represent á, è, ô, ü, ç, etc, the application would have to be locked into not just Ebcdic but also a particular Ebcdic code page that seems unsuited to the locale where the program was running. Admittedly, an Ebcdic system will have difficulty representing French, Greek and Russian names at the same time, because there's no code page that encodes all the necessary characters. An application hard-coded to US-Ascii would also be unable to support accented characters, and an application using any one Ascii code page (as opposed to Unicode) would have the same difficulty representing French, Greek and Russian names at the same time. Which is why, in 2021, we don't do that.
GoblinSlayer 5y ago
Just store UTF-8 in base64 encoding, it's compatible with ebcdic.
Kiro 5y ago
In a similar case in Ireland they ruled in favor of the data controller: > Following an eight-month investigation, the Data Protection Commission (DPC) have ruled that individuals do not have an 'absolute right' to have their names spelled with fadas. https://ireland.bloomsburyprofessional.com/blog/no-right-to-fada-under-gdpr-says-dpc https://ireland.bloomsburyprofessional.com/blog/no-right-to-...
- DoubleGlazing 5y ago
  That was an abomination of a ruling. I find it amazing that the Data Protection Commissioner basically went against the constitution which clearly states that Irish is the first language of Ireland.
seiferteric 5y ago
It seems like there should be some technical solutions though. Maybe just use the name field in the mainframe DB as a unique hash of the utf-8 encoded name and store the real utf-8 encoded name in an external DB or something.
SavantIdiot 5y ago
In 2018 I inherited a rather large website, and have been slowly fixing it to support unicode because many of the users want to use their real names, not an English-hack version of it. It is WAY more complicated than I thought it would be. There is so much code that manipulates strings that is not unicode aware. I've fixed the simple things, like places where the user name is displayed, etc., but the email subsystem is a train wreck and there are still places in the database where I couldn't retroactively fix old entries. Going on 4 years fixing this! But EBCDIC? Damn, opportunity to make lots of $$ here fixing people's code. I had friends that made bank on Y2K prep in the mid-90's.
- kccqzy 5y ago
  > email subsystem is a train wreck Actually, which email system supports email addresses with non-ASCII user names? And which additionally supports IDN domains?
  - SavantIdiot 5y ago
    Actually, there are other parts to the email subsystem besides the POP/SMPT interface, such as code that dynamically generates the subject and body, and have lots of regex and string manip code in them.
jwildeboer 5y ago
(Decision from 2019, unfortunately article doesn’t add updated information on if/how the bank solved this)
jstanley 5y ago
According to the author's tweet, the customer sued and won: https://twitter.com/edent/status/1450731852302532608 https://twitter.com/edent/status/1450731852302532608 I wonder why this fact is absent from the blog post? This is a baffling ruling. I don't think an inability to support funny characters should be considered a GDPR violation. Anyone can put any characters they want in their name, and everyone is not breaking the law just because Unicode doesn't have made-up squiggles.
- xyzzyz 5y ago
  First, just to be clear, these are not by any means “funny characters”. These are perfectly normal characters in languages used by these people. Second, if you were trying to make a point that people can put Unicode emoji in their names, well, try doing that on a birth certificate and tell me what the registration office tells you. If you successfully manage to get an actual “funny character” in your legal name, let me know.
- orf 5y ago
  For a lot of the world the characters you are typing with are “funny characters”.
  - adolph 5y ago
    At least 1.4B of them. https://en.wikipedia.org/wiki/Demographics_of_China https://en.wikipedia.org/wiki/Demographics_of_China
surfingdino 5y ago
Mainframes, COBOL, and databases that store data in formats that replicate the hard limits of paper punch cards are a real problem. Banks, insurers, and governmental institutions won't get rid of them and choose to surround those fossils of IT with layer upon layer of tech that gets outdated the moment it gets delivered. I was on a project where we were told to come up with an alternative way of encoding UUID4s, because "bank X runs their DB on a mainframe and they only have N bytes they can use for an ID." It used to be a given that nobody wanted their bank to run on anything, but mainframes. Now we'd rather they used cloud computing and Postgres. Mainframes have had their day. They may have a future, but they need modern databases and development tools.
- that_guy_iain 5y ago
  > It used to be a given that nobody wanted their bank to run on anything, but mainframes. Now we'd rather they used cloud computing and Postgres. Mainframes have had their day. They may have a future, but they need modern databases and development tools. I suspect you ask random Joe on the street they would say they would rather be on a mainframe. Also, I would much rather my bank didn't host on AWS, GCP, Azure, etc.
  - samus 5y ago
    The technological state of the art at the backend is a circle. You don't have to squint that hard to see the similarities between a hypervisor running hundreds of VMs and a mainframe running hundreds of batch jobs. The difference is just that the mainframe is usually (but not always) co-located with the bank. But small bank branches might completely lack mainframe systems on their own.
  - mmis1000 5y ago
    Mainframe nowadays do support modern language and modern tech stack. It's just no one willing to move on to the next stack.(or probably too expensive to) For example, IBM z runs linux. Backward compatibility is one of the biggest selling point mainframes provide, you can run code written 30 years ago with all limitation and bug preserved as is. And IBM z can also run many program write for original ibm/360 unmodified. Probably many ones decided to do so.
AtNightWeCode 5y ago
Simple to fix comparing to GDPR in general. Like where there are local laws that overlap and then EU laws that overlap that and then GDPR upon that. It is not like you can just follow GDPR cause then you may break a bunch of other laws.
