3 ms·

Wow you mean a free service can do a better job of GDPR compliance than the endless and nagging popups the other sites put out there? Almost sounds like the an

Wow you mean a free service can do a better job of GDPR compliance than the endless and nagging popups the other sites put out there? Almost sounds like the annoying popups are in spite and not out of need

flaminHotSpeedo 3y ago
Of course, it's trivial for a system that retains very little personal data (and really shouldn't be storing any) to comply with gdpr. Besides the obvious "less data, fewer problems" angle there's also the bureaucracy angle - last time I worked on gdpr compliance I got stuck in the middle of a fight with security (who wants to store all the data for ever), the legal team specifically in charge of figuring out what's in scope for GDPR, and another more generic legal team (this one was the worst - they had no idea what the system does and ignored any attempts at explaining it, plus they kept pushing for unrelated often contradictory retention changes)
- ilyt 3y ago
  We did had some of the talks with lawyer about security (in particular logs) and general consensus was that as long as they are stored explicitly for that purpose and only that purpose it isn't a problem, they just have to be properly secured. Logs like that fall under 6.1.b-f, basically "making sure malicious actor can't fuck with site" overrides needing to get permission to process that. Again, if they are used ONLY for that and are stored securely. Same reason why security footage (which also falls under GDPR) doesn't need consent, only information visible onto property entrance informing who is processing that info.
PeterisP 3y ago
A non-profit service should be expected to have better compliance than a service which has a strong monetary motivation to exploiting users data as much as possible and thus comply with privacy requirements as little as possible.
ilyt 3y ago
Compliance with GDPR is extremely easy: just don't gather PII in the first place. And if you want to gather data it's also not too hard, just ask for it and tell user exactly what you're going to do with it. It's when you want to cajole user into agreeing for gathering way more data than they would consent to if someone explained the extent to them plainly, and to send it to a bunch of 3rd parties too, that's where the difficulty starts and you have to use the blackest of black of techniques to cheat user while still being technically compliant to law.
- 542458 3y ago
  GDPR compliance is (IMO) very difficult. PII is defined so broadly that it’s near impossible to avoid gathering it, and there are so many stipulations and gotchas and regional requirements and changing guidance about how you must handle it that you essentially need legal help to navigate it. For example, does your company have employees? Congrats, their HR files (and anything else with their name on it) are covered under GDPR. But you can’t just get consent to handle their data here, since they’re employees and there’s a power mismatch. Instead, you need to rely on the “legitimate interest” clause, which requires specific legal documentation on impact analysis that must be kept up-to-date. Or another example: if your error logs contain IP addresses, that’s PII and subject to all the complexities of GDPR handling. Even in the absence of logging, I’m not sure a plain web server with all logging off isn't subject to GDPR given how broad the legislation is - after all, it has to process PII (IP address) to send responses, and GDPR covers any system that “uses” PII. To be perfectly clear, I’m not saying this is bad, but I am saying it’s complicated and not just as simple as “just don’t gather data” or “just get consent”. It’s not easy, you probably need a lawyer’s help.
  - withinboredom 3y ago
    All you literally have to do is tell people what you're doing and who has access to the data. It isn't that much more complicated -- its literally just requiring you to communicate, which you should have been doing before.
    - 3y ago

flaminHotSpeedo 3y ago

Of course, it's trivial for a system that retains very little personal data (and really shouldn't be storing any) to comply with gdpr. Besides the obvious "less data, fewer problems" angle there's also the bureaucracy angle - last time I worked on gdpr compliance I got stuck in the middle of a fight with security (who wants to store all the data for ever), the legal team specifically in charge of figuring out what's in scope for GDPR, and another more generic legal team (this one was the worst - they had no idea what the system does and ignored any attempts at explaining it, plus they kept pushing for unrelated often contradictory retention changes)

ilyt 3y ago
We did had some of the talks with lawyer about security (in particular logs) and general consensus was that as long as they are stored explicitly for that purpose and only that purpose it isn't a problem, they just have to be properly secured. Logs like that fall under 6.1.b-f, basically "making sure malicious actor can't fuck with site" overrides needing to get permission to process that. Again, if they are used ONLY for that and are stored securely. Same reason why security footage (which also falls under GDPR) doesn't need consent, only information visible onto property entrance informing who is processing that info.

PeterisP 3y ago

A non-profit service should be expected to have better compliance than a service which has a strong monetary motivation to exploiting users data as much as possible and thus comply with privacy requirements as little as possible.

ilyt 3y ago

Compliance with GDPR is extremely easy: just don't gather PII in the first place. And if you want to gather data it's also not too hard, just ask for it and tell user exactly what you're going to do with it. It's when you want to cajole user into agreeing for gathering way more data than they would consent to if someone explained the extent to them plainly, and to send it to a bunch of 3rd parties too, that's where the difficulty starts and you have to use the blackest of black of techniques to cheat user while still being technically compliant to law.

542458 3y ago
GDPR compliance is (IMO) very difficult. PII is defined so broadly that it’s near impossible to avoid gathering it, and there are so many stipulations and gotchas and regional requirements and changing guidance about how you must handle it that you essentially need legal help to navigate it. For example, does your company have employees? Congrats, their HR files (and anything else with their name on it) are covered under GDPR. But you can’t just get consent to handle their data here, since they’re employees and there’s a power mismatch. Instead, you need to rely on the “legitimate interest” clause, which requires specific legal documentation on impact analysis that must be kept up-to-date. Or another example: if your error logs contain IP addresses, that’s PII and subject to all the complexities of GDPR handling. Even in the absence of logging, I’m not sure a plain web server with all logging off isn't subject to GDPR given how broad the legislation is - after all, it has to process PII (IP address) to send responses, and GDPR covers any system that “uses” PII. To be perfectly clear, I’m not saying this is bad, but I am saying it’s complicated and not just as simple as “just don’t gather data” or “just get consent”. It’s not easy, you probably need a lawyer’s help.
- withinboredom 3y ago
  All you literally have to do is tell people what you're doing and who has access to the data. It isn't that much more complicated -- its literally just requiring you to communicate, which you should have been doing before.
  - 3y ago