Comment by rdiddly | Hacker News Reader

Comment by rdiddly | Hacker News Reader

Parent Full thread

Compliance is trivial and involves steps that are already best-practices anyway. You won't need to split any atoms.

https://techblog.bozho.net/gdpr-practical-guide-developers/

The penalty isn't meant to be something you afford. It's a penalty. (It's a feature, not a bug.) I'm having a really hard time not being sarcastic right now but compliance with the law might also end up being an economical option worth looking into. Cheaper than lawyering-up for being sued by shysters for non-compliance, and cheaper than being penalized for non-compliance.

Mind you, taking whatever-it-is off the internet is fine too. I totally understand. What I don't like is all the whiny sanctimony and martyrdom. "Yes I'm taking my thing off the internet, but first I'm going to make a big deal about what a tragedy it is for the world." Um no. The fact that your thing is a "small business" means few people care about it. (Sad to say. More people care about Facebook than about you. That's why they're the big incumbent.) And it emphatically doesn't mean for example, that you're some hallowed, heroic underdog who deserves protection, especially when you won't even afford the same to your own users and their data.

Here's a story for you.

I'm a hobby developer. I once made a tool mostly for myself, but decided to put it online. A couple thousand people use it, and it runs at a loss but I keep it up mostly because it's useful to some people out there. My tiny website isn't hurting anyone or breaking the internet the way Facebook or Google may be. To claim that having to spend my hobby time implementing a bunch of extra features is just "complying with the law" is bullshit, I'm sorry. In terms of scale, it's basically as if I forced you to do full safety test on a toy car you made for your kid, just because GM cars had safety issues.

And I'm not special. There are plenty of other small devs like me with thousands of small niche web tools out there, most of which are ran purely as a hobby, out of our own pocket. I may not make a blog post and get it to the top of HN, but devs like us have 0 incentive to keep our sites online.

HN loves to complain about things like AMP killing the web, but to me this is orders of magnitude worse.

What on earth are you doing that could cause a problem?

If what you're doing could cause a problem I'm pretty sure I'd rather you didn't without the ability to deal with it.

Just like StreetLend, most likely nothing, and it's just a fear, but again you need to realize that this is a site run purely as a hobby. I'm sorry but reading through legalese and combing my website's code to make sure it's compliant isn't part of my hobby. I'm not a company, I don't have millions of users, I just run a small tool that a few people use. Yet apparently I run the risk of being fined $20m...

You already had to comply with many other complex laws, like copyrights, trademarks and so on. I don’t see why a privacy law is anything different or special.

>many other complex laws

It takes 30 seconds to find out whether your identifier violates a trademark. Your content is trivially not a copyright violation if you created it yourself. Hobby projects are not debating the finer points of fair use and whether the conflicting name is for a sufficiently different kind of business to avoid confusion. But every HTTP server handles personal data, and a web-based tool with a database backend especially so, so all the subtlety of GDPR is in play.

> But every HTTP server handles personal data

But not all of them have a good reason to log it. /dev/null

Hard disagree. Abuse prevention, performance metrics. Httpd logs are a basic and necessary tool.

There are lots of guides out there designed for humans.

Essentially, all you have to do is tell your users what data you are collecting and how you will use it.

Also, if a user asks for their data, you give it to them, and if a user asks for their data to be deleted, you delete it. I imagine if either of these things were to happen today, you would do as they wished GDPR or not.

>There are lots of guides out there designed for humans.

It's not even remotely okay to use random people's blog posts as a compliance strategy.

Its funny that your being downvoted, but using a random persons blog for legal compliance seems risky.

> There are lots of guides out there designed for humans.

> It's not even remotely okay to use random people's blog posts as a compliance strategy.

Then use the simple, human friendly guide from the body who will be enforcing it in the UK. I did. I thought it was simple.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

If you think a hobby app runs a risk of being fined $20m then you clearly haven't looked into this at all. Why don't you do that first before getting worried about it?

Most server/frame works log ip address, but do not tie them to an account. If the account is deleted and the ip addresses are not than that seems like a potential violation as long as ip addresses are considered personal information. As a result the most common configuration is potentially in violation.

How about asking and recording a persons birthday when really all you need to know is if they are the age of majority? A birthday is more information than needed which seems like a violation GDPR when interpreted strictly with my cursory knowledge. Seems unlikely though that any regulator would enforce such a distinction though.

IP addresses are only PII if you are able to actually use them identify an individual.

> The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if:

there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual. [1]

So once the account info is deleted, that link is broken. This another piece of DP legislation that has been subject to a great deal of FUD since most of the headlines just went with ‘court confirms IP address are PII’ and omitted ‘in some cases’. TBH, this was already pretty explicitly obvious from the legislation defining Personally Identifiable Information (hint: clue’s in the name).

[1] https://www.whitecase.com/publications/alert/court-confirms-...

> So once the account info is deleted, that link is broken. This another piece of DP legislation that has been subject to a great deal of FUD since most of the headlines just went with ‘court confirms IP address are PII’ and omitted ‘in some cases’. TBH, this was already pretty explicitly obvious from the legislation defining Personally Identifiable Information (hint: clue’s in the name).

