5 ms·

A bit strange to have this feature enabled after an upgrade. The following statement is now wrong: > New Relic services are designed to receive and process tel

A bit strange to have this feature enabled after an upgrade. The following statement is now wrong: > New Relic services are designed to receive and process telemetry data on the performance of applications, systems, and infrastructure, which typically do not contain any personal data. Customers generally send very little additional personal data to our platform. https://newrelic.com/blog/how-to-relic/how-demise-of-privacy-shield-affects-you https://newrelic.com/blog/how-to-relic/how-demise-of-privacy... On the topic of privacy and GDPR, I find the previous link a good summary of the arguments used by American companies that cannot respect GDPR. Microsoft or Google say the same things in a lot more words.

jiveturkey 5y ago
If you are logging Personal Data, is that even wise, wrt GDPR? Logs have a funny way of escaping, NEWR notwithstanding. I'm not a Privacy Engineer, but surely everyone understands that you don't log raw passwords. Similarly, if you are bound by GDPR, shouldn't you not log PD?
- mhitza 5y ago
  From my experience most "shops" don't disable IP address logging in their load balancers/web servers, which is personal data under the GDPR and California privacy act.
  - jiveturkey 5y ago
    very good point!
- speedgoose 5y ago
  You shouldn’t log personal data but you may do it without planning to do so. For example you may log some error messages that contain personal data.
- autoexec 5y ago
  > If you are logging Personal Data, is that even wise, wrt GDPR? Has any company ever been driven into bankruptcy because of GDPR violations? Google, Amazon, Vodafone, Yoigo, The Municipality of Bergen, Orange Espagne, Malagatrom, the Bulgarian National Revenue Agency, Enel Energia, Deutsche Wohnen, and Facebook have been fined over and over again, but it hasn't hurt them. If you can make more money abusing people's data than you'd pay in fines, and that's only assuming you're caught, it seems like possible GDPR issues are just another cost of doing business.
msla 5y ago
I'd like to see someone take this analysis on. Is it valid? If not, why not, assuming American law? https://web.archive.org/web/20200813235643/http://slawsonandslawson.com/article-32-the-hole-in-the-gdpr-wall/ https://web.archive.org/web/20200813235643/http://slawsonand... > Article 3(2), a new feature of the GDPR, creates extraterritorial jurisdiction over companies that have nothing but an internet presence in the EU and offer goods or services to EU residents[1]. While the GDPR requires these companies[2] to follow its data processing rules, it leaves the question of enforcement unanswered. Regulations that cannot be enforced do little to protect the personal data of EU citizens. > This article discusses how U.S. law affects the enforcement of Article 3(2). In reality, enforcing the GDPR on U.S. companies may be almost impossible. First, the U.S. prohibits enforcing of foreign-country fines. Thus, the EU enforcement power of fines for noncompliance is negligible. Second, enforcing the GDPR through the designated representative can be easily circumvented. Finally, a private lawsuit brought by in the EU may be impossible to enforce under U.S. law. [snip] > Currently, there is a hole in the GDPR wall that protects European Union personal data. Even with extraterritorial jurisdiction over U.S. companies with only an internet presence in the EU, the GDPR gives little in the way of tools to enforce it. Fines from supervisory authorities would be stopped by the prohibition on enforcing foreign fines. The company can evade enforcement through a representative simply by not designating one. Finally, private actions may be stalled on issues of personal jurisdiction. If a U.S. company completely disregards the GDPR while targeting customers in the EU, it can use the personal data of EU citizens without much fear of the consequences. While the extraterritorial jurisdiction created by Article 3(2) may have seemed like a good way to solve the problem of foreign companies who do not have a physical presence in the EU, it turns out to be practically useless.
- nix0n 5y ago
  Currently, a lot of US companies have significant financial presence in Ireland, for tax-loophole reasons. See [0] for the Microsoft example specifically. I'm not a lawyer, and I know nothing about New Relic specifically. But the worst offenders of the spirit of GDPR really are vulnerable to EU enforcement. [0] https://www.theguardian.com/world/2021/jun/03/microsoft-irish-subsidiary-paid-zero-corporate-tax-on-220bn-profit-last-year https://www.theguardian.com/world/2021/jun/03/microsoft-iris...

jiveturkey 5y ago

If you are logging Personal Data, is that even wise, wrt GDPR? Logs have a funny way of escaping, NEWR notwithstanding. I'm not a Privacy Engineer, but surely everyone understands that you don't log raw passwords. Similarly, if you are bound by GDPR, shouldn't you not log PD?

mhitza 5y ago
From my experience most "shops" don't disable IP address logging in their load balancers/web servers, which is personal data under the GDPR and California privacy act.
- jiveturkey 5y ago
  very good point!
speedgoose 5y ago
You shouldn’t log personal data but you may do it without planning to do so. For example you may log some error messages that contain personal data.
autoexec 5y ago
> If you are logging Personal Data, is that even wise, wrt GDPR? Has any company ever been driven into bankruptcy because of GDPR violations? Google, Amazon, Vodafone, Yoigo, The Municipality of Bergen, Orange Espagne, Malagatrom, the Bulgarian National Revenue Agency, Enel Energia, Deutsche Wohnen, and Facebook have been fined over and over again, but it hasn't hurt them. If you can make more money abusing people's data than you'd pay in fines, and that's only assuming you're caught, it seems like possible GDPR issues are just another cost of doing business.

msla 5y ago

I'd like to see someone take this analysis on. Is it valid? If not, why not, assuming American law? https://web.archive.org/web/20200813235643/http://slawsonandslawson.com/article-32-the-hole-in-the-gdpr-wall/ https://web.archive.org/web/20200813235643/http://slawsonand... > Article 3(2), a new feature of the GDPR, creates extraterritorial jurisdiction over companies that have nothing but an internet presence in the EU and offer goods or services to EU residents[1]. While the GDPR requires these companies[2] to follow its data processing rules, it leaves the question of enforcement unanswered. Regulations that cannot be enforced do little to protect the personal data of EU citizens. > This article discusses how U.S. law affects the enforcement of Article 3(2). In reality, enforcing the GDPR on U.S. companies may be almost impossible. First, the U.S. prohibits enforcing of foreign-country fines. Thus, the EU enforcement power of fines for noncompliance is negligible. Second, enforcing the GDPR through the designated representative can be easily circumvented. Finally, a private lawsuit brought by in the EU may be impossible to enforce under U.S. law. [snip] > Currently, there is a hole in the GDPR wall that protects European Union personal data. Even with extraterritorial jurisdiction over U.S. companies with only an internet presence in the EU, the GDPR gives little in the way of tools to enforce it. Fines from supervisory authorities would be stopped by the prohibition on enforcing foreign fines. The company can evade enforcement through a representative simply by not designating one. Finally, private actions may be stalled on issues of personal jurisdiction. If a U.S. company completely disregards the GDPR while targeting customers in the EU, it can use the personal data of EU citizens without much fear of the consequences. While the extraterritorial jurisdiction created by Article 3(2) may have seemed like a good way to solve the problem of foreign companies who do not have a physical presence in the EU, it turns out to be practically useless.

nix0n 5y ago
Currently, a lot of US companies have significant financial presence in Ireland, for tax-loophole reasons. See [0] for the Microsoft example specifically. I'm not a lawyer, and I know nothing about New Relic specifically. But the worst offenders of the spirit of GDPR really are vulnerable to EU enforcement. [0] https://www.theguardian.com/world/2021/jun/03/microsoft-irish-subsidiary-paid-zero-corporate-tax-on-220bn-profit-last-year https://www.theguardian.com/world/2021/jun/03/microsoft-iris...