5 ms·

Can you say specifically what goes too far? I don't find it onerous or unreasonable at all, but my business model doesn't improve by violating it either.

by hnhg 3y ago

TylerE 3y ago
Right to be forgotten has some really nasty edge csaes.
- yoaviram 3y ago
  Such as?
  - jay_kyburz 3y ago
    such as the ability easily support redaction of personal data? Errg: sorry folks. I miss read the thread and thought the "such as" was responding to the comment next to it about the design flaw of not being able to delete personal data.
    - deleted 3y ago
      [deleted]
    - amanaplanacanal 3y ago
      That doesn’t sound like an edge case.
    - friendlyHornet 3y ago
      And this is nasty because?
    - seanhunter 3y ago
      That's not an edge case in the law, that's a limitation in your system.
  - Reubend 3y ago
    - Payments, particularly from P2P transactions. If I send you money, and then you request the deletion of your profile, there's plenty of complexity there. - Enforcement records from illegal content / violating content - Local data cache for offline mode in mobile apps I'm not saying all of these apply to "Threads". But there are tons of edge cases to consider that need code changes t o behave as expected.
    - 8fingerlouie 3y ago
      > Payments There's really no complexity there. The right to be forgotten doesn't superseed other laws, and it is required by law in most countries, that transaction data be stored for 5 years plus running year, so in case you request to be forgotten, that can only happen once the mandatory data retainment has expired, which can easily be handled by a "transaction date", and simply run a batch job that matches each user to their transactions (and desire to be forgotten), and once transaction are expired and the user has requested to be forgotten, you simply delete. > Local data cache for offline mode in mobile apps The right to be forgotten has a "grace period", so set your cache expiration to less than that amount of time and you're pretty much home safe, or better yet, don't cache GDPR sensitive data and you can pretty much cache for as long as you like.
      - spacebanana7 3y ago
        There's a lot more to payments than raw transaction data. Payments are usually related to the exchange of goods or services. The delivery data of those could be essential for winning a chargeback dispute or a liability for a customer that asked to be forgotten.
        jen20 3y ago
        You aren’t holding raw transaction data on the basis of consent, so it doesn’t matter.
- _cenw 3y ago
  If your app doesn't easily support redaction of personal data, you have a design flaw to fix.
  - Silhouette 3y ago
    How are you going to "fix" that "design flaw" when the personal data in question is the result of legally required customer age checks? Evidence needed to support your tax filings? Used to identify and block people who are repeatedly trying to defraud you or breach your security? Subject to a legal hold because it might provide relevant evidence in some legal action between other parties or it's been requested as evidence by some government committee? Data protection laws like the GDPR might take the position that you should minimise the collection and use of personal data. Many of us might even agree with that position in principle. It can still be complicated to work out what "minimal" actually means if you did have good reasons to collect the personal data in the first place and you might still need to keep the data or some part of it for those purposes or to comply with other laws or regulations.
    - _cenw 3y ago
      I don't know where your actual problem is. The GDPR allows holding data for most of these purposes. You intermingled legal obligations with data legal departments would like to hold in the end there. Only one of those is required. Also, some of these are pure theoretical in the EU. You're not even allowed to photocopy an ID in Germany; age verification is a checkmark someone sets upon verifying the ID is valid and then (metaphorically) handing it back, not a copy of a legal document that you probably don't want deduplicated to random S3 buckets held by all the companies you do business with. They're not exactly resistant to replay attacks, after all.
      - Silhouette 3y ago
        I don't know where your actual problem is. My point is that knowing which personal data you need to redact and under which circumstances is not always easy. Before you can build a system that does something you first need to identify exactly what something is required.
- elefanten 3y ago
  Can you elaborate a full argument here? Or link somewhere that does?
  - pinkcan 3y ago
    politicians and other shady individuals know how to use this to their advantage
JumpCrisscross 3y ago
> Can you say specifically what goes too far? Twenty-eight independent data regulators on a complain-investigate model. I’ve seen folks bury early-stage competitors with regulatory inundation as an effective, if unethical, strategy. Zero chance Musk wouldn’t have armadas of randos complaining raining in on Threads.
- pgeorgi 3y ago
  For EU-based business: The DPA of your country is responsible for you. For non-EU-based business: Appoint a representative in the EU. The DPA of that representative's country is responsible for you. So where do the other 20+ DPAs come in? They might be responsible for your customers - in which case, they'll contact your DPA and sort it out among themselves. You still won't have to become an expert in the nuances of Bulgarian, Swedish and Portuguese privacy law.
  - JumpCrisscross 3y ago
    > they'll contact your DPA and sort it out among themselves No, they won’t. They’ll help you coördinate. You won’t have to become an expert in other bodies of law, but you will need to responsive to them, which is time consuming, distracting and—if you’re running a real business—expensive. I’ve seen this deployed to remarkable efficacy, with asymmetry in defence:deployment cost in excess of 10:1.
- concordDance 3y ago
  > Zero chance Musk wouldn’t have armadas of randos complaining raining in on Threads. Note that Musk has zero need to tell anyone to do this. Some fans will do so on their own initiative and that will suffice.
Nifty3929 3y ago
How do you know you aren’t violating it? Even with the best of intentions, these laws can be labyrinthian and ambiguous, and therefore expensive to (try to) observe. And there is still always the risk that you are found guilty of something. For a small or medium business, you are likely to be far enough out of the radar to avoid issues. But as a large company you may easily end up in legal crosshairs, costing millions or billions of euros, even if you ultimately prevail. And if you lose…
- jonathankoren 3y ago
  Don’t collect information and you know you’re not violating it. ¯\_(ツ)_/¯ Seriously though, GDPR compliance isn’t that hard. You just have to get out of the habit of collecting everything.
  - mrweasel 3y ago
    > Seriously though, GDPR compliance isn’t that hard Unless compiling data on your users and selling it is your entire business plan. One of the issue I see it that many companies have been lured into this impression that they need to track everything, in great detail, but it doesn't actually provide that much value. I blame the snake oil sales people in the advertising/remarketing/up-selling/cross-selling business.
    - dgb23 3y ago
      This is correct. So many websites don’t actually need to collect any user data. It’s just a distraction, slows down and bloats their site and worsens UX. I recommend to simply get rid of any tracking. If you want user feedback, ask them or do tests. It’s cheaper and more effective.
      - Silhouette 3y ago
        So many websites don’t actually need to collect any user data. Any commercial organisation is going to have customers and therefore customer details and payments data. Any commercial site needs to record enough logs to investigate events like outages or security threats. Any site that isn't purely informational and read-only probably works with user-provided data in some way. People keep writing about GDPR and similar laws as if they only apply to data-harvesting analytics plugins on ad-ridden content farms but the same laws apply to everyone else as well. For many it will be reasonable and indeed necessary to process personal data in order to do whatever the site or app does.

