5 ms·

I have been involved in trying to implement GDPR, and one constant source of frustration was it's not actually very clear when a system is fully compliant. We h

by abeppu 2y ago

I have been involved in trying to implement GDPR, and one constant source of frustration was it's not actually very clear when a system is fully compliant. We had engineers and product people and legal people who had different understandings of what various terms meant. For example, you have a 'right to object' to a data controller doing further processing of your personal data, and you have a 'right to be forgotten' in which case we should not keep your personal data any longer -- but we need to remember enough that when we encounter you again, we recognize that you've objected to further processing. How are we supposed to know in future interactions that you've opted out if we've deleted all mentions of you and your PII? What does 'deletion' mean? If I have a DB which is based on an append-only WAL which can include write and delete "operations", which mean the DB will respond to queries as if the record were deleted, but the record is definitely on disk, and still gets read into memory but just isn't returned as part of any query, but someone with access to the machine could still in principle read it ... is it 'deleted'? Are you 'forgotten'? What if you're gone from the DB but an old DB backup in cold storage still has a record? What if a columnar file for the datalake in block storage still has a record but you're gone from all DBs that are part of online systems? What if no DB has your raw PII, but your IP was added to a bloomfilter or other sketch datastructure, so it can't be read back out but we could potentially identify with some confidence that your IP had previously been in our logs? I totally think GDPR was a step in the right direction, and I wish my own country would adopt a strong data privacy law. But I also wish that the EU had set up e.g. a certification system, a large set of reference examples for how pieces fit together, or something to give implementing parties some confidence about whether they're doing it correctly.

p_l 2y ago
The best thing about GDPR is that in case of violation, you're not immediately raked over coals. The responsible national body is supposed to cooperate with willing business in ensuring compliance - if the business cooperates in good faith, the fines are minor or can be waived altogether. And part of such cooperation would be for regulator to help specify down the case.
- abeppu 2y ago
  Hmm, if anything the emphasis on national bodies having discretion in when this is enforced seems sketchy and concerning to me. Sketchy on the regulatory side because I don't trust them to not pick targets in a manner which is informed by public sentiment or some other motivation. Concerning on the corporate side because I have heard people say things like "oh, it doesn't have to be 100%, we just need to be good enough to not be a target for enforcement", which then becomes the basis for not making an entirely good faith effort. Whereas something like PCI compliance for businesses handling credit card transactions isn't a law, but does have pretty clear standards, a certification process, and serious potential risks to your business if you do it wrong. But you go through the process, you get certified, and then you know you're doing it.
  - p_l 2y ago
    It's not "discretion at enforcement". It's that the goal of the national body is to get you up to compliance, with reduced fines as incentives for helping you get there. The difference with PCI is that with PCI non-compliance means that payment networks will refuse to work with you, but at least in theory you're not forced to work with them either - you can not "opt out" of GDPR. So the purpose of the national body is to get the rules followed, and it has both ways to sweeten the deal (reduced fines for cooperating business) and the stick (vast increase in fines). Worst thing about GDPR was the cottage industry of "GDPR lawyers" that exploded around it coming into force in order to capitalize on panicking businesses, often fueling said panic. In reality, the main difference in GDPR versus previously active law is that GDPR increased fines and introduced policy framework for enforcing and helping compliance. BTW, there's no such thing as "not being a target". It's just enforcement depends on finite resources - and on complaints from people. And "do the minimum to not be target for enforcement" would be actually grounds for increased fines for acting in bad faith.
    - abeppu 2y ago
      Your description sounds exactly like I'd expect a regulator to describe discretionary enforcement. My point about PCI is that people can actually implement it and know that they've done so. If the goal of GDPR is to get people up to compliance ... well since no one but the regulators can determine if a company is complying, we have no idea whether they're actually accomplishing that goal. The cottage industry you're complaining about exists precisely because the law was so unclear. I remember reviewing "non-binding recital" documents before it went into effect which were not helpful. For a law which created new requirements for systems at thousands of companies, they could have written material which directly was targeted at the parties who would be responsible for implementation, and which they would commit to being binding. But they didn't. > you can not "opt out" of GDPR For companies based elsewhere, there was a very serious consideration of should we just not try to do business in the EU. If you're a midsized company in the US faced with a large engineering effort to possibly meet regulatory requirements for a region where you have a small minority of customers, it's a real question.
abeppu 2y ago
Oh right, the other one that was totally baffling is people have a right to request their data, and we should give it to them in a timely manner -- but it's not sufficiently clear how we should know that the person making a request, possibly based on PII, is in fact the data subject in question. How do you check that? How do you find all the data that is associated to a person, given that accounts are not people? Sometimes it's gonna be impossible but GDPR doesn't say that your company's obligation to give people their data is contingent on them still having control of the email address they used to sign up years go, etc.
tbrock 2y ago
> but we need to remember enough that when we encounter you again, we recognize that you've objected to further processing. How are we supposed to know in future interactions that you've opted out if we've deleted all mentions of you and your PII? Just hash the PII, delete the original and reinsert the hashed version (perhaps into another table). On insert check if hashes match and the opt out bit is set, if they match and it’s set then act appropriately.
- abeppu 2y ago
  You used the word "just" there, but I don't think storing hashed PII is necessarily an out here. Clearly, the whole point of the suggestion is that we can still match the person against a record, and the hashed device id or ip or email or whatever else is functioning as an identifier.

