4 ms·

As someone that knows next to nothing about it, I was curious and googled how to adhere to the GDPR, and read through the top recommended article. Here's some c

As someone that knows next to nothing about it, I was curious and googled how to adhere to the GDPR, and read through the top recommended article. Here's some choice quotes: "Complying with the GDPR is a huge undertaking" "GDPR compliance (occupies) a huge amount of IT time and resources" "Moving your organization into GDPR compliance is a process you ideally started long ago" The article links to some ICO GDPR data processing checklist, which is a list of 18 different processes you need to have put in place. "The GDPR is made up of 99 articles that provide a detailed description of the regulation". <- 99 different articles to understand and adhere to ... "[I]t is impossible to provide an exact prescription that will guarantee your organization is in compliance" "One of the most onerous obligations of the GDPR is to provide “Data Subjects” – the people whose data you are processing – with access to the data that you hold about them (Article 15)", "They can also request rectification or completion of data if it is inaccurate or incomplete, and they can request that you delete their personal data" "This is onerous because Data Subjects can make requests in writing or verbally, and you need to be able to comply with the requests “without undue delay" ^-- All that seems to go against your assertion that you just have to "not track them", if you have to build out a system for everyone to access all data you hold about them, rectify it, delete it, verbally or in writing, without delay. I'm not even half way through the article and I'm skipping over tons of what it's saying needs to be done, with all the security measures that need to put in place, whether or not encrypted data is needed, breach notification, and so on. It seems like a heck of a lot more than just "not track people", or a trivial amount of work.

dmurray 2y ago
> ^-- All that seems to go against your assertion that you just have to "not track them", if you have to build out a system for everyone to access all data you hold about them, rectify it, delete it, verbally or in writing, without delay. If you don't track people's data, that "system" becomes an automated email reply with "we don't have any data about you". But if you deal with individuals, probably you do want to collect at least some data that would be subject to the GDPR protections, and it is definitely easier to forget all about it.
- LegionMammal978 2y ago
  Given that most things are personal data under the GDPR (e.g., IP addresses have been considered personal data, and things like usernames are clearly personal data), I don't think most companies can get off quite that trivially, short of being completely stateless and never logging anything.
  - anonzzzies 2y ago
    You can log with log if you have good reason; you just have to delete them after a reasonable time. Nothing about this is hard or costly if you think about from the start. Your 'forever data' basically should never contain PII as some users might have terminated their accounts etc so then their info cannot be in some cold store tape archive. Again, not complex; delete backups after a reasonable time and throw away the encryption key. The intent of the gdpr is that you think about all of this and not simply store everything to mine, have stolen, leak or sell later on. The problem is that many companies or the software they use is literally build to abuse that data so then it is indeed 'hard' and expensive to comply.
    - LegionMammal978 2y ago
      Sure, but regardless of your data-retention period, you still have to know where to find everything derived from anything user-generated, if you want to accurately respond to requests. You're free to argue that the GDPR is making companies do things that they already ought to have been doing, but my point is that "just don't be one of those evil user-tracking companies" is not a viable compliance policy in itself.
      - anonzzzies 2y ago
        Yes, that's true, it is part of the intent though, that's why people say this I guess.
      - Dylan16807 2y ago
        If your data retention period is less than your response time (which has to be less than a month), can you not say "everything we had at the time of request is deleted" and be done with it? A reminder that we're talking about passing visitors without accounts here, and for logging and analytics there shouldn't be a need to store anything longer than a couple days.
viraptor 2y ago
All of that is about complying with gdpr, assuming you're sharing customer data. If you don't, there's nothing to do. It's like "international shipping of live animals is a massive undertaking and takes lots of time" - cool, it's true - I'm not doing that so I'm done. Sure, you have to comply with data requests, but if you don't store/share it... that's also trivial.
- jasonlotito 2y ago
  > assuming you're sharing customer data. If you don't, there's nothing to do. This is 100% not true and would be a violation under the GDPR. You need not share any data and if you do nothing, you'd be violating the GDPR. > Sure, you have to comply with data requests, but if you don't store/share it... that's also trivial. Nope, this is also not true. At least, it's not just "data requests." You are in violation of the GDPR.
  - anonzzzies 2y ago
    If you don't have the data, it is trivial; you send an automated mail you don't store anything (of course if you really don't).
- snowwrestler 2y ago
  GDPR does not regulate “sharing,” it regulates any use of personal data. IP address is considered personal data, so you can’t avoid GDPR compliance if you are running a website at all (since you must process IP addresses in order to serve a website).
  - viraptor 2y ago
    I'm using simplified language here, not writing a legal document. The first use was also supposed to be "storing/sharing", but it's processing in practice. But here you go: > GDPR does not regulate “sharing,” 13.1.e requires at least the notification of the recipients of the data. With the requirement about the purpose of use, it effectively regulates sharing. > since you must process IP addresses in order to serve a website That's right and that places the IP in the 4.1.f "processing is necessary for the purposes of the legitimate interests pursued by the controller" area which doesn't require consent.
johnklos 2y ago
You listed just one slightly onerous requirement: allowing people access and agency over their data. If you don't store their data, you don't have to do that. It's a bit hyperbolic to say that you're, "not even half way through the article and I'm skipping over tons of what it's saying needs to be done", when you've literally only listed one thing.
chipdart 2y ago
> "This is onerous because Data Subjects can make requests in writing or verbally, and you need to be able to comply with the requests “without undue delay" I'm sure each case might be different, but I can't but help to think this is just a cheap excuse to inflate the work that is required ro comply with data Protection Regulation. I've worked already on a few projects involving data protection, and they all boil down to two steps: - only store anonymous data. No personal data? No problem. - if you need to store personally identifiable information, support deleting it on request. It might be easier to incorporate these requirements at the design stage, but by now this is a very basic set if requirements.

