GDPR for lazy people: Block all European users with Cloudflare Workers
apility.io
apility.io
The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling.
Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-stage startups use the (in 2008, when I did mine) best practice of “delete=1”. Changing your whole database over to permanent cascade delete is only easy if you’re a very experienced programmer or who knows what he’s doing. And that sets aside the fact that even if you know what you’re doing technically, there are lots of business logic problems with just deleting things out of the database and anonymizing users is very tricky.
I was not a great programmer when I started my first startup. I was learning as I went along.
We couldn’t afford a lawyer, and the amount of time for me (the only programmer) to go through and read all the regulations and make all the requisite changes in the product I would estimate might take on the order of a month or two, which if timed poorly would’ve killed our company. I say again: at an early stage startup with one programmer, you cannot have that one programmer spending two months on compliance.
It’s just gotten to the point that there’s one comment after another responding to this regulation or that regulation or this situation or whatever with “well, just call HR“, or “I can’t believe you don’t have a company policy for that!”
Or “well just ask your lawyers“. It ain’t that easy. Do you have any idea how much it would cost to have “your lawyers” go through the GDPR, tell you what you need to do, and deal with all of the edge cases and gray areas? $20k or $30k doesn’t seem too high.
My biggest fear is that all of these complex bureaucratic laws are just raising the bar for doing a startup. Maybe the days of two people doing a startup in someone’s garage should be in the past? If so, that makes me kind of sad.
Regardless it’s not obvious that GDPR is the right policy or that it’s well designed or clear.
Honestly that's a bad best practice if the data your collecting is sensitive, which PII is.
Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong.
There's ways around it, obviously. But they are not easy. Much easier to just mark as deleted.
Another example: Threaded conversation - someone deletes their post, and oops all the replies are now orphaned.
If a user requests deletion, assign anyYassociated entities (eg purchases, conversations etc) to an anonymous user. Or, keep the original user record and just blank all of the fields. You've had two years to think about these problems.
As long as you're confident enough in your PII solution to be willing to present it in front of other software developers who have been called as expert witnesses and declare that it meets the GDPR requirements, you can pick any "right way" you like to meet those requirements.
If you think it's an unreasonable burden to have to make PII handling solutions that are robust enough that you can honestly defend them in court if challenged, maybe you shouldn't be handling PII. Like, at all.
A good thing because it means startups stop playing fast and loose with my data. These are just growing pains. In a few years, enough stuff will be written online about best practices to stay GDPR compliant. The new guys can follow that.
Then you shouldn't be handling PII, any more than you should be handling credit card details, genetic information or military intelligence.
>Maybe that means I have no business working at a startup. Maybe we should think about the implications of that.
The EU has, and has decided that having seen the alternative, it would rather just not have the startups. I think that's a reasonable position to take.
Edit:
Ok, looks like there is a clause for these scenarios:
"However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information, for COMPLIANCE WITH A LEGAL OBLIGATION, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims."
Then there's:
"It should not apply where processing is based on a legal ground other than consent or contract. By its very nature, that right should not be exercised against controllers processing personal data in the exercise of their public duties. It should therefore not apply where the processing of the personal data is necessary for compliance with a legal obligation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of an official authority vested in the controller."
And, in terms of technical burden at least it seems like they try to alleviate it somewhat...
"The data subject's right to transmit or receive personal data concerning him or her should not create an obligation for the controllers to adopt or maintain processing systems which are technically compatible"
Erase the name and address fields from the user in the database. You don’t have to delete any line, and that person doesn’t have any personal info in your database anymore. Problem solved.
And what if the PII is stored in a blockchain? Then what?
No clue. But I can't wait for that to be tested, because I'm very curious what the solution will turn out to be.
Anyway this stuff is super complicated and there's no rollback for data that was mistakenly deleted and shouldn't have been, so the point is there are layers and layers of complications and scenarios and it's not as simple as everyone likes to make it out to be. It's not impossible, but it's definitely a lot of difficult work.
The "right to erasure" isn't as strict as the "right to be forgotten" -- You (the end-user) would need to prove that merely having your name and address in billing records violates your right to privacy. And to make that argument you'd have to provide evidence the business is using said information for purposes other than billing.
Personal data can be used lawfully to "fulfill contractual obligations with a data subject" (eg: fulfilling a purchase, and retaining information for warranty/returns/RMA etc purposes) and "To perform tasks at the request of a data subject who is in the process of entering into a contract with the controller. " and "For the legitimate interests of a data controller or a third party"
In many cases, that will be your mistake. The right to erasure is not absolute, and if you need to keep those records for a good reason -- for example, as evidence to support tax returns or defend chargebacks -- then you are entitled to refuse to delete them and to continue processing them for the necessary purposes. Otherwise mortgages would suddenly become a very fast way to send lenders under, since everyone could just demand they delete all identifiable records of who owes them money...
For data processing purposes like this, you will normally have to rely on the legitimate interests basis. That's the one with the almost entirely non-specific definition, combined with the almost entirely non-specific balancing requirements.
With a case like defending an unjustified chargeback, we might assume that the interest is surely both legitimate and overriding, but even that is only a personal view and not something any regulator has explicitly addressed in guidance, as far as I'm aware. In any case, plenty of other scenarios won't be so black and white.
You don't need to actually delete the row, just overwrite the information which you no longer have consent to store...
This is obvious isn't it?
Who are you people who can’t/won’t actually delete something from your db’s?
Past that, deleting things from databases is sometimes hard. If, for example, I delete userX, and userX was the founder of a number of forums, or chat rooms, or groups, or facebook pages that are linked to userX? Do those groups and forums and things count as 'belonging' to userX? If userX happened to be the guy who created /r/news, do we delete that subreddit, and all of the content therein?
What if userX was a paying member? Do you delete all his old invoices? How do you make sure that doing so still allows you to balance your books?
There are indeed real world scenarios wherein just deleting a user and cascading that delete throughout the system breaks things. In some cases, it might be better to replace userX's personal details with 'AnonymousUserX', but then that might leave behind content they've generated, which you then have to replace with "DELETED CONTENT" or some other stub, which causes complications.
I agree with the OP. People who assume this shit is easy haven't really thought about the problem much at all. There is a lot of data stored out there in ways that wasn't really designed to be mutable.
Because they either argue that it is hard to design a database that allows deleting or anonymization, or it is that they're in the business of selling data and won't delete anything and rather lie to their user and customers.
I would be interested to know if there is any other argument for this.
... unless you plan to use the backups.
Then you have to have another service that tracks entities to delete when a backup it's restored... and back that up separately.
There's little to ponder, that's why I mentioned "entities" rather than "user data." Use unique keys to reference the data rather than sensitive identifiers. The nontrivial part is storing your backup of entities to be deleted in a way that doesn't get destroyed at the same time as the event that forces you to revert to a backup. This now requires a separate storage, backup, and retrieval mechanism to maintain compliance.
This is terrible advice. All identifiers are PII and covered by the GDPR, not just the "sensitive" ones.
"Personal data" (the term actually used in GDPR) means any information relating to an identified or identifiable natural person. The GDPR specifically states that the regulations do not apply to anonymous data. A list of unique keys marked "never restore this data from backups" is not personal data. The data associated with those identifiers is not personal data if it cannot be associated with an identifiable natural person.
https://gdpr-info.eu/art-4-gdpr/
https://gdpr-info.eu/recitals/no-26/
Quantum has produced a very useful white paper on GDPR in relation to backup and archive systems.
Here's how to read it: "Personal data" means any information relating to an identified or identifiable natural person"
The "any information relating to" part is exactly the "unique keys" that you seem to think are not covered. The uniqueness and mapping to a person is literally the problem.
And re: PII, seriously? You're upset because I didn't type out "Personal Data"—even though you knew exactly what I was referring to, as did everyone else? Fight bigger battles…
The uniqueness is completely irrelevant unless it identifies someone. If there's no way to trace that unique key back to the identity of a natural person, then it isn't an identifier within the meaning of the GDPR and the data associated with that identifier isn't personal data.
>And re: PII, seriously? You're upset because I didn't type out "Personal Data"—even though you knew exactly what I was referring to, as did everyone else? Fight bigger battles…
It's a highly significant difference. Other legislation talks about "personally identifiable information" - in the US, NIST define a finite list of things that constitute PII. The GDPR talks separately about "personal data" (stuff you know about someone) and "identifiers" (the information that ties the data to a natural person). Lots of stuff that isn't PII is personal data. Data can become personal data through association with an identifier or cease to be personal data through anonymisation. Apropos of nothing, PII isn't necessarily personal data. Without that distinction, large parts of the GDPR are incomprehensible.
If I discovered your company was storing my personal data under "unique keys" that considered by themselves didn't personally identify me, I'd report you to my GDPR regulator immediately.
Unique keys with no personally-identifiable data in the key aren't some sort of innovative workaround that will allow you to store my personal data without my consent. It's not even remotely consistent with the spirit of the law, and IMO, with the plain text of the legislation.
https://gdpr-info.eu/recitals/no-26/
A salted hash of your IP address is an identifier, because it can be used to indirectly identify a natural person. If I see the same IP again, I can hash it with the same salt and check for a match. The IP can then be used to identify you through your ISP's DHCP logs. If I associate the hash value with any other data, then that data becomes personal data.
If I delete the salt value, then it's impossible for me to match the hash to an IP, so the hash ceases to be an identifier. Assuming that the data associated with that hash does not contain any other identifiers, or data that when combined in aggregate could identify a natural person, then it ceases to be personal data.
But remember, strictest interpretation wins.
As far as I can tell to comply with a deletion request with absolute certainty requires infallible storage (which would remove the need for backups) or modifying backups (which contradicts the concept of a backup). Maybe you can claim 'force majeure' at some point, but perfect compliance seems impossible.
If not, then it isn’t personal information.
What's your system for dealing with COPPA then? You're required to have a way for permanently removing data of children.
https://people.apache.org/~jim/NewArchitect/docs/new10136361...
“Are you in the EU? Y/N”
I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR. There is no way on earth that the EU as a whole has looked on your company/project or whatever and decided to screw you.
Have a look at the first few paras of this: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... after it says "Whereas". Does the language look a little familiar? Do the sentiments look strangely familiar in some way?
GDPR is not about destroying people's livelihoods. It is about protecting basic, fundamental rights that say 30 years ago we never knew needed to exist.
After all the knee jerk reactions have calmed down a bit, you may find that you personally have benefited in some way from EU regs. If you find that, then I suggest you fight tooth and nail for similar to be enacted at home. I'll be the first to thank you for that.
There is a lot of complications that arise if you think about the second order/third order consequences of the law.
http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...
My reading of them finds no second/third order anything. The regs are surprisingly clear.
I forgot to mention that unless you are trying to abuse EU citizens in some way then you have no problems. A useful side effect of the internet is that deciding whether someone is an EU citizen or not is tricky. That means that most companies have decided to treat all citizens in nearly the same way:
For you as a private individual, a foreign power now provides you (indirectly) with way more "rights" than you might have had in the past on the internet. Have a read of the regs, please. The first few paras are a bit "we the people" but then, that is what is required. Then go through the articles. Read them as a person first and then consider them as a company or whatever you do later.
This is an 88 page document with extremely dry language. Just confirming your assertion will be time consuming. No wonder many American services would rather shut out EU users than comply.
If you own a business, the cost of reading this document is about 2 days (with consideration for googling terms). To disenfranchise a whole continent because you are inconvenienced is ridiculous.
Put it a different way: are you too busy to read docs/specs of the technology you are using or will you abandon it because specs are too dry?
American services are just busy because they are doing their best to keep the lights on. Within a week, the handful of companies will comply. They’re just cautious because they have to pay folks and don’t want to make a silly mistake that will shut down their business.
Edit: structure
In my opinion you absolutely hit the nail on the head with this:
"If you own a business, the cost of reading this document is about 2 days"
This regulation calls for legal expertise, trusting google to save on fees seems risky for a business. In all seriousness, biz owners should shell out for expert advice for compliance, or stop doing business in the EU.
Google and Fb have already seen litigious groups claim $9.3B in fines on the first day[1]. There will certainly be a cottage industry of lawyers going after online businesses that have erred with GDPR.
[1] https://www.cnet.com/news/gdpr-google-and-facebook-face-up-t...
People can refer an issue to the regulators claiming that the GPDR has been violated. The regulators will determine if they believe the regulations have been violated and whether it's a large enough violation to enforce. If fines are levied they go to the government and are intended to be punitive, hence the percentage of revenue as the max fine so that you can't just ignore the regulation by being rich.
No individual or group other than the government is going to make money off of this, and the government has to balance the loss in taxes and cost to enforce against any gain from a fine.
This whole kerfuffle about the GPDR has just shown that american companies will lose their fucking mind if they have to follow anyone else's rules and can't just lobby the US government to force their laws on everyone else.
Shame on them for ignoring the law for that long, just because there weren't any fines yet.
Incorrect. They are civil right groups, which filed complaints with the authorities. Even if the complaints were fully accepted and the offenders fined to the maximum possible amount the groups would not "earn" a cent.
Umm, no, I won't read them?
I seriously cannot remember the past time so ever went and read all the official docs for a new tech.
Instead I learning by doing, and reading stack overflow.
If I have to read through 50 pages of docs to use something, I seriously am just going to use something else.
These same arguments could be applied to just dumping waste from manufacturing in the rivers. Does "If I have to spend 50 days disposing of my waste in a way that doesn't harm others I'm not gonna do it. I'm just gonna dump it somewhere else" sound acceptable?
Modern society has mostly decided it's not
If the EU doesn't wants these services, then hopefully these services will decide to leave, and the EU citizens can decide if it was all worth it.
I am certainly going to block EU customers on all my future side projects. It really isn't worth the bother for something that I just made for fun, and isn't making many money. Easier to just block this small market wholesale.
I even found a way to block them with a single line of frontend code!
I'd you are completely outside their jurisdiction though, there's no much they can so to you without starting a war or convincing your own government that the GPDR should be enforced.
I do think it's leaving money on the table though. The EU is 500 million people, 2/3rds more than the US and with a bigger aggregate economy. The US also has regulations that have a cost to implement so it's not like you are avoiding the issue just by focusing there
Oh, please. To not offer a service or website or whatever to people half a world away is not to "disenfranchise" them. I don't think you have room to call anyone else's comments "silly".
When I was 20/21, I worked at PJ Clarke's on the Hudson, a restaurant in downtown Manhattan. Back then, the Merc was still staffed by traders on all floors (they switched to computerized trade desks, I believe, and there were less people there).
During one shift, I had a party of 10+ people and had to grab extra tables from other area. The tables had tops made from granite and heavy. As I was moving the table, the majority owner Phil Scotti jumped in and started helping me. I said something like "I got it" and he looked me in the eye and said "Anything for a buck".
That quote might not be popular but I what I realized is that work is work and money is money. If a multi-millionaire could move tables and his wife (in custom, expensive, suits) can bus tables, then yes...Disenfranchising, or not servicing a bunch of folks, because you don't feel like it is fucking stupid.
I apologize for calling it silly.
I agree with you in everything though, everyone should be reading and following the law!
I've been watching experienced lawyers, general counsels, etc from various companies, vendors, etc literally yell at each other about some of the finer points of the laws. It's quite fuzzy on a lot of things, and get REALLY complicated in some cases, especially when dealing with 3rd party vendors, or when you are yourself the third party vendor. Certain patterns, technologies and software are very hard to retrofit properly. Some concepts like the business justification stuff gets really fuzzy when handling things like free accounts.
If you make any amount of reasonable money, you need a lawyer to work with your devs (hope you didn't outsource the work!) on a lot of this. And your usual lawyer, if in the US, might not be qualified to deal with EU laws. It's a tough situation. For businesses that don't even target EU markets on purpose, well...
If you're a medium to large international business, then this is just business as usual: dealing with new laws popping up, small or large, is just something you do. It sucks, but hey: it increases the barrier for entry of your next competitor!!
Disclaimer: I think GDPR is fine, and in a few years when every new startup or mom and pop company and 3rd parties are all setup for it, it will be a no brainer, just like email (not many people running their own email servers these days!). But the transition is hard, especially on smaller players.
I totally agree with you. But like you said, "It sucks, but hey...". That's totally the approach.
Yeah, it sucks, and what's new? There is always something that sucks. Within the next two months, there is: TLS1.2, new PCI guidelines, and GDPR that go live.
GDPR has more nuance then most other situations but just like PCI, you just deal with it.
What I imagine is this situation is like a bunch of stores stop taking credit cards because the new PCI guidelines require TLS1.2, anonymized customer data, and all customer data stored at rest to be encrypted or hashed.
Would folks have same reaction if their neighborhood deli said "fuck it!" I ain't protecting the CC data cause its tough and requires too much work?
But yes, once there's an industry of GDPR auditors, precedents in lawsuits, and the threshold for "Do not market explicitly to europeans" is obvious and well understood, this will be much easier.
And still, until the end of time, there will be companies that aren't GDPR compliant and don't work with EU customers. Maybe with the goal of doing so once they have more time and resources.
It's basically a checklist, and you're either compliant or you're not. It includes various levels with actual numbers and explicit requirements, there's very little interpretation needed.
If anything, it should've served as the model for GDPR.
See https://ec.europa.eu/info/law/law-topic/data-protection/refo...
> When the regulation does not apply
> ...
> Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.
The GDPR is most of my job right now, and I have a relevant background. To say that the cost of reading the document is two days clearly shows that you have very little idea of what the law means. I've been arguing with other privacy professionals about the details of this law and how to implement it likely for longer than you've known about it, and on a number of those questions there is still no consensus.
This is an incredibly expensive regulation to comply for most small and medium companies not because they're doing villainous things with the data, but because learning this law and then documenting your compliance for this law is ridiculously expensive for many types of businesses.
Lets swap GDPR for PCI compliance, which has a new standard (or fully implemented standard, if you may) coming soon. PCI deals with credit card information.
My relevant background allows me to make a few assumptions: 1. If you are in the US.
2. AND you have visited a Quick Service restaurant in the last five years (think Subways, Chipotle, etc.)
3. AND they use one of the major POS (point of sale) providers.
That your credit card, name, expiration date, and CVV is in plain text.
You may know the GPDR very well, as it is your job and you are most likely very qualified for it. And yes, there are probably lots of nuances to this law. However, thats every single law there is, every standard, guidelines, etc.
I'm not entitled. I am, however, a realist that understands that you just have to comply. Taking two days to read the 88 page PDF will make you more familiar then most. It might not make you an expert but for a small to medium sized business, it would give you the necessary tools to comply with majority of the law.
Quite frankly, I don't have a bunch of lawyers and I do have to implement GDPR. Will there be an official review? YES. There will be folks who know more then I and are professionals to double check my work. But I can't tell my stakeholders "Sorry, We can't do that because its just too tough". That seems entitled...
It’s like complying with 99% of securities laws and forgetting to comply with the insider trading laws. That’s not a defense.
It starts along these lines after the usual intro:
"The processing of personal data should be designed to serve mankind The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality"
I'll grant you that lacks a certain something but the language is compatible with another well respected charter of rights that you should be more familiar with.
FFS, do you not notice the similarities!
