4 ms·

4. have a system for tracking every single dataset you have lying around including ones that might just be for experiments and in a different format and purge p

4. have a system for tracking every single dataset you have lying around including ones that might just be for experiments and in a different format and purge people who have requested to be forgotten or be fined 10s of thousands of dollars 5. frequent new legal interpretations that become the basis of enforcement and then you have to rearchitect the whole way you were handling data always good to impose onerous rules on R&D when you are critically losing the R&D and capital race

michaeljx 2y ago
4. If it is personal data, you have to know where they came from, where they are stored and why. If you don't want to do that, then invest the minimal effort it takes to anonymize them during ingestion and then you can do whatever you want with them. 5. Now that is just false, or you have some really bad architects, if you are so sensitive to new legal interpretation (which there haven't been any significant ones)
- deleted 2y ago
  [deleted]
- YetAnotherNick 2y ago
  Why does everything needs to be pro EU or anti EU. Yes, consumer privacy is more protected in EU. And yes it has directly caused EU R&D budget to become significantly smaller. And yes it has led to ad revenue decrease and created more problem for small companies who can't use non targeted ad. If you are arguing against any of these, for which there are lot of data I think you are not up for discussion.
  - mftrhu 2y ago
    Where is the GP taking a pro-EU or anti-EU stance? Where are they arguing against "ad revenue decrease" which "created more problem for small companies", or the impact of GDPR on the EU R&D budget?
  - Ylpertnodi 2y ago
    >And yes it has directly caused EU R&D budget to become significantly smaller. Source?
- whimsicalism 2y ago
  1. all text data is personal data so yeah you can’t anonymize it, you need to have. a central metadata tracking of all datasets - this is a more challenging problem than it appears from on high. 2. i don’t see how you can look at, for instance, random EU jurisdictions not allowing Google Fonts on your website due to GDPR ( but only some jurisdictions and only years after the law was passed) and see that as inconsistent and moving target enforcement - and that is just one well known example of many many many
  - lm28469 2y ago
    > all text data is personal data Where did you get that from lol
    - whimsicalism 2y ago
      publicly? https://gdpr-info.eu/issues/personal-data/ https://gdpr-info.eu/issues/personal-data/
      - lm28469 2y ago
        Quote me the exact part because I don't think we're reading the same text
mftrhu 2y ago
Yes. You should have a system for tracking every single dataset containing personal data: that data does not belong to you. You are just its steward. You should have had such a system even before GDPR came into existence, but after it did? Your organization's lack of organization is not the legislator's problem.
- whimsicalism 2y ago
  I am describing a higher level of compliance than like 95% of shops that have data do in practice Even this website you are commenting on isn’t GDPR compliant lol, they won’t delete your text if you request.
  - mftrhu 2y ago
    It sounds like 95% of shops - of shops you know well enough to have an opinion about - should get their shit together, then. Why should people tolerate their sloppiness?
  - Ylpertnodi 2y ago
    Not deleting texts does not breach gdpr rules. Gdpr is about personal data, not anonymous (you can always put your real name, if you want) texts. Nor does hn do any tracking. Try actually looking at the gdpr, easily findable [even using google search] - it's not what you seem to believe it is.
nine_k 2y ago
Well, yes. Handle PII as you would handle live ammo. Always know where you store it. Don't toss it randomly. Don't experiment with it; neutralize it first! Use it to hit particular targets, and never shoot it at random directions.
- nickpp 2y ago
  > Handle PII as you would handle live ammo. But thing is, PII is not "live ammo". Artificially designating it so simply raises the cost of working with it. Doing that designation through an amazingly dumb law just makes EU Internet startups unfeasible. Meanwhile, US and Chinese startups flourish since they don't have this limitation. Self-own, really.
  - nine_k 2y ago
    I worked for a number of American companies, not beholden to also serve EU markers. They still did not demonstrate any cavalier attitudes towards PII though. Nobody wants to be the subject of some data leak front-page story.
    - nickpp 2y ago
      Of course not, but there is a huge difference between market-demanded standards and quality and government-mandated ones. In more ways than one: cost, difficulty of implementation, UX, etc. A real, practical example is that US web startups do not have to annoy their US users with cookie banners for simply using Google Analytics on their website - like the EU ones must. Underneath, the implementation and PII data protections are exactly the same, but the UX is night and day.