markstos 5y ago
I once worked for a newspaper while they were researching if dead people were voting in the state of Kentucky. The project would compare voter records with those of the deceased. The State responded to one of their open record requests with a a magnetic real about a foot in diameter, which I was tasked with decoding into a spreadsheet. I took the magnetic reel to college with me that summer and asked around. Turns out they had magnetic tape reader for reels of this size hooked up their VAX system. A friendly sysadmin tried to read the data for me, but it came back has gibberish. I wasn't surprised. Then he said "Aha! EBCDIC!" I hadn't heard it, but as the reel spoon and the names of the dead spun off the reel, he spun his own yard about this arcane format that was an ancient as the magnetic tape reel I'd brought it. And yes, there were some dead people voting in Kentucky.
- pavel_lishin 5y ago
  When suspected necromancy is afoot, of course you'd need to see a wizard about it.
- cesaref 5y ago
  The international banking system is coordinated by the SWIFT network, and all inter-bank messages are encoded in EBCDIC. If you transfer money between countries, or get statements from a broker, chances are it lived in EBCDIC at one point in it's journey.
amelius 5y ago
Try booking a flight with diacritics in your name. Same situation.
- PeterisP 5y ago
  What's funny is when the system explicitly requires "Write your name exactly as in the passport" and then fails validation by requiring only unaccented latin letters only, so it's impossible to fulfill both conditions at the same time.
  - exporectomy 5y ago
    They might have jumped the gun since new passports can't have accents but older ones might.
sethammons 5y ago
"My name is the complete work of Shakespeare, no, no not 'The Complete work of Shakespeare,' I mean the concatenated plays and poems, and I would like you to address me as such in any formal communications. Thank you for being GDPR compliant."
- t0mas88 5y ago
  You can't change your name at will in Belgium (where this case was). And I think in most of Europe the government has reasonableness requirements on the names you can give your kids. Elon Musk's strange combination would be refused for example.
dirtyid 5y ago
Are there precedence of legal requirements for diacritic support? Does it extend to all latin diacritics or popular regional subsets. I remember a Chinese scholar pushing for multiple language email address standard years ago, thinking it would be neat (and profoundly inpractical). Also maybe I'm misremembering, I swear I've seen arabic email addresses before.
a3w 5y ago
Someone I know told me that he got a German passport, but absolute garbage as his name in there because his actual name is in Arabic.
cupcake-unicorn 5y ago
Good on this consumer for dragging the bank through this. I'm sure the consumer probably got crap from friends/family about why they were doing this but this is sheer laziness on behalf of the bank and they deserve to be dragged through this to force them to uphold reasonable tech standards for all their customers. Glad that the EU has this option, I'm in the US and would use it more for stuff here :/
- jimmaswell 5y ago
  Not spending millions of dollars to appease people who are disproportionately upset over such a minor thing as missing accent marks is sheer laziness to you?
  - cupcake-unicorn 5y ago
    The point of the article is that their tech stack is embarrassingly out of date. A major institution shouldn't rely on ridiculous legacy tech from the 90s. If, for example, a bank is running on a PDP-8 I don't care if it costs millions to fix that, that's the banks problem.
    - gregw2 5y ago
      Might be hundreds of millions or billions... Check out the pricetags of companies switching custom old legacy systems to "newer" SAP.
theragra 5y ago
My friend often is having issues with flying, because his name is written as Maksims, and old booking systems think Ms at the end means missis.(he is male) Crazy shit everywhere in these old systems.
exporectomy 5y ago
People are so prissy about the unicode representation of their name while forgetting that even that is a machine-only representation made to approximate the technical limitations of printing presses and is different from anything they can write by hand or speak with their mouth. If you want the bank to use your "real" name, for most people, it needs to be spoken or possibly hand written. And it had better be in the correct accent or writing style too. In other words, storm in a teacup.
LeoPanthera 5y ago
I have two middle names and a hyphenated family name. It is too long for US passports. But not too long, for some reason, for my California drivers license. This makes checking in for flights a nightmare, since the names do not match. Domestic flights are OK, but I cannot checkin online for any international flight, I have to go to the airport to check in.
ryanthedev 5y ago
I wonder how airline reservations systems like Sabre are going deal with this.
Sophira 5y ago
> The bank didn't have support for diacritical marks. Things like á, è, ô, ü, ç etc. Unless I'm misunderstanding, EBCDIC does have support for all of the characters used as examples. Specifically, code page 37 - the "default" US EBCDIC code page and one apparently widely used on IBM mainframes[0] - has the characters at 0x45, 0x54, 0xCB, 0xDC, and 0x48 respectively. (Actually, code page 37 has all characters that are in ISO-8859-1, they're just in different positions.) [0] https://en.wikipedia.org/wiki/Code_Page_37 https://en.wikipedia.org/wiki/Code_Page_37
- Smoosh 5y ago
  You are correct. I have a mainframe right here in front of me, with a "test card" of all 256 byte values. There certainly are accented characters in most code pages. The problem is that they are difficult to deal with. They cause problems with data entry. They make sorting more complicated. They make searching difficult. etc etc. At my current site names are even stored in uppercase to reduce these issues. I welcome efforts like this to force computers to be more compatible with people - many mainframe systems are stuck in the dark ages of "to hard to be flexible" and need to be kicked into the 21st century.

