4 ms·

No, the "small guy" should not be entitled to violate privacy and rights of EU citizens (or any people, for that matter), just because US doesn't grant same pro

No, the "small guy" should not be entitled to violate privacy and rights of EU citizens (or any people, for that matter), just because US doesn't grant same protections.

davidmurdoch 4y ago
The small guy can't afford to abide by these vague and over-reaching regulations, is my point.
- neoromantique 4y ago
  It doesn't cost you anything to not collect my PII.
  - davidmurdoch 4y ago
    What if you are abusing a service? Can I collect it then?
    - neoromantique 4y ago
      This is quite a leap from unnecessary phone home request to check version, but alas it already has been answered in depth in other comments.
      - davidmurdoch 4y ago
        Not a leap. The conversation jumped to the broader conversation of GDPR and PII a few comments up. Running a service that might serve an EU citizen quickly escalates to involving lawyers and performing risk analysis in relation to being sued in a court across the ocean.
        neoromantique 4y ago
        >Running a service that might serve an EU citizen quickly escalates to involving lawyers and performing risk analysis in relation to being sued in a court across the ocean. Running any service where you are not sure of legal requirements might require consulting a lawyer first, how is it unique to GDPR? And in order to be on the radar for GDPR violations as a small business you REALLY need to do something seriously wrong.
        davidmurdoch 4y ago
        I actually think I may be mistaken. I've always believed GDPR was a regulation that crossed borders. Meaning it applies to any EU citizen, no matter where they are located, which is what made this unique (being that it's not my countries laws). But: > The GDPR applies to: > > a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU. from https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://commission.europa.eu/law/law-topic/data-protection/r... So now I'm wondering if an IP address reverse-geo lookup to block IPs in the EU is the easy way out for many online services, presuming that this doesn't cause compliance issues for EU users using a VPN.
        neoromantique 4y ago
        It sure is a good way to communicate that you don't care about my privacy and should not be getting my money ¯\_(ツ)_/¯
        davidmurdoch 4y ago
        GDPR is a headache and makes doing the right thing harder.
        neoromantique 4y ago
        No.
    - arp242 4y ago
      Yes. "Processing shall be lawful only if and to the extent that at least one of the following applies: [..] processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data" Reasonable abuse protection clearly falls under that, as has been fairly clearly stated even in the GDPR itself: https://gdpr-info.eu/recitals/no-49/ https://gdpr-info.eu/recitals/no-49/
  - Uvix 4y ago
    But I don't know what counts as PII because the regulations are so vague.
    - JohnFen 4y ago
      All of the legal definitions of "PII" leave out a ton that is actually personally-identifying information. Just have personal standards that exceed all of the laws. No problem.
- tpxl 4y ago
  Stop spreading bullshit. GDPR is incredibly easy to comply with if you don't do retarded shit.
  - davidmurdoch 4y ago
    Like attempting to protect a service against abuse? Do that and be 100% confident your aren't in violation and post an easy step-by-step tutorial on how to do it.
    - tpxl 4y ago
      Using IPs to protect from abuse has been debated to death and is considered legitimate use.
      - davidmurdoch 4y ago
        Just some questions off the top of my head, that I, a FOSS developer have, and can not say with absolutely certainty that an EU court won't have problems with. How long can the IP kept around for? And in what form? If it lands in a database, does it need to be encrypted at rest? Can it just be hashed? Salted, too? Do I need to rotate the salt? This limits the ability to protect the service though. Are the tools in my stack logging something somewhere else I don't know about? Could I get in trouble if it is? Cloudflare forwards IP-derived data to me, like the city of IP may be in, do I have to be concerned with that as well? Do I have to tell users upfront that I use Cloudflare and it derives data? I'm guessing I have to fully understand what CLoudflare does with this data. It eventually hits my Digital Ocean droplet, what does it log?, are there separate logs I can access from them outside my droplet? Certainly they have logs, too, what do I do about that? If I just require all users to explicitly agree to some form of data collection this probably goes away. Oh wait, now I have to manage obvious PII and ensure Right to be Forgotten can be exercised in a timely fashion, I've just made the whole thing more difficult for myself. There is a cost, and it affect the small honest devs the most. I'm not saying what GDPR is attempting to do is a bad thing, I'm just saying that it is not easy to comply like everyone keeps saying.