Can you say specifically what goes too far? I don't find it onerous or unreasonable at all, but my business model doesn't improve by violating it either.

by hnhg 3y ago

Can you say specifically what goes too far? I don't find it onerous or unreasonable at all, but my business model doesn't improve by violating it either.

TylerE 3y ago

Right to be forgotten has some really nasty edge csaes.

yoaviram 3y ago
Such as?
- jay_kyburz 3y ago
  such as the ability easily support redaction of personal data? Errg: sorry folks. I miss read the thread and thought the "such as" was responding to the comment next to it about the design flaw of not being able to delete personal data.
  - deleted 3y ago
    [deleted]
  - amanaplanacanal 3y ago
    That doesn’t sound like an edge case.
  - friendlyHornet 3y ago
    And this is nasty because?
  - seanhunter 3y ago
    That's not an edge case in the law, that's a limitation in your system.
- Reubend 3y ago
  - Payments, particularly from P2P transactions. If I send you money, and then you request the deletion of your profile, there's plenty of complexity there. - Enforcement records from illegal content / violating content - Local data cache for offline mode in mobile apps I'm not saying all of these apply to "Threads". But there are tons of edge cases to consider that need code changes t o behave as expected.
  - 8fingerlouie 3y ago
    > Payments There's really no complexity there. The right to be forgotten doesn't superseed other laws, and it is required by law in most countries, that transaction data be stored for 5 years plus running year, so in case you request to be forgotten, that can only happen once the mandatory data retainment has expired, which can easily be handled by a "transaction date", and simply run a batch job that matches each user to their transactions (and desire to be forgotten), and once transaction are expired and the user has requested to be forgotten, you simply delete. > Local data cache for offline mode in mobile apps The right to be forgotten has a "grace period", so set your cache expiration to less than that amount of time and you're pretty much home safe, or better yet, don't cache GDPR sensitive data and you can pretty much cache for as long as you like.
    - spacebanana7 3y ago
      There's a lot more to payments than raw transaction data. Payments are usually related to the exchange of goods or services. The delivery data of those could be essential for winning a chargeback dispute or a liability for a customer that asked to be forgotten.
      - jen20 3y ago
        You aren’t holding raw transaction data on the basis of consent, so it doesn’t matter.
_cenw 3y ago
If your app doesn't easily support redaction of personal data, you have a design flaw to fix.
- Silhouette 3y ago
  How are you going to "fix" that "design flaw" when the personal data in question is the result of legally required customer age checks? Evidence needed to support your tax filings? Used to identify and block people who are repeatedly trying to defraud you or breach your security? Subject to a legal hold because it might provide relevant evidence in some legal action between other parties or it's been requested as evidence by some government committee? Data protection laws like the GDPR might take the position that you should minimise the collection and use of personal data. Many of us might even agree with that position in principle. It can still be complicated to work out what "minimal" actually means if you did have good reasons to collect the personal data in the first place and you might still need to keep the data or some part of it for those purposes or to comply with other laws or regulations.
  - _cenw 3y ago
    I don't know where your actual problem is. The GDPR allows holding data for most of these purposes. You intermingled legal obligations with data legal departments would like to hold in the end there. Only one of those is required. Also, some of these are pure theoretical in the EU. You're not even allowed to photocopy an ID in Germany; age verification is a checkmark someone sets upon verifying the ID is valid and then (metaphorically) handing it back, not a copy of a legal document that you probably don't want deduplicated to random S3 buckets held by all the companies you do business with. They're not exactly resistant to replay attacks, after all.
    - Silhouette 3y ago
      I don't know where your actual problem is. My point is that knowing which personal data you need to redact and under which circumstances is not always easy. Before you can build a system that does something you first need to identify exactly what something is required.
elefanten 3y ago
Can you elaborate a full argument here? Or link somewhere that does?
- pinkcan 3y ago
  politicians and other shady individuals know how to use this to their advantage