294 points by edent 5y ago

I have to admit, I did not have "EBCDIC" && "GDPR" on my 2021 bingo card.

Can someone comment on what assumptions those banks are permitted to make regarding names? E.g., can they assume that names can be expressed as a sequence of (current) Unicode characters with some specific maximum length? Can they assume that names have no leading / trailing spaces?

mqus 5y ago
I think that it has to be reasonable. Assuming that your French-speaking target region has only names without accents is unreasonable. Assuming a maximum length of 200(?) utf8 codepoints(or even bytes) seems reasonable (defendable) in court. Same for leading/trailing spaces.
- temac 5y ago
  The longest personal name, according to the Guinness World Records, was 747 characters long, and happened to be in a latin alphabet. So I guess ~ 1000 bytes should be OK. Or even maybe what could be enough to fit 200 arbitrary utf8 codepoints, so 800 bytes. If you want to be safe maybe allow for up to 1000 arbitrary codepoints? :)
  - Smoosh 5y ago
    Oh man, I don't want to be in the queue behind that guy while he spells out his name to the clerk.
contravariant 5y ago
I'm somewhat wondering to what extent a bank is required to support storing the names natively. I mean something like "${name} spelled with an acute accent on the e" would be technically a correct description even if it is impractical to use. The GDPR does grant you the right to correct your personal information but doesn't specify how this information is represented. As far as I can tell the GDPR also doesn't grant the customer the right to have their name represented correctly on their bank pass (otherwise everyone with a long surname would require impractically long bank passes), the court only ruled that the inability of the bank to store the name correctly simply isn't an excuse.
mindcrime 5y ago
I wonder if there are any limits on this from the GDPR perspective? What if my name has 2^40 characters in it? Are companies required to support that? What if I change my name from whatever it is today (say, "Phillip") to a name that has 2^40 characters? Would the bank be required to accommodate that? etc..
- PeterisP 5y ago
  In civil law countries (after Brexit, 100% of EU is civil law) generally you can't change your name at will or by simply starting to use it, it usually requires asserting one of specific reasons that (in the eyes of the law) justify a name change, a request to authorities and their approval - which would be denied if you wanted to change your name to something that has 2^40 characters. If you did officially change your name to something interesting, I presume the bank would definitely have to accommodate it; but the restrictive part would be the process of actually changing your name.
- samus 5y ago
  The GDPR contains language that makes its provisions relative to the current techical state of the art. A bank can clearly not be expected to store all the 2^40 bytes of a person's name :)
tialaramex 5y ago
Probably reasonable assumptions. When you're not sure, assume the standard will be reasonableness, because that's what the law assumes when it isn't specified. So, you can make reasonable assumptions. What is reasonable will change, which is fine because the way courts figure out what's reasonable in some particular case is to either have the judge decide, or have a jury decide, and people change too. The nice thing about reasonableness is that you are equipped to make a first pass at judging it yourself, since you are presumably a reasonable person. If you need second guessing, have a team mate consider it, and, if you're worried that your collective idea of "reasonable" might be distorted in an important way, that'll be why your organisation probably encouraged diversity to avoid that. You might say, this seems awful because it isn't precise enough to say, implement it as a Javascript library. That's true, but intentional. Justice will necessarily involve such judgement calls, and trying to evade that by specifying everything precisely with no room for judgement is a bug not a feature.
PeterisP 5y ago
I believe that the main assumption they can make is that they can use the name on the ID forms issued by the government or, in case of foreign citizens, their passports. Due to history of international diplomacy, the general standard for passports expects that in addition to whatever script the country uses, they will also include the name of the person in English or French - so this is the key source of the problem, as for passports in e.g. Russian you will get an "English" name that you might use, however, you may get passports with names only in French, so you would have to support the English and French alphabets but perhaps not necessarily any others. Regarding trailing spaces etc, IMHO the standard would be "as shown in passport" i.e. trailing spaces definitely would not matter, but spaces and punctuation between words would (e.g. D'Artagnan as a name). I looked for but did not find any specific restrictions on name length. In general, the country will have regulations on what they accept as names in their official IDs, and again you may piggyback on other institutions - as long as you accept everything for which your government have issued documents, you should be fine; and if someone has an interesting case that requires changing the process, let that fight happen between them and the government first.

erk__ 5y ago

Time to break out UTF-EBCDIC! https://en.wikipedia.org/wiki/UTF-EBCDIC https://en.wikipedia.org/wiki/UTF-EBCDIC

LinAGKar 5y ago
Thanks, I hate it
deleted 5y ago
[deleted]
justin_oaks 5y ago
Interesting. It makes a bad system worse to try to make it better.
Kim_Bruning 5y ago
truly terrifying!

spullara 5y ago

My brother-in-law has an apostrophe in his last name and almost no systems bother to support it and it is in the character set. If this is an example of an appropriate use of GDPR, wow.

cabalamat 5y ago

If EBCDIC is incompatible with GDPR, then so are machine-readable passports as the format only allows ascii letters A-Z. https://en.wikipedia.org/wiki/Machine-readable_passport#Names https://en.wikipedia.org/wiki/Machine-readable_passport#Name...

dane-pgp 5y ago
That seems like a sufficiently different scenario to me (as a non-expert) that I think a court could reasonably reach a different conclusion. Firstly, if a government decides to "comply" with the GDPR by just seizing and revoking your passport, you might not have a case against them as the granting of passports could be considered a Royal Prerogative (or an equivalent under other systems of government) and thus non-justiciable. You might try to claim this is discrimination, but I don't think that "non-ASCII characters in name" is a legally protected class, and of course anyone could change their name to have or avoid non-ASCII characters. Also, if the format is designed to be machine-readable, then arguably the "accuracy" of your name on the passport has to be judged by the machine, not by you as the holder of that name. Moreover, the format is agreed as a consequence of an international treaty, which again might put it beyond the jurisdiction of a domestic court, and if your passport was declared invalid by a nation you were attempting to enter because it contained non-standard characters, that is not something that a domestic court could provide a remedy to.

gpvos 5y ago

More articles should have a "Dance" section.

gpderetta 5y ago

Every problem can be solved with an additional level of indirection. For example use html character entities for characters that are not representable in the DB character set.

deleted 5y ago
[deleted]
caf 5y ago
And/or rename the existing "Name" field to "Named-based Index Key" and add a new field for Name.
- FateOfNations 5y ago
  Our just leave it with "Named-based Index Key"... "no sir, we aren't able to correct your name since we don't store names in our database."

jan_Inkepa 5y ago

They don't say what the outcome of the case is? I guess it's still in progress(seems to be 2 years old though)? Really interesting use though! Edit: ah on the linked wiki article it says: > The Court of Appeal of Brussels held that, in accordance with Article 16 GDPR, the data subject has the right for their name to be correctly spelled when processed by the computer systems of the Bank So the plaintiff won, but no word on if/how the bank actually fixed it.

Luc 5y ago
The lower court ordered the bank to spell the name correctly. The court of appeal upheld this judgement. Source (Dutch): https://www.gegevensbeschermingsautoriteit.be/publications/arrest-van-9-oktober-2019-van-het-marktenhof.pdf https://www.gegevensbeschermingsautoriteit.be/publications/a... This tweet says it was ING Bank: https://twitter.com/simonhania/status/1270812210584043521 https://twitter.com/simonhania/status/1270812210584043521
- Deukhoofd 5y ago
  > De geschillenkamer van de GBA heeft deze uitleg als niet afdoende aangezien. Dat een bankinstelling anno 2018 niet bij machte zou zijn om een naam van een klant correct te schrijven onder uitleg dat zij nog gebruik maakt van een informaticasysteem van 1995, werd niet afdoende beschouwd. Ouch. Basically "That you're not able to write a customers name correctly in 2018 because you use a system from 1995 is not an excuse".
  - jerf 5y ago
    The court does have a point in this case. There's a huge number of systems in the world that existed in some form in 1995 and were correctly handling names in 2018. It's not like that's some sort of weird case that nobody else has encountered.
    - bawolff 5y ago
      Indeed: Iso 8859-1: 1985 Unicode: 1991 Utf-8: 1992 There is even IBM277 for an ebcdic version.

mjburgess 5y ago

The ruling was that the bank has to change: https://gdprhub.eu/index.php?title=Court_of_Appeal_of_Brussels_-_2019/AR/1006 https://gdprhub.eu/index.php?title=Court_of_Appeal_of_Brusse...

zinekeller 5y ago

.. until it ends with "SWIFT is incompatible with GDPR". (Okay, privacy wise, some might have uneasiness with SWIFT but we're talking about how it can't handle (in this case) characters outside US-ASCII, unless you have negotiated it with the bank you're sending on, which if it's a US bank, is not supported: https://twitter.com/ajlobster/status/735240869859753985 https://twitter.com/ajlobster/status/735240869859753985)