"A group of undertakings should cover a controlling undertaking and its controlled undertakings, whereby the controlling undertaking should be the undertaking which can exert a dominant influence over the other undertakings by virtue, for example, of ownership, financial participation or the rules which govern it or the power to have personal data protection rules implemented. An undertaking which controls the processing of personal data in undertakings affiliated to it should be regarded, together with those undertakings, as a group of undertakings."
Good bye and good riddance. And I don't really care if the door hits you in the ass.
If Instapaper, to name an example, wouldn't do shady shit with user data, there would be no reason at all to forgo the European market.
Half of commenters are making this assertion; the other half are asserting it's a damn good thing that small companies will be eviscerated for insufficient seriousness, whether or not they are doing anything abusive. Some of you are necessarily wrong.
The answer to “How do you handle...” is that you get your shit together. Separation of duties, build and configuration standards, no customer data on random laptops.
When I was in high school, I worked at a sandwich/coffee shop. The precious commodity in that store was cash. We didn’t leave cash on a counter, or on a roll in our pockets it was in a locked register. When there was more than $500, we withdrew down to $250 and put the cash in a safe. At the end of the night, we put the cash in a locked pouch and two of us walked to the bank and put it in a dropbox.
Data is no different, just more complex.
Yes it is
The word choice almost presumes the conclusion, that data privacy rules are obvious, and cheap, and akin to just washing hands after using the toilet.
Every regulation has costs and benefits. I also would love to have better worldwide privacy at no or little cost, but the fact that people are blocking the EU shows that some companies just don't see this to be the case. And they're voting with their feet.
EU citizens should accept the fact that if they support the law, they will further data privacy protections, which are good, and they will face the music if some innovation leaves or whatever compliance costs may come with it.
The contempt shown for us collectively as users and people is what triggered the regulatory backlash.
The 2016 electron demonstrated that better than anything why this is important.
As mentioned before, size limits is probably good for compliance costs; if the problem is political influence, make that a key part of the law. Making part of the law liability per privacy breach can be useful too (to deter companies from lax security that end up with them hacked).
Legislators don't have the luxury of saying "I'm not totally sure what's the best legislation" to fix this issue; they are forced to propose an actual fix. If you don't have a better alternative on hand, I'd urge you to consider that which legislators have arrived upon after months or years of consideration.
Like encryption, data privacy is either all or nothing.
And personally? I'd rather live in a world without tracking-enabled Google and Facebook business models than the one we're currently in.
Holding personally identifiable data is a toxic externality: Experian simply exposed a clear case.
If you want to do so, you should have to bear that cost. Or design your business model differently so that you don't.
For example ACA 2012 (Obamacare) applies the most onerous terms on companies greater than 50, but not a lot of 100 person companies split into two groups of 50 to dodge it.
I think privacy is indeed along a spectrum and not binary. I certainly think that EU citizens are more concerned with Facebook and the vast trove of data they have and political irresponsibility with it than with GarethsFirstApp in the Android store handling user data well.
And I'd point out that the latest Facebook media privacy outrage was caused by a smaller (1 person?) third party company.
GarethsFirstApp isn't so innocent when it's providing Facebook with data they can no longer collect themselves (given a hypothetical "You're small, so we'll let you get away with it" GDPR).
So based on that some might argue, that the small bussinesses should be regulated more as majority of violations are comming from them, not well established bussinesses. It is probably not true, but it might also be.
So... binary only is a right way to go.
Yes, no matter. Should small companies also get free pass on food safety laws? Health inspections are a PITA for restaurants too.
This reaction is pretty much textbook psychological reactance[0]. People doing business had some freedoms wrt. user data, but it turned out in practice that they should never have them in the first place. Now that those excess freedoms are being removed, businesses cry foul.
--
But if you look at how reality works, then you'll see that small companies often do not implement the proper food safety standards. This causes all sorts of problems, because if a company already does one shady thing, then doing one more isn't as much of a problem anymore.
It's like restaurants putting the toilet in the kitchen. Shut the business down!
Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.[1]
Not sure how that's 'complete freedom to ignore' exactly, nor is that an exhaustive list, just some examples of where they may need to be balanced against other freedoms.
(see below for my response wrt SS85) I prefer to dwell on things like this:
The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.
Below:
A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned. Therefore, as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the controller is able to demonstrate, in accordance with the accountability principle, that the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where such notification cannot be achieved within 72 hours, the reasons for the delay should accompany the notification and information may be provided in phases without undue further delay.
The rules are enforced via third-party litigation. So its not the "EU", but some lawyer looking for a nice payday that you have to worry about.
Edit: any replies instead of just downvotes? Yes, it isn't spelled out entirely in the GDPR but it isn't operating in an empty place. The civil law systems of most of EU have certain assumptions in place, like that you will first try to find recourse through proper avenues, and only then try direct litigation. If anything, you might actually try to sue the data protection authority for mishandling your case.
If it's only meant to be used against big companies or extreme offenders, why doesn't it say so? It seems like the spirit of the law and the language of the law are not aligned and in my opinion that's a sign of poorly designed regulation.
I object to the idea that small projects should be ok with breaking the law merely because they very likely won't get caught.
Have you read the bloody law! http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...
This is legislation designed to protect not only me (as an individual) but you as well (as a probable foreigner) from me!
Out of an 88 page law, 1% of an auxiliary middle of the law is carved out for small companies.
I'm not sure that counts as differential application for small companies. In the US at least, large portions of entire key burdensome laws don't apply for employers below size 50, 10, 5, etc. This does not seem to be the case here.
Does anyone know whether an official impact study on innovation was even done before its passage?
The law may be good as a whole but be overly burdensome for small companies. You should at least acknowledge that instead of just dismissing that outright.
At least my reading of the GDRP is that it tries very hard not be a big burden. If you are a small company or organisation and you collect a minimal amount of information (for example to contact them) there is not a lot you have to do.
The main thing is, you are not allowed to be sloppy. If you collect personal data, you have to think about whether you should collect it at all, where to store it, process it, and when to delete it. And you have to tell people that before you ask them for personal data.
Nothing like, we just collect a bunch of data, give copies to everybody, and have no idea what we collected. That attitude no longer works.
If you set up food regulations, are you going to exempt restaurants with only one cook? Or have aviation regulations that do not apply to airlines with only one pilot?
Given that the entire GDRP is less then a hundred pages, you can easily read it in one evening and get an idea of what you can do, have to do, and what the corner cases are that you may need to discuss with a lawyer.
But restaurants with only one cook can't afford a $300/h lawyer to tell them how to keep their shit hygienic!
If it turns out that you are in breach, they will write to you with information about what you're doign wrong and how to fix it.
In the EU we don't rely on lawyers for a fraction of the stuff you do in the US.
So if it's "innovative" a small 5-person startup should be able to wreak havoc to my personal data in whatever way they see fit? What is that nonsense. Are you seriously suggesting that "innovation" in startups should be more important than my privacy?
No matter what the ultimate decision is, no matter how sensitive the subject matter, impact studies are critical to making smart decisions.
I might say yes but I still want an impact study.
I prefer governing bodies operate with an awareness of how their actions affect society.
I think you're justifying a really extreme reaction based on the worst behavior of a few companies. GDPR doesn't just go after data-resellers. It targets how a well-intended company can use and keep your data even with no third party involved.
Laws that mess up the good-guys lives are bad laws. GDPR is from the same folks who thought a law that lead to pestering users about cookies was a good idea.
Also I like the cookie idea. If only people really cared about misuse of their data they'd like it too. We've seen how good 3rd party cookies have been for some democracies.
>All well intentioned gun enthusiasts should support it.
Really black/white argument there which the issue is not. And nor is this topic. There should be more nuance in GDPR, but there isn't which creates a lot of discomfort.
>It's not stopping any well intended company from fairly using data.
It actually is, but whether or not that is an overall good thing is yet to be seen. Certainly, they did some level of testing before proceeding.
No, and it is dishonest of you to suggest that was claimed.
> impact studies are critical to making smart decisions.
Which were done as was consulting with industry etc. well before the law was passed two years ago.
And yes, I've read the law. It's typical of legislation in that it obviously wasn't written by people who knew what it looked like to perform that in a real life business.
Have you read recital 1? https://gdpr-info.eu/recitals/no-1/ ? The starting point of the law is that data protoection is a fundamental human right,. The data subject owns their PII, not some company collecting it.
It's all up whether you are willing to accept that as a fundamental right or not.
I mean there is a billion of Chinese that live with the fact that free speech is not a fundamental human right. Most Westerners have a problem with that.
Now many US based IT professionals seems to have problems with accepting that nobody else can own the data about a human.
> It's typical of legislation in that it obviously wasn't written by people who knew what it looked like to perform that in a real life business.
That's what a cotton farmer could have said when they made slavery illegal. Obviously respecting other's human rights makes some business models illegal.
But the laws regarding it are not clear for an actual operating business. Instead of being simple and straightforward to implement, they are an ambiguous mess that are wasteful and misplaced. Laws designed that way almost never actually accomplish what they set out to do.
I am not sure I can fully follow you here.
If implementers accepted that they only collect what is absolutely necessary and they delete what the they are not legally requited to keep things would be much easier.
Problems start when the business model is that customers'/users' data is our product/an asset and we somehow try the find the minimum possible implementation that just meets the requirements of the law while still using all loopholes it might possibly leave.
I agree that the law is not very clear for how you should code it. Nor very detailed what you can do with a certain piece of data. So it depends on your approach: If you take a conservative approach that if in doubt, we don't keep the data it suddenly gets much clearer. If you start fiddling maybe I could still do it if we did it like this and that you end up in endless work.
And of course if you have an existing system that never had the requirement of deleting anything there is a lot of work. But the law has been in force for 2 years, so businesses that wake up now when the transition period has ended it can be a mess.
>Laws designed that way almost never actually accomplish what they set out to do.
How would you have written the law? Do you have counter-examples of laws being written so clearly that you could recommend them?
The key point really is: Many business models and practices on the internet are incompatible with the spirit of GDPR. It's a fundamental right that the users own their data and businesses are not allowed to do with it whatever they want.
Lawmakers did not want it write it that so clearly, because lobbyists would not have accepted it. And business owners still don't want to accept any suich fundamental right. So complaining about the law being too complicated is somewhat canting.
Yeah, it might be getting harder making a startup working on personally-identifiable data - even if it's not doing anything shady. But it's also hard to make a food or healthcare startup; you can't just "move fast and break things" there either. In EU, PII were finally granted the status of something actually important.
As for startups that depend on abusing user data, I'm very happy they have problems now.
- personal data (car) are any data that have potential identifying a person
- person owns its data (car). You cant buy them (well this part is different than the car), you cant steal them, you cant sell them, but you can borrow them from. But for that you need to ask (consent), where it is not allowed to trick the owner to give them to you, whithout beeing fully aware what was borrowed and why. And if you are borrowing the data for someone else, you need to ask about that too. And tell when you will return it.
- it is immature and unfair to play grumpy if someone doesn't want to allow to use its data. Or try to force/blackmail them from him. So its not allowed to do that (noyb.eu)
- once you borrow the data (like property, envision a car), behave acordingly, owner can demand them back, demand to see them, demand to know what you are doing with them and if stolen it is completely normal to tell them about that. And if they were stolen due to your fault (leaving keys in a car), they might demand to be compensated. Same goes if you misuse them (let me put some fertiliziers on back seat, forget to return them, giving it to all your friends without asking,...)
- if the data owner asks you to do something that requires his data ("hey, can you please take my car and bring me icecream from the store") you don't need to ask for data, it is expected you can have them.
Did I forget something? I consider it simple, as long as you try to stay genuinly respecting to other persons ownership. Just think about borrowing your car or borrowing car from your best friend and you wont go far wrong.
if yoi tell me your birthday how can i forget it?
if you borrow me a car i have something i can return...
Ask any husband.
Joking aside, if the memory is on a computer system, as opposed to a person, you can, you know, just delete it.
Obviously, removing the commit would break git's ability to sign any hashes for that repository after that point…
And thinking it through a bit more, what about the companies that use v8? Could I ask my regulator to get Joyent to remove it from their systems? I'm sure they have copies…
Law has nuance and cases (and corner cases), it's not some strict predicate.
You entirely missed the point of my hypothetical, which was about immutable data structures like git employs.
As it turns out, our business also uses a git-like hash-chained commit log for our normal database. Deleting old entries would thus violate the integrity of our database. Is that now illegal under the GDPR?
That's not really relevant. GDPR doesn't ask people to forget things out of their minds.
So let's rephrase to a more relevant example:
> if yoi provide me your birthday on a web form and I put it in a database how can i forget it?
This now becomes relevant, and easy do answer. You delete it.
> The starting point of the law is that data protoection is a fundamental human right,. The data subject owns their PII, not some company collecting it.
> It's all up whether you are willing to accept that as a fundamental right or not.
As a fundamental right, doesn't that mean that the government needs to abide by it as well? Can an EU resident demand that their image be removed from all footage collected by public surveillance cameras, for example?
> Now many US based IT professionals seems to have problems with accepting that nobody else can own the data about a human.
I think the idea that someone can own facts about anything is bound to cause some amount of confusion or even cognitive dissonance.
At what point does one's right to be forgotten supersede another's right to remember?
If Alice knows something about Bob because of their personal interactions, as he asks her to forget about it, but she still remembers it, is she violating Bob's right to be forgotten? How about if she had written it down in a journal? Does she need to erase what she wrote? What if her journal was stored electronically? In any of these cases is she allowed to tell another person? What if she already told another person before Bob told her to forget about it?
More concretely, suppose Bob visits Alice's house, and then a couple of weeks later tells Alice that she must forget that he visited. If she ignores his request is she violating Bob's rights?
Now suppose Bob is visiting Alice's website, which records his IP address in a log file. Bob asks to be removed from the log, and again Alice ignores his request.
I think for many technically minded people there seems like an awfully smooth gradient between these last two scenarios, and so classifying one as reasonable and the other as a violation of human rights can be surprising. Precisely where is the line drawn that makes one scenario reasonable, while the other is completely unacceptable?
That's a good point. The term "fundamental right" occurs only the recitals, not in the law itself IIRC. The laws applies to authorities, but not when they carry out the legal tasks in prosecuting and preventing crimes and dealing with public security. So you would not have any rights with respect to video surveillance by authorities, unless you could prove that that is not done for public security :(
When it comes to authorities practices differ a lot in the EU. Let me give 2 examples because I live/lived there
1. In Germany video surveillance of public spaces is not very popular. One of the biggest cities in Germany, Frankfurt/M. seems to have 6 (six) such cameras now. And whenever there is a new one, it still makes big headlines http://www.fnp.de/lokales/frankfurt/Datenschuetzer-Es-wird-z... (In socialist East Germany they had them already in the 1980, but I am sure they all disappeared in 1990)
Google has stopped rolling out Streetview in the very early beginnings. Not that it is an authority, but it shows the public opinion, even if it's a single picture every couple of years and faces are blurred.
It appears that the resistance is more and more broken. At my last visits in Germany I saw cameras on trains/buses for the first time. I'd assume they are not counted as public spaces, but private properties. Which is a problematic classification considering their function. In Northern Ireland cameras were standard on buses already in the 1990s, no idea for how long before that.
When you get a German passport they will store the fingerprint on it (I guess that's a nearly world-wide standard for machine readable passports). However, in Germany they make a big fuzz about it that the fingerprint is erased from all databases as soon as you have accepted your new passport. If you detect a typo in your passport after accepting it, you have to apply for a new one, pay again and have your fingerprints taken again.
2. In Finland public videos surveillance has existed in all big cities (not that there are many...) for decades. There are also street condition (think snow) cameras on the internet. It's not their purpose, but some of them show fully identifiable people when they happen to walk by. Not many people seem to be bothered about it.
In Finland the fingerprints for the passports are stored until there will be a law how they are allowed to be used. Only few people believe that the police would not use them to solve a high profile crime before the law is ready.
A common Europe is still a big fiction in many aspects.
I think the GDPR would protect them because of a number of factors:
* there's a legitimate security interest (vandalism, terrorism, rape and other personal crimes)
* the recordings are not stored longer than necessary to fulfill that purpose
* there is clear signage indicating you are entering an area with surveillance cameras (i.e. you are giving informed consent)
The GDPR protects the individual's right to privacy but it's a balancing act and the security interests are fairly valid.
So if I don't want to be filmed on the bus I take a taxi for 10 times the price? (Not sure whether they might have cameras, too. Haven't taken a taxi in Germany for many years.) Or I walk 2 hours?
That's not what I would call informed consent. It's information yes, but as long as there are no competing bus lines without cameras there is no choice really.
Yes, in Germany, everyone, meaning citizen(EU/EEA) or not, enjoys the right of forgotten from surveillance cameras or any image/personal information that is not subject to the legal registry, from public record beyond 90 days. Unless you are targeted for an otherwise legal reason.
Personal anecdote: I was involved in a student demonstration once that ended with the police recording every individual separately in addition to checking our national ID cards. After about 14 days I wrote them a letter requesting information about what data they had kept and to destroy that data if it is not part of an active investigation.
I received a formal response saying they had already destroyed the data shortly after collecting it because they didn't end up needing it.
I presume the law is exactly the same as with any other organisation, i.e. the BDSG (Bundesdatenschutzgesetz) which as of now implements the GDPR (DSGVO) in Germany.
No, no-one can force you legally to forget something, and I think this brings up the main problem with your argument, which is that we're not talking about Alice and Bob, we're talking about Alice and Bob's Widgets INC.
I'm technically minded and I see a 100% separation between the interaction between Alice and Bob, and Alice and Bob's Widgets INC. Yes, I do think it's completely reasonable for Alice to ask bob to be removed from log files, journals whatever.
Lets look at a parallel you drew:
> More concretely, suppose Bob visits Alice's house, and then a couple of weeks later tells Alice that she must forget that he visited. If she ignores his request is she violating Bob's rights?
I wouldn't say that Alice is violating anyone's rights here. Being unreasonable, yes. Asking for something with no legal or enforceable basis, yes.
> Now suppose Bob is visiting Alice's website, which records his IP address in a log file. Bob asks to be removed from the log, and again Alice ignores his request.
This is a non sequitur, these are different scenarios with different requests, just with the names kept the same. Businesses aren't people, and they don't have memories like people. Businesses don't (for the most part, legal actions notwithstanding) need IP address information. It can be helpful, certainly. Knowing your customer has returned, knowing what they have looked at etc., but it's not essential.
So yes, it's reasonable to ask for removal from logs, and no, it isn't reasonable to ask someone to forget you visited their house.
In the US, corporations are people.
In the EU, corporations are legal persons but don't inherently enjoy the same rights/protections as natural persons (i.e. humans).
Just remember the Hobby Lobby ruling: in the US, corporations can have religious beliefs. In the EU that sentence doesn't make any sense because a corporation cannot hold beliefs (though the people employed by or owning it can).
> in the US, corporations can have religious beliefs. In the EU that sentence doesn't make any sense because --
It doesn't make sense because in the EU we didn't artificially create a legal construct to support the notion of corporations having religious beliefs (or "being people").