Makes sense.

Given the above still seems like a potential issue to not delete the ip logs.

1) Bob signs up for a service and is logged

2) Bob than asks for his account to be deleted. Account details are deleted, but the ip logs are retained.

3) Bob signs back up for a new account allowing the data processor to make the link from his new account to his ip old logs with the first account.

Weather the data processor can relink the two records with reasonable probability in step 3 depends on the particulars of the circumstance.

I assume cases like the above will be judged, at least in part, based on the data processor following best practices, and operating in good faith(not actively trying to unmask individuals and actively try to prevent unmasking).

Currently I would not let the GDPR stop me from going forward with any web services plans, however my casual reading of GDPR articles on HN and beyond have not made it obvious how cases like the above will be handled.

What about cryptocurrency? Lots(most?) record ip addresses, after which independent analysis can be done.

> What on earth are you doing that could cause a problem?

Nothing. Anything. This regulation assigns huge amounts of legal and financial risk to any hobbyist and will likely be selectively applied.

You don't have to implement any new features to comply with the GDPR. You just need to be clear with users about what data you are collecting and what you do with it.

I really think some people are just completely blowing this up into something it's not, probably because the only thing they've read about it is others scaremongering.

As a business owner that cares about privacy, I was basically compliant already - all I had to do was reword my privacy policy a bit to make it more human-readable.

>You don't have to implement any new features to comply with the GDPR.

How do you deal with user requests? You need at least somehow be able to gather the data, pack it into an user underdstandable format, and delete database entries, also from your backups.

/export?userId=x (make sure to validate they are logged in)

gather data: select * from every table that has userId

pack it into understandable format: every language i have used makes json, xml, csv pretty darn easy

delete: delete from....

backups: i am surprised your hobby project takes backups. perhaps have a table with userIds that were deleted, and when you make your new backup, remove all their data?

> delete: delete from....

Ah yes, and then all of my data has holes in it that I need to deal with. "Hmm, we only have 5 orders for this, but we're missing 6". "hmmm, we charged this credit card, but there's no order for it and I'm not sure if we ever shipped anything?" "hmmm, how do I delete this tracking number from the postal systems' records?"

Then you have a legitimate reason for keeping some of the data (book keeping, shipping) and not for others. Delete the data you can, keep what you must.

> Then you have a legitimate reason for keeping some of the data (book keeping, shipping) and not for others. Delete the data you can, keep what you must.

Will regulators agree with what I "must" keep?

I thought we were talking about hobby projects here? If you are shipping things, collecting payment info, you should be taking things seriously.

Since when does selling things exclude something from being a hobby?

hmmm.. if we're going to draw a line between "hobby" and "profession", then that's perhaps the most obvious way to do it.

Etsy https://www.etsy.com/ is full of shops of people who create things as a hobby, but do try to sell things. There are many hobbyist creators who make a few things and try to sell some of them, at least to recoup costs and maybe even earn a little money. In many cases I suspect they earn about $0.001/hour. As a business, it's terrible; as a hobby, many enjoy it. I think "earning a competitive wage" is a reasonable cutoff for at least being on the road to a "real" business.

I suspect most people just ignore the backup part. Out of sight, out of mind...

If you're a small business, you are likely to receive a very small number of such requests, if indeed you receive any at all. For most small businesses, someone would simply do a manual extract/delete of the data if it was ever requested.

Regarding backups, realistically you are not going to be required to delete from them as it's completely impractical to delete a single user's data from backup. You just need to be straight with your users - tell them that their data will be removed from your live system immediately, but that some data will remain in archive, securely encrypted, until the end of your defined retention period.

are you a lawyer?

No, I likely would have mentioned if I was ;)

I found the ICO's guide[1] fairly straightforward to understand though.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

Please sit down for an hour and watch this: https://www.youtube.com/watch?v=-stjktAu-7k

It is by far best GDPR presentation and explanation of lots of misconceptions. Please report back what you think about GDPR when you finish, I am curious it you will still feel threatened.

I watched it. All one hour 42 minutes of it.

From the presentation: "guilty until proven innocent". How can you NOT feel threatened?!

Congratulations (btw, I really like the guy explaining it)! Now you should probably understand the need for it and why multiple clones are going to start to pop out around the world, not to mention that you know more about GDPR than 99% of people beeing negative about it.

Guilty... is really not something special, IRS anyone? ;) Did you catch something else? Something useful maybe? About borrowing a car for instance? :)

The GDPR is actually late, I have a few IoT devices and I verify them by isolating them on network and sniff out communication (mitm on wifi and old school 10 port hub (yeah, the one screaming everything to all ports) for wired. It is a sad sight, even if they have absolutely no need to contact outside servers (I would never have a device like Siri in my home) they still do, another case would be broadcom drivers on android calling home. Someone has to stop this madness.

I know a lot of people are pissed off due to GDPR, but I will gladly ask them again in 10 years. I think they will change their mind.

Personal data is a big deal and should be treated as such. If you're hell bent on storing your user's personal data then you need to treat it as such.