PeterisP 5y ago
I'm not sure about the speed and schedule of adoption, but I believe that SWIFT systems across the world (including USA!) are migrating towards ISO 20022 messages which has technical support for characters outside US-ASCII; and requirements such as these are a driving factor to migrate away from the earlier SWIFT MT standards.
- zinekeller 5y ago
  ... hopefully, but I wouldn't be shocked if the systems can technically receive Unicode-encoded transfers but then "convert" it into ASCII/EBCDIC at their mainframes :/

_pmf_ 5y ago

That's one way to get your account cancelled.

gpderetta 5y ago
I'm sure that cancelling accounts of people with "funny" spellings, will definitely not get the bank in trouble for (indirect) discrimination at all.
gambiting 5y ago
Not sure about Belgium specifically, but at least in UK the bank can't close your account without a valid court order. They can temporarily suspend it if they suspect you of some crime, but in general a normal checking account cannot be closed by the bank "just because". I'd expect it to work the same way in all of EU.
- fallingknife 5y ago
  That's great! Should be the same in the US, and also apply to payment processors.
DarkWiiPlayer 5y ago
ooof... didn't GDPR also have some strong opinions on retaliation though?
silon42 5y ago
Or in the future, getting international payments disabled (including most credit cards).
PeterisP 5y ago
Since banking account history has to be stored and provided for literal decades after account closure, they would still have to implement the changes even if that customer left, as they will still be processing his data and have to do it according to the law.

tyteen4a03 5y ago

This ruling is interesting. As a person with names in Chinese, I could technically force my bank to support UTF-8 simply by saying I do not wish to be known as my English name, which is the phonetic spelling of my Chinese one. Now since I'm Hongkongese where my English legal name is as legal as the Chinese one the law might be different but for Chinese people though...

caf 5y ago
Same for those with Arabic, Persian, Korean, Thai, Russian ... names
- egeozcan 5y ago
  Also Greek, Turkish, German, Romanian... Is there any language other than English that can be written 100% by ASCII characters? If you have special letters in your name, you'll have a different name in another country without that letter. My surname is supposed to be Özcan, but it's Ozcan or Oezcan in many official documents. Don't even let me start with the "Turkish iİıI problem"... I mean it's not totally unrecognizable but it's a different name nevertheless. I was talking to a Romanian colleague recently and she told me that most of the country uses some US keyboard layout instead of Romanian and cannot type Romanian letters, so people have 2 names even in their home country.
  - gpderetta 5y ago
    thinking that ASCII is enough for English is a bit naïve.
    - xxpor 5y ago
      Spelling it that way is a fantastic way to look pretentious.
      - WorldMaker 5y ago
        It's at least a little more elementary than that. There are many, many school teachers of young children that will tell you that words like coöperative lost a lot useful disambiguation power when English dropped support for such syllabic markers. I see words written like that and I think of grade school, which seems like the opposite of pretension.

andrewaylett 5y ago

Sounds like the perfect use-case for UTF-7? https://en.wikipedia.org/wiki/UTF-7 https://en.wikipedia.org/wiki/UTF-7 No, I'm not entirely serious.

krallja 5y ago
You probably want UTF-EBCDIC instead: https://news.ycombinator.com/item?id=28987256 https://news.ycombinator.com/item?id=28987256

rocqua 5y ago

So, the part of the GDPR the bank was unable to comply with here is the "right to rectification". That suggests that the bank made a 'mistake' when it recorded the name in its system as well as it could. I don't think that should count as a mistake. The information in the bank's system is as good as it could be, so there is nothing to rectify. It feels weird to me when privacy legislation turns out to require supporting UTF-8. I think something in the legal process went wrong here.

dmitriid 5y ago
> It feels weird to me when privacy legislation turns out to require supporting UTF-8. No. It requires you to store data correctly. And in the case of a bank storing data incorrectly could have potential ramifications (think two different people, one with diacritics and without). The law doesn't care whether you use UTF-8 or a manually written translation table, or a 15th-century printing press
- Volundr 5y ago
  > And in the case of a bank storing data incorrectly could have potential ramifications (think two different people, one with diacritics and without). Surely this situation wouldn't cause any issues though right? If they are relying on names as unique identifiers, they've got far bigger problems than a users name being spelled incorrectly.
  - TeMPOraL 5y ago
    No, but banks interact with people - both customers and employees. People interpret names. Errors like this could be used to, for example, impersonate someone (by tricking an employee), or deny someone service (e.g. via a clerk who behaves like a zombie, a protein peripheral of the bank's computer system).
  - gspr 5y ago
    Issues? Depends on what you mean. Maybe not practical issues, but I for sure would be offended if my bank refused to use my actual name. I find this whole ordeal delightful, and applaud the intention of the GDPR and the ways the courts upheld it in this case.

qwerty456127 5y ago

The first comment saying "TrÃ¨s intÃ©ressant !" looks hilarious in this context. I wonder if it has been made to look like this intentionally or not.

nerdponx 5y ago
I'm sure it was deliberate. Got a good laugh out of it!
capitainenemo 5y ago
Certainly looks like a joke to me, especially given all the correctly rendered text, and the various encoding related comments. Was probably rendered like this. $ echo "très intéressant" | iconv -f iso-8859-1 -t utf-8 trÃ¨s intÃ©ressant
- murkle 5y ago
  ... and in reverse with this very cool tool (found on HN I think) https://ftfy.vercel.app/?s=tr%C3%83%C2%A8s+int%C3%83%C2%A9ressant https://ftfy.vercel.app/?s=tr%C3%83%C2%A8s+int%C3%83%C2%A9re...
  - capitainenemo 5y ago
    Well... you can do it in reverse with iconv too... $ echo trÃ¨s intÃ©ressant | iconv -f utf-8 -t iso-8859-1 très intéressant Admittedly no autodetection. Luckily EU mangling is usually just one or two encodings.
    - rndgermandude 5y ago
      > Luckily EU mangling is usually just one or two encodings. Just to list the iso-8859 parts concerning EU member states: - iso-8859-1 (Latin-1, Western European, including German umlauts, French accents, etc) - iso-8859-2 (Latin-2, Central European, including characters to support Polish, Czech, Slovakian, Hungarian and other) - iso-8859-3 (Latin-3, South European, including characters to support Maltese) - iso-8859-4 (Latin-4, North European, including characters to support the Baltic states) - iso-8859-5 (Latin/Cyrillic, including characters to support Bulgarian) - iso-8859-7 (Latin/Greek, including characters to support Greek) - iso-8859-10 (Latin-6, Nordic, refinement of Latin-4, popular in Baltic states) - iso-8859-13 (Latin-7, Baltic Rim, because -10 was not enough) - iso-8859-15 (Latin-9, basically Latin-1 with the €-sign and some commonly used characters missing in Latin-1) - iso-8859-16 (Latin-10, South-Eastern European, "Intended for Albanian, Croatian, Hungarian, Italian, Polish, Romanian and Slovene, but also Finnish, French, German and Irish Gaelic (new orthography)") And they are all still in use. ;) It seems to me -15 is now more popular than -1, probably because it supports the Euro currency sign.

