Hacker News Reader

Comment by gandutraveler | Hacker News Reader

I got a speeding ticket in Germany last year. I want them to delete my record. I own the data, they just tracked me over-speeding.

View on HN

Data retention policies in GDPR specifically address the case, if there is a legal reason to keep the data it should take precedence. That's it you can't tell that you wish your 10k euro bank credit to be forgotten.

Accounting logs might need to be kept up to seven (in some cases 10) years, so the data related to them should be kept. The data is sort of field based and some might need to be able to be forgotten earlier.

So if another country says it's not legal to comply with the GDPR in their country, they get off scot free? :P

totally, but then again you won't be able to transact with the EU, besides all the diplomatic aftermath.

And sure, by German law, your data will be deleted after you paid your fine. (Plus some time for processing and record keeping)

This doesn’t make this a good analogy though. The GDPR does not prohibit storing private data, it just requires explicit and informed consent. It does not require deletion of data that is required to conduct a transaction, such a receipts, order data or adresses required to fulfil an order. It doesn’t impact storage of data required for law enforcement or any other reason that is mandated by law. It just doesn’t allow unconsentual tracking and accumulation of private data.

The GDPR isn't as good as you think it is. It's going to turn into one of those laws where small software startups / or normal small businesses are just going to be in constant violation, because the amount of resources required to do it properly requires a team of 5 or 10 expensive software engineers. It's going to be a great way to nip small companies in the bud and consolidate this kind of stuff into bigger companies.

It gets even worse with it's extraterritoriality, because you can still be under it if your dealing with a person who lies that they are an EU citizen and they are using your service in your own non EU country as a resident of the non EU country. It's like data FATCA.

And there are other loopy catch 22 ambiguities, like if you want to delete someone from your audit log, do you delete their personal info (which is fairly expansive definition under GDPR) from the audit log too? Then how can you show you deleted the person's info if they are also deleted from your audit log?

Read this to see more from the small company side and how much of a mess it is:

https://www.brentozar.com/archive/2017/12/gdpr-stopped-selli...

Think of this theoretical situation. If your an EU citizen vacationing in a developing nation who has a medical emergency, could that hospital just decide to reject you because the hassle & cost of dealing with GDPR is too great? Remember, it's a developing nation, they can choose to just refuse service to you.

Kind of like how a lot of americans get rejected by non US banks because dealing with FATCA is just too much of a pain ass today?

> Read this to see more from the small company side and how much of a mess it is:

> https://www.brentozar.com/archive/2017/12/gdpr-stopped-selli...

I read his post, and wonder if the 'attorneys' he consulted are specialists in EU law, or were his standard ones. There's a lot of FUD around GDPR but the guidance is getting better, and people assume it's being 'policed' when the UK's body (the ICO) is more about guiding into best practices than punishment.

The comments (esp around medical records) suggest ignorance of how it's working.

Source: reading the GDPR and accompanying notes from the ICO; discussions with a large company's GDPR advisor, who was involved in drafting the legislation.

Disclaimer: this is not legal advice, I am not a lawyer, and you are an idiot if you act on anything I say.

You might have noted that I have refrained from giving an opinion on how good or bad I think that the GDPR is. I just pointed out that it does not at all apply to the case that the GP pretended to have a problem with. By all means, there's enough to criticize about the GDPR, but do it with an argument that has merits, but not by attacking a strawman. (Your hypothetical case is a strawman, too, since the hospital doesn’t do business in the EU and is most likely required to keep records by law, which is a specific exemption clause)

I'm pretty sure the hospital in the developing nation doesn't sell in the EU, so they don't need to comply.

Phew, crisis averted!

Government bodies are exempt from the regulation like always.

Reply on news.ycombinator.com