Hacker News Reader

You should note that lots of what that letter suggest it has rights to, are not rights granted under GDPR. Or at least would be subject to legal clarification.

If you send that letter, expect to receive a standard response/report of data with a form response that politely & legally amounts to “piss off”.

Large organizations have considerable resources set aside to make sure their “piss off” letter is legally defensible & GDPR compliant.

That letter is likely only a problem when selectively used by a malicious actor against a small organization. Frankly not the kind of org that is systematically tracking personal data.

> That letter is likely only a problem when selectively used by a malicious actor against a small organization.

Which is what is so annoying and economically destructive about regulations like these that are broadly applied to all companies, especially on the internet where single person companies are very popular. They are designed in a vindictive way against large companies like Facebook or major online retailers who burned customera due to minimal information security investment.

But they so often ignore the reality of the burden it places on small firms who account for 90% of businesses and 50% of employment, who cant afford lawyers or the legal risks of a 'piss off' letter.

The western economic environment countinually gets more and more structured favouring large firms, encouraging large scale merging, which usually generates the type of large oligopoly companies who most often does the things that cause regulations to get created, then imposed on smaller firms.

If Japan's economy is any indication we do not want to state heavy economy where big companies are the only sanctioned winners and smaller companies are heavily disincentived by the state (whether indirectly, by side effect, or overtly).

If not having these laws created isnt an option (seemingly impossible in an administrative heavy org like EU), I then hope someday these regulation start being structures like progressive income tax using size minimums or are contained to specific industries where it's clearly a problem (both of which would apply well to minimum wage laws for example). So laws are pinned directly to a specific problem area justifying the heavy-handed state intervention, not just blanket laws on everyone.

For most smaller businesses there is no real reason to do all that much as long as you can answer such questions on an ad-hoc basis. Although of course we still have to see how widespread it will become in practice.

Basically you need to make sure you 100% know what data you collect (including any third parties) and make sure you have a good reason to collect it.

Honestly most of GDPR should be considered "common sense". It's just that many corporations actively act against the interest of individuals they collect data on, and it's precisely these practices that GDPR tries to correct.

Unfortunately even if you're already handling personal data responsibly, the GDPR still also requires that you be able to provide various documented policies to your regulator on demand, still contains lots of ambiguity about how far subject rights can go in practice, still imposes obligations to include lots of extra detail in privacy policies or otherwise provide lots of information and active warnings to data subjects, etc.

How about, “Our documented policy is to not collect personal information from users at all.” Assuming it’s true, wouldn’t that be compliant?

GDPR also expands what is personal data to include things that are collected as a matter of course such as IP address.

You likely have a reason to log that data but GDPR requires that you document it.

Further it reaches into your business even if you aren’t trying to do business in the EU, as EU citizens can come to your site without your control.

There is a lot to like with GDPR but it absolutely is expansive & easy to have many interpretations.

Maybe these things shouldn’t be collected as a matter of course. Should web servers log client IP addresses by default? Why? Does my mail server need to log email addresses of incoming mail by default? “Logging all the things” as default behavior really needs to be a thing of the past.

If anyone wants to get their feet wet in open source, there are thousands of high profile projects out there that could use a patch to scrub PII from their logging, and these are probably simple diffs.

“Logging all the things” as default behavior really needs to be a thing of the past.

Maybe, but logging useful things is reasonable. We investigate problems with our systems using server logs. We diagnose various security threats, fraud risks and ToS violations using server logs.

We're generally respectful of users' privacy, but we also have a legitimate interest in knowing how our systems are being used and preventing people from doing bad things with them. Those legitimate interests may take precedence over a visitor's right to privacy in some cases, in the same way that you can't tell a government to forget your criminal record or a bank to forget that you owe them money.

What if you have a forum and users of that forum commit a crime, police asks you to give up their data and you say you don't have any data?

> you say you don’t have any data?

And what’s wrong in telling the truth to the police? Sounds great to me. Also, see how signal responds to such requests.

Presumably it would, but since approximately 0% of businesses that actually do anything could make such a statement truthfully, that doesn't help very much.

> The western economic environment countinually gets more and more structured favouring large firms, encouraging large scale merging, which usually generates the type of large oligopoly companies who most often does the things that cause regulations to get created, then imposed on smaller firms.

This is where socialism differs from communism - in socialism you have big privately owned companies, whereas in communism these are state owned. Everything else is more or less the same. Europe is currently under transition from group of mostly free mostly capitalist countries into full retard socialist authoritarian regime. Regardless of that, GDPR is a very good thing, shame it has only been introduced now and not 10 years ago.

While I agree with your opinion about the GDPR, your analysis of Europe is otherwise plainly wrong. You would be aware of this if you actually followed EU politics (there is currently a strong trend towards right-wing / center politics. Left-leaning parties are moderately out of favour), which you definitely do not have to do. Just try not to spread misinformation on the internet: There is plenty of it to go around already.

Not true; GDPR explicitly grants a large number of rights to the data subject. [1]

These rights include:

* the right to be informed about what data is processed

* the right to access all data gathered about them

* the right to rectification of incorrect data

* the right to receive an export of the data in a common format

* the right to object, to have all data removed, and to restrict processing until further notice

GDPR also requires a data controller to respond within a month, and not charge any fee for this unless the requests are excessive (because they are repetitive). [2]

[1] https://gdpr-info.eu/chapter-3/

[2] https://gdpr-info.eu/art-12-gdpr/

The letter is a nice mix of asks that are specifically covered, rights that might be covered & things that are not covered at all.