Please don't act as if both ideas are equally valid descriptions of the real world when one of them is strictly a legal fiction and completely meaningless in any other sense.
I'm sorry but just like the notion that a 2-person startup would need $300/h lawyers for any significant amount of time to ascertain they're sufficiently in compliance with the GDPR to not get sued into oblivion (.. or something? over here people can just read and implement the needed provisions by themselves in under a week, is what I heard from my friends in the business), this seems to be a problem inside the US legal system, doesn't really seem to me like it's the EU's problem to take into account when it's broken like that.
I assume you mean Alice's Widgets INC., since Alice was the one with the website.
But in any case, I didn't say "Alice's business's website". I said "Alice's website", as in her personal website. Are you saying that an individual's website can record visitor's IP addresses and store them indefinitely, but a business cannot?
1. don't be unreasonable
2. be acceptable
Actually, just because one critcices the way the law is made doesn’t mean they think it’s basic intention is wrong.
As of your slavery example: Forbidding slavery is one(good) thing. Saying „everbody having somebody work for them out of anything but total free will and not being able to prove it is doing forbidden slavery“ is something else. If i must work because i need to eat and pay rent, is that total free will? How can anyone prove that?
So sure, the wording is extremely important.
Because, and this has been repeated millions of times on HN, Europe and the US follow different systems in writing laws
Tax law is probably the most common example of this.
If you aren't competent at responsibly handling personal data and you want to build a project or startup, pick one that doesn't handle personal data, or put in the effort to learn how to do things properly.
And then: What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost? You either have no option to reset passwords, or must do it by phone, which is extremely expensive.
Stop logging the IP address then. Hopefully default settings in web servers will change.
> What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost?
That means you have a legitimate interest, so long as you don't send marketing emails to those addresses, or sell them, and so long as you delete them if someone deletes their account.
> How does for example a small yoga studio’s email list fit in your examples?
If someone signs up to your email list, they've consented to receiving emails. Just don't sell the list, and remove people if they unsubscribe.
The only real complication (if you're in the UK, I don't know about other countries) is that there is a fee to register as a data controller. https://ico.org.uk/for-organisations/data-protection-fee/
the thing is not about doing what you propose but that however you‘re doing it, you have a lot of bureaucracy and legal insecurity right now.
The examples of wrongdoing you give should be leading to hard measures. But those with good intentions shouldn’t have high bureaucracy costs.
To be clear: i don’t say these laws shouldn’t exist. They just should have been targeted at the actual wrongdoers and put smallest possible burden on all with no bad intentions.
Then you have a legitimate need for the data, so store it for a reasonable length of time and then delete it.
People repeat this a lot, but it sounds like complete nonsense.
Why does your business need to perform “security anslysis in case of attacks”? Do you get paid to do that? Why would you need IP addresses for that?
Another example is logging requests to secure sections of the site and/or server and perform IP blocks on fishy activity.
I don't see why the IPs would ever have to hit the disk for this purpose, just keep them cached in RAM for a few minutes.
the only way round this is to make the webserver spend a non-trivial amount of time running some derivation function on the IP for each and every request (remember you can't cache the result if the entire point is not to store the IP)
The problem is that it's possible and that is where the GDPR hooks in.
Put another way:
If the goal is to prevent certain actions by making them illegal and a given boundary can already ensure that, whats the point in widening that boundary even more?
Atleast in germany the boundary has not been widened and most corporations seemed to operate just fine.
> Just because if the name is added to such a database of cars produced, it will be personal identifying?
When you add data to your database you'll have to consider this, yes.
Privacy under the GDPR means that you evaluate whether or not it is necessary to store such data.
Why? Because the GDPR is not only about the present but also about potential problems. If your database gets breached and someone runs of with the data, the GDPR seeks to ensure that the data contained is the absolute minimum necessary and does not threaten the privacy of the users if possible.
Put another way:
Under GDPR you do not own data like car color, built, model, extras. People give you stewardship of the data and you are responsible for it. It is your task to protect it. Protecting people's data is easier when you don't have as much of it.
But in legal matters, you need to identify people and have some kind of audit trail, especially if they tried to breach your system. That makes no sense.
If IP addresses in logs are necessary for audit trails, why aren’t fingeprints?
That doesn’t help.
IP adresses are not 1:1 assigned to a person for a whole lifetime, fingerprints are.
Only with a lot additional effort and connection to other databases, IP adresses can actually be connected with a person, but only for an uncertain period of time, finding out this timespan, and ensuring it’s really only exactly this one person requires even more effort.
So a properly crafted law would have made all these efforts illegal, and put high fines on them, but not the decades old practice of storing ip adresses in logfiles.
I understand audit logging for authenticated users, but that's hardly a general case.
I want to be protected from marketing firms that sell my email adress , and everyone who uses it to send me mails for whatever product to buy judt because i entered it for some totally different reason. Those shall be fined with 5 figure amounts.
I don’t see how my(and my housemates/office colleagues etc) ip in the logfiles of the webserver which a small business rented for 3€ to upload 3 html filed can be abused (without storing my email and name without consent which is actual personal data and therefore illegal) and i dont want my hairdresser, car mechanic etc be in need to consult a lawyer to understand all that stuff and have a day worth of bureaucracy and adfing a “we have your current ip in the logs” note just because they want me to be able to google their street adresses.
The law is simply not well crafted for no use if the latter is the case.
If you are using a email list in order to fulfill a contract to your members by informing them about times and so on then that is also permitted by GDPR. If a customer buys a subscription then the company in order to fulfill their side of the contract can then naturally store information to do so.
Mailing lists also has had a long history of best practices in order to not get marked as spam by the large email services. Get consent so users don't mark it as spam and allow unsubscribing. If a small yoga studio used a email list for a significant time and not been forced to do shady behavior in order to bypass spam filters, then they are almost guarantied to be compliant with GDRP.
Similar an online business has a contract when a customer buy a product or service. In order to fulfill that contract a email address is commonly used. Perfect GDPR compliant. Hard to imagine a online business before GDRP that did not have a contract with customers.
Correct ?
As long as you do your best to implement the GDPR and interact with the regulatory agency in a friendly and helpful manner then there won't be much need for a lawyer (but do consider that the GDPR being written as it is is also the result of being written in the EU where law is written a bit differently)
Otherwise, I would love to hear which part of my comment was orwellian in nature?
The concept of the rule of law was invented primarily in countries that now belong to the EU. Is there no one left there who still thinks it's important? It's not even that people argue "the GDPR couldn't be less vague without loopholes, and this is important enough that it's worth the cost". The idea that a powerful human's best attempt to objectively apply stable, published rules is generally better than a powerful human's unrestrained discretion just seems foreign to most commenters here.
If you ran an organization publicly associated with George Soros in Hungary (whose prime minister has described him as an "enemy of the state"), then would you still feel good relying on your friendly relationship with the government? What steps would you take to comply with the GDPR as it's currently written, if you couldn't rely on the goodwill of the people interpreting it? With a sufficiently corrupt government, there's nothing you can do; but the point where a judge will accept an obvious lie tends to come long after the point where a regulator lets politics disambiguate a vague standard.
If you produce a device that accidentally violates FCC guidelines, would you rather be immediately punished to the extend of the regulation or rather work with the FCC to rectify the issue and how to fix it for affected customers?
The other reason is that yes the GDPR is vague. It must be because in the past corporations have abused loopholes and the only way to prevent people abusing loopholes without punishing people who don't abuse them is to make it vague and then decide on their behaviour.
And again, these are corporations, legal persons. They don't even have the remotely same rights as a natural person.
If I ship a device that fails to comply with FCC rules, then I would prefer that the maximum penalty provided by law is also a fair and reasonable one. I understand that most regulated fields are complex enough that if we don't give regulators some discretion, then the law will be filled with loopholes and impossibly complex; but I would like to give them the minimum discretion they need to do their job. I think the GDPR fails that test spectacularly. Do you really think they need the statutory authority to fine someone 20M EUR for their semi-commercial side project that made $1k lifetime total? If not, then why give it to them?
The GDPR applies to natural persons too. Imagine if it didn't! Facebook could just contract all the creepy stuff to a sole proprietorship operated by Mark Zuckerberg...
ETA: From https://ec.europa.eu/info/law/law-making-process/types-eu-la...
> Regulations are legal acts that apply automatically and uniformly to all EU countries as soon as they enter into force, without needing to be transposed into national law. They are binding in their entirety on all EU countries.
So not quite the same as the US, though maybe some analogy in that the regulation is still "secondary law", subordinate to the EU treaty? But I don't see how you can describe a set of rules "binding in its entirety" as anything but law.
Stage 1 is when they want to fix it and they express wishes that the industry changes their ways. Stage 2 is the cookie law and Smartphone USB charging. A very vague regulation or law is implemented as a sort of warning for the industry to better go and fix it. Stage 3 is nuclear; GDPR.
The smartphone industry is as mentioned at Stage 2. The EU expressed wishes to reduce the charger garbage, nobody did anything, so they simply put out a regulation that almost literally just says "all smartphones need one common charger". Largely this has been microUSB but vendors are switching to microUSB.
The regulations are to my knowledge and experience also employed and enforced in a similar manner; first you get a nice letter informing you that your website is in violation of X. Ignore that or get aggressive towards the regulatory body and you get a less nicely worded letter with a threat of a fine. Continue that path and you get a fine.
The ultimate goal is that everyone should be compliant but it's okay to be occasionally not as long as you are willing to be helpful and fix it immediately.
>Do you really think they need the statutory authority to fine someone 20M EUR for their semi-commercial side project that made $1k lifetime total? If not, then why give it to them?
They don't you have a legal right for a proportional punishment. Unless your little side project caused damages the fine will be appropriate such that you can pay it without going bankrupt. And if it did you'll have to pay those damages on top of course.
>The GDPR applies to natural persons too. Imagine if it didn't! Facebook could just contract all the creepy stuff to a sole proprietorship operated by Mark Zuckerberg...
It only sorta does, it only does not apply to natural persons while they don't engage in commercial activity.
And a sole proprietorship is to my knowledge a legal person, even if the only natural person involved is 1. (I would know, I am basically one, or rather, small business operator would be the more accurate translation, which also has limits on turnaround and profit)
The sole proprietorship would have less rights than the person behind it and has no option but to fully implement the GDPR in any project or product. A natural person on the other hand, publishing a hobby on the internet with no commercial or business activity (which are different things in german law and you can certainly run a commercial activity without ever touching money or forming contracts).
The GDPR indeed says the punishment should be proportional; but what does that mean to you? Are you sure it would mean the same thing to a regulator? A regulator who dislikes you? If they said that 10k email addresses and MD5-hashed passwords leaked from someone's game server was a worst-case breach, then I'd say that was ridiculous; but I don't see what in the text of the law lets me say that it's objectively false.
The USA has no concept of a separate entity for sole proprietors. It's just you, even if you're trading under a business name. If the GDPR didn't apply to that, then that would be a massive loophole, so I'm pretty sure it does. In any case, the real question is perhaps commercialness, where (a) lots of hobby projects have some small commercial element, ads or donations or a tee shirt or whatever (and to be clear, I do think privacy regulation should apply to them, just more specific regulation); and (b) I strongly suspect the GDPR applies to some noncommercial activity too--would the EU let a political group pull a Cambridge Analytica with all volunteer staff? I haven't researched that, though.
If I lived in Germany, then I'd probably have pretty good faith in my regulators. But imagine the example of that Soros-linked group in Hungary (which I'd edited my first comment to add, so you may have missed it). I don't think that's hypothetical--political organizations keep lots of data, so I suspect that somewhere, a group is making plans to comply with the GDPR, as interpreted by regulators whose government considers them "enemies of the state". What would you do in their place? Wouldn't you wish the text of the regulation gave the regulators less room to maneuver?
Well, they are seperate entities so the loophole exists for how the US handles it but in the EU there is no loophole.
>In any case, the real question is perhaps commercialness
Last I checked you don't need commercial elements like ads, donations or anything like that to be considered commercial. Running your own git server with open registrations would be considered commercial (there is additional seperation in that you don't have to pay taxes unless you are profit-interested).
>I strongly suspect the GDPR applies to some noncommercial activity too-
Monitoring of any kind that is strictly outside private interest.
The EU lets every police force in the EU, or in Interpol request data interception. That is a LOT of organizations, and of course, they got caught doing abuse just the same. But, for instance, the default practice in the US is that you get told your phone is tapped (yes, really), unless the police explains to a judge why not (nearly always), BUT in that case you still get told afterwards. This does not exist in the EU. You will never be told you got tapped.
Second, in the US, the provider looks at the order, verifies it with the proper authorities, and decides for itself on scope, reasonableness, ... etc. In the EU, nope. If an order is received the only actions that a provider can take must be technical in nature. In theory an employee that does the actual tapping of the phone can't even tell his manager he's tapping phones, and definitely he can't tell anyone which phones are to be tapped or why (nor is there any obligation on the part of the requesting force to tell him why, but it is a field on the form). In many countries, this can be done without judicial oversight, or in nearly all cases with only very, very light oversight. This, to me, is far more worrying than the situation in the US.
If a local police officer in Latvia wants to tap the phone of anyone in the EU, he just has to fill out a form and fax it to interpol.
This is even weirder given that Europe has actual experience with abuse of surveillance powers, everywhere from Germany Eastward, as well as during WWII. They KNOW what can go wrong, they just have to ask their parents or grandparents to find people who were actually exposed to this. And yet ...
Next we find out that large-scale spying on the own population is done in, at least, UK, France, Germany, the Netherlands ... and not a peep. This was barely reported in the local media, in fact. We all know that most other countries are going to be worse than these, not better. And, of course, they cooperate with the NSA as well.
Hell, the US has reporting on how much they spy on their own citizens (in fact, that's the source of most of the outrage). No such stats in the EU. Nobody, not even the police forces themselves, feels the need to have the most banal, basic level of transparency.
Clearly when it comes to spying the EU is of the opinion, them, yes, perfectly allowed. Think of the children ! I mean, clearly these guys do not believe in privacy.
So yes, it is very Orwellian when they just request that you work with them on the privacy of their citizens. Clearly the result they want is not actual privacy and protections for their citizens.
If they believe in privacy protections, they have a lot of state agencies that they need to attack for not having any decent respect for privacy, as well as the fact that what few protections do exist only exist in a vast complex tangled web that errs on the side of violating people's privacy. And that's ignoring the fact that privacy protections have been systematically eroded further and further in Europe (e.g. recently in Germany).
They actually do, the german police for example, generally destroys any video or image footage they make after 24 hours if there is no reason to believe they would help solve a crime.
I can't say anything about Latvia but in germany atleast the privacy of letter and remote communication is heavily protected and usually not granted lightly (exceptions being stuff like actual nazis)
People are definitely aware of the past and there is always a lot of outcry whenever a new law attempts to encroach on that territory, politicians have destroyed their careers with such proposals.
>And that's ignoring the fact that privacy protections have been systematically eroded further and further in Europe (e.g. recently in Germany).
Please note that the BND, the german intelligence service, recently shutdown a surveillance program after several thousands of people requested the deletion of their datasets.
>You will never be told you got tapped.
I don't understand why you should be told that the police is trying to get evidence of you doing a crime? Or someone else's crime?
Again, we have different laws and legal systems (!) in the EU up to and including not having the US constitutions. I think it would benefit the conversation if you recognize these differences instead of applying american laws and principles on the EU.
Source ? This, to me, seems unlikely in the extreme. I mean this is strict enough that even I would agree they would regularly shoot themselves in the foot with such a policy.
> Please note that the BND, the german intelligence service, recently shutdown a surveillance program after several thousands of people requested the deletion of their datasets.
I doubt it's the only one. Call me when they change the law back so they can't legally do this.
> I don't understand why you should be told that the police is trying to get evidence of you doing a crime? Or someone else's crime?
The idea, in the US, is that you get informed afterwards. How else will you sue the police if it wasn't reasonable at all ? How will abuses be discovered ?
Keep in mind that more than a few police officers have been sued for using surveillance on women they were merely interested in, in some cases then proceeding to beat up and harass other interested parties. I doubt that this behavior is in fact limited to (a few) US cops, we both know the truth is that (some) EU cops simply get away with it.
General guidance policy and numerous court cases. Not all footage is 24 hours, most is however. Some exceptions go for 48 hours. [http://timetravel.mementoweb.org/list/2010/http://www.polize...]
Video surveillance, especially when in public spaces, is frowned upon and there is a long rat tail of court cases.
The law is very strict in when, what, who and how long video surveillance is allowed, including the 24 hour limits, though in case a crime is suspected the footage can be kept for 14 days until a crime is confirmed. [https://recht.nrw.de/lmi/owa/br_bes_text?anw_nr=2&gld_nr=2&u...]
>we both know the truth is that (some) EU cops simply get away with it.
Generally, they are reprimanded or even punished when such behaviour is discovered as it is a violation of various laws, including privacy.
>How else will you sue the police if it wasn't reasonable at all ? How will abuses be discovered ?
Generally, any evidence the police brings up in a court case requires that the police has an explanation on how they got to that evidence. That may have been illegal, in which case a second case might be brought up and the involved officers will be punished.
However, unless the evidence they collected is wrong due to the surveillance (the bar is very low on the police being guilty of forcing you to commit a crime), the evidence will be used regardless (a few edgecases but generally evidence is not poisoned if gained by wrong means like in the US IIRC).
>I doubt it's the only one. Call me when they change the law back so they can't legally do this
Already is, which is in part why the BND stopped this too.
The bar is high for someone tapping the phone or otherwise doing remote communication surveillance, [GzBBPF, Section 1, 2, 4 and 7]. Unless there is a very strong suspicious that you commited treason or commited a federal crime and there is absolutely no other way to prove you did it, they can't legally tap the phone.
Basic dependencies of your argument: the police force will never abuse surveillance, then not make a court case out of it.
Second basic dependency of your argument: the court will easily rule against the very forces they depend on if they find violations.
These are reports German police officers that got caught, shall we say, being VERY untrustworthy:
https://www.itproportal.com/2011/09/12/privacy-boss-slams-ge...
https://www.thelocal.de/20161213/cannibal-cop-convicted-of-m...
http://www.scmp.com/news/world/europe/article/2142710/dozens...
http://www.spiegel.de/international/germany/hanover-police-o...
https://www.thelocal.de/20121017/45615
https://www.youtube.com/watch?v=vM1c_58e6jk
https://www.youtube.com/watch?v=juQD0OU6SD8
So I feel like I've provided plenty of evidence that the police cannot be trusted to act correctly, or even just sane. The German police, clearly, is no exception to this rule. Therefore Germany trusting them to do the right thing is just hiding abuse, not preventing it.
You also left the question unanswered: if tapping is so correctly and justly done, then why does it need to be such a big secret ? There is a case to be made that, sometimes, it needs to be kept secret DURING an investigation, but why afterwards ? In many cases, even that is not necessary, when for instance following or tracing someone who was brought in to the police station, it seems to me like there is no reason whatsoever to keep it a secret that the police reads his mail/call logs/... Why do they want this perpetual secrecy, if not to hide abuse ?
The answer is very simple: because Germany hires neonazis, cannibals, violent bullies and worse into their police force, and police officers like those are also trusted with tapping people's conversations.
