Hopefully, this starts a meaningful conversation about what other people are also doing. I am not a fan of Facebook but this might get the ball rolling on broader legislation similar to GDPR in US.
Is it the hacker news mindset that you should need a law degree to launch a website now?
GDPR is so bad that I would rather make a HIPAA compliant service than a GDPR compliant service.
If that's still too hard, a summarized form can be found at https://www.gdpreu.org
OTOH, anyone who says they clearly understand the implications of GDPR for their site has either spent a lot of money on lawyers or is lying. Let alone someone who has implemented it. Privacy by design requires deletion of data after legitimate interests and/or consent have expired, probably (!!!) in 3rd party systems. How, precisely, do you implement that?
Can you shadow-delete accounts for some period of time to allow users to change their minds? If no, what UI do you put on a "delete my account" button that has absolutely no undo, even in the 24h regrets period?
Do people have GDPR privacy rights over eg comments on YC that may mention them by nym?
Given the GDPR covers EU residents (not just citizens), as an American can I buy a plane ticket to Dublin and start requesting full data dumps? What rules are those provided to me under, and how do you make software that can do that?
0. You require the third party you passed the data on to delete data when you tell them. The third parties should tell the person that they now have their data, where they got it from, how they will process it and how to get in touch with their data protection officer. 1. You can but you must also allow someone to delete in full (assuming none of the many reasons to reject removal requests apply or you don't wish to exercise them). 2. This is murky, but probably not. There's a right of freedom of expression and information. 3. No, you have to be a resident not a visitor. You'd have to see how Eire define residency.
http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE...
It's long but the language is far easier than American legalese. The implications depend on your site/service behaviors. An RSS reader is pretty trivial, interactive social media... less so.
> Privacy by design requires deletion of data after legitimate interests and/or consent have expired, probably (!!!) in 3rd party systems. How, precisely, do you implement that?
Privacy by design is a design philosophy, it might be a pain to refactor into an existing system but the design constraints aren't onerous.
If your "3rd party system" is something like AWS, just delete the data. If you're sending it off to some other service, they do need to be GDPR complaint (the law covers this situation).
re: legitimate interests, we partitioned our data. Access logs, for example: one stream gets anonymized for simple analytics, another gets dumped into in-depth weekly analytics jobs, and the final log stream outputs encrypted auto-expiring S3 files with strong access control for infosec purposes. When a user withdraws consent, we just stop logging new information. Truly anonymized data is OK, our in-depth analytics data is purged within 14 days, and InfoSec is a justifiable legitimate interest.
> Can you shadow-delete accounts for some period of time to allow users to change their minds?
Yes. GDPR does not require instant response. You should be transparent about what will be kept and how long, a clearly communicated 24h shadow-delete is completely reasonable.
> Do people have GDPR privacy rights over eg comments on YC that may mention them by nym?
This is a good question, I'm also curious about quotes. The recent Google case suggests both fall under GDPR.
> Given the GDPR covers EU residents (not just citizens), as an American can I buy a plane ticket to Dublin and start requesting full data dumps? What rules are those provided to me under, and how do you make software that can do that?
Assume everyone is covered by GDPR.
Except the GDPR is full of hand-wavy stuff. Who needs a DPO? What is "large scale" in that context? How exactly do you conduct a legitimate interest balancing test? Who is your lead regulator and under what criteria as an American company can you decide?
Also, people have a lot more 3rd party systems than most think. Think transactional mailers, marketing mailers, billing systems, payroll, zendesk, etc.
And even an RSS reader is scary. What if someone follows a series of blogs about HIV treatments, or internal trade union politics? If that means you could infer the person is poz or is a member of that trade union, you now have heightened scrutiny data in your possession.
GDPR has explicit provisions for all of these legitimate interests (notifications, clients, employees, customers). Most of these services are aware of and planning for GDPR, I wouldn't want to work with any that aren't.
> And even an RSS reader is scary. What if someone follows a series of blogs about HIV treatments, or internal trade union politics? If that means you could infer the person is poz or is a member of that trade union, you now have heightened scrutiny data in your possession.
Right, and I like that! Attempting to derive sensitive information should require consent, transparency, right to rectification, and stringent data handling requirements. It sounds like overkill for an RSS reader, but why the heck does an RSS reader need to do that kind of profiling in the first place? Maybe that's the right level of scrutiny and prior applications were unwarranted?
On the other hand, there are no concerns with simply storing the followed blogs.
> Except the GDPR is full of hand-wavy stuff.
Can't win, legislation is either micromanaged or hand-wavy... it's worth noting that some of the hand-waving is actually business friendly.
I'm not saying these laws are perfect. There is definitely room for improvement, but this is still a consumer win over the pre-GDPR wild west.
I never said the RSS reader is profiling. They don't have to be. Does the mere presence of the inescapable user data -- ie what feeds they monitor -- create heightened scrutiny, because someone else could infer with that data, were it to be leaked. It well may. I would seriously consider blocking EU users until this is sorted out.
Worse, the RSS reader could offer suggested feeds, and accidentally find themselves in possession of such data, entirely accidentally. Even if users were clearly asked if they wanted to see suggested data, or allow their data to be used to suggest feeds. They may not intend to derive sensitive data to possess it.
Or suggest you have a site like YC, and someone puts "hi, I'm poz" in their description. Tada, sensitive data.
The GDPR should have defined when a DPO is required, what a LI balancing test is, etc. Alternatively, the orgs could have pretended to be competent and issued guidance before -- oh right, they haven't issued final guidance yet. I'm sure 6 weeks is plenty of time.