Hacker News Reader

Comment by sb8244 | Hacker News Reader

It might be an unpopular opinion here, but I'm not entirely sure that the GDPR is going to be a good thing. It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries.

On top of that, developing business software becomes incredibly complex when navigating all of the potential ramifications of these policies. I thought it was strange that the SAP SDK at a hackathon essentially required the app to get OAuth permission from the user to access / write an encrypted payload that the app couldn't read / access / delete / update without user consent.

View on HN

I see your point, but a large majority of web sites are extremely misbehaving, since they allow Google (any typically a bunch of other analytics firms) to track users around the web without any consent (through Google Analytics). I find this terribly frustrating. I decided to opt out of the Google ecosystem completely, but data about me is still vacuumed through Google analytics and Google-hosted JavaScript/CSS. I use uMatrix, but blocking Google-hosted assets is out of reach for most non-technical users.

We would not be here in the first place if companies and website owners treated the user's privacy with respect. I don't feel pity for them that they jump through hoops now.

If you host a small personal site, just consider axing Google analytics. You can get reasonably good statistics by just using a local log analyzer that does not upload your visitor's data to an analytics/ad company. Respect your user's privacy.

>. You can get reasonably good statistics by just using a local log analyzer that does not upload your visitor's data to an analytics/ad company.

1) Has your user consented to your webserver's access logging?

2) Has your user consented to the use of access log entries about them for analytical purposes?

3) How will you delete the access log entries corresponding to a user upon request?

4) How will you provide a user with the access log entries about them upon request?

(I am not a lawyer, this is not legal advice).

from what i catched talking to our lawyer, there are other levels of consent than explicit by the user explicit consent that might be revoked, in this case.

1. concerns of security and quality of service (gathering logs with full ip addresses is allowed for a reasonable time, a few days for example).

2. you don't need to delete the logs if you use them for this specific purpose only.

3. for analytical purpose it is enough to use pseudonomic identifiers, in case of ip address zero out the last part and you are fine.

4. using Piwik or your own cookies? Suddenly its not a third party cookie anymore and you are more free to do things.

The problems for operators begin when they are handing this over to a third party.

It is remarkable how many websites use Google fonts. I wasn't really aware until I used uBlock to disable third party fonts, and icons started disappearing on many fonts. Web designers are inadvertently enabling mass corporate surveillance by simply trying to save bandwidth on font icons.

Google Fonts is actually not a problem from a GDPR perspective as long as the EU-US 'Privacy Shield' is in force. All in all, Google's data privacy compliance is outstanding in comparison with most other US companies, only Amazon and Microsoft are probably on the same level.

Maybe I’m misunderstanding GDPR, can you explain how tracking your users through logs is OK within the GDPR, but Google Analytics isn’t Ok.

Logfiles are necessary to operate a service securely and guarantee quality of service. This is one form of implicit consent that users are giving you without you having to ask them for it.

But Storing IP addresses for each access indefinitely (> some days) is the problem.

If you rotate the files into a version where IP addresses are without the last part after a few days, then this is considered pseudonymous data and GDPR has no problem with you keeping this for a long time anymore.

Local log files are not automatically compliant by my reading of the GDPR, but IANAL. My understanding is that PII is a huge risk, regardless of it being local or with a vendor, and you aren't allowed to track things that you aren't actively using for some business process. Many default log formats have data that people don't actively use, which seems to be a violation of GDPR even for local files.

Again, IANAL.

IANAL, so this is not legal advise!

First: I think it is ethically better, because you are not giving your user's data to a large company that builds profiles of your users for their own purposes.

Second: if you pass the data to an analytics company, you share responsibility in ensuring that that data is processed according to the GDPR. Article 83 states on imposing/determining fines:

the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them

It is up to you (as the controller) to ensure that you use a data processor that is GDPR-compliant (Article 28):

Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.

(By the way, it seems from the same article that you also need a written contract with the data processor that specifies exactly what data is provided, for which period, etc.)

---

tl;dr: it seems much easier to fulfil the obligations of the GDPR when you do not involve third parties.

I still don't see how local files are by default compliant with the GDPR. I get that you prefer it from an ethical point of view, but that's unrelated to the specifics of the GDPR.

For sure it's a bit of a blunt tool, but we've seen companies can't be relied on to do it themselves.

And yes, as devs it does force us to ask hard questions that we've been conveniently ignoring, usually at the request of management or marketing. Does this need detailed analytics? Do we need to store this information? How do we need to store this information? How do we design UX to withdraw consent? How do we handle the absence of consent? Etc. More difficult, but more ethical, too.

One nice thing (maybe) is that it's so much effort to get consent to run pervasive analytics on EU users, that many people might just stop running pervasive analytics on EU users at all. Maybe all users? At least I can dream...

> It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries.

If you open shop in a different country, you follow their laws. Your website being accessible in a country is seen as the same thing. It's not hard to implement geo blocking if you want to show best effort and thereby opt out of it.

This can very quickly become onerous for anyone wanting to run a website, if they have to understand the law of any country where it might be accessed. I think the onus of geoblocking should be in the country that decides this website doesn't obey it's laws, otherwise only large corporations with lawyers will be able to run websites.

If your website is doing business (i.e. Has some sort of legal presence) in another country, well, that's a different story.

If I'm just serving cat pictures, then I agree. But as soon as money and/or PII is involved, then a different set of rules apply.

This is where the technical complexity comes in. All of a sudden my static hosted page on github which gets a few hundred visitors per month and uses analytics should have Geo blocking? How much overhead will that add to the small site?

It's very unlikely your static page contains personal data that would be ok in the US but not in EU.

If you're referring to logging, there are some good responses in this discussion on how that will still be ok.

> It might be an unpopular opinion here, but I'm not entirely sure that the GDPR is going to be a good thing

Feedback from the trenches: it is a very good thing. Suddenly corporate people are beginning to care about security and privacy: we receive spontaneous inquiries from customers about compliance as well as various questions about password storage policy and proper encryption. Previously the very same people were laughing in our face when we told them passwords must not be stored as plaintext. Whatever the content itself, the message of the GDPR is clear: companies have to care about their users privacy and security, or they'll get a wild kick in the guts.

> It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries.

If you don't process PII about people from EU then GDRP does not apply. Merely accessing the page from EU does not trigger GDRP.

PII is an American concept, not a GDPR concept. The GDPR has a notion of personal data and it is much more expansive than PII. While merely accessing the page from the EU doesn't trigger GDPR, logging and analytics may.

I do think DPAs attempting to regulate EU external sites will be something to behold.

I'm pretty sure it does trigger in this case, if you have any tools like GA on your site.

Reply on news.ycombinator.com