I run a company based in the UK, but I myself am American and most of my business experience is in the US. Despite that, I honestly have had no issues adapting to the GDPR. Considering that the business I operate has systems specifically designed to store as much data on people as possible, I find it absurd other businesses are unable to handle user/client data responsibly.
That said, I cared about privacy BEFORE GDPR and intended to act responsibly regardless of regulation.
Now compliance is largely handled by the tool makers, and the Yoga studio can focus on their business case and any custom coded extensions to ensure they remain compliant. (For popular stuff like Apache, compliant configurations are probably already available or will be shortly, once we all figure out if we are allowed to keep logging IP addresses by default.)
I'm not sure I understand the email jab; obviously you can store data, you just must obtain consent first, and must allow the data to be deleted on request. That's an opt-in mailing list with an unsubscribe feature that actually works and properly deletes the relevant data. Why should that be difficult for a small business to do right?
You just gave a perfect example of why GDPR will hurt startups and innovation.
Or, alternatively, just don't do business where it would put you under the jurisdiction of the GDPR. That's what a lot of companies are doing, and there seems to be a lot of resentment over it.
Yeah, and that resentment makes no sense to me either. In both cases it's simply people doing what, in their estimation, makes the best use of their available resources.
We're a small agency and all of the legal worries around the GDPR have essentially put one of our revenue streams on hold until we sort out the legalities. Like the comment above, we simply do not have $300/hr available for lawyers to go over everything.
In the latter it just confounds me that the legislators set up a situation, where a small business in the UK is better off not selling a digital good (that you can make infinite copies of) to a buyer in Malta, because the bureaucracy would cost more than the sale would pay. You can't have a "single market" like that.
That's great that your company works well with GDPR. I imagine many companies will. I'm also sure that the impact on your backups could have been had without the law if you so chose.
However, an organisation that works inside the UK (EU) serving many EU paying customers (presuming here) is very different from say, Instapaper, who pulled out of the EU today because they don't make very much money from EU customers.
If we pass a regulation that says everyone who is in New York for any amount of time must pass an annual 1 hour health exam (conducted by NY state), I imagine this to be totally acceptable to New Yorkers. It correlates with good public policy: you prevent communicable diseases, and can catch health problem before it gets big. However, if this rule were to be enforced strongly, someone who might stop by once or twice a year probably is better off never coming.
Edit: duely noted. Libertarian capitalists of hacker news do not agree.
Here's a hint: my dentist is actively harming me when taking out a tooth.
if that was true you wouldn't pay them to do it. They are causing you pain in the short term, yes. That's not the same as harm.
...or maybe I shouldn't have used this site if I didn't want to be exposed. This is going to end up being less exposure for the EU to things on the internet until someone figures out how to monetize them. If they cost money without somehow contributing something they will be actively excluded.
I'm not too worried about your browser cache, but it could under the right circumstances give you some small power to harm me, yes.
I decided to remove any use of cookies from all of my sites() a week ago. For my business (writer, and sometimes consultant) that makes sense for me but I understand that most businesses need some access to customer data so they have a motivation to properly handle personal data.
() except my blog is on blogger - still trying to deal with that - I will probably go back to using Jekyll.
The thing after "Whereas" is just a preamble stating the intentions, not the actual legal text. In this case, I scrolled down no fewer than 31 pages, thinking to myself "The whereas section can't be that long" until I finally found the real start of the legal text "HAVE ADOPTED THIS REGULATION" on page 32 of 88.
There are no GDPR police looking to shut you down. Calm down.
All data I happily ignored so far to increase privacy.
Why do you need to know that? Why don't treat all users with respect?
I totally get your point. But my product already focuses on privacy. Saving any kind of metadata/communication data is more than I do now.
No. GDPR is an overreaching and idiotic law, where standard IP logs are illegal.
I’m really glad to hear that I’m not being targeted. However, I don’t much care about what the intent is, I care about what the effect is.
And what I see is a law that is vague and enforcement agents are given broad discretion. What this looks like is that each case become “facts and circumstances” case, which is an absolute nightmare from a compliance standpoint.
And the additional paperwork and personnel requirements appear to be non-trivial and will add a significant amount to the minimum necessary capital and labor needed to start a startup .
The inevitable and undisputable result is that at least some startups on the margin which could’ve made it before the law was passed will not make it after the law was passed.
Supporters would argue this is a good thing, but I would argue it is not.
If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all.
To your example, you could easily not switch to a CASCADE, but instead set delete=1 and rewrite every sensitive field with a special value. Doesn’t even require a DB migration.
If your attitude to properly handling sensitive information is “it’s too complicated and costly, so we’ll just not handle it and YOLO”, perhaps GDPR is a good reflecting moment for you.
[edit:typo, edit:clarification]
But the thing is that GDPR affects all PII not just sensitive one so your random small useless app/blog/game/forum that has some personally identifiable but harmless and unimportant data stored is now under the same restrictions like your email or FB data.
Unimportant like your email address and your one password you're reusing everywhere? Yes, they should know better but that's neither here nor there.
But on the topic in general, could someone explain to me what the real world consequences are likely to be for a small business not based in the EU, of not complying? If I've never cared where my users were as long as their payments cleared (oh, is that where they get you? the payment processor?), and I'm selling handcrafted bobbins online in Canada without letting people delete their email address, what is likely to happen if someone complains to EU authorities?
Databases such as Cassandra are made so that updating doesn't actually delete the old data until some time later so frequent updates will degrade performance and storage. Other databases that allow for immediate overwriting the data will cause fragmentation and thus performance decline and wasted storage until you compact (basically recreating the entire database) which is not something you want to do all the time, especially on SSDs.
If it takes a week to garbage collect that's fine, it just can't stick around forever.
The pessimistic case sounds like trying to remove things within hours.
It isn't an impossible problem to solve, but the GDPR is a significant time and a money burden that will especially be an issue for small startups that don't have millions in venture funding to spend on this.
Maybe a percentage will be better educated, and actually request data deletion here and there, sometimes but I don't thing anything is going to massively change in general customer behavior. The GDPR just gives the means to those who really want to control their data (which were there before, by the way, just not really enforced. Now that there's a number figure to the possible fine, now is everyone paying attention.)
1. GDPR gives you 40 days to respond. You don’t have to run VACUUM everyday.
2. The entire point of my post was acknowledging that there are costs to being GDPR compliant, and why it’s responsible to have that cost.
> "you could easily not switch to a CASCADE, but instead set delete=1 and mark every sensitive field with a special value"
Emphasize on the part after “and”
If you for instance save all the user data like user preferences under a random userId, and then delete the personal data (such as email address, name etc.) associated with the userId I would expect this to be GDPR complaint without having to do a cascading delete.
It's a law, not a technical constraint. No one gives a fuck about some foreign key relations, they care that personal data cannot be accessed, or somehow reconstructed.
"Anyone can design a lock that they themselves can't pick"
I can see two reasons why this would be a problem:
You have a really shitty un-normalized database design. Granted that you may have to denormalize specific columns for performance reasons. But why that would be the case with, for example names, phone numbers or sexual preferences, totally escapes me.
Or, you're referring to actual cascading deletes, meaning that you need to get rid of child relations, based on deletion of the parent relation. If this poses a problem then I'd argue that you're guilty of a shitty database implementation, arguably with criminally bad definition of your primary / foreign key pairs.
I really don't see a problem here, unless the database schema is implemented in a totally incompetent manner.
Edit: Clarity
But often all you need to do is overwrite the name, address, or similar bits of information, and you can then leave the rest of the data intact and set your delete flag.
It feels like all these tiny companies, one-man shops, and early-stage startups are going to be collateral damage to a regulation designed to stop facebook and google from knowing a horrific amount about everyone. In fact, it feels like a regulatory moat that will do very little to impede any big tech company while forcing me to do twice as much work for any side project I try to develop.
There's so much smugness about the GDPR being a "good reflecting moment", etc. which makes me think that people who support the GDPR believe that there's no way detractors could disagree with it in good faith or for good reasons.
> It feels like all these tiny companies, one-man shops, and early-stage startups are going to be collateral damage to a regulation designed to stop facebook and google from knowing a horrific amount about everyone. In fact, it feels like a regulatory moat that will do very little to impede any big tech company while forcing me to do twice as much work for any side project I try to develop.
If you don't store PII, you don't have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights
> There's so much smugness about the GDPR being a "good reflecting moment", etc. which makes me think that people who support the GDPR believe that there's no way detractors could disagree with it in good faith or for good reasons.
I think it's mainly a difference in viewpoint: this is my data for me. Not yours. GDPR makes it easier for me to enforce that. From my perspective I don't care about you violating my rights "in good faith", just like most people don't cares if you trespass on my property and steal something "in good faith".
The problem is not the work that the GDPR requires, the problem is the work I'll have to put into understanding the GDPR.
I think it's mainly a difference in viewpoint: this is my data for me. Not yours.
This is the part that I don't understand. If I own a shop, and you come in and buy something, you have absolutely no right to demand that I forget your face and your purchase. In the real world, it's not your data, it's my memory. If I go home and write in my diary that today hekfu bought lots of broccoli, you don't have the right to come to me in five years and demand that I remove all mention of you from my diary at my own cost.
I don't understand the concept of data ownership, because it does not align with how I understand the real world to work.
I asked this question in a comment [1] here on HN a few weeks ago. There were affirmative responses that yes, the shopkeeper should in fact be held to account for keeping notes on who came into his store.
I hate to break it to you but yes I do: by doing business within the EU market you're accepting that. In fact you're accepting that the very same way that you're accepting that you can't store all your clients' credit card/cvv numbers that are used on your store.
I freely admit that keeping a diary is not the same as keeping customer details, but that's the point here: why are they treated the same?
If you want to collect the data, then it must relevant for your business and that warrants you should treat it properly.
Upon request to erasure you should go use reasonable measure to remove it. Wiping your memory is absurd and is never considered reasonable – no need for a lawyer to rule that out.
Even just the first two, seeing and writing down, are legally distinct. Supermarket checkout staff handle hundreds of credit cards a day. How do you think the law would react to such an employee writing all of them down?
It's not discriminatory against old people, because even a completely amnesiac person armed with a notepad can permanently capture vastly more information than all but a photographic memory.
This is where there's been a divergence on thought. In the real world you have limited capabilities to collect and store the data that is currently being collected. You're physically limited in how much you can retain and retrieve. In your old timey example I assume the diary to be sitting there in the back of the shop just being a record of my name and what I bought, but that's not how a lot of data is being used or being collected online.
The equivalent would be you making the diary automatically write down a potential unlimited amount of data on me and then using it to sell advertising the moment I enter the shop.
If I went past your store and it automatically retrieved physical details about myself, what I'm wearing, my interests, hobbies, location and you then built a profile and then sold this information to advertisers there absolutely would be regulations regarding this in the real world.
A better example:
http://www.bbc.com/news/technology-23425297
Privacy limits As retailers trial such tech they are well aware there is a risk of a privacy backlash.
Clothes store Nordstrom recently cancelled a scheme which tracked customers' movements through its stores using their phones' wi-fi signals after complaints.
"Are we willing to accept our everyday movements being monitored and analysed, not to keep us safe but purely to allow advertisers to target us? I think people will start to say no, our privacy is worth more than a few advertising dollars."
--
You say shop with a diary to present the most innocent of examples but for every shop with a diary there's billions of stalkers following people everywhere they go to learn as much about them as possible in order to sell them products and influence how they think which they never agreed to.
You might call it poaching, but that only became a crime when society made it one, and that's what the GPDR is doing now with personal data
Data about users has become a valuable asset, and taking it from people now is depriving them if that value, whether or not you personally use it to make a profit.
A server 'processing' (which seems to include using it in any way, not just storing [1]) your IP address appears to fall under the GDPR[1], and said server would be in violation of the law unless its processing falls under one of the exemptions.
The main exemption appears to be getting the user's explicit consent, though there's also this super vague exemption: "for your organisation’s legitimate interests, but only after having checked that the fundamental rights and freedoms of the person whose data you’re processing aren’t seriously impacted." [2]
In general, it seems very hard to avoid the GDPR because what is considered 'personal data' is extremely broad.
Maybe I'm misunderstanding something.
---
[1] https://ec.europa.eu/info/law/law-topic/data-protection/refo...
[2] https://ec.europa.eu/info/law/law-topic/data-protection/refo...
I used "legitimate interest" as my lawful basis for logging IP addresses and website usage information. From the UK ICO's guidelines [1]:
"It is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing."
There's a three part test:
1. Identify the legitimate interest: ensure the security and stability of my systems.
2. Show that processing is necessary to achieve it: need to know when and how the site is used in order to troubleshoot problems and detect abuse
3. Balanced against individuals' interests: We pseudonymize logins so usage information is not obviously related to specific individuals. There is no sensitive data on the site that can be revealed by usage data. The retention period is short which further limits what can be revealed.
Now, people here on HN might nitpick my logic, but fortunately they're not the regulators. I'm confident that, in the very unlikely event that a regulator even notices my little businesses, that I'll be able to correct any mistakes before fines come into play.
[1] https://ico.org.uk/for-organisations/guide-to-the-general-da...
Every business owner in Romania knows two things:
- the IRS equivalent will investigate them periodically, usually every few years - they will ALWAYS find something to fine the company for
Sure, you will have to correct the something, but that doesn't mean you don't have to pay the fine anyway.
Also, incidentally, the company I was branch manager for has been once investigated by the police for credit card theft (they received a complaint). They couldn't find anything (because we didn't steal any credit cards - we just had a lot of computers because we were programmers, working for the main company in the US) but, in order not to have wasted the raid, they decided to prosecute us for copyright violations (they found a few pirated games).
So, at least in Romania, there is no such thing as "correcting mistakes before fines come into play".
As in your example, they'll use any law to beat people over the head. That should not be an argument against a privacy protection law.
It's actually a human problem. The history of political bodies granted immense discretion to fine and punish is consistent and terrible.
I doubt you'd be able to fix any issues before they get involved.
PS. it's Cambridge Analytica
1. I have been using Google analytics for their entertainment value. I assume that's verboten now.
2. I assume the IP addresses in my logs are PII. Should I shut off logging?
2. You can simply exclude IP addresses from logging.
1. yeah, probably.
2. There's a comment elsewhere in the thread to this effect, but short-term logging for the usual purposes of managing stability/security of a system almost certainly qualifies as legitimate interest. Don't keep the logs indefinitely, but I figure nginx's defaults with a week's retention period is quite reasonable.
The relevant authorities also have a track record of giving people warnings and time to fix things, so especially for something so trivial, I'd basically just make a good faith effort and not stress about it.
GDPR has no concept of PII. Personal data is anything relating to a natural person. It's not just an identifier like an address or phone number.
You don't give a damn; neither do those computer illiterate people who use the same email address and password for everything, and one leak of some shitty inconsequential website may obliterate their entire online presence.
If you are storing backups for longer than this then perhaps you have to ask yourself why.
For instance, the last company I worked for deliberately didn't keep database backups past 30 days and had that policy for some years prior to GDPR. The idea being that it would be expected by a user that when they hit "delete" on something in the web app it would actually be deleted.
(Additionally there is a whole minefield of crap that could happen if you got subpoenaed and had to due process on months or years worth of backup data, but this wasn't the primary driver of the policy)
This is a pretty good read on the matter:
https://ico.org.uk/for-organisations/guide-to-the-general-da...
Are you aware that setting “delete=1” is essentially what file systems do when deleting a file? What file system do you suggest companies to use when they want to comply with GDPR?
That is vague, for sure, but hopefully you have the engineering skills and domain knowledge to make a good call.
Dealing with credit card data? Think a lot about it.
Dealing with movie preferences? Deleting from the database should be adequate.
Dealing with attendants from a local conference? Delete the files when you don’t need them.
(And remember: nobody will ever show up with a fine one day. It will always start with a warning and a chance to improve before any fine is applied – unless there is serious neglect.)
A filesystem will remove the entry pointing to the data on disk, and mark that region as free and ready to be reused - and it will get overwritten.
Those seems like impositions on people who implement bad practice or work in fields that have morally questionable practices regarding people's data and identification. Many people I know don't engage or work in such industries because of the moral implications of doing so and what people are doing with data.
Its not about "just ask your lawyers" or "just call HR". Its about "well don't do dodgy/disrespectful stuff with customer data".
And if everyone is doing it or its regarded as "best practice" (as the old joke goes, best practice is just orwellian-speak for average), then that seems like MORE of an arguement why GDPR type activities and policies are required.
There's a lot in the GDPR that I like, but having just been through a massive compliance effort, there's a lot in there that overreaches and is just there to leech money out of the companies that make an effort to comply.
Look at the ways that the US targeted online poker sites. None of them are in the US and subject to US law. But lots of banks are, and US lawmakers made it illegal for those banks to transfer money into or out of the poker sites and that basically worked.
It’s not that I was trying to cut ethical corners or do things poorly, I just didn’t know what the right way to do things was. Computer science education is often very theoretical and high level and not at all practical .
I’ll be the first person to say that I was not the most experienced and or talented programmer in the world, but do we want to prevent such people from starting companies?
And secondly, not all PII is the same. We stored names and addresses and phone numbers and websites. Not exactly medical histories or DNA profiles.
They don't really agree that all PII is not the same. To them, storing their IP address without permission is a horrific violation of their human rights.
It strikes me personally as illogical and paranoid to the point of hysteria. However, that's just me, and at the end of the day, I think there's a cultural divide here as to what constitutes privacy, who owns what data, and what power we should trust the government with.
Yes. You should be fine as long as you're not collecting anybody's data or potentially harming them in any way, but apart from that, there should be established a bar to entry to what has become the fundamental motor of almost every single thing on the earth.
Later, outside of that legislation, when I'm collecting it, I deal with the Australian Privacy Principles [0].
It doesn't bother me that much, because I take a "well if we don't need it, we shouldn't be collecting it, and if we are collecting it, we should do so minimally and protect it anyway."
I believe under GDPR, if you need it, you can collect it. If you don't need it, why would you be/collecting or holding it?
There are certainly legal problems/ambiguities around ip and data collection, and yes, its usually legislated by people who really don't understand tech or information theory or data linking, but frankly I haven't heard very many legitimate ones brought up in relation to GDPR.
What I think someone naive and fresh out of college would do, for instance, when asked to delete data is...delete data.
And if they think that "delete my data" means go through a database and put a '1' in a delete flag against a record that is still retained, then I think they're not so naive, they picked that up somewhere from someone acting nefariously who told them it was "best practice".
And if they picked that up somewhere and it is industry "best practice", that's the kind of bullshit we should be weeding out of the tech industry.
If the user can't view/delete their data, that's a dark pattern. Which again, see above: needs to be weeded out of tech.
[0] https://www.oaic.gov.au/privacy-law/privacy-act/australian-p...
If it is impossible for some startups to respect strong privacy practices maybe we simply don't need those startups.
This 'startupism' is almost an ideology. No mechanical engineer would complain about safety regulation just because it means that they cannot start a business in their garage. In other industries, strong safety standards and regards for customer privacy is simply the norm, not an annoyance.