Aardwolf 5y ago

Makes me wonder what the rules for registered names are: is a registered name a series of characters from an existing writing system, that would hopefully be compatible with Unicode, or is it anything a human being could possibly write on a piece of paper, including something that has no equivalent in any writing system?

zokier 5y ago
I don't know about Belgium, but at least Finland has whole committee deciding on what are legal names and what are not https://oikeusministerio-fi.translate.goog/nimilautakunta?_x_tr_sl=fi&_x_tr_tl=en&_x_tr_hl=fi&_x_tr_pto=nui https://oikeusministerio-fi.translate.goog/nimilautakunta?_x...
samus 5y ago
Governments usually have their own standards and rules on which names they would recognize and how they would store them. They would reject names that are impossibly long or can only be spelled with homegrown writing systems, same as they would reject stuff like "Fuuk Yu". Edit: on the downside, they would probably also reject many reasonable names.

xfz 5y ago

https://tools.ietf.org/id/draft-msporny-base58-01.html https://tools.ietf.org/id/draft-msporny-base58-01.html

edwinjm 5y ago

Heh, if you're looking for a good example of Technical Debt… Yes, already in 1995 Unicode was an established standard (even Windows 95 started to support it). The bank should have known it would be a requirement in the future.

coldacid 5y ago
Unicode's old enough that Windows NT was built to work with it natively. In fact, all the "ANSI" Windows API calls in NT were just wrapper functions around the Unicode equivalents handling Unicode/code-page conversions. And this was 1993.
- WorldMaker 5y ago
  Yup, in fact the biggest compatibility headaches in NT today stem from how early they adopted it: they made some assumptions about UCS-2 that turned out to be wrong and had to shoehorn in UTF-16 support that mostly works (except when it falls over a cliff). Meanwhile Linux and others waited for UTF-8 to exist and that's become the internet/web's major standard as well and there are some small papercuts interoperating between UTF-16 and UTF-8 that with today's hindsight shouldn't have been so annoying or necessary. Windows might have been better off waiting for UTF-8 itself other than Windows made the right architectural decision for the time when it made that decision and could not have suspected UTF-8 to turn up only a few years later.
  - anthk 5y ago
    > Meanwhile Linux and others waited for UTF-8 UTF-8 was already a thing in Plan9.
    - WorldMaker 5y ago
      UTF-8 was first presented to IETF at Usenix in January 1993. NT 1.0 shipped June 1993 and had been in development for several years before that. The famous "Plan 9 implemented UTF-8 first" thread's most specific date mentioned was September 1992 which only three months more lead time before the standardization notice in January 1993. Are you suggesting the NT Kernel team should have somehow better paid attention to a not-yet-standard from a research laboratory Operating System? It still probably would have been a couple years too late in the design/architecture process even if they had, given the release data in June 1993.

po1nt 5y ago

Imagine you maintain this system and somebody named X Æ A-XII Musk will try to register. Jokes aside. I know a person named exactly like me just with a small diacritic difference. I realize they use secondary identifiers but this is identity theft waiting to happen.

kayodelycaon 5y ago
I go by Kayodé online (Kay (actually Qué) oh Deh), which isn't the African name Kayode (Ki-oh-Day or Ki-oh-Dee). The number of places that don't support diacritics this is absolutely mind-boggling.
josephcsible 5y ago
> Jokes aside. I know a person named exactly like me just with a small diacritic difference. I realize they use secondary identifiers but this is identity theft waiting to happen. I don't see how that really makes identity theft any worse. There's already a ton of people with exactly identical names, and differing only in diacritics isn't any worse than that is.
FateOfNations 5y ago
I suspect that kid is going to change his name as soon as he can. Was taking their fantasy name and turning it into something like "Ashton Archangel Musk" too just too pedestrian for them? I unfortunately have a number of people who have the same name as me. Get emails for them sometimes...

cannabis_sam 5y ago

I want to suggest that businesses should be penalized somehow for using “ancient” technology, but then on the other hand you have roman concrete…

mminer237 5y ago
You shouldn't penalize stuff for being old. You should penalize stuff for being bad. Not being able to accurately store and represent customers' names is the problem here, not that it's old.
- cannabis_sam 5y ago
  Yeah, that was my point..

asdfe8988 5y ago

>EBCDIC is an ancient (and much hated) "standard" which should have been fired into the sun a long time ago. It baffles me that it was still being used in 1995 - let alone today. I want a pony.

BBC-vs-neolibs 5y ago
That's my que: "Does this mean that Z̷̡̧̢̰͓̪͖̭͙̰̣̱̬̹̙̜̪̣̏̿̏̋͑́̒͑́̒̿̇̈̍̇̌͝͝a̵̡̧͍̘̮̤̙̹͙̦̙͙͖͓̥̟̦͔͒̇̊̊̔̓́͒́̌̈́̑͋̏̏̏̚͘͝͠͝l̶͉̯̱͇̭̭̉̉̈́̿͐̽̒̎̽͌̚͜ģ̸̧̛͙̩̹̰̤̱̖̘̻̪̻̮̫̟̙̲͍̰̻͕̗̫̿̆̃́͗̽̊̽̌̔̂͂̈͊̐̈́̈̈́̈̓̆͌̑́̕͜ǫ̶̢̹̥̮̟͍̔̑̔̽ can finally open a bank account?"