by abeppu 2y ago

p_l 2y ago

The best thing about GDPR is that in case of violation, you're not immediately raked over coals. The responsible national body is supposed to cooperate with willing business in ensuring compliance - if the business cooperates in good faith, the fines are minor or can be waived altogether. And part of such cooperation would be for regulator to help specify down the case.

abeppu 2y ago
Hmm, if anything the emphasis on national bodies having discretion in when this is enforced seems sketchy and concerning to me. Sketchy on the regulatory side because I don't trust them to not pick targets in a manner which is informed by public sentiment or some other motivation. Concerning on the corporate side because I have heard people say things like "oh, it doesn't have to be 100%, we just need to be good enough to not be a target for enforcement", which then becomes the basis for not making an entirely good faith effort. Whereas something like PCI compliance for businesses handling credit card transactions isn't a law, but does have pretty clear standards, a certification process, and serious potential risks to your business if you do it wrong. But you go through the process, you get certified, and then you know you're doing it.
- p_l 2y ago
  It's not "discretion at enforcement". It's that the goal of the national body is to get you up to compliance, with reduced fines as incentives for helping you get there. The difference with PCI is that with PCI non-compliance means that payment networks will refuse to work with you, but at least in theory you're not forced to work with them either - you can not "opt out" of GDPR. So the purpose of the national body is to get the rules followed, and it has both ways to sweeten the deal (reduced fines for cooperating business) and the stick (vast increase in fines). Worst thing about GDPR was the cottage industry of "GDPR lawyers" that exploded around it coming into force in order to capitalize on panicking businesses, often fueling said panic. In reality, the main difference in GDPR versus previously active law is that GDPR increased fines and introduced policy framework for enforcing and helping compliance. BTW, there's no such thing as "not being a target". It's just enforcement depends on finite resources - and on complaints from people. And "do the minimum to not be target for enforcement" would be actually grounds for increased fines for acting in bad faith.
  - abeppu 2y ago
    Your description sounds exactly like I'd expect a regulator to describe discretionary enforcement. My point about PCI is that people can actually implement it and know that they've done so. If the goal of GDPR is to get people up to compliance ... well since no one but the regulators can determine if a company is complying, we have no idea whether they're actually accomplishing that goal. The cottage industry you're complaining about exists precisely because the law was so unclear. I remember reviewing "non-binding recital" documents before it went into effect which were not helpful. For a law which created new requirements for systems at thousands of companies, they could have written material which directly was targeted at the parties who would be responsible for implementation, and which they would commit to being binding. But they didn't. > you can not "opt out" of GDPR For companies based elsewhere, there was a very serious consideration of should we just not try to do business in the EU. If you're a midsized company in the US faced with a large engineering effort to possibly meet regulatory requirements for a region where you have a small minority of customers, it's a real question.

abeppu 2y ago

Oh right, the other one that was totally baffling is people have a right to request their data, and we should give it to them in a timely manner -- but it's not sufficiently clear how we should know that the person making a request, possibly based on PII, is in fact the data subject in question. How do you check that? How do you find all the data that is associated to a person, given that accounts are not people? Sometimes it's gonna be impossible but GDPR doesn't say that your company's obligation to give people their data is contingent on them still having control of the email address they used to sign up years go, etc.

tbrock 2y ago

> but we need to remember enough that when we encounter you again, we recognize that you've objected to further processing. How are we supposed to know in future interactions that you've opted out if we've deleted all mentions of you and your PII? Just hash the PII, delete the original and reinsert the hashed version (perhaps into another table). On insert check if hashes match and the opt out bit is set, if they match and it’s set then act appropriately.

abeppu 2y ago
You used the word "just" there, but I don't think storing hashed PII is necessarily an out here. Clearly, the whole point of the suggestion is that we can still match the person against a record, and the hashed device id or ip or email or whatever else is functioning as an identifier.