Fortunately for all of us, safety regulation is actually very specific in requirements.
But do let me know when GDPR actually does anything to deal with ISPs, credit unions, medical companies, and plenty of other institutions that have breaches all the time and have endured roughly $0 in penalties.
lol
http://www.wired.co.uk/article/canonical-warns-2m-users-of-p...
https://arstechnica.com/information-technology/2013/07/hack-...
If that were true we wouldn't be seeing daily threads here (like this one) that effectively amount to "I don't want to follow the law/protect the data I collect" for months now.
Complying with GDPR can involve a significant cost, but as said multiple times already, the issue isn't data privacy and security but the vast ambiguity of the law. Costs and risk explode when the rules are vague and applied "on-principle".
There are numerous comments on this page that keep saying you need "a good reason" without realizing that is absolutely useless in a legal sense and can open up a large volley of litigation against any business.
You're not opening yourself up to litigation from random 3rd parties -- they can only file complaints to regulators who will decide how to respond.
Forgive me if it doesn’t make me comfortable that the decision whether to file a lawsuit against me or not is left to some often uneducated and inexperienced regulators.
It's hardly only EU bureaucrats who have pointed this out. See Bruce Schneier from a few years ago: https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...
However, you can sort of match the two by storing personal data in a separate key-value map, using the (random) key from that map to link your data to the personal data and then just deleting the map entry when someone asks to be forgotten.
The annoying part is retrofitting data scrubbing into things like data warehouses and other systems of record, without accidentally deleting data you have a legal obligation to retain to satisfy, e.g. anti-money laundering laws or audit requirements.
By the way it is this stuff that is so maddening about GDPR. The EU steadfastly refused to be helpful by even answering frequently asked questions clearly.
You know, I'm starting to feel that at least some of this contention is based on how Americans interpret the law vs. how Europeans do it. Somehow it seems that Americans (and the UK) has this huge legal corpus but everything has to be nitpicked to the letter, or the common law judges' interpretations may vary wildly, and some people might skate on technicalities, i.e. abuse of the letter of the law.
Whereas in civil law, which the EU is, there's less leeway for interpretation, however, the spirit of the law is also taken into account.
It's really not as simple as you make it out to be and the EU has plenty of argumentative litigation.
The US holds one dominating advantage in one subset of technology. Consumer-facing internet tech. While a lot of people employed in this field commentate on this website, it's a marginal part of the tech industry, and it's not worth sacrificing privacy for, Europe does not need Silicon Valley to produce high-value products.
And if adtech is supposed to be the definition of the future, rather than genomics, complex manufacturing and the life sciences than I'm okay with us skipping that part. There are business models that don't rely on sacrificing the attention and privacy of consumers.
> it's a marginal part of the tech industry
Hilarious
You are succumbing to a lot of stereotypes here, which I might add is fuelled by a cargo cult tendency within Silicon Valley.
Then they get access to the technology through partnerships. This sounds like a win-win for the EU companies
I do agree that the EU has less of an entrepreneurial spirit. Some cultural elements, but also practical: It is difficult to scale an app, since there are such large language and culture barriers between EU member states. There is a decades long brain-drain of highly technical (AI) people. Finally, it is very hard to compete with US companies, as they skirt the rules, winning all network effects with huge VC infusions.
I always suspected some of that was accomplished with military and intelligence support: The American economy and intelligence apparatus stands to benefit a lot with the entire world using Google and Facebook. The other side of this coin is that the pro-privacy anti-surveillance movement may also be supported by foreign intelligence agencies in an attempt to hurt US economic and military interests. https://en.wikipedia.org/wiki/Lernout_%26_Hauspie#History was close to establishing an AI-type Silicon Valley in Belgium in the early 2000's, but was unsuccessful.
/s
That betrays a deep lack of knowledge of what happens in Europe. There are a ton of innovative ideas and services that originated here.
Just off the top of my head, Skype and Spotify are huge and well-known.
/s In cased you missed it.
Clicking on ads is how they fund AI research. Not all tech is equally profitable but you need all kinds. Meanwhile EU is still debating whether it's worth getting into the AI game.
Visit Germany sometime. Drive through the countryside. Most parts of the US look like a hollowed out shell by comparison.
In what way do you mean? Wind power?
Textiles? Gone
Light industrial? Gone
Regional banks? Dying
Local banks? Dead
Small retail? Dead
Dairy agriculture? Dying
Family agriculture? Dead
I grew up in a small town. 20 operating farms circa 1990. 2 today. 3 agricultural/equipment dealers, today 0. 5 small/medium manufacturers... 1 today, because of a military contract. School enrollment? -25%.
I watched the beginning of decline when I was in high school. There is no anchor businesses that sustain local economies, and no access to capital. Without government spending, either indirect or direct transfer payments, a shockingly high number of US localities would be in a state of complete implosion.
Conglomerates are all about capital, not efficiency. We are paying more, not less, by eliminating market participants.
Just like in the rest of the world, in the US too the vast majority of people are clustered in and around urban areas. In order to achieve your goal/argument you counted vast stretches of nothingness. At least since the early 20th century migration to cities has been going on, and it still does - large urbanized areas continue to suck in people from the already emptier areas of the country.
https://en.wikipedia.org/wiki/Megaregions_of_the_United_Stat...
Which is why those services are responding by blocking all EU customers.
Seems like a win win for everyone. Businesses don't have to deal with ounerous laws, and EU citizens don't get to use those services.
It's not just that. It's that there is no money in cloning unsuccessful startups. Nobody wants to copy you until you're a success, but by then it's too late. By then the first mover has the momentum and resources.
This doesn't change that. By the time a startup becomes successful it will have the resources to pay compliance costs and enter the other market.
The problem is that having to exclude EU users until you're big enough to afford compliance will cause more ventures to die on the vine, before they ever become successful enough for anyone to want to copy them.
It also puts the local EU startups at an obvious disadvantage, because they have to pay the compliance costs up front instead of only after proving themselves in the US market.
Mechanical engineering projects are too costly to be undertaken casually in the first place. Regulation is unlikely to be the long pole, so do you don't hear them complain about it. It only takes a few minutes and some easily self-teachable skills to start serving HTTP traffic; now it's going to take a few months and some lawyer hours to create the bureaucratic cover for doing so.
Yes, because of the implications, as the parent said. Just making stuff is cheap these days, that's not just true for software. You don't have to build a factory, if you want you can even outsource the actual construction entirely if you don't want to go through the trouble and remain flexible, just like "cloud computing" using startups.
> It only takes a few minutes and some easily self-teachable skills to start serving HTTP traffic;
Because people do it without caring for or knowing the consequences.
> now it's going to take a few months and some lawyer hours to create the bureaucratic cover for doing so.
I don't understand your point, it's exactly what the parent said? Yes, this forces the startups to actually care about the consequences of what they are doing.
It's getting worse, but it's generally been the case that it's impossible for an individual to bootstrap a company and be 100% compliant with every law and tax regulation. You would never have any time to actually provide a product and service customers. You just do the best you can and as you get bigger you become more complaint.
If you have to retain certain data for eg tax purposes, then that sounds like a good reason to me.
It's like people are complaining about something they haven't taken the trouble to understand. That couldn't possibly happen HERE, the bastion of rational hacker ethic, could it?
I miss the days when "hacker ethic" meant weird Unix enthusiasts and not neolibertarian grifters...
Back in the days we used to say that the Internet self-regulates. Well guess what, that's not happening anymore. Companies like FB or Google are actually breaking the web as we know it because they exploit our trust. If GDPR means that their business model will break then so be it. I have huge appreciation for Google, and none for FB, but enough is enough. And they're just the low hanging fruits. There are countless other companies out there working in unethical ways. If anyone's business model is to invade user's privacy then fuck off and die. That's not entrepreneurship, that's greed and a total disregard for human rights.
And by the way, we're not just professionals. We're also users.
You don't have to delete specific records from every one of your backups; in case of a deletion request, you have to be able to replay that if you restore the backup. Also, have some kind of policy in place for how exactly you're handling your backups and how long you're storing them.
Even a one-year-old start up could have literally thousands of database dumps in different places if they followed best practice of triple redundant daily dumps.
I'd suggest this is a reasonable safety/compliance balance.
If information is backed up (in a way that it cannot be easily accessible and queried directly from the backup,) and the backups are stored securely, and there is a mechanism/policy (it doesn't have to be a purely technical measure) to replay the deletion in case if the backup is restored, you're going to be fine.
* Have a clear data retention policy and make sure that all backups have an expiration date.
* Secure your backups with strong encryption to protect user data in the event of a leak.
* Explain it to the user when the account is deleted when the deletion will filter through your backups.
* Guarantee that if a restore is needed, their data will be immediately deleted from the restored system.
You have to do very little if you're keeping backups for less than month, simply delete from the DB and wait for backups to age out:
https://ico.org.uk/for-organisations/guide-to-the-general-da...
If you are keeping for longer than a month be prepared to justify that.
> This is made even worse if you have multi region backups and cold back ups.
You should be automating this. I assume you're automating the dumps. Automate the deletion. Deleting three encrypted files off S3 every day really isn't particularly hard. I've written stuff to do this a bunch of times.
> Even a one-year-old start up could have literally thousands of database dumps in different places if they followed best practice of triple redundant daily dumps.
If you have backups sprinkled willy-nilly about the place that you may have lost track of then it shows you have a significant lack of care about my data, and so I don't want you to have it at all.
I don't think that blocking Europe with Cloudflare is a good idea. How is blocking Europe going to fix the problem of already having European data in your databases?
The barrier to entry is so low that anyone with a credit card can setup complex IT environments quickly and collect valuable and sensitive information with no consequence to the principals.
If anything, a reduction in the rate of new startups would indicate that perhaps the market is growing MORE rational, which corroborates the recognition of risk of PII that the GDPR manifests.
Early-stage startups do not, in general, have their shit together. A straw may not break a camel's back, but a camel embryo would have a harder time with it.
I think HN has just hit peak stupidity.
The amount of paranoia, misreading, misunderstanding, etc. about the GDPR is just insane (or intentional shilling, but let's not go all tin-foil-hatty prematurely).
Nobody who's doing anything even remotely above-board is panicking or anything of the sort. If you weren't already mostly complying with the GDPR (paperwork notwithstanding) your security practices and/or business practices were sloppy and/or dishonest and/or exploitative to begin with.
EDIT/Addendum: People who are not in the know are (somewhat understandably) a little bit nervous about "interpretation" and such, but there's a reason there's a "sliding scale" of potential penalties. Regulators don't tend to go for people/companies who are actually trying to do the right thing. They go for the people/companies who are the most egregious violators. (I hope I don't have to explain the reasoning behind this, but do ask if you're confused.)
thats the main point for me. Some of GDPR is good: right to delete in a reasonable fashion is great. Right to not be personally identified is awesome, but that's much easier to do in the ISP level. Adtech creates problems - that should mean you have to regulate adtech. But GDPR is more about documentation, bureaucracy and Vista-style popups than about how to protect data. You need a lawyer just to put ads on your site. It's a draconian law designed by a single-issue Green leftist, which relegated IP addresses to the status of some kind of fatally dangerous information. It breaks the web from a "web" to a series of tubes with doors in between. The severity of the law is out of proportion with the average internet user's concern about privacy: time and again people have shown they just don't value it as much as the law suggests.
After a few days, when the cheerleading has stopped people are going to be faced with some unpleasant realities: small business switching to facebook (because otherwise their website would contain more legalese than content) and ecommerce turning more towards the large marketplaces. In this sense, Facebook, Google and ebay/amazon become one-stop shops for GDPR-compliant solutions. The reason: GDPR removes options but offers no alternatives.
IMO, it's good to actually at least try (as a company) to come with some sort of consistent set of guidelines as to how a security breach should be handled. And a company-wide policy on how company laptops should be treated (disk encryption, etc.).
It's just that nobody actually bothered to actually do these things because the potential penalties were absolutely trivial.
I know of at least one company which chose to just pay the regulator in their country a monthly fine instead of fixing the problem because it was cheaper than paying developers to fix the issue.
How is that not broken?
(I should say that I have problems in which this was "released", so to speak, since there hasn't been time for any establishment of practice based on the intent of the law, etc. It should definitely have been a gradual rollout, but that's not really relevant now that it has been "released".)
A senior executive at a large bank once told me "that's the idea!". Specifically, complex and onerous regulation makes it a lot harder for upstarts and, while costly for large established players, they can bear it.
"We couldn't afford a lawyer and the amount of time for me (the only chef) to go through and read all the regulations and make all the requisite changes in the kitchen I would estimate might take on the order of a month or two, which if timed poorly would’ve killed our restaurant. I say again: at an early stage restaurant with one chef, you cannot have that one chef spending two months on compliance."
Would you eat in a place like that?
Also: your equivalency is ridiculous. I have had a "food manager's card", which means that I am certified to oversee an entire restaurant of chefs and cooks who all presumably have their own "food handler's card". The certification took about an hour. Food handler's cards take even less time, and you'll be shocked to know that many people working in restaurants don't actually have them.
In contrast there's so much FUD surrounding this bill that you'll end up having to hire a lawyer to figure out how to clear up your EULA without accidentally leaving a loophole for the predatory lawyers on the American side that are partly the reason those EULAs are such a impenetrable wall in the first place
a vast majority of the food places in my home country were like that when I was growing up, and such places likely still make up a sizable portion of the food businesses down there now. I can't help but be a bit offended by this attitude, because it seems to not only be implying that these businesses are likely to be operating in bad faith, but that the world would legitimately be better off without them as well. It's great that you probably grew up and live in a situation where that might've been feasible, but I can't in good conscience defend those views having lived in places where such strictness is out of reach for most entrepreneurs.
The world isn't entirely comprised of Europe and North America.
I think there is a subtle difference between negligence and bad faith.
> but that the world would legitimately be better off without them as well
Well, that's precsiely what laws forbidding businesses like that say. "We'd rather not have them if they can't stick to those rules."
Are you making the argument that the west is generally over-regulating food safety and public health? If so, on what basis? Looks to me like a variant of the old "when i was young we didn't have [seatbelts|gun regulation|hard hats on construction sites] and i turned out just fine!"
Right, but the alternative in certain situations is having no businesses at all, as was the case in my home country.
>Are you making the argument that the west is generally over-regulating food safety and public health? If so, on what basis? Looks to me like a variant of the old "when i was young we didn't have [seatbelts|gun regulation|hard hats on construction sites] and i turned out just fine!"
No, and again, it's offensive that this is legitimately the first thing that comes to mind when somebody from a developing nation says that it's local population has reasons for doing things the way it does. Nowhere was I arguing that public safety is a bad thing, and don't appreciate having words put in my mouth. I was merely stating the fact that businesses down there almost unanimously don't have the resources to be hiring lawyers, or whatever other services that they would need in order to guarantee compliance with overly strict regulations like you see in the west. If such regulations were in place, and they were strictly enforced somehow, what would happen is that nearly all entrepreneurship would disappear altogether, except possibly for the wealthy (which are often the most corrupt down there), or outside investors with potentially dubious motives for dealing with the local population. It would literally price-out the very people you'd be trying to help with your regulations.
I never said that situation was better than the west, or that things were somehow better "back then" (I much prefer living in the US today), I was saying it was better than nothing, and that these entitled western sentiments can't feasibly be applied everywhere to positive effect. Has it come to the point now that small villages will be needing to apologize to westerners for liking the convenience of having some semblance of commerce in their neighborhoods, due to all the benefits that brings, like not having to worry about cooking dinner in equally poor conditions every night at home? It's not an attack on the west, it's annoyance with the west's over-the-top moralizing of the choices different people make under constrained circumstances that westerners seem to forget exist.
Do you find it offensive that people prefer to live in countries with a high standard of living if given the choice? Is that somehow disrespectful to the people who do not have that choice? Bringing emotion into this seems counterproductive.
Generally you seem to agree that regulation can be beneficial (if compliance is feasible).
I'm sure you also agree that you'd like the toys you buy for your kids in the US to comply with US safety standards, even when they're made in china, and regardless of whatever standards exist in china?
Because judging countries for not being able to meet standards its incapable of meeting is plain naive colonialist mentality. It's like criticizing a school yard basketball player for not being up to NBA standards, then getting mad when people point out that they aren't in the NBA. Like what are you expecting to accomplish by projecting your beliefs about regulations in a situation like that, and then acting as if people are attacking your way of life? Again, it must be really convenient to have been sheltered and only ever have known environments where abundant regulations are possible, but stop projecting your morals on people that live differently.
>Do you find it offensive that people prefer to live in countries with a high standard of living if given the choice?
I don't see the need for you to be asking such an obvious question, other than to intentionally try to put words in my mouth or paint some kind of strawman of my arguments. The answer should be obvious to anyone.
>Is that somehow disrespectful to the people who do not have that choice?
No, but accusing people of suffering from some kind of cognitive bias ("when i was young we didn't have [seatbelts|gun regulation|hard hats on construction sites] and i turned out just fine!") when all they're doing is explaining why a certain situation is the way it is, is definitely disrespectful. Again, re-read my original comment: nowhere was I even remotely attacking western standards, yet you chose to respond to it by criticizing someone for explaining how they lived through sub-par circumstances. Like seriously, what need was there to get all holier-than-thou about this?
>Generally you seem to agree that regulation can be beneficial (if compliance is feasible).
Only up to a point. I am generally pessimistic about how government intervention in the free market tends to turn out. I'm an entrepreneur here in the US, and enjoy some of the luxuries the US has compared to my home country, but I'd be lying if I didn't think certain regulations were hindering my ability to even start certain businesses (not because I try to do anything questionable, but because I have ADHD and literally can't stand to jump through endless hoops and file mountains of paperwork). I've already switched states once here to move to one that had more favorable business regulations than the one I originally came to.
>I'm sure you also agree that you'd like the toys you buy for your kids in the US to comply with US safety standards, even when they're made in china, and regardless of whatever standards exist in china?
What does this have to do with anything? I'm not opposed to businesses following the regulations of the countries they intend to do business in. The problem with the GDPR is that now a lot of businesses that weren't even intending to do business in the EU, now have a huge universal liability on their hands. Yeah "they've had enough time" and all that, but that still doesn't change the fact that the EU has done the equivalent of police china's toy manufacturers according to its own standards, simply because these toys may potentially get shipped to the EU at some point. It's not the same as having a requirement that toys entering the country meet a certain standard, because a public web server can be accessed by anyone at any time, even if the host was never intending to serve EU people specifically.
If GDRComplianceCost > EUVisitorProfitMargin Then BlockEUVisitors
> The real issue is that GDPR hits Silicon Valley right in the soft spot where it hurts: Callous and unrestrained collection of user data.
I've kept myself to lurking in those threads, simply because there's been so much FUD about this for the last few months. This, however, is spot on and it needs to be pointed out.
If people think GDPR is bad, then they should have a look at what it takes for a small startup that want to sell chicken eggs for breeding purposes, especially if you buy/sell across the EU borders. The requirements are quite insane compared to GDPR. :)
I just want to roll my eyes when I see comments to the effect of, "Oh, it's so simple, just read the 80+ pages! The language is clear and straightforward, we promise! Also, you should have separated duties, full CI/CD that sanitizes any possible user data from leaving its hermetically sealed tier, and delete data early and often. If you don't, you'll be fined several tens of MegaEuros." The risk-reward ratio there is just insurmountably high for a small one- or two-person team.