No, the "small guy" should not be entitled to violate privacy and rights of EU citizens (or any people, for that matter), just because US doesn't grant same protections.

davidmurdoch 4y ago

The small guy can't afford to abide by these vague and over-reaching regulations, is my point.

neoromantique 4y ago
It doesn't cost you anything to not collect my PII.
- davidmurdoch 4y ago
  What if you are abusing a service? Can I collect it then?
  - neoromantique 4y ago
    This is quite a leap from unnecessary phone home request to check version, but alas it already has been answered in depth in other comments.
    - davidmurdoch 4y ago
      Not a leap. The conversation jumped to the broader conversation of GDPR and PII a few comments up. Running a service that might serve an EU citizen quickly escalates to involving lawyers and performing risk analysis in relation to being sued in a court across the ocean.
      - neoromantique 4y ago
        >Running a service that might serve an EU citizen quickly escalates to involving lawyers and performing risk analysis in relation to being sued in a court across the ocean. Running any service where you are not sure of legal requirements might require consulting a lawyer first, how is it unique to GDPR? And in order to be on the radar for GDPR violations as a small business you REALLY need to do something seriously wrong.
        davidmurdoch 4y ago
        I actually think I may be mistaken. I've always believed GDPR was a regulation that crossed borders. Meaning it applies to any EU citizen, no matter where they are located, which is what made this unique (being that it's not my countries laws). But: > The GDPR applies to: > > a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU. from https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://commission.europa.eu/law/law-topic/data-protection/r... So now I'm wondering if an IP address reverse-geo lookup to block IPs in the EU is the easy way out for many online services, presuming that this doesn't cause compliance issues for EU users using a VPN.
        neoromantique 4y ago
        It sure is a good way to communicate that you don't care about my privacy and should not be getting my money ¯\_(ツ)_/¯
        davidmurdoch 4y ago
        GDPR is a headache and makes doing the right thing harder.
        neoromantique 4y ago
        No.
  - arp242 4y ago
    Yes. "Processing shall be lawful only if and to the extent that at least one of the following applies: [..] processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data" Reasonable abuse protection clearly falls under that, as has been fairly clearly stated even in the GDPR itself: https://gdpr-info.eu/recitals/no-49/ https://gdpr-info.eu/recitals/no-49/
- Uvix 4y ago
  But I don't know what counts as PII because the regulations are so vague.
  - JohnFen 4y ago
    All of the legal definitions of "PII" leave out a ton that is actually personally-identifying information. Just have personal standards that exceed all of the laws. No problem.
tpxl 4y ago
Stop spreading bullshit. GDPR is incredibly easy to comply with if you don't do retarded shit.
- davidmurdoch 4y ago
  Like attempting to protect a service against abuse? Do that and be 100% confident your aren't in violation and post an easy step-by-step tutorial on how to do it.
  - tpxl 4y ago
    Using IPs to protect from abuse has been debated to death and is considered legitimate use.
    - davidmurdoch 4y ago
      Just some questions off the top of my head, that I, a FOSS developer have, and can not say with absolutely certainty that an EU court won't have problems with. How long can the IP kept around for? And in what form? If it lands in a database, does it need to be encrypted at rest? Can it just be hashed? Salted, too? Do I need to rotate the salt? This limits the ability to protect the service though. Are the tools in my stack logging something somewhere else I don't know about? Could I get in trouble if it is? Cloudflare forwards IP-derived data to me, like the city of IP may be in, do I have to be concerned with that as well? Do I have to tell users upfront that I use Cloudflare and it derives data? I'm guessing I have to fully understand what CLoudflare does with this data. It eventually hits my Digital Ocean droplet, what does it log?, are there separate logs I can access from them outside my droplet? Certainly they have logs, too, what do I do about that? If I just require all users to explicitly agree to some form of data collection this probably goes away. Oh wait, now I have to manage obvious PII and ensure Right to be Forgotten can be exercised in a timely fashion, I've just made the whole thing more difficult for myself. There is a cost, and it affect the small honest devs the most. I'm not saying what GDPR is attempting to do is a bad thing, I'm just saying that it is not easy to comply like everyone keeps saying.