3 ms·

GDPR is about far more than just cookies. Once you get into it, the GDPR is extraordinarily vague. It obviously wasn't written by engineers or even people with

GDPR is about far more than just cookies. Once you get into it, the GDPR is extraordinarily vague. It obviously wasn't written by engineers or even people with domain experience. You can easily interpret common server-side logging operations as GDPR violations if you're not careful.

lbriner 5y ago
Seems a very patronising response. Personally, I have found the GDPR clear and well thought-out. Of course, there are some things that are annoying that you have to comply with like "IP addresses are personal data" but that is a problem with the web, not with the intention and implementation of GDPR.
kmeisthax 5y ago
As it should be. The G stands for "General", after all. If engineers wrote the law, it would have no effect, because it would specify the means by which tracking happens (e.g. cookies, HTML5 localstorage) but not the act of tracking itself; and it would be easy to circumvent. Legal documents cannot be precisely specified bundles of English-language-shaped computer code; they need flexibility so that the judge can actually rule things that make sense. For example... why shouldn't server-side logging be treated as in GDPR scope? It does not matter if cookies weren't used to collect it; an IP address and time pair is already enough information to identify an ISP account and that's usually enough for lawyers to sue you with.
M2Ys4U 5y ago
The clue's in the name, it's the General Data Protection Regulation. The idea is to provide a high level of data protection in general. It's not just an internet/engineering law. It applies exactly the same in an offline setting as it does on the web.
Nextgrid 5y ago
I'm upvoting this because you are correct that the GDPR about much more than just cookies, but I disagree with the (perceived?) negativity around how the regulation is vague. It's designed to be vague because it covers intent and outcomes more than specific technical means of achieving them. This ensures the law doesn't need updating every time there's some new variant of local storage, new browser fingerprinting vector, etc and also to prevent offenders from trivially working around it using a technicality. Similarly, enforcement will also be much more about intent and outcomes than any specific technical means (well that's the theory - in practice neither is being enforced right now). Nobody will enforce it based on some technicalities, they'll enforce it based on outcomes - if you collect personal data and use it to track a user without an appropriate legal basis (in this case, it should usually be consent), you'll be in trouble regardless of whether you use a cookie, a browser fingerprint, or even just save whatever search queries they type and use that as a way to reidentify them. Conversely, nobody is going to go after you if you set a session cookie to persist a login or shopping cart.
jeroenhd 5y ago
The GDPR is far from vague, the complications come from the legalese that was used to write it. Engineers aren't lawyers and vice versa. You wouldn't want to develop software thrown together by lawyers, and lawyers wouldn't want to work on law written by engineers. It's "vague" on purpose. Had the GDPR banned cookies, companies would have switched to fingerprinting. Had the GDPR banned JS tracking, Google would've pushed Dart to Chrome. It's written that way so that companies can't think of loopholes because of the language used. Most (European) law is written quite vaguely. The vagueness allows judges to make the right call rather than become law robots. Instead of specifying concrete limits, the law refers to the current state of the art. If you let the law decide what safeguards are or aren't appropriate, we'd be using 3DES and MD5 to this day, because that's what the law says. We've seen what the EU does when it tries to lay down more concrete rules: they're trying to force the EU to manage certificate authorities for browsers, which is obviously a terrible idea. Crap like that is why we need vague laws.
goto11 5y ago
> You can easily interpret common server-side logging operations as GDPR violations if you're not careful. Indeed - if you log client IP, it is subject to GDPR.

lbriner 5y ago

Seems a very patronising response. Personally, I have found the GDPR clear and well thought-out. Of course, there are some things that are annoying that you have to comply with like "IP addresses are personal data" but that is a problem with the web, not with the intention and implementation of GDPR.

kmeisthax 5y ago

As it should be. The G stands for "General", after all. If engineers wrote the law, it would have no effect, because it would specify the means by which tracking happens (e.g. cookies, HTML5 localstorage) but not the act of tracking itself; and it would be easy to circumvent. Legal documents cannot be precisely specified bundles of English-language-shaped computer code; they need flexibility so that the judge can actually rule things that make sense. For example... why shouldn't server-side logging be treated as in GDPR scope? It does not matter if cookies weren't used to collect it; an IP address and time pair is already enough information to identify an ISP account and that's usually enough for lawyers to sue you with.

M2Ys4U 5y ago

The clue's in the name, it's the General Data Protection Regulation. The idea is to provide a high level of data protection in general. It's not just an internet/engineering law. It applies exactly the same in an offline setting as it does on the web.

Nextgrid 5y ago

I'm upvoting this because you are correct that the GDPR about much more than just cookies, but I disagree with the (perceived?) negativity around how the regulation is vague. It's designed to be vague because it covers intent and outcomes more than specific technical means of achieving them. This ensures the law doesn't need updating every time there's some new variant of local storage, new browser fingerprinting vector, etc and also to prevent offenders from trivially working around it using a technicality. Similarly, enforcement will also be much more about intent and outcomes than any specific technical means (well that's the theory - in practice neither is being enforced right now). Nobody will enforce it based on some technicalities, they'll enforce it based on outcomes - if you collect personal data and use it to track a user without an appropriate legal basis (in this case, it should usually be consent), you'll be in trouble regardless of whether you use a cookie, a browser fingerprint, or even just save whatever search queries they type and use that as a way to reidentify them. Conversely, nobody is going to go after you if you set a session cookie to persist a login or shopping cart.

jeroenhd 5y ago

The GDPR is far from vague, the complications come from the legalese that was used to write it. Engineers aren't lawyers and vice versa. You wouldn't want to develop software thrown together by lawyers, and lawyers wouldn't want to work on law written by engineers. It's "vague" on purpose. Had the GDPR banned cookies, companies would have switched to fingerprinting. Had the GDPR banned JS tracking, Google would've pushed Dart to Chrome. It's written that way so that companies can't think of loopholes because of the language used. Most (European) law is written quite vaguely. The vagueness allows judges to make the right call rather than become law robots. Instead of specifying concrete limits, the law refers to the current state of the art. If you let the law decide what safeguards are or aren't appropriate, we'd be using 3DES and MD5 to this day, because that's what the law says. We've seen what the EU does when it tries to lay down more concrete rules: they're trying to force the EU to manage certificate authorities for browsers, which is obviously a terrible idea. Crap like that is why we need vague laws.

goto11 5y ago

> You can easily interpret common server-side logging operations as GDPR violations if you're not careful. Indeed - if you log client IP, it is subject to GDPR.