I'm sure there are actually good parts of GDPR, and, hell, for all I know, the whole thing is the overarching achievement of Western civilization. But, unfortunately, reading 80 pages of dry foreign legalese when I'm not a lawyer is somewhere between a waste of time and a very bad idea (e.g. I think the regs are simple, make a mistake, then have huge legal liability). I will sadly be blocking the EU from any services I work on going forward until the point where I'm successful enough that I can actually have my lawyer look over everything.
Fun fact: GDPR has not one word to say about advertising in particular. Ad targeting may still be legal in some cases! Meanwhile all networked software is illegal by default unless its operator can prove that it stays within the defined GDPR exceptions.
Have you been in Usenet in a networking group around 2000. Good luck with these fake opinions.
Just because some startup incubator is great at grabbing words from the hacker culture ("ycombinator", "hacker" "news"), does not mean they get to redefine the meaning.
They are just greedy, greedy for money and words they can appropriate.
> Meanwhile all networked software is illegal by default unless its operator can prove that it stays within the defined GDPR exceptions.
This doesn't make sense to me. Can you please instruct me how I would go about suing the curl project? Please help me understand how this networked software is "illegal by default." I actually don't understand precisely what you mean by "networked software" so perhaps my misunderstanding lies there.
Overall I find statements like this "all networked software is illegal" to be FUD hogwash. It's just the same as when environmental regulations are going to "destroy the energy industry" and labor regulations are going to "destroy the service industry" etc.. Industry (represented here by tech entrepreneurs) is doing their typical disingenuous wringing of hands they always do when consumer/worker/environmental protections are brought forth.
Let's get rid of the GDPR, the EPA and the Paris climate accords while we're at it.
Any server you curl is processing your personal data by addressing the HTTP response to your IP address. Curl itself arguably fails "privacy by design" test in that there is no Tor, etc. enabled by default, although I admit that's a stretch. The entire HTTP protocol design of obtaining documents by interacting directly with their publishers is similarly careless from a privacy perspective.
>"all networked software is illegal"
It's not always illegal. It's illegal by default, and up to you to demonstrate that it falls within one of the defined exceptions.
>"destroy the energy industry"
I'm quite happy that only serious and well-capitalized entities can surmount the regulatory hurdles to running a smoke-billowing power plant. I'm not happy that we're doing the same things to websites.
I also don't think the _solution_ to that problem is to create a new bureaucracy and complex set of rules ("you won't be targeted, trust us!") that seems to address a "problem" (if it even is so) that is a large superset of ad-driven tech. Overcharged bureaucracy goes against the hacker spirit.
By the way, a way out of this mess seems to include crypto. We know right now that most ICOs are scams, crypto has lots of technical issues, and is in general still not ready for "prime time." That being said, when it _is_ ready for prime time, it's hard to even imagine how a crypto network could even comply with any of the basic ideas of GDPR, despite the fact that privacy is not really a concern.
How would you implement a "right to be forgotten" on a blockchain ledger? It may not even matter that the EU itself would not interfere, as GDPR also apparently creates private rights of action. Any sufficiently loony EU citizen can drag foreigners to court with gigantic lawsuits.
That being the case, "the network" doesn't own these 'side ledgers.' They have owners who may well keep non-public data. Further, that the data comprising a particular digest needn't be disclosed, only that the owner of the digest vouches for the digest. For forgettable mode, said owner validates their own data, generates the digest, adds it to the blockchain, and subsequently 'forgets' the data that created the digest.
Now maybe that flies in the face of a fully public blockchain, but it allows the implementation of that which you couldn't fathom: a right to be forgotten alongside blockchain technology.
After GDPR: Everyone's required to do it, so at least you don't have to worry about your competitors.
That's what this is about: Self-regulation failed. Here's the externally imposed regulation. Be thankful it's as well-written and aligned with our interests as it is!
Sarcasm... maybe :)
They might not crash an economy but they can crash a democracy.
So really the regulation is somewhat deserved and levels the playing field with other industries that have the potential to damage society.
Personally I wish two people could start an internet company or a bank or an exchange or an investment fund without deep pockets for compliance and legal. But it’s no more. Mourn it and think about the next sector that is open for growth.
Simply and brutally put: if you are incompetent and/or malevolent in your business practices and for that reason your business faces existencial threat from a piece of regulation that codifies the ideal setting for the industry, your business better dies ASAP.
I want that just like you can't have a random person design cars, architect buildings or teach our kids, similarly a random person cannot code up a commercial/government web site where they were "learning as I went along"; and an enterprise that can't afford to consult a lawyer can not get their hands on people's private data that they'd rather not change throughout their lives. Entrepreneurs to the hell, the amount of irresponsibility some people posting here want conceded to them is mind-boggling. I really hope that the upcoming decade will bring some sanity to this wild-west of an industry where who don't know what they are fucking doing can't just go out and handle stuff that they should not be allowed to even observe with a telescope from miles and miles away.
Of course, Europe couldn't care less - they never had a real startup industry in the first place.
So what? Communism turned feudal Russia into a world superpower in less than 2 decades. Do the ends justify the means?
While I, in agreement with OC/OP, see it as a threat to the entire industry.
BTW I'm not in the US not in a country where GDPR is effective. But I CRAVE that my country implement the same measures or better. Unfortunately that's unlikely.
Finally, it's a threat to the bad part of the industry. And then there are those who exaggerate the situation while they are not really affected by the regulation. But the hysteria will diminish and hopefully most of the bad actors wil either change their business or just go out of the industry, searching for other places to exploit (which hopefully they will not find).
There is healthcare in America[1]
[0] https://en.wikipedia.org/wiki/List_of_countries_by_homeless_...
[1] Doesn't actually need a source
Homeless people in big American cities are everywhere. In the couple of large Canadian cities I lived in, they were present, but not nearly as much. I guess Canada is better at hiding the problem.
I'm mostly surprised though that the Canadian social safety nets don't prevent it from happening more. As a kid my family was.... "not doing well" (understatement), and we were able to bounce back up and avoid becoming homeless reasonably easily by using every program imaginable (it took a lot). In the US, we would have been screwed. Yet those numbers...
[0] Sydney rents are insanely steep
However if I were earning any kind of money at all, I would have paid out the nose for it, with some small help from the Government. The system here is actually very similar to what the American system would be if it functioned better. Medicare subsidises but doesn't eliminate costs for many low-income people, you pay for private insurance if you have money or else you get a big fat tax which is worse than any insurance fees. The Australian system is definitely nicer if you are absolutely dirt poor (by Western Standards) like me, but otherwise it's pretty much a correctly functioning version of what the American system aims for, ideologically and conceptually it actually doesn't differ much. I'm not sure why ours seems to work so much better.
> The U.S. Department of Housing and Urban Development released its annual Point in Time count Wednesday, a report that showed nearly 554,000 homeless people across the country during local tallies conducted in January. That figure is up nearly 1 percent from 2016.
> Of that total, 193,000 people had no access to nightly shelter and instead were staying in vehicles, tents, the streets and other places considered uninhabitable. The unsheltered figure is up by more than 9 percent compared to two years ago.
While the UK was counting
> The study, by housing charity Shelter, found that 307,000, or one in every 200, people are now either sleeping rough or in temporary accommodation.
Temporary accommodation includes bed&breakfast, staying with friends, emergency shelters. There are about 5000 people sleeping rough in the UK at the moment in a population of about 60million.
And then look at the countries who have worse homelessness than the US.
Nigeria, South Africa, Russia, Indonesia, China, Haiti, Venezuela, India, Zimbabwe, Honduras, Ukraine.
The important consequence of this is that it puts EU startups on more equal footing than in the past. Most EU countries already had fairly solid privacy regulations, some more, some less, but certainly more than the US (generalization, but that's the trend). If you were a company from a different jurisdiction, you could mostly skirt those regulations (up to a point) because they weren't enforced in most cases. Not so much if the regulation is from your home country.
With GDPR, actual EU startups now play by the same rules as non-EU companies who do business in the EU. If a US startup wants to be international, they'll have to compete with EU startups on a more level playing field now.
I can easily say that if I had to choose between a US service and an EU one, from now on the answer is almost always the EU one.
What gives EU the right to legislate in those jurisdictions? What non-privacy laws will EU enact in non-EU countries?
> If a US startup wants to be international
Well I have no intention of being international now, but I still have to play by EU's rules on the possibility that I might ever want to do business there.
And that is the reason companies like Oracle and other will still make big $$ - why? Because you cannot "break things and sell ads" and do "delete=1" when you are developing RDMBS.
And then there's this: "In 1990, Oracle laid off 10% (about 400 people) of its work force because of accounting errors.[53] This crisis came about because of Oracle's "up-front" marketing strategy, in which sales people urged potential customers to buy the largest possible amount of software all at once. The sales people then booked the value of future license sales in the current quarter, thereby increasing their bonuses.[54] This became a problem when the future sales subsequently failed to materialize. Oracle eventually had to restate its earnings twice, and also settled (out of court) class-action lawsuits arising from its having overstated its earnings. Ellison stated in 1992 that Oracle had made "an incredible business mistake."[53]"
So Oracle isn't a particularly good example of a well run business with good internal processes (I also wouldn't put them in a list of ethically run companies either)
If you're a garage-startup, you're unlikely to be slapped with fines under GDPR. Let's be honest- if you're a garage startup you're lucky to be noticed by anyone, much less European regulators. The argument expressed here is sleight of hand: complaining about the supposed impact on "the little guy" when the regulations themselves are designed to target Facebook & Google (among others) specifically.
The regulations are not that complex, they just require a new standard of respect for users, one that we should have always had as an industry. The fact that we had to wait for regulators to force this on us is our shame, no one else's.
You might be noticed by your competitor, who reports you to the regulator.
> The argument expressed here is sleight of hand: complaining about the supposed impact on "the little guy" when the regulations themselves are designed to target Facebook & Google (among others) specifically.
No, that is not how they are designed. They might have been motivated by the behavior of Facebook and Google (or not, who knows actually) but they have been designed to target the big and little guys equally. Many GDPR proponents here in comments espouse that as a good thing.
They'll contact you and let you know there's a problem, and you need to fix it - that's it.
If you continually flout the regulations after being warned then sanctions will be escalated.
Half the world is running around saying "I'm going to be fined 20 million euros!" and it's just fear-mongering.
I don't have a problem with that.
If the law has a side-effect of people who suck at understanding and organizing and managing data responsibly not starting companies and making money off of data, I'm also okay with that.
Maybe the days of two guys starting a company in a garage learning how to handle other people's information before they start a company dependent on it is just beginning.
I'm also okay with that.
You don't have a right to be incompetent. You don't have a right to be clueless when it comes to databases and information. You especially don't have a right to take advantage of other people who don't understand exactly what it means when they agree to a ToS page.
The reason there are so many comments to the effect that this is a non-issue is that it's just not hard to comply unless the business you're running is doing something shady. There is nothing technically difficult about complying with GDPR. If it's hard for you and everyone in your company, I don't know what to say. Hire someone who doesn't suck at this.
This is only difficult from a business point of view. Not a technical one.
If at some point I create something that is large enough to matter, I can worry about it then and will have the resources to do so. Until then I'll continue working on software as if it does not exist. It's hard enough to build a profitable product that is valuable to people, don't need to think about any laws handicapping my creativity and design decisions.
The "best practice" you mention was already illegal if you have European users, the right to be forgotten was already a consequence of existing laws and directives (just ask Google).
As for startups the GDPR already takes company size into account, so unless their business is literally being a private NSA/Stasi/etc. they don't have much burocracy to deal with (https://ec.europa.eu/info/law/law-topic/data-protection/refo...)
It’s true that compliance can sometimes be scary and requirements are not always clear. Big company ending fines probably keep some people awake at night.
The point is regulators don’t generally want to end your company, they want to see (proof of) reasonable efforts towards full compliance.
Compliance does take time and effort and can be technically challenging. It can be a constant overhead on regular technical / development efforts. But it also isn’t rocket science. It would help people to not overreact (also, there has been lots of time to prepare for it).
It's not if you're actually thinking about what you should be doing with user data from an ethical perspective. Our company has had zero problems complying with GDPR.
>My biggest fear is that all of these complex bureaucratic laws
Allow me to be extremely blunt here. If you think these laws are complex and if you have to resort to meaningless U.S. connotations of bureaucracy, you shouldn't be handling user data.
Nothing has to be automatic as far as the deletion requests go. It's fine for you to go through the db manually and grant a specific request within 30 days.
If you're big enough to get enough requests to not be able to handle the load, you can afford a couple of days of dev work.
It's mind boggling the amount of people who's interpretation of GDPR is overzealous (to the max) based on third party interpretations. Get to the source of it and you might find it's not that bad.
You're only in trouble if your business model actually relies on doing things to the data your users would not want you to do (which could be argued is for the better good).
If you can't handle cascading deletes, continue to set delete=1 and overwrite the other columns with random data / empty strings / whatever.
Less risky than implementing cascading deletes, but still effectively gets rid of PII.
Can you point to the bit of GDPR that says I can have all my data permanently deleted?
The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling.
You want it to sound like the second phrase is the observation that proves the first, but in my eyes the two sentences are contradicting.
You can very well be technical and/or entrepreneur and think it's "no big deal to comply with this huge law".
Because, in fact, one of the defining characteristics of being an entrepreneur is taking risk, including the risk to not comply 100% with all BS laws. And one of the defining characteristics of hackers and programmers is thinking they can solve a problem (and often underestimating how long it would take).
So your GDPR-related observation would in fact prove the opposite of what you're stating: that there are plenty of entrepreneurs and technical people on HN.
Now, if you wanted to say: "there are no conservative, risk adverse entrepreneurs, and by-the -book corporate software engineers in HN anymore", then yes, that would be something that your GDPR related observation would support.
P.S Note that I'm not making an argument either way. There might be many or few entrepreneurs and technical people on HN. I'm just saying that if the latter is the case, it's not at all supported by your observation re: GDPR.
I'm sitting through tons of GDPR meetings & there are quite a few conclusions amounting to "maybe we shouldn't have stored the data that way".
1) Don't collect more information than is necessary to provide service. Why do you need to care about someone's physical address? "Shipping physical product" is a good answer. Why do you need to maintain historical usage data? "Providing user the ability to view their own usage history" seem acceptable. If any of your answers involve "Just in case", "because marketing said so", or "I don't know", then your plan smells. If you think you need to make money selling my data, think again: maybe you should be charging me enough to cover your costs and make a profit; or if you already are doing that and you still want to sell my data, the you should just stop being greedy.
2) Allow the user to fix incorrect data. I mean, you wrote it to a database at one point in time, you can issue UPDATEs to allow the user to edit information.
3) Remove data when it's no longer needed (e.g. when it's out of date, or when a user says "I'm outta here") If you can't be arsed to figure out how to properly delete data from your database, or hire someone who knows how, then I suggest you're not really dedicated to the business of creating software of value to customers.
4) Provide all of a user's data to that user. It's right there in your systems, and your software is accessing it to make decisions, provide service, etc. How hard can it be to put it all into some CSV files to download? You don't have to copy the users rows from your MySQL tables into a SQLite database that the user can download. Some files with basic explanation of content will suffice.
Yep, it raises the bar on what's "bare minimum" to get your company going. But keep in mind this is more 'line of business' than all the other requirements foisted on you by the law: things like corporate structure, taxes, occupancy permits, etc.
VC firms pair your technical ability with another founder who, presumably, has more of a business bent. That person should understand how to set your business up and how it's regulated - and if not, know where to find answers.
You sound to me like all the GOP whiners about how "regulations hurt business" who fail to see that lack of regulations hurts consumers.
A quick read of some of the provisions of GPDR immediately brought to mind this passage from Atlas Shrugged:
> “Did you really think we want those laws observed?" said Dr. Ferris. "We want them to be broken. You'd better get it straight that it's not a bunch of boy scouts you're up against... We're after power and we mean it... There's no way to rule innocent men. The only power any government has is the power to crack down on criminals. Well, when there aren't enough criminals one makes them. One declares so many things to be a crime that it becomes impossible for men to live without breaking laws. Who wants a nation of law-abiding citizens? What's there in that for anyone? But just pass the kind of laws that can neither be observed nor enforced or objectively interpreted – and you create a nation of law-breakers – and then you cash in on guilt. Now that's the system, Mr. Reardon, that's the game, and once you understand it, you'll be much easier to deal with.”
Make extra personal data stuff opt-in, rest should be the same as usual.
Let's take that feature because it's mentioned often, but it doesn't exist.
Read Article 17* carefully yourself. It doesn't say "permanent". It never even says the word "delete". Elementary, My Dear Watson.
* https://gdpr-info.eu/art-17-gdpr/
> at an early stage startup with one programmer, you cannot have that one programmer spending two months on compliance.
And then here's the other straw man.
An early stage startup in the US with one programmer has more to worry about from US regulation than European regulation. Nonetheless, if you want to trade with Europe then reading the ICO guidance on the GDPR for your business should take a couple of hours.
> My biggest fear is that all of these complex bureaucratic laws are just raising the bar for doing a startup.
There are so many things I care about more than whether you can create a startup with wilful disregard for people's rights.
Did you even notice that Equifax* lost control of personal data on pretty much every single American? Your name, date of birth, your SSN. Equifax did this because they are actually incentivised to make their systems as insecure as they can get away with.
The only thing you're right about is that real security has real costs, but you're not convincing me that they're not needed.
* https://www.sec.gov/Archives/edgar/data/33185/00011931251815...
Next, something like the deletion right has to submit to other laws that mandate data retention, like having to keep sales and bookings records for 10 years due to tax laws. If you do a cascading deletion in your data set, you're probably breaking these, so flagging records as deleted, or moving them to an archive to comply with these other laws still is perfectly find.
So this is just another regulation a startup has to think about. It's way easier than, i.e., tax laws, so please. Just stop panicking -.-
You do not have to do cascade delete. Just invalidate the data that identifies the user (this includes also transaction dates).
Well, maybe it is possible to cross reference a person based on the transaction volume?
The worst thing is those who can afford the $300k lawyers to get away with doing whatever to my privacy.
Startups that specialize in easing the pain of compliance do help. I recently had to implement tax collection in an app and a third-party API saved me a lot of work. However, it was still a drain on resources and took over a month to implement and test.
I don't know a lot about GDPR, but the requirement to permanently delete all your information is absurd, especially if you need that information for a legal context. What if a customer sues you years later and you've deleted all their information? I don't get it.
The number of people who are saying it’s no big deal to ignore privacy rights that should be law, especially for sensitive information, is mind boggling.
We can't get to full compliance, and in the timeframe with the workload we're working with, we didn't send out a message to all of our users asking them to reconfirm that we can email them.
That's just a hassle I don't think is worthwhile at this stage. So, we're risking it. Are we going to get a $4m fine for this. No, did we every implement the cookie law, which because we are an embed would create a brutal UI and result in some of our customers having multiple "accept cookie" messages on a single page? No, we said screw it, it's a stupid law.
