7 ms·
I don’t have much of an opinion on the overall value of GDPR, but I’ve been asked multiple times now to create indexes of personal data to _comply_ with the law
by kasey_junk 2y ago
I don’t have much of an opinion on the overall value of GDPR, but I’ve been asked multiple times now to create indexes of personal data to _comply_ with the law when said indexes were not wanted for business or technical reasons.
An example is in big data repositories where personal data may have been provided but not used for anything. Yes it’s there but nothing uses it. To enable the reporting and deletion requirements you build a system that keeps track of all that, now the data _is_ trivially correlated which seems like the opposite of the intent.
Even when I build systems that prunes the data on ingest it feels weird. To conform with a privacy law I’m building a sophisticated filter for finding personal data I don’t even want.
- ranger_danger 2y agoWhat a strange game. The only winning move is not to play.
- estebank 2y agoThat is precisely the intent of the law: align the incentives of users and service providers, making storing PII annoying enough that the service provider will ask themselves "do I really need this data in the first place?"
- aleph_minus_one 2y ago> making storing PII annoying enough that the service provider will ask themselves "do I really need this data in the first place?" No, the service provider will rather ask himself: "Where can I find a really good lawyer who can tell me how to handle shitty EU laws without getting into a risk of getting sued?" In other words: this law is a job creation scheme for lawyers.
- OKRainbowKid 2y agoUsually, complying with the law is the best solution if you do not want to get sued.
- aleph_minus_one 2y agoThe problem is that it is often hard to interpret what the laws mean (they are made by politicians and not computer scientists), and which behaviour risks you getting sued and which not.
- p_l 2y agoComplying with GDPR by not taking data you do not need is easy. Lawyers mainly worked on producing disinformation about it because confusing people made for better consulting fees, but especially once guidance on "legitimate use" filtered out from legalese, they kinda stopped having an angle ... unless what you actually want to do is to violate GDPR and trade in PII, then you need to lawyer up
- aleph_minus_one 2y ago> Complying with GDPR by not taking data you do not need is easy. If your claim was true, the solution would be easy: I simply find a need for all data that I collect. Problem solved? For sure not, which obviously falsifies your "idea" that it is so easy.
- p_l 2y agoIt does not, because what falls under legitimate interest is also quite clearly described. Is it necessary for performing the service to end user? Is it necessary to support technical or legal issues in providing the service? (Trading data with other entities, marketing, etc ARE NOT, logging, debugging, security/audit logs ARE). Creating BS claims for "legitimate interest" like IAB does is just setting yourself for big fines for breaking the law.
- estebank 2y agoIf you're technically unable to comply with the requirements of fetching all PII for a given person and subsequently delete it, you have no business storing that PII in the first place. Your line of argument is like complaining that seatbelts are government overreach that increases the cost of cars.
- ranger_danger 2y agoWell, that seems like a good idea, but will that lead to a larger rise in more anonymous services? It also seems like KYC (know your customer) style laws may be incompatible with ECD (E-commerce directive, similar to USA Section 230) laws too.
- remus 2y ago> To conform with a privacy law I’m building a sophisticated filter for finding personal data I don’t even want. ...and then presumably deleting it, as required by the law if there is no business or technical reason for having the personal data. That seems like a pretty good pro-privacy move, vs leaving that data hanging around forever.
- kasey_junk 2y agoIt seems weird to me because I’m creating a capability that could be used to invade privacy when none would exist besides the compliance requirement.
- remus 2y agoIt seems a net positive overall to me: the system has gone from collecting and storing personal info for no reason, with all the risk that entails (e.g. a data breach that exposes that info) to no longer storing that info (and hopefully no longer collecting it in the first place either). It seems to me like you've built an important auditing tool for picking up areas where the system as a whole was being loose with personal data. If the end goal is to improve privacy, not collecting and storing the data seems a much stronger protection than crossing your fingers hoping someone doesn't go rummaging around looking for personal data.
- p_l 2y agoJust because you do not yet have the capability to abuse the invasion of privacy you have already done, does not prevent you from doing so later. GDPR's goal was to make PII into "toxic materiel", to be only handled if you really, really need it and are willing to deal with the toxicity. Having a pool of toxic sludge and declaring everything is fine because you do not use it after filtering what was useful for you does not stop it from being a dangerous pool of toxic sludge.