Your argument boils down to "I don't want to take special measures to protect your personal data, so I shouldn't have to".

Personal data is literally anything related to a person. That encompasses a few sensitive kinds of data, but is not a big deal in the general case.

There is zero risk running hobby projects for developers. GDPR only applies to the relationship between a business and a consumer. If you have personal hobby-projects, they are 100% outside of the scope of GDPR. You can continue to collect any information you want etc.. What is defined as a hobby project differs with regulation in different countries, but usually it's something like revenue < 5000 €.

You can continue running all hobby tools you want.

Do you have a reference for this? I've seen nothing to suggest non-commercial projects are exempt.

> To claim that having to spend my hobby time implementing a bunch of extra features is just "complying with the law" is bullshit, I'm sorry

100% agree. And your situation applies to millions of hobbyists, personal websites, projects, startups, and small businesses around the world.

GPDR appears to be intentionally burdensome, a classic regulation strategy aimed at protecting large incumbents while stifling small business, innovation, and newcomers, or even side projects like your own.

>Compliance is trivial

Compliance depends on how well your understanding of of a bunch of fuzzy terms like "legitimate interest," "level of security appropriate to the risk," "necessary in relation to the purposes for which they are processed," "no longer than necessary," etc. align with 28 different regulators and judiciaries. That's as far from "trivial" as it gets. Bozho.net is not a lawyer, not your lawyer, and even if here were your top-tier lawyer specialized in data privacy he wouldn't have a clue what courts were going to take these things to mean in the context of GDPR, because there aren't any judgements yet. Security and minimization standards are also about "taking into account the state of the art" - do you know what the state of the art is, and is your organization capable of implementing it? An entirely plausible outcome here is that only the most advanced engineering organizations have technology that meets these standards.

> the most advanced engineering organizations have technology that meets these standards.

Horeshit. There is nothing advanced about storing only the data you need. However, if you've been hoarding like crazy and weighed down with technical debt, and haven't used the last two years, then yeah, might be hard.

Yes, it's a new law, yes, in practice it will be defined by judgments. How is this different from any other new law, other than this one impacts IT harder?

And let me guess what the alternative is: do nothing.

Consider also that European law is different to US law. We draft laws and contracts in a conceptual/abstract way, whereas in the US where everything has to be exhaustive, explicit, and over-worked; just in case anybody dare sues.

GDPR recognises one-size-fits-all won't work. Yes, that means it has some vague terms. Yes, you might have to show you thought about the implementation, and that you erred on the side of privacy.

It's funny how everybody always talks about the maximum fines, not the other sanctions that the GDPR can impose. Guess that's just more sensational.

> Compliance is trivial and involves steps that are already best-practices anyway.

Isn't that besides the point?

You can be 100% compliant and still be sued by somebody. And you'd have to pay some lawyer a lot of money to make it go away.

That risk already existed before the GDPR (anybody can sue anyone for whatever reason they can come up with), but GDPR is high profile enough to make people scared.

About a decade ago, I ran a website that made heavy use of user uploaded GPS data. I didn't sell any data. The only ad income was Adsense.

If I had bothered to restore the server from backups after a HD crash, I'd probably take it down now. Just not worth the potential trouble.

> You can be 100% compliant and still be sued by somebody.

No, someone can report you to a member state's compliance organisation.

> You can be 100% compliant and still be sued by somebody. And you'd have to pay some lawyer a lot of money to make it go away.

I fail to see how GDPR makes that new. You can be sued for any reasons already, being in the right or not.

E.g. 99% of useful websites violate some patents (that shouldn't ever have been issued), actual predatory suing about this issue happens, yet no one closes his website because "the patent situation makes it too uncertain".

> Compliance is trivial.

Indeed it is: the first 100 pages of the text detailing what compliance means are a manual for how to read the remaining 5000 pages, and a warning that there will be per-country variants of the law, which I'm sure will all be very clear, made easily available and not at all weird or objectionable, or require being well-versed in the legal intricacies of said member state at all !

/sarcasm

You make this assertion elsewhere in the thread. It is incorrect. The entirety of the legislation is 88 pages long and it is really quite straightforward (full link preserved) [1].

Here is a set of (easily available) interactive tools, explainers and guidelines from ICO in the UK which explicitly outline what compliance looks like and what steps you can take to achieve and demonstrate it [2]. It’s available as a 162 page PDF, if you insist on counting pages, but much of it relates to the processing of sensitive data or data relating to children which the majority or orgs can skip.

[1] http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...

[2] https://ico.org.uk/for-organisations/guide-to-the-general-da...

Mind you, taking whatever-it-is off the internet is fine too

We won’t take our services off the Internet. We’ll simply block you and your overbearing friends in the EU from accessing them. You might not miss one of us, but you’ll likely miss hundreds of thousands of us. Enjoy Facebook. That may be the only site you still have access to when the dust settles.

Compliance is trivial

Since you are saying that, I can guarantee that you haven’t actually read the law or been in charge of trying to make a website compliant. That is an absurdly incorrect statement. Billions are being spent around the world on attempts to comply with it.

Reply on news.ycombinator.com