gregw2 5y ago

Transitioning off a long established core mainframe/AS400 app is not necessarily so easy as just changing to UTF-8 as the article author implies. If you have no mainframe or enterprise experience to relate to that observation, consider the effort involved to transition from python 2 to (UTF-8 clean) python 3! That said, I am not even clear from the article which diacritical markings are missing from EBCDIC and if the lawyers arguments to "not change" were legitimate in the way the article implies... you do realize there are hundreds of EBCDIC code pages covering at least all the European languages ... since these are markets which IBM has sold into for 50+ years now, right? I only learned about EBCDIC code pages when trying to proactively properly setup character encoding handling for data extraction from one of my employer's long running AS400s... "Which EBCDIC?" is not that different a headache from "which extended ASCII code page?"... EBCDIC is not just like 7-bit (non extended) ASCII as the article implies.

toyg 5y ago
> Transitioning off a long established core mainframe app is not necessarily so easy I don't think the author implied it was easy, just that it should have been done at some point in the 25 years since the system was first implemented. The last paragraph is just an exortation to use Unicode everywhere all the time, today.
nemoniac 5y ago
[flagged]
- meepmorp 5y ago
  Are you implying that the Nazis are responsible for EBCDIC? If not, how does your point relate to the topic at hand?
  - jackjeff 5y ago
    Nah. The Nazis were too busy creating Facebook :)
  - sipos 5y ago

Muromec 5y ago

oh, now I wonder if I can cite GDPR (and Dutch government for their BRP thing) and ask my bank to spell my name in a proper Ukrainian Cyrillic the same way it is done in my id.

CWuestefeld 5y ago

At the time I moved out of New Jersey 8 years ago, the state was still unable to represent my completely vanilla name on my driver's license. My first name is "Christopher", but their computers can't/couldn't handle an 11-character name. It was always truncated on my driver's license. This led to problems when they instituted their trusted ID compliance. When renewing the license we were required to provide some combination of documentation to corroborate our identity, and obviously that documentation needs to match the name shown on the driver's license - and of course mine did not. There was one way out for Christophers like myself. A birth certificate was considered the ultimate truth, so as long as I had a notarized (with the raised seal) birth certificate to prove my identity, they would allow me to renew my license. The State of New Jersey is very awful at IT. My wife, who works in healthcare finance, told me about problems she was having with the State because - get this - their field for what amounts to "Medicaid ID#" was too narrow, so they had to recycle ID#s for new recipients! And to make that worse, they discarded old backup data so when checking the data for a patient several years ago, it's only possible to find that of the latest owner of ID# 12345.

pickledcods 5y ago
I have the exact same problem with my European passport. maximum name length, that is total first+middle+surname must be less than 30 characters. Officially I am not who I am.
- toyg 5y ago
  That's not a limitation of the European format, which is in fact not agreed on in the original resolution [1]. Your country is doing it wrong. In the UK, where the format has been set in 2014 so still in an EU context, the limit is 60 (30 for surnames, 30 for the rest). Interestingly, it looks like we're actually going backwards on this: accented characters have actually been dropped from the main passport page in recent years, to be replaced with ICAO transliterations. Which is shameful, to be honest, since it implies passports are now incomplete as a form of ID (unless the real name is recorded somewhere else). Airline lobbying clearly won the day, years ago. This seems to be a UK-only thing at this point. [1] https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:41981X0919:EN:HTML https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX...

CWuestefeld 5y ago

Question: does the bank have the right to say, "I'm sorry Mr potential customer, but we can't meet your requirements so are unable to give you an account"? Or is it essentially required that everyone doing business must do things like keep all computer systems modernized?

hyperman1 5y ago
Belgian law, if I am not mistaken, requires that every Belgian (European?) Inhabitant has access to a basic package. The bank can deny access to credit etc, but an account and a (normal debet) bank card are a right.
PeterisP 5y ago
I wanted to say that they should not have that right, however, looking at GDPR, perhaps it's not forbidden after all. However, it's worth noting that it's not just a single exceptional person - Belgium has accented letters in two of their three official languages and names with accents are reasonably common, so if you tried that, you would have to discard many customers, and also those customers would be overwhelmingly from the french-speaking part of the country so that might be treated as explicit discrimination targeting the french-speaking minority community.
samus 5y ago
Such a complaint is hard to defend if the customer presents a government-issued identification document. If governments can agree on certain technical standards, even though some of them are actively hostile to each other on other important matters, surely banks can be expected to comply with some of them too. The bank is entitled to use whatever internal representation they like (although they better don't misidentify persons), but they better be able to print the correct name in forms and letters. The embossed name on payment cards is a separate, more troublesome issue. The bank should provide appropriate documentation as evidence if the cardholder's embossed name could not be spelled correctly because of limited technical standards.

retrac 5y ago

In slightly related news, Ontario just last year finally allowed people to use accented characters in their official legal names, birth certificates, and so on. French has been an official language in Ontario for over half a century. The reason it wasn't possible until recently was entirely technical. The systems were limited by ASCII or, yeah, possibly EBCDIC. (I don't have the details.) Still no guidance on how the average government clerk with the very common US-style layout is supposed to type them in, though. https://news.ontario.ca/en/release/58538/ontario-introduces-french-accents-on-drivers-licences-and-ontario-photo-cards https://news.ontario.ca/en/release/58538/ontario-introduces-...

gspr 5y ago
What I don't understand when I hear stories like these is why the hell not just use someone else's solution? Surely neighboring Québec had this sorted out ages ago – why not just duplicated whatever they did? Problem solved in no time. Going further, I wonder why for example the EU doesn't try to get schemes going that facilitate the copying of IT solutions between member states. Why does every country have to reinvent the wheel?
- coldacid 5y ago
  I think even the Quebecois hate the French-Canadian keyboard layout. Certainly it's incredibly hated here in Ontario.
  - kps 5y ago
    https://en.wikipedia.org/wiki/CSA_keyboard https://en.wikipedia.org/wiki/CSA_keyboard is just awful — it uses ‘right Control’ as a graphic-shift modifier for most characters, instead of AltGraph/Option. (It also uses AltGraph/Option for some common characters like []<> and for French «».) You can't find a better example of government committee work anywhere.
  - toyg 5y ago
    You mean the Québécois, surely (sorry, couldn't resist - on topic for the thread...)

dhosek 5y ago

One of the fun things about EBCDIC is that 370 assembler has opcode-level support for converting an EBCDIC-encoded numeric string into an integer (and maybe the other way around too, it's been a while). This is one of two things I remember about my now-ancient 370 assembler knowledge. The other is that there is no built-in support for maintaining a call stack. It is up to each subroutine to handle this and there were some weird declarations around this to indicate whether a subroutine was reentrant, the definition of which escapes me now. And people shouldn't criticize EBCDIC too much, after all Windows still dumps a lot of crap in legacy 8-bit coding that can cause applications to break (there was a recent post on HN about someone being unable to run the IntelliJ debugger because of an accent in their username). At least EBCDIC is clear about its limitations.¹ ⸻⸻⸻ 1. I'd be remiss if I didn't point out one other EBCDIC weirdness: It has two vertical bars, | and ¦ which always caused complications in translations between EBCDIC and ASCII. IIRC, ¦ was the more common symbol in EBCDIC coding but some converters wanted to translate | to | instead (or maybe it was the other way around—the last time I did IBM big metal was 30 years ago).