JumpCrisscross 3y ago

> Can you say specifically what goes too far? Twenty-eight independent data regulators on a complain-investigate model. I’ve seen folks bury early-stage competitors with regulatory inundation as an effective, if unethical, strategy. Zero chance Musk wouldn’t have armadas of randos complaining raining in on Threads.

pgeorgi 3y ago
For EU-based business: The DPA of your country is responsible for you. For non-EU-based business: Appoint a representative in the EU. The DPA of that representative's country is responsible for you. So where do the other 20+ DPAs come in? They might be responsible for your customers - in which case, they'll contact your DPA and sort it out among themselves. You still won't have to become an expert in the nuances of Bulgarian, Swedish and Portuguese privacy law.
- JumpCrisscross 3y ago
  > they'll contact your DPA and sort it out among themselves No, they won’t. They’ll help you coördinate. You won’t have to become an expert in other bodies of law, but you will need to responsive to them, which is time consuming, distracting and—if you’re running a real business—expensive. I’ve seen this deployed to remarkable efficacy, with asymmetry in defence:deployment cost in excess of 10:1.
concordDance 3y ago
> Zero chance Musk wouldn’t have armadas of randos complaining raining in on Threads. Note that Musk has zero need to tell anyone to do this. Some fans will do so on their own initiative and that will suffice.

Nifty3929 3y ago

How do you know you aren’t violating it? Even with the best of intentions, these laws can be labyrinthian and ambiguous, and therefore expensive to (try to) observe. And there is still always the risk that you are found guilty of something. For a small or medium business, you are likely to be far enough out of the radar to avoid issues. But as a large company you may easily end up in legal crosshairs, costing millions or billions of euros, even if you ultimately prevail. And if you lose…

jonathankoren 3y ago
Don’t collect information and you know you’re not violating it. ¯\_(ツ)_/¯ Seriously though, GDPR compliance isn’t that hard. You just have to get out of the habit of collecting everything.
- mrweasel 3y ago
  > Seriously though, GDPR compliance isn’t that hard Unless compiling data on your users and selling it is your entire business plan. One of the issue I see it that many companies have been lured into this impression that they need to track everything, in great detail, but it doesn't actually provide that much value. I blame the snake oil sales people in the advertising/remarketing/up-selling/cross-selling business.
  - dgb23 3y ago
    This is correct. So many websites don’t actually need to collect any user data. It’s just a distraction, slows down and bloats their site and worsens UX. I recommend to simply get rid of any tracking. If you want user feedback, ask them or do tests. It’s cheaper and more effective.
    - Silhouette 3y ago
      So many websites don’t actually need to collect any user data. Any commercial organisation is going to have customers and therefore customer details and payments data. Any commercial site needs to record enough logs to investigate events like outages or security threats. Any site that isn't purely informational and read-only probably works with user-provided data in some way. People keep writing about GDPR and similar laws as if they only apply to data-harvesting analytics plugins on ad-ridden content farms but the same laws apply to everyone else as well. For many it will be reasonable and indeed necessary to process personal data in order to do whatever the site or app does.