Hacker News Reader

> this is not why I got into tech, I don't want to read 68 pages of yuk

One of the goals of this law and similar efforts is to make it clear that you need to consider the social, ethical, and legal ramifications of the things you crate. You are not creating neutral things in a vacuum; there is no neutral ground in a burning world[1]. That "small thing on the internet" might be reuniting families that were separated by work or politics, or it might be undermining the support structures of an entire industry or community. Maybe you are creating a social space*, which includes a duty to manage that space to keep so it doesn't become a tool of abuse[2]. Maybe your small site stays small. Obviously you cannot be expected to foresee every potential consequence of your creation, but you at least need to make the effort and catch the low-hanging fruit (e.g. the basic privacy features enforced by the GDPR).

[1] http://opentranscripts.org/transcript/no-neutral-ground-burn...

[2] http://www.gdcvault.com/play/1024060/Still-Logged-In-What-AR

> One of the goals of this law and similar efforts is to make it clear that you need to consider the social, ethical, and legal ramifications of the things you create.

One often wonders whether lawmakers heed their own advice here with what they create.

In the US, I've always found it humorous that there is no legal penalty for lawmakers continually and knowingly violating the constitution. The worst that happens is they get their bill struck down in court, then their state's legislature can vote in the next law.

How about 3 strikes for politicians. They do their job poorly, they lose it, regardless of their election status.

There is no agreed upon measurement of job performance that transcends the partisan divide.

Well, as a german, where this happens often enough: If a law gets truck down by the Federal Constitutional Court ("Bundesverfassungsgericht") as being in violation of the constitution, this universally can be seen as a bad job performance for the lawmakers. They know the law was in violation of the constitution, still they agreed upon it. It's their fucking job to make sure laws are not in violation of the constitution. This clearly justifies a strike.

> It's their fucking job to make sure laws are not in violation of the constitution.

Well, not really: That's the constitutional court's job.

Is that really true? I'd expect there to be cost associated with shitty law. Uncertainty and frequent changes shouldn't be in the interest of anyone but those whishing for extremes. Thus i'd hope for companies to support politicians who's legislature achievements will last. I'd hope, but am of cause not sure this can overcome those seeking short term benefits and political tribal blood sport thanks to the shitty US two party voting system.

Research shows people support of basic different options like more generous or stricter welfare programs change based just on which party they were told supported which option (chosen randomly by the researchers). In the face of that it's hard to believe that people particularly care about deeper things like that.

It’s safe to say people create hobby projects that fit within their ethical framework. This is about forcing a very slanted set of ethics on pretty much every creator.

I personally find regulation like this abhorrent and against my morals. Sadly I don’t have the money to fight the EU so my creations will be blocked to its citizens going forward.

The end result of this is that EU citizens will be the ones that suffer from lack of access to technology and the smart ones will end up VPNing into non-EU networks to stay on the cutting edge.

Why do you equate cutting edge with unlimited unregulated collection and processing of personal data?

I’m just confused by your view.

This is a relatively simple regulation that basically required anybody processing user data to do so responsibly. How does one have an ethical objection to that?

Define anybody. Define user data. Define responsibly.

Please read about the GDPR, where this is all explained in far better detail than I will be able to.

Alternatively, hire a lawyer, like you would for any other regulatory requirement.

> in far better detail than I will be able to.

Far better details? It gives vague info on what might be considered personal data... I would not call it very detailed. In most cases just says personally identifiable information.

The GDPR does exactly that.

> The end result of this is that EU citizens will be the ones that suffer from lack of access to technology and the smart ones will end up VPNing into non-EU networks to stay on the cutting edge.

Right, because everyone who lives in Europe is too incapable of coming up with technology and businesses themselves (that have the added benefit of being GDPR compliant) and without access to American firms they will surely fall into a technological dark dark age.

Instead of viewing GDPR as some nightmarish spectre coming to ruin everything, why not think of it as a potential opportunity? You're familiar with making money in a borderline no-holds-barred approach, now try and come up with some innovative business ideas that _don't_ rely on scraping and selling as much data as mechanically possible to prop up a business. This is a great for the disruption hackernews loves so much.

> Right, because everyone who lives in Europe is too incapable of coming up with technology and businesses themselves (that have the added benefit of being GDPR compliant) and without access to American firms they will surely fall into a technological dark dark age.

