4 ms·

And are you prepared to respond to GDPR and other jurisdiction requirements of data collection and management?

by michaelteter 2y ago

p-o 2y ago
Aren't you jumping the gun a little bit? While it's a valid question, it's very premature.
- Symbiote 2y ago
  It's not premature; it's something to consider whenever sharing people's personal data on the internet. The GDPR does not apply "in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity" [1]. However, that does not extend to generally sharing the information on the internet [2] as that's no longer purely personal. [1] https://gdpr-text.com/read/recital-18/ https://gdpr-text.com/read/recital-18/ [2] https://law.stackexchange.com/questions/92229/what-does-household-exception-to-the-gdpr-mean https://law.stackexchange.com/questions/92229/what-does-hous...
  - dylan604 2y ago
    How does the fact that the user opts-in for the service by manually adding the tag to their profile so that information they personally added could be shared get considered by the GDPR?
    - d1sxeyes 2y ago
      Not sure and IANAL but the GDPR text is a bit weird on that. Article 9 has section e) which says that information 'manifestly made public' relating to 'special categories' is excluded. What's weird is there seems to be no such exclusion for personal information which does not relate to special categories. Having this 'opt-in' certainly seems to tick the box for consent. However, if reproducing information from a publicly available bio would fall foul of GDPR requirements, then I think there are bigger fish to fry than a hobby project made by a guy who at least seems to trying to respect people's preferences.
      - Symbiote 2y ago
        Although I wrote "it's something to consider", from what I can see the developer has already considered this sufficiently for the scale of the project.
padolsey 2y ago
My hope is that, since it's opt-in, and people are publicly publishing this stuff, It'd be alright. Dunno.
- stickfigure 2y ago
  You will get haters and armchair lawyers no matter what you do. Ignore the trolls.
d1sxeyes 2y ago
Usual note that IANAL, but looks like this service is opt-in, and only relists data which is already public on a user's HN profile. If a user removes the reference from their bio, then the user's profile will be essentially inaccessible through the service (although technically the cached version would still be on the server. Adding a check to delete the file which matches the user's hashed ID here[0] would take care of profile deletions on subsequent accesses. Failing all that, a user could request deletion and OP could delete the user's file manually. There's nothing that seems overly onerous to implement to be (at least) GDPR compliant. [0]https://github.com/padolsey/at.hn/blob/d4ca6702c558edf73665210d2525ddd31d552031/server.mjs#L207 https://github.com/padolsey/at.hn/blob/d4ca6702c558edf736652...
jdiez17 2y ago
No action is needed if OP doesn’t store unnecessary info or use spyware

And are you prepared to respond to GDPR and other jurisdiction requirements of data collection and management?

p-o 2y ago

Aren't you jumping the gun a little bit? While it's a valid question, it's very premature.

Symbiote 2y ago
It's not premature; it's something to consider whenever sharing people's personal data on the internet. The GDPR does not apply "in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity" [1]. However, that does not extend to generally sharing the information on the internet [2] as that's no longer purely personal. [1] https://gdpr-text.com/read/recital-18/ https://gdpr-text.com/read/recital-18/ [2] https://law.stackexchange.com/questions/92229/what-does-household-exception-to-the-gdpr-mean https://law.stackexchange.com/questions/92229/what-does-hous...
- dylan604 2y ago
  How does the fact that the user opts-in for the service by manually adding the tag to their profile so that information they personally added could be shared get considered by the GDPR?
  - d1sxeyes 2y ago
    Not sure and IANAL but the GDPR text is a bit weird on that. Article 9 has section e) which says that information 'manifestly made public' relating to 'special categories' is excluded. What's weird is there seems to be no such exclusion for personal information which does not relate to special categories. Having this 'opt-in' certainly seems to tick the box for consent. However, if reproducing information from a publicly available bio would fall foul of GDPR requirements, then I think there are bigger fish to fry than a hobby project made by a guy who at least seems to trying to respect people's preferences.
    - Symbiote 2y ago
      Although I wrote "it's something to consider", from what I can see the developer has already considered this sufficiently for the scale of the project.

padolsey 2y ago

My hope is that, since it's opt-in, and people are publicly publishing this stuff, It'd be alright. Dunno.

stickfigure 2y ago
You will get haters and armchair lawyers no matter what you do. Ignore the trolls.

d1sxeyes 2y ago

Usual note that IANAL, but looks like this service is opt-in, and only relists data which is already public on a user's HN profile. If a user removes the reference from their bio, then the user's profile will be essentially inaccessible through the service (although technically the cached version would still be on the server. Adding a check to delete the file which matches the user's hashed ID here[0] would take care of profile deletions on subsequent accesses. Failing all that, a user could request deletion and OP could delete the user's file manually. There's nothing that seems overly onerous to implement to be (at least) GDPR compliant. [0]https://github.com/padolsey/at.hn/blob/d4ca6702c558edf73665210d2525ddd31d552031/server.mjs#L207 https://github.com/padolsey/at.hn/blob/d4ca6702c558edf736652...

jdiez17 2y ago

No action is needed if OP doesn’t store unnecessary info or use spyware