toyg 5y ago
> there was a recent post on HN about someone being unable to run the IntelliJ debugger because of an accent That's not Windows, that's JVM weirdness. Using the right calls, this sort of thing has been fine in Windows for some time.
- dhosek 5y ago
  It's JVM weirdness on Windows. This isn't a problem on Linux or MacOS where file paths won't be in some arbitrary encoding. This ends up biting a lot of other cross-platform software as well and is why Rust has OSString, but for code in, say, C/C++ it ends up being a major pain point (the TeX development team often end up dealing with this sort of issue).
  - breakingcups 5y ago
    File paths on Windows aren't in some arbitrary encoding either?

N19PEDL2 5y ago

If the bank still relies on legacy software and IT standards, well it's just its fault. They cannot expect people with diacritics or other non-ASCII characters in their name just to spell it incorrectly because their systems do not support Unicode in the twenty-twenties. Maybe their IT team had other priorities than replacing EBCDIC with Unicode (or whatever they find more appropriate for their systems), but this is an indicator of poor interest in technological progress by the bank itself. It reminds me some banks that gave millions to Microsoft to keep ATMs running Windows XP after its end of life. Edit: I elaborated a bit more and I realized that it might be more difficult than just replace the character encoding standard to a more modern one. For example, the name of the account owner likely needs to match exactly the holder name on the credit card associated with the account, and I'm not sure if diacritics can be embossed correctly on the card.

oldie 5y ago

Remember all the ghastliness with code pages that sprang up around Ascii, such that systems configured for different languages didn't agree about what characters most code points were supposed to represent? Well, good news: Ebcdic supports that. For example, here's a code page that can represent all the characters you're likely to need in French: https://en.everybodywiki.com/EBCDIC_297 https://en.everybodywiki.com/EBCDIC_297 So, to be unable to represent á, è, ô, ü, ç, etc, the application would have to be locked into not just Ebcdic but also a particular Ebcdic code page that seems unsuited to the locale where the program was running. Admittedly, an Ebcdic system will have difficulty representing French, Greek and Russian names at the same time, because there's no code page that encodes all the necessary characters. An application hard-coded to US-Ascii would also be unable to support accented characters, and an application using any one Ascii code page (as opposed to Unicode) would have the same difficulty representing French, Greek and Russian names at the same time. Which is why, in 2021, we don't do that.

GoblinSlayer 5y ago

Just store UTF-8 in base64 encoding, it's compatible with ebcdic.

Kiro 5y ago

In a similar case in Ireland they ruled in favor of the data controller: > Following an eight-month investigation, the Data Protection Commission (DPC) have ruled that individuals do not have an 'absolute right' to have their names spelled with fadas. https://ireland.bloomsburyprofessional.com/blog/no-right-to-fada-under-gdpr-says-dpc https://ireland.bloomsburyprofessional.com/blog/no-right-to-...

DoubleGlazing 5y ago
That was an abomination of a ruling. I find it amazing that the Data Protection Commissioner basically went against the constitution which clearly states that Irish is the first language of Ireland.

seiferteric 5y ago

It seems like there should be some technical solutions though. Maybe just use the name field in the mainframe DB as a unique hash of the utf-8 encoded name and store the real utf-8 encoded name in an external DB or something.

SavantIdiot 5y ago

In 2018 I inherited a rather large website, and have been slowly fixing it to support unicode because many of the users want to use their real names, not an English-hack version of it. It is WAY more complicated than I thought it would be. There is so much code that manipulates strings that is not unicode aware. I've fixed the simple things, like places where the user name is displayed, etc., but the email subsystem is a train wreck and there are still places in the database where I couldn't retroactively fix old entries. Going on 4 years fixing this! But EBCDIC? Damn, opportunity to make lots of $$ here fixing people's code. I had friends that made bank on Y2K prep in the mid-90's.

kccqzy 5y ago
> email subsystem is a train wreck Actually, which email system supports email addresses with non-ASCII user names? And which additionally supports IDN domains?
- SavantIdiot 5y ago
  Actually, there are other parts to the email subsystem besides the POP/SMPT interface, such as code that dynamically generates the subject and body, and have lots of regex and string manip code in them.

jwildeboer 5y ago

(Decision from 2019, unfortunately article doesn’t add updated information on if/how the bank solved this)

jstanley 5y ago

According to the author's tweet, the customer sued and won: https://twitter.com/edent/status/1450731852302532608 https://twitter.com/edent/status/1450731852302532608 I wonder why this fact is absent from the blog post? This is a baffling ruling. I don't think an inability to support funny characters should be considered a GDPR violation. Anyone can put any characters they want in their name, and everyone is not breaking the law just because Unicode doesn't have made-up squiggles.

xyzzyz 5y ago
First, just to be clear, these are not by any means “funny characters”. These are perfectly normal characters in languages used by these people. Second, if you were trying to make a point that people can put Unicode emoji in their names, well, try doing that on a birth certificate and tell me what the registration office tells you. If you successfully manage to get an actual “funny character” in your legal name, let me know.
orf 5y ago
For a lot of the world the characters you are typing with are “funny characters”.
- adolph 5y ago
  At least 1.4B of them. https://en.wikipedia.org/wiki/Demographics_of_China https://en.wikipedia.org/wiki/Demographics_of_China

surfingdino 5y ago

Mainframes, COBOL, and databases that store data in formats that replicate the hard limits of paper punch cards are a real problem. Banks, insurers, and governmental institutions won't get rid of them and choose to surround those fossils of IT with layer upon layer of tech that gets outdated the moment it gets delivered. I was on a project where we were told to come up with an alternative way of encoding UUID4s, because "bank X runs their DB on a mainframe and they only have N bytes they can use for an ID." It used to be a given that nobody wanted their bank to run on anything, but mainframes. Now we'd rather they used cloud computing and Postgres. Mainframes have had their day. They may have a future, but they need modern databases and development tools.