If we listened to every stupid law on the books, nobody would have any fun.
BUT, in my opinion, we work within the objective of the law. The law is about protecting users private data. That is a good thing. Due to GPDR, we are taking extra steps to protect user data, and making it easier for users to delete their data. We have had to create Data Processing Agreements for our customers.
Take a look at the law, see what you can implement, understand why the EU has implemented the law as they have, and get as close to legal as you can.
Every start-up is making trade-offs, just because this is a big-bad LAW, does that mean it should get all the attention and that your customers should suffer while you implement.
Weigh the odds and get to work. If this kills a start-up, I suspect it is the start-up gave up or needed to act shady.
This is definitely doable for a one-man start-up with no lawyer.
Just like Terms of Use, take a look at what others are doing, and then copy what works for you and your busy.
The GDPR doesn’t fine small companies that aren’t making a lot of money. The fines also don’t apply fully to startups until they are a certain age, depending on country.
The GDOR doesn’t require you to delete user data that you need. That would be insane, you could obtain a loan and ask to have the record of it deleted if it did. The GDPR does require you to inform people that you keep their data, and it requires you to tell your national how you plan to keep the data safe.
You’re not required to have GDPR legal representation in one man - small companies or startups.
The GDPR is only really a problem if your business model evolves around selling privacy data. I won’t lose any sleep over it being harder to make a new Facebook and I’m looking forward to see what new business models spring up.
I work in the Danish public sector by the way. I have around 500 systems that need to comply, some of these systems run on mainframes and have bits of software that are older than me. I’m not worried, especially not when we haven’t seen a single case in the courts. Until that happens the GDPR is really just a piece of paper because nobody knows exactly how it’ll be interpreted by the legal system.
> it’s getting to the point where I don’t think there are
> many entrepreneurs and/or technical people on here
> anymore.
Not sure, I tried my luck with co-founding 2 companies but I work now as an employee. I notice that the number of Stars on popular Github projects is rising every year, leading me to the conclusion there is an ever growing number of technical people. More over I realize it becomes easier every year to deal with more complexity.
That said, it becomes more feasible to handle more business logic - or compliance logic if you will.
I know that especially Lean Startup proponents say one should start with low tech solutions. Also I attended an accelerator program and was surprised that most startups there were not tackling exactly super complex things. In fact one Startup worked with some kind of modified Wordpress or so - which has GDPR logic already included.
So yeah, things become more technical and complex but I think it's for the good. Also when handling other people's data I guess there should be some responsibility. For the 2 companies I co-founded data-export would have been trivial to implement as the Web Apps were AJAX powered, I would have had just to provide a link to the user. In case of Startup #1 users were anyway only there to train for some test, so it would have been no problem to delete the user records. Probably delete cascade would have been fine as I worked with backups. Deleting data from backups would have been fine as well, they take up only precious space and use up bandwidth. Startup #2 was more about producing content that was not from users.
Also I want to note that in times where TDD is something even known to barely technical people, delete cascade is safe and a no-brainer.
Anyhow, the most challenging thing looking back would be all those 3rd party tools. To name some: Google Analytics, Mixpanel, managed DB/Redis/etc. I was never a fan of any of those tools and in times of Docker, we can run our software on whichever computers seem most suitable.
> My biggest fear is that all of these complex
> bureaucratic laws are just raising the bar for doing a
> startup. Maybe the days of two people doing a startup
> in someone’s garage should be in the past? If so, that
> makes me kind of sad.
GDPR isn't really complex, it's more like a collection of vague rules and recommendations. Basically most of them are like keep only the data you need, offer export and deletion following best practices.
Getting a banking permit requires an awful lot of money and you have to go though a lot of bureaucracy to get it, do you also have a problem with that?
What if a startup leaked your private data, like Equifax did? would you still feel the same way about this?
If the industry would have been able to self regulate, big bad government wouldn't have dropped the hammer on them.
Sorry but this comment has been driving me crazy. The GBDR about 100 pages? Obamacare is 20,000.
This law may be a lot of things. It may have a huge impact. It may require companies to do things hugely differently. It may require a huge amount of work for some. It could do a huge amount of good or bad.
But, it is NOT a huge law.
Don't take it seriously.
To a lot of US-ians the GDPR is just some EU bureaucrat stopping them from making more $. Nothing matters apart from being able to do whatever you want and make $.
It’s just a different mindset.
The example from a previous HN article was the Chicago Tribune blocking EU access.
Are you saying that there's a "huge immediate opportunity" for people in Europe to read local Chicago news?
Not every business is global. In fact, 99%+ aren't.
That’s the startup I’m presently working on. We’ll expand beyond the US borders (and implement GDPR) when we advance to a larger revenue stream. But right now, GDPR compliance is a distraction that interferes with gaining enough traction to help us afford the engineering and legal resources to ensure such compliance.
NOTE: we delete all client data when they cancel already. And we don’t do any creepy marketing.
Meanwhile they'll be using VPNs to access your site anyway :)
This does sound like you'll have an easy time complying with GDPR! :)
So what's there to worry about? Sounds like you're well on your way to being compliant
If anything, this allows you to be transparent with your users too.
Do you inform your users what data you're collecting, why you're collecting it, and get their consent? Are you taking proper precautions with the expanded PII data (encrypting at rest for example)? You've basically covered the requirements.
> Yet needs to be sure they don’t end up giving the company to the EU because someone over there signs up on a marketing list.
What kind of FUD are people reading...if someone voluntarily gives you their email to sign up for a list that's fine. You just need to keep that they consented to receive what they agreed to. What you can't do is use that email for crap they didn't sign up to receive. Obviously normal unbsub rules apply, which in this case says forget that someone ever signed up.
In my limited view, this is pretty much the case. When I was telling our management team about the GDPR and how it relates to our new European-focused project, the first thing the CEO said was "how do we get around this?"
Management decided we're not gonna comply with the GDPR and just hope nobody notices.
Which in the longer term turned out to be right. I'd love to see Winterkorn behind bars for that one.
Although they don't say it that way, that seems to be what most GDPR advocates are implicitly advising. They keep saying not to panic and shut down your web site or block europeans because and the EU is not going to sue you as a first step, etc etc.
As a dev though, I also understand the frustration. Creating startups is already time-intensive and stressful. A lot of us are on shoestring budgets. Most startups will fail. To a solo developer in the US, the idea of spending time understanding and complying with GDPR is daunting, it's more than just a hindrance to many. Still, I don't want to break European law, so maybe it's easier to block EU users at first and change policies later if profitable.
I think blocking is at least showing you respect the law, compared to just doing nothing and being non compliant.
"Most startups will fail": I do not see that happening. You will first receive a warning. The EU won't really care if you are a tiny startup. Unless you are running a shady business, there's not much to worry about.
I think assuming the EU won't care about tiny startups is irrelevant - I want to follow the letter of the law, it's why I'd opt to block EU users instead of just ignoring the existence of the law.
Hence, the blocking of the EU - its better to block at the beginning and then expand to the EU once we have revenue to support someone handling this as an employee.
You know this is not what would happen, right, that you'd be given advice and the opportunity to towards an amicable resolution?
I know nothing about European legal systems though
And as a member of a EU country that for the last year has been constantly bending (when not breaking) the rules to repress and attack legitimate political reivindications, the relativism in the application of GDPR is something that I find very worrying.
Uber versus Night School is an example of this. Uber: Ignore taxi regulations, get tons of VC, get rich while being awful people. Night School: try to work with government and play by the rules, fail, get used as a cautionary tale.
Source: https://psmag.com/economics/night-school-failed-because-it-f...
I think something akin to GDPR is necessary and good, but GDPR as written probably isn't it. I look forward to seeing how it works out in practice, and how it develops/is replaced, and in the meantime feel bad for the developers and customers that suffer through the unintended consequences and misfeatures of it.
After the law gets clarified some, I think you're right that it won't be bad for small players. But I wouldn't want to be one of the test cases.
Calling the data protection agencies "government" may be correct in some very legalistic sense, but is utterly wrong under any colloquial meaning of the word.
You don't know this.
How many $300kEUR fines (the maximum in Germany until yesterday) served by a German DPA (we have 17: one federal, one per state) have you heard about in the last 5 years?
From April 2015 to March 2017 there were 124 proceedings, with 47 leading to fines.
The aggregate sum of all those 47 fines was... 174.226 Euros.
[1] http://www.dw.com/en/germany-fines-man-208000-for-stealing-c... [2] https://www.thelocal.de/20170405/germany-to-fine-social-medi...
The second one is a law very much like GDPR (notice the little words "up to"?). Not a single fine has been given based on that, not even a small one.
GDPR is the PCI of the privacy world, 99% of companies will be non compliant if audited, but 99% of companies wont be audited. The difference is unlike PCI anyone can launch claims against companies, including for malicious reasons like taking out a competitor, and political reasons like a eurocrat taking a disliking to a particular company.
Most large banks and insurance companies are listed.
We had two major expenses: liability insurance for meetings and SOX insurance for the officers. Everything else was in the noise.
I've been involved in GDPR efforts at work and all the policies seem fairly straight forward to me. If you're not doing shady shit and you're upfront with your users what you are collecting the data for, how long you keep it and what access policies you have set up.
Not a problem if you ask me.
Enforcement guidelines are ill-defined, and the definition relies on vague terms. For example, is retaining an IP critical to running your business? What if you're getting DDos'd? Now it is up to someone else to make that distinction, and you're dependent on them "being reasonable."
You can even self-report if you're not sure you handled the privacy well, and they will point you the stuff you have to work on (and give you month to do that).
I Understand Americans are afraid of fine and lawsuits, but please don't be afraid. Read GDPR statement from regulatory instances, they are here to help business too.
I think GDPR is short-sighted from a game theory perspective and will short-change European citizens.
When I sold software online, Europe was < 5% of my sales. Why take on business-ending liability risk for that amount of sales? Sure, maybe I'd do these things anyway, but once you open that pandora's box, you're relying on favorable interpretation and the goodwill of regulators.
Having seen what happened in the US with civil asset forfeiture, well-meaning laws can have their purpose bent, and goodwill can be perverted. Why take on that exposure?
Why would you hand of the data of your customers to someone that won't/can't prove to you that they will be in compliance with the current legal requirements?
Honestly that is the entire point of the GDPR, don't misuse customer data and don't hand it over to 3rd. parties unless the customer allows you to.
Good. Outsourcing violations, ethical or legal, shouldn't get you off the hook for them.
Besides which, what are you doing handing off stuff that's important to your business without knowing what's being done with it? Not a recipe for success. And if it's not important, then...
Are you just making this stuff up, or has this actually happened?
You didn't (as hundreds of others), so now the EU forces you to. So now you have an opportunity to become a better company: https://medium.com/tsengineering/the-gdpr-blog-post-9a571b13...
You're working in the real world, with real consequences if you end up exposing people's personal data. The party is ending. Either deal with it, or find something else to do.
They are dealing with it... by limiting their liability.
As far as I can tell, the "user" doesn't have a whole lot of choice there and Facebook isn't the only company doing that kind of aggregated data collection.
I see them as a very poor example of good things coming out of Silicon Valley...
But Silicon Valley isn't a monolith where everybody is on the same page about everything, I have no doubt there's plenty of people in SC who consider FB a success-model to be followed into a shining future.
If “fighting over coconuts” is not on their list of things they wish to do, it’s not a completely absurd choice.
These are things I can put off until later, I don't need them to validate my startup concept. If the startup is successful, it might make sense to expand the market.
Plus, blatently ignoring regulation is cheaper in the short term, and if you successfully leverage that advantage into revenue than you can start throwing money at the problem once the regulators finally do get around to prosecuting you.
Worked for Uber.
I do agree with your overall point though.
The thing about GDPR that I disagree with is how it aims to have global jurisdiction. If it was a US law (as a US-based developer), perhaps I'd protest it, but I'd still follow it if I wanted to work in software.
So if you "sell" to EU residents, follow EU's rules.
Surely this will just result in the development of the reseller model?
As long as the reseller doesn't collect data, they're protected and as long as the US company doesn't maintain a presence or ideally market to the EU, they're untouchable due to the lack of any EU-US enforcement agreement for the GDPR.
The Poland proposal [1] to limit GDPR compliance to only large businesses was trying to address that. But it's flawed, because a small company (Cambridge Analytics) could still make a lot of damage to users' privacy... but the intent of Poland was good.
I feel there should be an opt-out based on the numbers of users and the age of the company/service: If you can easily prove that you're not handling more than X users and your company is less than 2 years old, then GDPR does not apply yet, as long as you warn clearly on your website that you're not-yet-falling-under-GDPR. If you're still in the GDPR-waiver zone but believe to be GDPR compliant, then you can remove the warning and are subject to GDPR like every other company.
That way entrepreneurs won't be scared to try some MVP here and there. I'm especially thinking of those trying to start a startup in countries that are part of the E.U.. The rest of the world entrepreneurs can just focus on their local userbase.
[1] https://iapp.org/news/a/polands-proposed-gdpr-exemptions-spa...
"We are a startup on a shoestring budget, we can't put safety belts in our cars!!!"
The cost of being in the car business is to build safe cars. The cost of being in the webservice business is to protect userdata.
If you can't, you are not good enough to be allowed on the market.
If you disagree, should the US also stop prosecuting VW for the diesel cheating?
Great point about VW btw, I forgot about that !
The safest car is one that can't drive, and the most privacy-friendly software will fail to compile. You should be able to build a functional car before you need to worry about making it as safe as possible, and similarly you should be able to build a functional MVP of your software before you need to worry about compliance with a huge international policy.
Before you are permitted to use your DIY car you need to comply with safety regulations to avoid harming others. You can keep your unsafe car off the street in your garage, though. Same for software that is not compliant; you just don't get to call it a "product" and let it loose on the public.
you can drive your unsafe car on the track, and your negligent mvp on your customers own hardware as in-house software.
A one person entrepreneur might not consider him/herself to be "being in the webservice business". Instead he/she would consider being in the business of [whatever problem the MVP is trying to solve]. It just hapens that in the 21st century, most of innovation happens online.
Back to your car analogy, it seems that people on one side argue that all companies "being in the webservice business" are 'car makers'. some people on the other side of the argument might say it's not.
Also, ultimately, it's possible that after spending a lot of time and hours examining the legal requirements of GDPR, a startup realizes it's not technically hard to comply, but the issue here isn't implementing the requirements, it's more about getting all the legal analysis, certification, handling customers requests, etc.
> If you disagree, should the US also stop prosecuting VW for the diesel cheating?
In that case, VW has clearly been in the car business for much more than 2 years, and in my example "X users", a good value for X would be something order of magnitudes less than the number of VW customers around the globe. So no, the US would continue prosecuting VW.
It's that the equivalent of starting a new car company and arguing that you shouldn't be required to follow the same safety standard as Volkswagen Group, because you're still a small company?
At it's core the GDPR is simply stating that you're accountable for the data you collect and that you're only allowed to use the data for the purpose is originally collect. Building privacy into your product is much easier for someone designing something from scratch, compared to retrofitting it into the business plans of Facebook and Google.
I get the feeling that most of the people arguing against the GDPR are people who are focused solely in collecting user data as a core business. The people I know who are building actual product, where people pay for a service, are doing fine. Even though that they have to build products in a manner I suggested five years ago, where user data is either not collected or delete when processing is completed.
If your business is based around exploiting user data however it might be a lot harder, but then that's the point of GDPR, to prevent people exploiting user data.
GDPR exists because it turns out we can't trust companies to handle personal data with the care it deserves, and I don't see why any company should be excused that proper care.
I have a profitable, bootstrapped SaaS business based in US. It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. It's a trivial application that stores mostly already public data. Only email is required to login so that I can send password reset and other such communication.
I've been talking to a very well known giant corporation (also based in US, but has many global offices) for months. The VP and director love my product and want to start using it right away for their department. But their legal team is scared shitless with 4% fines in GDPR. They are putting some draconian clauses, (various ISO certifications and such) in the contract that I, as a small company, cannot comply. That's their interpretation of GDPR. It doesn't matter whether it's right or wrong.
The VP and Director are really nice people and I've developed very good rapport with them. But I'm afraid their patience will run out soon and they'll go back to using spreadsheets. A lose-lose situation.
This is the side-effect of GDPR.
I'm all up for GDPR. I have uBlock, have blackholed all Facebook domains, etc. But don't assume that GDPR doesn't affect normal business transactions. Of course, blocking European users doesn't do anything for me since I want to do everything I can to protect user privacy.
But anyone who says, "Oh, how hard could it be?" has no idea what they are talking about.
And this law’s effects are all about the unintended consequences. Anyone thinking government regulators are reasonable and benevolent has never dealt with said regulators beyond any trivial level. To make it more fun each member country handles enforcement, so now you have a risk of 28 different interpretations of the law. It’s madness. Even if you do everything right there is still a compliance risk. It’s like HIPAA in the US — HIPAA is pretty “easy” to comply with, but the consequences are so severe that it necessarily drives up operational costs significantly. Unless Europe is a significant part of your revenue, better to block Europe and decrease your risk to near zero rather than have a potential risk of catastrophic, company-ending fines. Because the fine isn’t against profit, it’s against total, worldwide revenue. So unless your European profit exceeds 5% of your worldwide revenue, no sane person would take that risk. Even without the enforcement risk, you still have to deal with potentially hundreds or thousands of information requests — even if you are doing everything by the book.
This is possibly the strangest comment I've seen about this whole ordeal.
I understand it's frustrating on your side, because you have no control over the response of your customers. But understanding what GDPR is (and not falling for FUD) is why the VPs and Directors get paid the big bucks and get the fancy titles. If they can't or won't work with legal to become compliant, they should resign and let someone else do the job properly.
I'm not saying, "oh it's easy" -- it's not easy. But that doesn't make the law wrong either. And it's not OK to blame GDPR as being "bad", when those rules are mostly just putting some real enforcement around stuff all moral and ethical organizations should have already been doing anyway.
Your points don't "make the law right". In whose view? Right or wrong for whom? In his example he listed all the ways he is handling user data in a respectful way. And yet, he is still harmed by this law.
That the VP and President may be doing their jobs wrong (in your view) is no recourse for OP, he is harmed all the same.
And ... are they doing their jobs wrong? At the end of the day, they are limiting their risk. What threshold of risk of harm to their business and livelihoods would you feel is an acceptable tradeoff to comply?
There are many real world effects of GDPR and we are just starting to see the pros/cons of it.
Please tell me I've read something wrong. Otherwise, this is just panic induced stupidity. I expect they will grow out of it (though maybe not before you go bankrupt, which obviously sucks big time).
The GDPR regulates both Data Controllers, and Data Processors
Suppose I'm excited to hear about Hats.example, a site that sells hats. I visit, but they don't have any hats for my ostrich. Damn. But, they do have a box where I can leave my email address "to be contacted about future products". Great, maybe they'll introduce Ostrich hats. I fill out the box.
Hats.example uses famous email deliverability company WeSpamPeople.example to ensure their marketing emails have "industry best in class reach". I soon get an email every week featuring different styles of hat, but they're all for people, disappointing.