dmurray 2y ago

> ^-- All that seems to go against your assertion that you just have to "not track them", if you have to build out a system for everyone to access all data you hold about them, rectify it, delete it, verbally or in writing, without delay. If you don't track people's data, that "system" becomes an automated email reply with "we don't have any data about you". But if you deal with individuals, probably you do want to collect at least some data that would be subject to the GDPR protections, and it is definitely easier to forget all about it.

LegionMammal978 2y ago
Given that most things are personal data under the GDPR (e.g., IP addresses have been considered personal data, and things like usernames are clearly personal data), I don't think most companies can get off quite that trivially, short of being completely stateless and never logging anything.
- anonzzzies 2y ago
  You can log with log if you have good reason; you just have to delete them after a reasonable time. Nothing about this is hard or costly if you think about from the start. Your 'forever data' basically should never contain PII as some users might have terminated their accounts etc so then their info cannot be in some cold store tape archive. Again, not complex; delete backups after a reasonable time and throw away the encryption key. The intent of the gdpr is that you think about all of this and not simply store everything to mine, have stolen, leak or sell later on. The problem is that many companies or the software they use is literally build to abuse that data so then it is indeed 'hard' and expensive to comply.
  - LegionMammal978 2y ago
    Sure, but regardless of your data-retention period, you still have to know where to find everything derived from anything user-generated, if you want to accurately respond to requests. You're free to argue that the GDPR is making companies do things that they already ought to have been doing, but my point is that "just don't be one of those evil user-tracking companies" is not a viable compliance policy in itself.
    - anonzzzies 2y ago
      Yes, that's true, it is part of the intent though, that's why people say this I guess.
    - Dylan16807 2y ago
      If your data retention period is less than your response time (which has to be less than a month), can you not say "everything we had at the time of request is deleted" and be done with it? A reminder that we're talking about passing visitors without accounts here, and for logging and analytics there shouldn't be a need to store anything longer than a couple days.

viraptor 2y ago

All of that is about complying with gdpr, assuming you're sharing customer data. If you don't, there's nothing to do. It's like "international shipping of live animals is a massive undertaking and takes lots of time" - cool, it's true - I'm not doing that so I'm done. Sure, you have to comply with data requests, but if you don't store/share it... that's also trivial.

jasonlotito 2y ago
> assuming you're sharing customer data. If you don't, there's nothing to do. This is 100% not true and would be a violation under the GDPR. You need not share any data and if you do nothing, you'd be violating the GDPR. > Sure, you have to comply with data requests, but if you don't store/share it... that's also trivial. Nope, this is also not true. At least, it's not just "data requests." You are in violation of the GDPR.
- anonzzzies 2y ago
  If you don't have the data, it is trivial; you send an automated mail you don't store anything (of course if you really don't).
snowwrestler 2y ago
GDPR does not regulate “sharing,” it regulates any use of personal data. IP address is considered personal data, so you can’t avoid GDPR compliance if you are running a website at all (since you must process IP addresses in order to serve a website).
- viraptor 2y ago
  I'm using simplified language here, not writing a legal document. The first use was also supposed to be "storing/sharing", but it's processing in practice. But here you go: > GDPR does not regulate “sharing,” 13.1.e requires at least the notification of the recipients of the data. With the requirement about the purpose of use, it effectively regulates sharing. > since you must process IP addresses in order to serve a website That's right and that places the IP in the 4.1.f "processing is necessary for the purposes of the legitimate interests pursued by the controller" area which doesn't require consent.

johnklos 2y ago

You listed just one slightly onerous requirement: allowing people access and agency over their data. If you don't store their data, you don't have to do that. It's a bit hyperbolic to say that you're, "not even half way through the article and I'm skipping over tons of what it's saying needs to be done", when you've literally only listed one thing.

chipdart 2y ago

> "This is onerous because Data Subjects can make requests in writing or verbally, and you need to be able to comply with the requests “without undue delay" I'm sure each case might be different, but I can't but help to think this is just a cheap excuse to inflate the work that is required ro comply with data Protection Regulation. I've worked already on a few projects involving data protection, and they all boil down to two steps: - only store anonymous data. No personal data? No problem. - if you need to store personally identifiable information, support deleting it on request. It might be easier to incorporate these requirements at the design stage, but by now this is a very basic set if requirements.