- okanat 2y agoThe only way _you_ can think of is "invading privacy". If you delete any data that can single out people when you're ingesting it, then nothing more needs to be done. So you delete any user identifying data by default, not keep it from the very start, unless you have a very strong use case. You can also have completely anonymised but still useful data. There are many statistical methods to collect useful but reasonably and provably anonymous data like differential privacy. If the businesses that give you data don't provide the option of completely deleting it then they are non-compliant as well.
- schmidt_fifty 2y ago[dead]
- lionkor 2y ago> An example is in big data repositories where personal data may have been provided but not used for anything In that case you have to delete it, you know this, right?
- kasey_junk 2y agoYes. That’s the point. I’m building the capability to comply with the deletion requirements. But prior to that requirement the systems _didn’t_ have any usage of the personal info.
- estebank 2y agoIf you didn't have any use for that data, why was it being stored in the first place? If it continues to not be necessary for your business, why don't you stop recording it instead of building an index to remove them after the fact?
- kasey_junk 2y agoUsually it’s a case where a data provider gives you data that is necessary for a business but _also_ includes data you don’t want or need. Some process will ingest and index the valuable data and throw the original file into non-indexed storage in case it needs to be re-run. Ideally you filter that data at ingest time but even that is building a capability that feels against the intent. But let’s say you didn’t even know to build the filter. Now you need to go in and scan all those files to remove the personal data. A capability that requires you to read data you hadn’t prior.
- paulmd 2y agoSo, you are just building a huge pool of personally-identifiable data that you are holding onto for no commercial or business reason or benefit to the user? You’re literally the reason the law was passed. Don’t do that. Like what happens when you get hacked or leave an Amazon bucket public and someone sells all your customers’ PII on the dark web? A lot of HN’ers “”struggle”” with the concept that the law isn’t “confusing” or “bad” it’s that they themselves are taking actions that are socially harmful and laws have been passed to target this behavior. But it’s difficult to make a man understand something when his paycheck depends on not understanding it. The axiom has been for businesses to hoover up as much data as possible, and that’s explicitly the mindset the EU wants you to stop. Being asked to at least catalog what you’re hoovering up is a tiny tiny ask, let alone the immense risks you’re running with other people’s identifiable data. Don’t create these targets for people to hack in the first place, especially when they self-admittedly serve no useful purpose even to your marketing. You’re literally the guy getting mad the government is making him clean up his superfund site. Moving the drums is riskier than just letting them sit there forever… up until they inevitably rust out. https://en.wikipedia.org/wiki/Valley_of_the_Drums https://en.wikipedia.org/wiki/Valley_of_the_Drums “I ain’t hurtin’ nobody, it’s a free country!”
- aeurielesn 2y agoDon't ask for personal data then.
- kasey_junk 2y agoI had a case once where an hr system was supposed to provide a catalog of office locations. Unbeknownst to us (or the hr system owner) after a software update it started sending us extra fields which would occasionally include the office managers name and contact details (including home address at times). Had another case where a pos vendor was supposed to be sending us aggregate sales data. Again, not in the agreed spec, they included the names of any loyalty users who had used each pos. I once saw a script kiddie spew a whole credit card file into a non existent endpoint filling the request logs with pci scoped data. Many web based api (especially json based ones) will not refuse requests that have extra fields in them, so you can get in the case where poorly crafted clients are sending data they shouldn’t. My point is many many systems don’t ask for personal data and still get and store it.
- aeurielesn 2y agoWow, storing data blindly like that sounds like a nightmare but I can totally see it happening.
- troupo 2y ago> My point is many many systems don’t ask for personal data and still get and store it. It's strange that your response to it is "yup, it's totally fine who cares" and not "the systems should be updated to not do that".
- kasey_junk 2y agoWhere did I respond with that? My central concern is there is a trade off to be made between keeping the data in place and building a capability to actually read/index the actual personal data. My opinion many times is that not having the technical capability to read that data is often a better privacy control in practice than building it to delete data and hoping it doesn’t get repurposed. That seems to be a minority opinion here.
- rqtwteye 2y ago"An example is in big data repositories where personal data may have been provided but not used for anything. Yes it’s there but nothing uses it." It's not being used until somebody decides to use it.
- kasey_junk 2y agoSure, but does me building a capability to proactively do that make it more likely that someone decides to use the data than if I hadn’t built it?
- rqtwteye 2y agoHaving the data at all makes it more likely that somebody will use it.
- Wool2662 2y agoThey could have taken the cheap way of just deleting everything. So someone already wants to use it or at the very least have the option.