Hacker News Reader

Comment by VMG | Hacker News Reader

The GDPR ensures that only Facebook will be able to comply, and prospective competitors shouldn't even bother.

The regulation counts 58 000 words.

The regulation's big but it's probably not larger than a sprawling API documentation, etc. and you approach it the same way: just read what you need.

IIRC almost _half_ of the actual regulation is about what and how the member countries should set up their internal supervisory authorities and the rest is similarly specific.

There are innumerable checklists, summaries and guides on how to deal with GDPR as well.

The two I like are:

https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...

and

https://ico.org.uk/for-organisations/guide-to-the-general-da...

I see so many people parroting this but I just don't get it. Surely it won't be a problem at all for a new startup handling data correctly from day 1? Facebook has a mountain of historical data that was collected using non-GDRP-compliant methods that now falls foul of EU law.

You need somebody that knows the regulations and developers that are capable of auditing the whole system. That's added fixed costs, which is an advantage for incumbents.

But these regulations are not that complicated! Heck, in the EU we've been observing most of them in the last years already. Most things are really straightforward. Things get complicated when your core business is making users' data available to third parties. But it's not different from any other business: if you want to make money in catering for example, you need to read and adhere to relevant laws, too.

Is an IP address PII or not? I have read multiple different interpretations today.

Is a hash of an IP address PII?

Is this really that complex? If it can be linked to the individual, then it is. https://www.whitecase.com/publications/alert/court-confirms-...

So IP + timestamp of my ticket system logs is invalid because I also have a timestamp of ticket updates by a user. Actually, just IP because I have a timestamp on the log file. So the latest line has an IP, so I can take the file timestamp and see the latest ticket comment and now I've linked it to an individual. You're right, this is easy. Even easier now that I can't think of a way of storing an IP without the ability to at least correlate the latest one.

> So IP + timestamp of my ticket system logs is invalid

What makes it "invalid"? If you can identify a person by their IP, then the IP becomes a part of their personal data. For most websites it's irrelevant, because people just visit and leave. But if someone signs in with their real name, you just need to update the ToS saying that apart from their other data you also store their IP. How complicated is that?

Ok, just update the ToS. No ability needed to provide opt out of that IP collection? No ability needed to go, upon request, and delete all these IP+timestamp logs that I could use to correlate with their name? Handwaving all of this stuff away as clear and easy is at the least ignorant to real people's concerns and at most willfully dishonest.

How can anyone "opt out of that IP collection"? It's not the way the Internet works: logging is an essential part of of its infrastructure (and in certain jurisdictions it's required by law). The only problem is if the IP is associated with personal data. If the user really wants to remove it, they can remove their personal data, and in this way the problem disappears.

On the other hand, if you plan to sell the IPs associated with some other data to a third party that can easily link it to people (Google and Facebook can), you may want to consult a lawyer.

Can you point to the bit of the law that requires website owners to delete data upon request? Or the bit of the law that requires website owners to ask for consent to gather IP addresses?

Writing style can be linked to individuals.

Can I still have a forum where users submit text?

I love all these posts that assume because they've never been on a software that team that makes compliance part of their job, that it's completely outside the grasp of a small team.

Those of us in fields regulated prior to GDPR are laughing at you.

Is that what they are saying though? I'm not reading it as 'small teams can't comply'. I'm reading it as if you comply, you will make less money advertising, and that affects the dynamics in a social app.

If you have to charge money, your chance to overcome the network effect of FB or an established site is difficult, because en masse migration of users to a new service typically goes hand in hand with that new service being offered freely.

Conversely if you don't charge money, your ability to fund the development of a competitor is based on reduced ad income since you can't offer targeted ads, which is going to shorten your runway by a significant amount.

These two things seem to indicate that the likelihood of building something that replaces one of the existing social services goes down. I don't think it makes it impossible, but the law seems to make it less likely that the social app incumbents get replaced (if that was at all possible).

As far as those in other regulated fields having done this for some time, I can't think of many regulated fields where the network effect is so high as social apps, so it is probably a bit apples to oranges. Presumably it is not as large a deal in those markets where social network dynamic is not as strong.

Reply on news.ycombinator.com