Hacker News Reader

Comment by mulmen | Hacker News Reader

I don't see how self-hosting has anything to do with it honestly. This is about tracking people without their consent. It's about preserving rights of individuals. Self hosting is no more or less acceptable than third party hosting. It's not a technical issue.

View on HN

So is your position that website owners should have no visiblity at all on their visitors, and no way of knowing how many people are using it?

Website owners can have visibility on their visitors if those visitors explicitly consent to it.

Not sure what is so difficult to understand about this.

So if I don't think that Walmart should be able to record me with security cameras while I'm in the store I should have the right to demand that they ask me to sign a waiver before entering the store? Shouldn't it be Walmart's right to do what they want on their property, and my right to decide not to visit Walmart if I don't agree with that. Isn't the converse an infringement of Walmart's rights?

I'm not 100% sure, but I believe the cameras at Walmart are for security only. I don't believe Walmart is using facial-recognition technology to identify visitors, track their behaviors (which aisles they visit, how long they look at specific products, etc.) and then using it to other retailers for them to then target those visitors with ads.

OK, it's the petrol station part of the supermarket, but

"Tesco is set to install hi-tech screens that scan customers' faces in petrol stations so that advertisements can be tailored to suit them, it has been reported.

The retailer will introduce the OptimEyes screen, developed by Lord Sugar's Amscreen, to all 450 of its UK petrol stations, in a five-year deal, according to The Grocer.

The screen, positioned at the till, scans the eyes of customers to determine age and gender, and then runs tailored advertisements."

https://www.theguardian.com/business/2013/nov/03/privacy-tes...

Sometimes, guaranteeing freedom for one party requires taking away freedom/rights from another party. For example freedom from slavery means taking away the right to have slaves. Society has to make a choice: which one is more important? In case of GDPR, the EU has chosen: the privacy of citizen is more important than business concerns.

Why are people obsessed with companies rights? Do they not have enough already?

There's an asymmetry between what a company can do politically/legally given it's resources and what an individual can do. This is why countries generally have some kind of laws protecting consumers.

Security cameras recording footage and it not being used in 99.999% of the time when no crime occurs is fine. The tapes aren't kept forever. Just as having server logs to identify malicious actors i.e. hackers or scammers is fine. What's not fine is e.g. running facial recognition on the security camera footage, or figuring out who bought what (cough Amazon Go).

GDPR has exemptions for security. Your free to track information for the purposes of blocking vulnerability bots, but only the minimum data required for that purpose... and your visitor's data cannot be used for other applications without their consent.

> Shouldn't it be Walmart's right to do what they want on their property, and my right to decide not to visit Walmart if I don't agree with that. Isn't the converse an infringement of Walmart's rights?

No. Property "rights" are secondary to human rights. Like, Walmart can't knowingly sell poison as food just because it's their property...

In your example, Walmart is free to record you on security cameras for security / theft purposes. However, they can't record what you're looking at and reuse that information for targeted advertising without consent - profling is simply not required to do business, so your right not to be profiled wins.

> “they can't record what you're looking at and reuse that information for targeted advertising without consent”

What law prevents them from doing this?

The actual Walmart? Nothing. The previous poster used Walmart's security cameras as a strawman argument against GDPR, which I expanded on.

Consent isn't the only lawful basis for processing personal data.

They can know how many people, as long as they don't store personal information. Keeping a counter doesn't require consent.

Keeping a reliable counter of meaningful interactions is hard without personal data to correlate unique users.

Ok, so it’s hard. Nobody is entitled to that being easy in the way that they are to privacy.

What privacy? Knowing that user dhsidhujdjdowhdyyehheis is using my website is not an infringement on your privacy!

Why do you think you can control what I do with data you send to me? Don't send me data I'd you don't want me to have it.

Why do you think you can control what I do with data you send to me?

Are you really interested in rehashing this conversation? You got plenty of answers last time¹, I doubt you'll get new ones

¹ https://news.ycombinator.com/item?id=16957978

Obviously no one said anything convining. Sure, it's law under the gdpr and I'll comply. That doesn't mean I think it's a reasonable law.

I'm just saying there's no point starting over, you'll just get the same kind of responses. You should preempt them if you're hoping to get anything new. Though I doubt you'll get it anyway.

> Why do you think you can control what I do with data you send to me?

Legal protections, like the GDPR.

Why do you think I can’t photograph your face?

Don’t reflect light in my direction if you don’t want me having pictures of you!

I agree with this perspective. I haven't seen anyone present a compelling case as to why a person should own all data about themselves.

You would if you could see what the military does with data about people.

> Keeping a reliable counter of meaningful interactions is hard without personal data to correlate unique users.

