3 ms·

>This makes it impossible to use any components hosted by third parties without getting consent by the users. There are six lawful grounds for processing perso

>This makes it impossible to use any components hosted by third parties without getting consent by the users. There are six lawful grounds for processing personal data under GDPR; only one of those grounds is consent. Consent is not always necessary, nor is it always sufficient. An IP address is potentially personal data, because it could relate to a natural living person. There are all sorts of legitimate reasons to use that data without consent, the most obvious being to fulfil a request by the user. You will run into issues if you're using that data in ways that aren't strictly necessary - keeping logs indefinitely, using that data for marketing purposes, sharing that data with third parties without good reason and without adequate safeguards etc. https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/

TekMol 3y ago
Unfortunately, a judge can always say that using an external resource was not necessary to fulfil a user request. As they did in the judgement I linked to. A judge can always claim you could have used a local version of whatever external resource you used.
- olivierduval 3y ago
  Of course... or he can say that you could use another resources that is GDPR compliant and/or privacy preserving. YOU provide the service so YOU are responsible for the way your user's data are processed and must ensure that it's processed according to the rules (requiring consent when necessary)
- jdietrich 3y ago
  A judge can say anything they like, but that doesn't mean it'll be upheld at appeal. If you can use a local version of an external resource, you should. Minimisation is an integral principle of GDPR. There are plenty of circumstances where it would be impractical or impossible to perform a necessary function without sharing data with third parties, but that still needs to be done with appropriate thought and care. I would have a great deal of confidence in embedding a resource provided by Stripe; I would have absolutely no confidence in embedding a resource provided by Google.
- josefx 3y ago
  And if that is the first GDPR related offense you get away with a slap on the wrist.
olivierduval 3y ago
Yeah... it could be nice if people stop spreading FUD on GDPR ;-) All GDPR is asking mostly is: you only gather minimal PII to provide a service (if needed at all). If you use PII for another purpose than providing the service or meeting operational purposes (like fraud detection or monitoring your infra), then you must obtain the consent of the user (for marketing or selling your users data for example). This extends to your providers too (like Google Analytics...) The problem is that a lot of "internet services" take for granted that they can do whatever they want with the data they got for a specific purpose... even without informing the user! And that's not good... so GDPR has been created. But if your service is "fair" to the user (meaning: you only use the datas to provide the service), then there's no problem...
- jansan 3y ago
  Apparently a German court ruled that embedding fonts from Google Fonts is not "fair" to the user. You either have to ignore parts of the GDPR or you accept to not be able to do many useful things.
  - usr1106 3y ago
    You can do useful things without selling user data to Google. Yes it's selling: You provied the data, Google gives you hosted services back. If you think embedded fonts are useful for you, you can host them. Then you pay the bill and not your users.
- j16sdiz 3y ago
  > (like fraud detection or monitoring your infra) reCAPTCHA, in this case can be consider as "fraud detection". Can we do it without PII? Yes. Maybe. With lots of effort and less optimal result. Does this fit the "necessary" provision of GDPR? This depends on which court you ask. reCAPTCHA does not add "direct" value to the user, it even cost some harass... but it is a life saver if your service is big spam target.
  - account42 3y ago
    Like any US-based service (or one controlled by a US company), reCAPTCHA is subject to US laws which mean they CANNOT guarantee that your PII is only used for fraud detection purposes because the govermnet can order them at any time to hand over that data while also ordering them to keep silent about that.

TekMol 3y ago

Unfortunately, a judge can always say that using an external resource was not necessary to fulfil a user request. As they did in the judgement I linked to. A judge can always claim you could have used a local version of whatever external resource you used.

olivierduval 3y ago
Of course... or he can say that you could use another resources that is GDPR compliant and/or privacy preserving. YOU provide the service so YOU are responsible for the way your user's data are processed and must ensure that it's processed according to the rules (requiring consent when necessary)
jdietrich 3y ago
A judge can say anything they like, but that doesn't mean it'll be upheld at appeal. If you can use a local version of an external resource, you should. Minimisation is an integral principle of GDPR. There are plenty of circumstances where it would be impractical or impossible to perform a necessary function without sharing data with third parties, but that still needs to be done with appropriate thought and care. I would have a great deal of confidence in embedding a resource provided by Stripe; I would have absolutely no confidence in embedding a resource provided by Google.
josefx 3y ago
And if that is the first GDPR related offense you get away with a slap on the wrist.

olivierduval 3y ago

Yeah... it could be nice if people stop spreading FUD on GDPR ;-) All GDPR is asking mostly is: you only gather minimal PII to provide a service (if needed at all). If you use PII for another purpose than providing the service or meeting operational purposes (like fraud detection or monitoring your infra), then you must obtain the consent of the user (for marketing or selling your users data for example). This extends to your providers too (like Google Analytics...) The problem is that a lot of "internet services" take for granted that they can do whatever they want with the data they got for a specific purpose... even without informing the user! And that's not good... so GDPR has been created. But if your service is "fair" to the user (meaning: you only use the datas to provide the service), then there's no problem...

jansan 3y ago
Apparently a German court ruled that embedding fonts from Google Fonts is not "fair" to the user. You either have to ignore parts of the GDPR or you accept to not be able to do many useful things.
- usr1106 3y ago
  You can do useful things without selling user data to Google. Yes it's selling: You provied the data, Google gives you hosted services back. If you think embedded fonts are useful for you, you can host them. Then you pay the bill and not your users.
j16sdiz 3y ago
> (like fraud detection or monitoring your infra) reCAPTCHA, in this case can be consider as "fraud detection". Can we do it without PII? Yes. Maybe. With lots of effort and less optimal result. Does this fit the "necessary" provision of GDPR? This depends on which court you ask. reCAPTCHA does not add "direct" value to the user, it even cost some harass... but it is a life saver if your service is big spam target.
- account42 3y ago
  Like any US-based service (or one controlled by a US company), reCAPTCHA is subject to US laws which mean they CANNOT guarantee that your PII is only used for fraud detection purposes because the govermnet can order them at any time to hand over that data while also ordering them to keep silent about that.