Cite one EU startup that you’ll miss if the issue was reversed.

Spotify.

Nokia and Skype we're both from Europe as well IIRC

Spotify, CityMapper, Revolut, and while technically not a startup, I think OpenStreetMap should count as well.

> Instead of viewing GDPR as some nightmarish spectre coming to ruin everything, why not think of it as a potential opportunity?

That's the best way to think about it. When the EU started imposing VAT taxes on non-EU companies on internet sales to EU customers, a bunch of businesses sprouted to handle all of that accounting for you. (So instead of me selling my software online directly, technically all of my EU customers now buy from a US company called FastSpring instead. Fastspring remits VAT on EU sales for me so I don't have to deal with EU tax law, just my own Australian tax law.)

There's probably similar opportunity for a GDPR service that stores customer data via API service, that shields small / micro businesses from all the GDPR compliance. (Eg all your personal Wordpress blog comments are actually stored, hosted and served by a service that handles GDPR modal-consent forms and deletion requests on your behalf.)

>... now try and come up with some innovative business ideas that _don't_ rely on scraping and selling as much data as mechanically possible...

The problem is a lot of us who would never scrape or sell data and have no interest in exploiting our customers, are still worried about not being GDPR compliant, and the EU choosing to pursue us an example for something that none of our customers actually care about.

> The problem is a lot of us who would never scrape or sell data and have no interest in exploiting our customers, are still worried about not being GDPR compliant, and the EU choosing to pursue us an example for something that none of our customers actually care about.

Why would you be worried about being pursued as an example? Is there any data that supports this as a reasonable fear? Isn't this exactly the "GDPR is a nightmarish spectre that can destroy anyone at any time" mentality?

> [...] You are not creating neutral things in a vacuum; there is no neutral ground in a burning world[1]. That "small thing on the internet" might be reuniting families that were separated by work or politics, or it might be undermining the support structures of an entire industry or community [...]

Your points are well argued - especially regarding the ethical and social implications of what we create, and I agree with them, however we have differing definitions of "small" in this context.

Your arguments apply to things that are maturing and are reasonably big already, but big things have small beginnings... and the internet/web is a fantastic place for nurturing those very very small ideas for basically free, this law appears to threaten those small ideas.

Arguing the EU is overreaching in demanding basic protections its citizens data, and that the only people who support it are... rioters (?) is a pretty vacuous and idiotic argument to make.

If you're making something that stores personally identifiable information outside of what you need, and don't care enough to secure it or offer ways for a user to manage that data then yes, take it down. Good riddance.

Or, just don't store that data in the first place. If you're storing usernames, passwords and the like then you have nothing to worry about.

>If you're storing usernames, passwords and the like then you have nothing to worry about.

Absolutely false. Anything pertaining to a person in any way is personal data. All default web server installations are GDPR violations, unless nginx grew an "edit the access.log entries pertaining to you" endpoint recently. (Although you can maybe argue "legitimate interest" for web access logging if you invest the time, and implement the right to erasure).

Webserver logs are totally fine since you need them for information security (ie, finding out who has been spamming your webserver with requests), just use the default NGINX settings, in most distros that means deleting old logs automatically.

You are incorrect. Even an IP address that dynamically changes with your ISP is considered personal data and is under strict guidelines. You have absolutely have a lot to worry about if you want to be in compliance.

Something as simple as running Google Analytics without a processing agreement in place is a liability.

No. This is a fundamental misunderstanding of the law. IP addresses are considered PII if and only if they can actually be legally used to identify an individual. And even where they can be, what on earth are you doing with them that you imagine is non compliance?

I was thinking about GA (Google Analytics) the other day, and how I can follow the GDPR guidelines. The articles I read, both from Google and other sources said to not use user IDs to identify users without consent, to anonymize IP addresses, and to not send PII information to Google, such as in URLs. Ok, that sounds simply enough, but then... I started thinking about it more.

1. User profiles can't be sent to GA. For example, hacker news has /user?id=JohnDoe for profiles, and that contains a username, which is personal data that should not be shared with GA. Ok, so I could rewrite my profile URLs before sending them to GA without the usernames.

2. I haven't heard a single source mention referrals. If I'm on a user profile on my site and click a link, that's going to send /user?id=JohnDoe to GA as the referral. I would need to overwrite the referrals before sending them to GA as well.