In that sense it’s a great way to rattle someone without specific GDPR guidance. But all things being equal, the large orgs that are capable of systematic data collection, are not at all troubled by it & certainly won’t be answering it with direct point by point answers.

Which things that are mentioned do you believe are not covered?

I’m not a GDPR lawyer or auditer, do nothing in this reply should be seen as advice.

My general feel is that if he didn’t cite a specific article it was on purpose. He took implications or broad interpretations for anything not explicitly cited.

A couple that jump out immediately are the requests for server locality information, retention periods & specifics about security policies are the ones that are likely to get a very polite “we conform to industry best practices piss off” replies.

That's all neatly laid out in article 13. [1]

I'm not a lawyer but having extensively studied all of GDPR recently I'm afraid the letter seems legit. If there's any error it will be a minor one.

[1] https://gdpr-info.eu/art-13-gdpr/

Article 13, to my reading, provides no basis for requiring locality information or security policies. The retention declarations I’ve seen have been legal niceties that don’t answer the question in a way that makes it clear what the retention policy is.

I’m not suggesting that the letter won’t get a response. I’m suggesting there isn’t anything in it that would cause a large organization to send any different a response than if they got a letter written in crayon that said “gives us the GDPR data”.

In that way it’s not a “nightmare” letter. It’s the default thing you pay lawyers for.

Is there anything stopping these letters from being abused like DMCA Takedowns? Just one of these look like they'd tie up a human worker for days. How much personal information are you going to have to provide to ask for such data? Especially for ".. provide me with a copy .." Does any of this apply to "anonymized" data?

You can charge reasonable administrative fees or refuse to act if the request is "manifestly unfounded or excessive, in particular because of their repetitive character". [1]

[1] https://gdpr-info.eu/art-12-gdpr/

Is a single request like this from a single individual excessive or repetitive though??

I think GDPR intends to protect businesses from "denial of service attacks" through sending many repetitive or bogus requests. A single, legitimate request is definitely not excessive.

So if you get 100000 individual requests is that going to be excessive? There are people organising already to send such requests to various sites.

Unless your PII workflow is bonkers, you should be able to respond to those letters in mostly automated fashion.

I mean, you do handle your data in mostly universal way, instead of randomly copying pieces of your database to random parties? Right?

How do you automate checking if person requesting the data is the person claims to be. How do you automate reading an email and giving meaningful response?

I admit I'm not sure how the verification part is supposed to look like. For the rest, I assume that if you have a standardized data flow (and don't randomly resell people to different parties), you could automate the part that writes responses, and only have humans read the original mail and check appropriate checkboxes to generate a standardized reply covering all the relevant points.

> Anyone in the EU can send you such a letter, and you have 30 days to reply.

What's the process for authenticating who sent the letter? Seems like a potential new attack vector.

Precisely this. Once you’ve dealt with sensitive data where authentication is required (real life, signatures with witnesses and all), the surface area for attack when it comes to data request is huge if the burden to reply is based simply on an email. Sending an email request is practically free with automation, which provides a nice way for phishers to know where targets store their information. Anyone know of how some companies are authenticating requests?

Im Germany you generally need to send a real letter (or a fax) and it needs to contain your signature.

"Authentication" for this is provided by harsh penalties on signature forgeries. Also, you'd only get one single data point and everything really sensitive has address data and they will* send their response to a known address.

If all information you have about a person is their email (and usage data) then this won’t make a difference though... The GDPR considers even an IP address personal data, even if you have no way to correlate it with a real person. So where does this leave you if you have to respond?

Imagine I’m sending a request for information from a given IP address, requesting all the personal information you hold on that IP. I kinda proved that I’m using this IP and it’s part of my private data... but providing all information on this IP is likely to leak data on other people and there’s no way legitimate the requester

An IP address is only personal data in combination with a timestamp or similar time-related information. I don't see an attack scenario where an attacker would gain anything useful.

Note that he's propably still risking jail time over this.

German courts have ruled that IP addresses are personal data. EU courts so far agree. The timestamp is irrelevant.

The GDPR makes anything that can be potentially traced back to a person personal data, it's a much wider definition than PII.

It also means that constructing data sets may lead to personal data being generated out of non-personal data. So even if you only store IPs without timestamp, if you stored timestamps elsewhere and you could reconstruct the IP of the user, you're up for grabs.

> Note that he's propably still risking jail time over this.

I feel like most criminals are OK with that.

Do you have a source of that?

I dream of the day that I can ask various companies to delete every piece of data they have about me.

I dream of the day that I can discover the various companies who have any data about me...

Agreed, sadly there’s no chance for the US to get this for the next 2.5 years at a minimum

and you really think that they will? you pretty sure will get the following response:

ok -- hidden in their database -- (date_deleted = now()) fixed.

That's exactly what GDPR is for - I can be somewhat sure they'll delete it, and and if I'm wrong and they do what you described, I'll laugh hard as they bleed money when discovered.

Yeah, the companies I know of who are implementing "right to be forgotten" because of GDPR are taking it 100% seriously and going through, in some cases, significant pains (dealing with legacy systems) to ensure compliance.

Well the problem is who will control it? Angela Merkel? Manuel Macron? Oettinger - the European Comissioner? Seriously.. nobody will control.