michaeljx 2y ago

4. If it is personal data, you have to know where they came from, where they are stored and why. If you don't want to do that, then invest the minimal effort it takes to anonymize them during ingestion and then you can do whatever you want with them. 5. Now that is just false, or you have some really bad architects, if you are so sensitive to new legal interpretation (which there haven't been any significant ones)

deleted 2y ago
[deleted]
YetAnotherNick 2y ago
Why does everything needs to be pro EU or anti EU. Yes, consumer privacy is more protected in EU. And yes it has directly caused EU R&D budget to become significantly smaller. And yes it has led to ad revenue decrease and created more problem for small companies who can't use non targeted ad. If you are arguing against any of these, for which there are lot of data I think you are not up for discussion.
- mftrhu 2y ago
  Where is the GP taking a pro-EU or anti-EU stance? Where are they arguing against "ad revenue decrease" which "created more problem for small companies", or the impact of GDPR on the EU R&D budget?
- Ylpertnodi 2y ago
  >And yes it has directly caused EU R&D budget to become significantly smaller. Source?
whimsicalism 2y ago
1. all text data is personal data so yeah you can’t anonymize it, you need to have. a central metadata tracking of all datasets - this is a more challenging problem than it appears from on high. 2. i don’t see how you can look at, for instance, random EU jurisdictions not allowing Google Fonts on your website due to GDPR ( but only some jurisdictions and only years after the law was passed) and see that as inconsistent and moving target enforcement - and that is just one well known example of many many many
- lm28469 2y ago
  > all text data is personal data Where did you get that from lol
  - whimsicalism 2y ago
    publicly? https://gdpr-info.eu/issues/personal-data/ https://gdpr-info.eu/issues/personal-data/
    - lm28469 2y ago
      Quote me the exact part because I don't think we're reading the same text

mftrhu 2y ago

Yes. You should have a system for tracking every single dataset containing personal data: that data does not belong to you. You are just its steward. You should have had such a system even before GDPR came into existence, but after it did? Your organization's lack of organization is not the legislator's problem.

whimsicalism 2y ago
I am describing a higher level of compliance than like 95% of shops that have data do in practice Even this website you are commenting on isn’t GDPR compliant lol, they won’t delete your text if you request.
- mftrhu 2y ago
  It sounds like 95% of shops - of shops you know well enough to have an opinion about - should get their shit together, then. Why should people tolerate their sloppiness?
- Ylpertnodi 2y ago
  Not deleting texts does not breach gdpr rules. Gdpr is about personal data, not anonymous (you can always put your real name, if you want) texts. Nor does hn do any tracking. Try actually looking at the gdpr, easily findable [even using google search] - it's not what you seem to believe it is.

nine_k 2y ago

Well, yes. Handle PII as you would handle live ammo. Always know where you store it. Don't toss it randomly. Don't experiment with it; neutralize it first! Use it to hit particular targets, and never shoot it at random directions.

nickpp 2y ago
> Handle PII as you would handle live ammo. But thing is, PII is not "live ammo". Artificially designating it so simply raises the cost of working with it. Doing that designation through an amazingly dumb law just makes EU Internet startups unfeasible. Meanwhile, US and Chinese startups flourish since they don't have this limitation. Self-own, really.
- nine_k 2y ago
  I worked for a number of American companies, not beholden to also serve EU markers. They still did not demonstrate any cavalier attitudes towards PII though. Nobody wants to be the subject of some data leak front-page story.
  - nickpp 2y ago
    Of course not, but there is a huge difference between market-demanded standards and quality and government-mandated ones. In more ways than one: cost, difficulty of implementation, UX, etc. A real, practical example is that US web startups do not have to annoy their US users with cookie banners for simply using Google Analytics on their website - like the EU ones must. Underneath, the implementation and PII data protections are exactly the same, but the UX is night and day.