3. What about 404 pages that I make up? What if I visit https://www.example.com/JohnDoe? That's sending my personal name to GA again. Hmm, ok, the site could exclude GA from 404 pages.

4. What about search boxes? What if I use the search field on a blog? https://www.example.com/posts?search=JohnDoe. Hmm, that's my personal data being sent again. Ok, we need to make sure any data from search boxes is now stripped and not sent to GA.

5. What if I manually add a query parameter or modify one? A homepage might have https://www.example.com/?page=2, but what if I change it to https://www.example.com/?page=JohnDoe. Hmm, yes, that's personal data being sent again. I guess I need to validate the page parameter to ensure it's an integer before sending the URL to GA. What if I then type in a personal phone number as the page number?

> FB fucked it up for everyone

Nah, just for companies that trade personal information as if it was cattle feed. As an individual, I have no problem with the GDPR.

If you won't handle my personal information with proper care, you should shutdown or get sued out of existence.

Cheers.

Or every independent software developer who isn’t doing anything nefarious with your data but doesn’t have the resources to implement a bunch of new, EU mandated features.

Proper encryption, limited data collection and exposure, and deletion are not fancy features. If this is onerous, it is hard to imagine you are shipping much.

Your attitude towards my privacy makes me happy you won't be marketing your products in Europe.

This features you need to implement are the bare minimum required for good security practices.

How hard is it to just not collect data that isn't directly related to the running of your business?

Do you find yourself accidentally including data sales SDK's? Do you finish your website or app and realise you've accidentally set it up to fingerprint the user, scrape everything you can from them and sell it?

If your business is just a tool supported by wanton data scraping are you actually doing anything innovative and worthwhile or are you just making an MVP to pack full of advertising and jump on that bandwagon?

If you aren't doing that, then it's just a matter of checking what data you are harvesting and thinking about why you have it and if you really need it. Because if it's actually critical to the running of your business then GDPR does allow you to keep it. If it's not, why waste space, effort and now risk in bothering to harvest and keep it in the first place.

Let me play devil's advocate, and say that some personal data may not be immediately useful, but if continued to get collected, may become useful (for commercial exploitation) later.

For example, an online shop might collect customer addresses, even if the sale is purely digital. If the shop ever decides to expand to physical goods, those addresses will be very useful to find an optimal location.

However, GDPR prevent the shop from collecting (or more accurately, raises the cost of doing so), since the use, and value of, said data only becomes apparent in the future. So the shop makes the best choice now to remove the collection, and then suffer the future disadvantage.

Save the data, tell them about it in your privacy policy (i.e. that you remember that data and how you have in mind to use it), and add a "delete account" button that deletes that data.

Maybe show a notice just below the address input fields that "we remember your address for a while, this is why" and link to the relevant section in the privacy policy.

I'm more likely to hand over sensitive (or even obvious data) if I'm confident it's being handled responsibly. So it could be an opportunity for the markets for your products to increase.

If your small site is saving all that user data in an unsecured S3 bucket then yeah, pulling it down seems like the right idea.

GDPR doesn’t require you protect the data. You can still leave it unprotected as long as you tell them this on some stupid fine print.

There’s no damage that GDPR protects you from, and it doesn’t add any liability for stolen, hacked, or misused data.

Facebook can do the same shit they were doing under GDPR!

Yes, it does require you to protect the data:

> (83) In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing and implement measures to mitigate those risks, such as encryption. Those measures should ensure an appropriate level of security, including confidentiality, taking into account the state of the art and the costs of implementation in relation to the risks and the nature of the personal data to be protected. In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage.

also:

> Section 2, art. 32, Security of processing:

> Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: [..]

"If I made a small site that saves some user data"

Then you already had a ton of legal obligations, you were just not aware of them, since only now everyone is talking about the GDPR.

"FB fucked it up for everyone"

A lot of the things people are complaining about right now were already illegal, before the GDPR. People were just not caring about it.

> FB had to go and be evil and now the EU is overreaching demanding everyone spend their time bubble wrapping everything

What you call overeaching other's call protecting the interests of consumers.

> [...] If I made a small site that saves some user data i'd just pull it down too, I don't want the burden of worrying about being sued for some small thing I created, you just wont have it anymore.

Actually I think that's a good thing then.