It's hard if visitor numbers would directly translate into revenue or similar. The trouble you're running in then is discerning organic hits from clickfarming.

If all you care about is when, where what content is popular on your website, there's a pretty simple method: Tally 200 and 304 responses. 200 tells you how many visits you get. 304 tells you, how often people hit refresh, or re-visit your page within the expiration time of the URL that 304s.

Also there's little value in identifying individual visitors. Getting a coarse idea where visitors are located in the world might be nice (for a regional news outlet for example). So just slap some coarse grained. GeoIP on it.

> It's about preserving rights of individuals.

I'm not sticking up for all the big data perverts, but what about an individuals right to speak freely and disclose information they have observed/recorded? The 'right to be forgotten' seems at odds with everyone else's right to remember and disclose occurances.

That is not the case. The "right to be forgotten" is not absolute. There are lawful bases for processing under which the right to be forgotten does not apply.

Go read GDPR article 17.3, it's easy to read. A few things for which the right to forgotten does not apply:

- exercising the right of freedom of expression and information

- for compliance with a legal obligation (e.g. keeping records for tax reporting)

- for public interest reasons related to health, science, historical research

Seriously, there is too much FUD about the GDPR.

Yes! The fud keeps increasing every time another gdpr related post pops up here.

I'm 60% sure it's people who read articles from Adtech Corporations about GDPR and not from people in the EU having to deal with it.

The only bad thing that I've noticed about GDPR is that some niche sites that rely on ad revenue are getting fucked over by Google (if you turn off personalized tracking for your visitors you still need the consent to track, there is no difference) so their income might break down.

That's quite sad but on the other hand they're exploring alternative methods of income and I'm certain adtech will adapt.

I doubt it's only that. I think it's also the tendency of people nowadays to only read titles and not to investigate further. I think some people are triggered by the phrase "right to be forgotten" and they jump to conclusions without finding out what it's really about.

The EU cookie law was almost the same issue, barely anyone implemented it and those who did did so poorly or incorrectly.

This time it bites back tho.

Thanks for the direction. I've read the GDPR a few times but it is (intentionally) non-specific on many implementation details. As I alluded to in comment, 17.3(a) seems like it would work as a global excemption in practice. I'm not familiar with how court rulings that provide legal precedent have impact or are respected across the diversity of legal systems across the EU. By May 25th 2020, after a multitude of GDPR related cases and verdicts, the answer may be more clearly defined. (Or increasingly nuanced with even greater uncertainty ;-)

GDPR also doesn't forbid individuals to do pretty much anything. Article 2c "This Regulation does not apply [...] for a natural person in the course of a purely personal or household activity;" - you can speak freely and disclose information you have observed/recorded, but the business you are running can not.

And with application layer DDoS attacks and intrusions: surrender? Do not ban bad actors? Or outsource to Cloudflare that keeps an army of EU lawyers and is compliant?

Nah, that's a legitimate interest (the example given in Recital 47 is preventing fraud, which is similar). You can process it as long as you only use it for that purpose and delete it as soon as possible.

Are you also against access logs?

Only if you’re not scrubbing IP addresses and other PII within a reasonable window of time.

IP addresses are not pii. (Maybe personal data under the gdpr, but they are not pii.)

Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything.

> Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything.

Cookies and other artifacts in the request headers or query parameters that can identify a unique user.

Identify a unique user does not mean that it's pii if I cannot produce the real world identity of the user from the cookie.

True! But some cookies are usually tied to a user account, with an email address, and/or other PII.

How careful are you with tacking cookies to requests? Be mindful, and keep documentation.

Under the GDPR that's PII. IP Addresses too. Personal Data is any data relating to a natural person, if you can uniquely identify them that falls under the monitoring/profiling definition of the regulation.

"A much discussed topic is the IP address. The GDPR states that IP addresses should be considered personal data as it enters the scope of ‘online identifiers’. Of course, in the case of a dynamic IP address – which is changed every time a person connects to a network – there has been some legitimate debate going on as to whether it can truly lead to the identification of a person or not. The conclusion is that the GDPR does consider it as such. The logic behind this decision is relatively simple. The internet service provider (ISP) has a record of the temporary dynamic IP address and knows to whom it has been assigned. A website provider has a record of the web pages accessed by a dynamic IP address (but no other data that would lead to the identification of the person). If the two pieces information would be combined, the website provider could find the identity of the person behind a certain dynamic IP address. However, the chances of this happening are small, as the ISP has to meet certain legal obligations before it can hand the data to a website provider. The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant."

https://eugdprcompliant.com/personal-data/

PII or not PII it is still covered by GDPR.

Reply on news.ycombinator.com