that_guy_iain 5y ago
> It used to be a given that nobody wanted their bank to run on anything, but mainframes. Now we'd rather they used cloud computing and Postgres. Mainframes have had their day. They may have a future, but they need modern databases and development tools. I suspect you ask random Joe on the street they would say they would rather be on a mainframe. Also, I would much rather my bank didn't host on AWS, GCP, Azure, etc.
- samus 5y ago
  The technological state of the art at the backend is a circle. You don't have to squint that hard to see the similarities between a hypervisor running hundreds of VMs and a mainframe running hundreds of batch jobs. The difference is just that the mainframe is usually (but not always) co-located with the bank. But small bank branches might completely lack mainframe systems on their own.
- mmis1000 5y ago
  Mainframe nowadays do support modern language and modern tech stack. It's just no one willing to move on to the next stack.(or probably too expensive to) For example, IBM z runs linux. Backward compatibility is one of the biggest selling point mainframes provide, you can run code written 30 years ago with all limitation and bug preserved as is. And IBM z can also run many program write for original ibm/360 unmodified. Probably many ones decided to do so.

AtNightWeCode 5y ago

Simple to fix comparing to GDPR in general. Like where there are local laws that overlap and then EU laws that overlap that and then GDPR upon that. It is not like you can just follow GDPR cause then you may break a bunch of other laws.

markstos 5y ago

I once worked for a newspaper while they were researching if dead people were voting in the state of Kentucky. The project would compare voter records with those of the deceased. The State responded to one of their open record requests with a a magnetic real about a foot in diameter, which I was tasked with decoding into a spreadsheet. I took the magnetic reel to college with me that summer and asked around. Turns out they had magnetic tape reader for reels of this size hooked up their VAX system. A friendly sysadmin tried to read the data for me, but it came back has gibberish. I wasn't surprised. Then he said "Aha! EBCDIC!" I hadn't heard it, but as the reel spoon and the names of the dead spun off the reel, he spun his own yard about this arcane format that was an ancient as the magnetic tape reel I'd brought it. And yes, there were some dead people voting in Kentucky.

pavel_lishin 5y ago
When suspected necromancy is afoot, of course you'd need to see a wizard about it.
cesaref 5y ago
The international banking system is coordinated by the SWIFT network, and all inter-bank messages are encoded in EBCDIC. If you transfer money between countries, or get statements from a broker, chances are it lived in EBCDIC at one point in it's journey.

amelius 5y ago

Try booking a flight with diacritics in your name. Same situation.

PeterisP 5y ago
What's funny is when the system explicitly requires "Write your name exactly as in the passport" and then fails validation by requiring only unaccented latin letters only, so it's impossible to fulfill both conditions at the same time.
- exporectomy 5y ago
  They might have jumped the gun since new passports can't have accents but older ones might.

sethammons 5y ago

"My name is the complete work of Shakespeare, no, no not 'The Complete work of Shakespeare,' I mean the concatenated plays and poems, and I would like you to address me as such in any formal communications. Thank you for being GDPR compliant."

t0mas88 5y ago
You can't change your name at will in Belgium (where this case was). And I think in most of Europe the government has reasonableness requirements on the names you can give your kids. Elon Musk's strange combination would be refused for example.

dirtyid 5y ago

Are there precedence of legal requirements for diacritic support? Does it extend to all latin diacritics or popular regional subsets. I remember a Chinese scholar pushing for multiple language email address standard years ago, thinking it would be neat (and profoundly inpractical). Also maybe I'm misremembering, I swear I've seen arabic email addresses before.

a3w 5y ago

Someone I know told me that he got a German passport, but absolute garbage as his name in there because his actual name is in Arabic.

cupcake-unicorn 5y ago

Good on this consumer for dragging the bank through this. I'm sure the consumer probably got crap from friends/family about why they were doing this but this is sheer laziness on behalf of the bank and they deserve to be dragged through this to force them to uphold reasonable tech standards for all their customers. Glad that the EU has this option, I'm in the US and would use it more for stuff here :/

jimmaswell 5y ago
Not spending millions of dollars to appease people who are disproportionately upset over such a minor thing as missing accent marks is sheer laziness to you?
- cupcake-unicorn 5y ago
  The point of the article is that their tech stack is embarrassingly out of date. A major institution shouldn't rely on ridiculous legacy tech from the 90s. If, for example, a bank is running on a PDP-8 I don't care if it costs millions to fix that, that's the banks problem.
  - gregw2 5y ago
    Might be hundreds of millions or billions... Check out the pricetags of companies switching custom old legacy systems to "newer" SAP.

theragra 5y ago

My friend often is having issues with flying, because his name is written as Maksims, and old booking systems think Ms at the end means missis.(he is male) Crazy shit everywhere in these old systems.

exporectomy 5y ago

People are so prissy about the unicode representation of their name while forgetting that even that is a machine-only representation made to approximate the technical limitations of printing presses and is different from anything they can write by hand or speak with their mouth. If you want the bank to use your "real" name, for most people, it needs to be spoken or possibly hand written. And it had better be in the correct accent or writing style too. In other words, storm in a teacup.

LeoPanthera 5y ago

I have two middle names and a hyphenated family name. It is too long for US passports. But not too long, for some reason, for my California drivers license. This makes checking in for flights a nightmare, since the names do not match. Domestic flights are OK, but I cannot checkin online for any international flight, I have to go to the airport to check in.

ryanthedev 5y ago

I wonder how airline reservations systems like Sabre are going deal with this.

Sophira 5y ago

> The bank didn't have support for diacritical marks. Things like á, è, ô, ü, ç etc. Unless I'm misunderstanding, EBCDIC does have support for all of the characters used as examples. Specifically, code page 37 - the "default" US EBCDIC code page and one apparently widely used on IBM mainframes[0] - has the characters at 0x45, 0x54, 0xCB, 0xDC, and 0x48 respectively. (Actually, code page 37 has all characters that are in ISO-8859-1, they're just in different positions.) [0] https://en.wikipedia.org/wiki/Code_Page_37 https://en.wikipedia.org/wiki/Code_Page_37

Smoosh 5y ago
You are correct. I have a mainframe right here in front of me, with a "test card" of all 256 byte values. There certainly are accented characters in most code pages. The problem is that they are difficult to deal with. They cause problems with data entry. They make sorting more complicated. They make searching difficult. etc etc. At my current site names are even stored in uppercase to reduce these issues. I welcome efforts like this to force computers to be more compatible with people - many mainframe systems are stuck in the dark ages of "to hard to be flexible" and need to be kicked into the 21st century.