But then, WeSpamPeople's VC runs thin, and they cut a deal with OutrightFraudAndScams.example, which tricks people into making dubious "investments" and wants a lot of "leads". Now as well as the hats newsletters I asked for but don't really care about, I'm getting stuff inviting me to invest in Venezuelan Bitcoin mining and a project to make "Green cyber-organic goats for the blockchain". Ouch.
Hats.example are a Data Controller. The GDPR says they are responsible for looking after the data that I gave to them, even if "technically" that form I filled out is a Javascript frame injected by WeSpamPeople.example, it's part of the Hats.example business, so it's their responsibility to ensure my email is not abused by a processor like WeSpamPeople.example, for example through contractual terms requiring WeSpamPeople.example to delete my email, never to send it elsewhere, etcetera.
WeSpamPeople.example are a Data Processor because they were given my email address and other details to send me "marketing" information. They have a duty under the GDPR to get reasonable assurance that this was OK with me, for example maybe Hats.example did some paperwork that promised they're legitimate and they got sign-off for these email addresses. Regardless of whether they were given terms requiring them to do so by the Data Controller, the GDPR says they have to take care not to abuse the data, for example they can't sell it to anybody, since they obviously don't have permission to do that.
OutrightFraudAndScams.example are also a Data Processor, and maybe also a Data Controller they know they didn't have permission to touch this data, but presumably they also routinely violate all sorts of other anti-fraud or anti-scam laws. Maybe the GDPR will help add to the fines and charges and put them out of business.
[Edited: minor typos / fixes]
Just so it's clear, you're positing that when WeSpamPeople breaks every existing contract they have, that those on the other side of said contracts are now liable?
Of course it could happen, but I don't see the EU fining those on the other side of the contract as long as they moved to another DP and alerted their users when the breach of contract was discovered. Both actions should happen regardless of GDPR.
TBH, email is a bad example anyway because good providers are already pretty quick to boot bad actors so they don’t end up on blacklists.
Yes.
It's not unreasonable, because GDPR has components that require vendor assurance (more or less). So the megacorp with a point-of-presence in the EU has to be cautious about what strictly-US SaaS services it uses if there's any potential for data crossing into the SaaS.
This is almost certainly exactly what GDPR is intended to do. It aims, in part, to make sure companies can't shirk their responsibilities by handing everything over to vendors who will ignore GDPR.
An actual compliance audit from an accredited auditor, paid for by the SaaS offering of course, is not going to be cheap or easy.
And the GDPR is the side-effect of people running hog-wild with PII etc. I feel for you but I see your situation as collateral damage of the privacy crisis.
Blocking Europeans sounds a lot more reasonable than having to hire a lawyer and spend double the time and effort just to be compliant while writing a new JavaScript MVC Todo List app.
The people (by and large government is run by the people, for the people, at least in some countries) have had enough. I've had enough, and this is us telling companies they've had their chance and not made the grade so we're dictating now. As a person, and father (who has to worry for the rest of my live about my offspring's health and happiness, and linked to that, privacy) I'm very happy with this law. I support it, as seemingly a lot of people do. That's not authoritarian, it's the will of the people.
And no, I'm not some sort of communist beard stroker, I'm pretty central in my political beliefs and I also don't appreciate governments sticking their noses in where it's not welcome, but this, this is welcome.
Why would you think that SV would be interested in offering anything for its own sake? The vast majority of the model is to create new rent-seeking profit opportunities for investors, with internet users as a mere means to that end.
Yet. Give it some time.
> I would be very wary of a company who claims this legislation is onerous. It is potentially life threatening to companies who do very shady things without your consent. That much is true. That is the entire point.
I somewhat suspect those companies hiding behind the 'oh lets just block Europe' excuse just don't want to admit the extent of what they are doing with the data.
US citizens should take note of this, because it's their data too.
[1] https://medium.com/tsengineering/the-gdpr-blog-post-9a571b13...
EU citizens should not be pissed off that second-order effects exist in the world. If they are, they need to take ECN 101/102 again and pay closer attention.
If the cops showed up at your door asking to search your home, business, and Internet accounts without a warrant, would you let them? Why not? What are you hiding?
Thing is? We changed almost nothing about the way we processed data. Data subjects are no better off because we've spent tens of thousands of dollars complying. Whether people comply or not, the fact of the matter is that this regulation is onerous. It's onerous even if you love the intent of it, and it's onerous even if you think it's worth it.
Much like China, which has managed to develop a huge internet industry because it doesn't have to compete with the American competitors, the EU's huge market will provide a lot of space for EU startups if the American competitors refuse to do business in Europe. But unlike China, the GDPR will make those European companies more competitive on the world scene rather than less.
If the choice was between 2 services, one of which complied with GDPR and one which didn't, and explicitly excluded GDPR protected users, I'd assume the vast majority of regular consumers, but definitely businesses, would pick the GDPR compliant one.
It will also do just about nothing in regards to the major companies that everyone had such a big privacy issue with in the first place, so not only is the regulation vague but it's also ultimately very ineffective.
They tried hard rules, rather than principles with the cookie laws and the companies around the world turned a good idea into a shit-show of popups while continuing to behave like nothing happened.
Honestly the more I read and the more I see how different business react I start to view the GDPR as EU finally showing that will not accept businesses viewing it as a second rate legislator.
The GDPR and reactions to Trumps policies an EU that is finally starting to behave like it's representing the best interest of 500 million people.
I mean, if companies cared about privacy in the first place, there probably wouldn't be the need for such a regulation. At the very least, GDPR will get the general population be conscious about what the hell is going on under most websites.
We've also lost customers (including a contract that would have been our second-biggest) because our competitor is either lying or doesn't know anything about the GDPR, and has convinced customers they're compliant. Their story sounds easier than ours; "We're in the EU, so we're compliant" as opposed to "Hey, you need to sign this DPA with us to be compliant."
And no, many companies already did care about privacy. Companies are not faceless villains -- they're made up of people like you, assuming you have a job, and even aside from not wanting the bad publicity of breach or misuse most people want to use data correctly.
I think a lot of that is down to decisions taken by US-based management that is simply clueless about how law works outside the US. And probably also only got their information from US-based lawyers that were either as clueless as themselves, or had incentives to make everything look very complicated.
On the other hand, most of the companies around me that have no links with the US were not particularily worried, and either consider that they are already compliant, conducted minimal work to be acting in good faith, or at worst are waiting for the regulatory body (CNIL here) to tell them what they are doing wrong, if that is the case.
However, I don't know any company that does shady things with their users' data, and things might be very different for those.
Right now there are billions of people around the world clicking "yes" on all the privacy and consent popups while grumbling about the annoying notices and just wanting to get back to what they were doing. Meanwhile there are also plenty of people creating havoc by filing lawsuits against every company they can, adding up to billions demanded on just the first day.
No, the EU is not the US, no lawsuits have been filed. Some individuals have reported some companies to their local data protection agencies, just like the GDPR says you should. No money has been "added up to billions", because the DPAs don't sue for damages, the levy fines to ensure compliance.
Huge difference. If you're going to critique the GDPR, please understand how the legal and regulatory systems of Europe work first.
This law has been in application since 1978 [1]. And in 2018, we have adtech companies like Criteo. [2] I have one of my best friend who started his adtech startup in France. Everything is good.
There's is a lot of implicit contracts (you filled up our sign up form? Well, then you chose to give us your data. ...) The only things you have to do: know which data you collect and give the ability to people to update/delete their data. That's all.
I don't understand the fear. I don't understand what is "vague" about it. It's so simple and low barrier that Microsoft decided to make it the rule for all of their users. But thanks to the hysteria, they made a PR stunt out of it.
--
[1] https://en.wikipedia.org/w/index.php?title=Data_ownership&ol...
The difference is that France is insignificant in the adtech market. The real money is in the US and spread out across Europe, with Asia soon to overtake. The existing rules you point to weren't affecting global operations where Criteo and others made their money.
It's strange that you think the business models are going to fly in Asia. China and many Asian countries are laying out privacy regimes that are even more strict than the GDPR. Take a look at China [1] or Thailand [2]. Pretty soon it will be the case only in America that adtech companies can collect and sell endless personal information without consequence.
[2] https://www.bangkokpost.com/business/news/1455534/new-data-l...
Ok, spend all your time going after the ad company and ignore the government which is 1000x worse and will control your life or toss you in a cell. Good luck with that.
The laws are not stricter (they arent even laws yet), and they are meaningless in those areas because the government itself already defies them.
That doesn't make laws meaningless.
But China grants legal exemptions without especially good or consistent oversight over those countries. The net result is an awful lot of folks who get a legal exemption for a specific aspect of their business and then tend to run roughshod in other less scrutinized areas.
How is this different from any other western government?
Now if you're taking about security contractors, that's different and the same the whole world over I guess.
Second... I don't see how valuation matters. Did they loose money? Went out of business? No. VW lost valuation during the whole diesel gate scandal. Did that make VW a less relevant? No.
And the last thing that I wanted to mention: I said "this is just an implementation of an old French law into the European Level". And I was mentioning the French law itself, not the European Law.
The cookie issue that you're mentioning is related to the ePrivacy directive, which is solely European Law, that was passed one or two years before the whole lost of valuation. My point was just that the GDPR doesn't affect anybody.
Do you know that they are a publicly traded company? Losing money is exactly what happens when the stock price falls. When you lose more than half of your value, going out of business is a serious risk.
It only affects the ability to make more money by issuing new shares.
But the "bank account" of the company doesn't get divided by two. Customers don't start paying only half the price for their service.
Given the EU assertion of global jurisdiction, the GDPR seems like a bit of a trade war and it's surprising more commentators aren't treating it as such.
The US should be inspired by this and give online retailers the opportunity to collect and remit sales taxes.
Sincerely hoping that this marks the end of the data gold rush
I'm sorry the analogy is totally flawed. On one hand you have something consumable: food, on the other side that can be made eternal: data.
When making an application that collect data, you just have to make a form/button to give the ability to update/delete data. It's no more different that when you make an adult website, you have to make a page "Are you above 18?"
Sometimes, it sounds to me that people on HN don't have a problem with the law X or Y. They rather have a problem with the concept of regulation in general. (See the comments on all the posts about Germany requiring Uber drivers to have a car insurance with a higher liability.)
But if you want to give an analogy to normal business, a more suitable one would be: "Giving people the option to delete their data is a bit like allowing customers to get their money back on their gift card they purchased 2 years ago"
How is that unfair?
You're not understanding the analogy. What does a user get out of using Google's services? They get access to a suite of products (search, email, cloud storage, online productivity apps, videos, and so on) that are maintained by a rather expensive group of employees and run on a rather expensive collection of hardware. When you use those services you pay for them by letting Google collect information about your use of those services. The value you get from those services is often intangible (you watched a cat video or looked through a photo gallery of your sister's new kid), though sometimes monetary (you don't have to pay an ISP for an email address if you use gmail.) When you choose to no longer use the services and demand that Google delete all the data they have gathered are you going to return that intangible value and pay them for the money you saved by using their systems? How would you do return the experience of watching a stupid cat video? It's exactly like eating a meal but insisting the restaurant give up the value, i.e. the money, that they got from you.
But still, the analogy is flawed then. If I give the restaurant money, the way the use they money afterwards doesn't affect me. They cannot take more money from my bank account or from my pocket. The only thing they can do is invest it and make more money, but it does not affect me.
When I give my data, the way they use my data – after I've "eaten there" – can affect my life. They can send me spam, they can put me into database of "people with suspicious behavior", ...
The law is more about giving a second chance: I could have given information in the past, and you could have sent me commercial emails in the past. But now I've realized I've made a mistake and I don't want you do that anymore.
If you want an analogy to real life: it's more about giving 5 years of jail to a burglar. They committed a mistake, so they have to pay for it, but they should have the right to get out after having paid, and live a normal honest life.
How is that unfair?
Google generates money not by collecting data but by showing targeted ads (they need personal information to do good job at targeting).
They actually do provide option to opt out, remove information about you but they make a quite a hassle to opt out and block features that could otherwise work, to encourage you to opt back in. For example you don't agree for Google to your location history? Fine, you don't have location history in Google Maps even for places you searched 5 seconds ago.
Anyway, to turn things around, yes they provide you services for free, and you're paying for using them by have targeted ads, if you decide to not use those services anymore you can't get an offline version of their tools that doesn't phone home, so why should they be allowed to keep your data in perpetuity?
The fair result of a person choosing to stop using a company's service is that they get to stop paying for that service, i.e. Google doesn't get to collect data about your current and future activities.
People truly underestimate how much information about them is actually worth.
There are also extra procedures you have to follow that could be really complicated depending on the business. This is even worse for small businesses. I can definitely understand those people who want to just wash their hands of it, especially if they don't get much business from Europe.
As I said other comments, I'm not sure if people on HN have a problem with the GDPR, or just with the concept of regulation itself.
Also, when I read about "complicated rules for small businesses". It reminds me about American republican politicians explaining how taxes on the rich will affect the average joe's taxes.
The reality is that many rules only apply to big businesses. And small businesses are exempt of many rules. My favorite one is the "Data Protection Officer", everybody on the internet™ says that you need one. The reality? Most small business won't. The article 37 explains that the Data Protection Officer is when a business is "collecting data on a large scale" [1] Second of all, people interpret that as "Hiring somebody", you don't. It's just a role, take your CEO, and now he's your "Data Protection Officer", ...
--
Perhaps in early stage of a startup a founder will take the title to save cost, but he/she will want to lose that responsibility as soon as possible.
Congratulations, you're uncompliant. Thanks for playing "GDPR is easy".
> (5) The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39.
Expert knowledge just mean that he/she read the entire directive. The same way that most employer in europe have read their country's labor law.
The reason why they say that is because the "Data Protection Officer" is the person liable for GPDR violation. The same way the CEO is liable for many wrong doing a company could do. They require no certification, no degree for a person to be a "Data Protection Officer."
Just having read the GDPR doesn't count for "expert knowledge", it's just knowledge. "Expert" is something more. How much more? Funny you should ask, welcome to GDPR limbo.
Also, it doesn't say expert knowledge merely of GDPR, it says expert knowledge of "data protection law", vague and unbounded, certainly not limited to the GDPR. GDPR is probably the most restrictive you have to comply with, but the text literally requires you to have to have expert knowledge of the others, too. Finally, there's the little "and practices". It's not enough to read it, you have to be an expert in how data protection law is used in practice.
Before you have processed even a single byte of data, you're literally uncompliant simply by being blasé about how you name your DPO. It seems unlikely that anyone will get busted simply for this, but low likelihood of enforcement is not the same as compliance, and why would they include this paragraph if they didn't feel it was important? People who actually care about being compliant need to think about this.
The irony here is that American users are so used to being endlessly surveiled without consequence that they are genuinely shocked that the rest of the world refuses to put up with this bullshit. This is completely normal to them.
The GDPR is just another step in a global fight by people all over the world to regain their data sovereignty and protect themselves from endless surveillance. The momentum at the international level is very clearly for data sovereignty. Russia and many Asian countries are following closely behind. And while everybody was freaking out about the GDPR nobody seemed to notice that China passed even stricter online privacy laws [1] earlier this month. Singapore [3] and Malaysia [4] are up to speed and even Thailand [2] will likely soon require minimum standards. (Edited to add more links.)
The end result is like so many other things: American companies will end up blocking everybody but American users who they know they can exploit without consequence. American users will celebrate their exploitation as freedom from Big Government. Everybody else will move on and just shake their heads.
[1] https://www.csis.org/analysis/new-china-data-privacy-standar...
[2] https://www.bangkokpost.com/business/news/1455534/new-data-l...
[3] https://www.pdpc.gov.sg/Legislation-and-Guidelines/Personal-...
Also it's hilarious to claim China has better privacy when that government tracks everyone using facial regulation with real-time threat scoring and national social rankings called a "citizen score". A late payment on a single bill gets your face and contact info on a giant billboard so go ahead and try complaining about your data over there and see how far that goes.
Get this: not everybody is consumed by paranoid fantasies concerning their government. And while your shallow understanding of China based off a few western-oriented articles here and there may validate your own biases do understand they have no real relation to reality. In reality, there are no extraordinary consequences for missing a single bill. On the other hand if you're sued in court over a debt the judge -- not unlike American judges (!) -- can use public humiliation to try to modify your behavior.
And sure, China has nothing to worry about other than this: https://en.wikipedia.org/wiki/Social_Credit_System
>>> People have already faced various punishments for violating social protocols. The system has been used to already block nine million people with "low scores" from purchasing domestic flights. While still in the preliminary stages the system has been used to ban people and their children from certain schools, prevent low scorers from renting hotels, using credit cards, and black list individuals from being able to procure employment. The system has also been used to rate individuals for their internet habits (too much online gaming reduces ones score for example), personal shopping habits, and a variety of other personal and wholly innocuous acts that have no impact on the wider community.
Also tell these people it was just a big joke: http://www.scmp.com/news/china/society/article/2144690/chine...
>>> Authorities vowed to collect the personal information of debtors and publish it in public places such as newspapers, train stations and other high-visibility platforms. The Supreme People’s Court reported in January that by the end of 2017 it had publicly listed the names of nearly 10 million people. They had been blacklisted from various activities, with 9.36 million of them prohibited from buying plane tickets and 3.67 million from buying high-speed rail tickets.
I see this "not clear" repeated here. Can you cite a section that you find not clear, so we understand what you mean?
So n = 8000 makes a sand pile.
If folks find ambiguity in the GDPR, do NOT get into American Fintech. Here's a great question: what are the technical requirements mandated by the US government to become a bank?
It is a blocker that slows down your efforts to work on the next feature. It is not hacker friendly. It is a huge pain in the ass.
Edit: btw, I don’t really blame the EU. Google and Facebook got us into this mess.
AIUI that's one of the main changes, that explicit consent is now needed to retain data and specific details of how it will be secured, who it might be passed to, must be given. Also that if the service being offered doesn't need the data, that the company offering the service can't insist on having it.
It is a big thing for micro-businesses and SMEs in the UK - despite having data protection laws already - it does change the complexion of how one handles PII and the embedded assumptions. We're talking about businesses many of whom have paper bookings diaries - the diary apparently needs to now be secured, whilst it's always sat on the counter before; that's a costly structural/workflow change (unlock the diary for every phone call!).
What is poorly written about it?
> there must be clear paths to implementation and verification.
There are.
>Perhaps that should've been fixed instead of wondering why so many companies don't really want to deal with it.
There's nothing to fix, and I'm going to assume you can't even name 3 things since your post is just an extremely vague talking point.
There are examples of regulation that does work, but GDPR is not really in that category.
I haven't seen many grey areas or difficult corner cases in the discussions here, so far.
Only people claiming that everything is unclear, because they don't want to accept the truth: that they clearly fall under the GDPR.
...Ok, because you say so? Are you a lawyer? Do you realize that this whole discussion exists precisely because it's unclear?
There are already billions in lawsuits against facebook, google and others so companies are rightfully being careful. And even if you fall under GDPR, there is plenty of vagueness about the data and processes itself. This is not as simple as you make it out to be.
I realize that this statement is untrue.
Some people are dredging up all kinds of "but what if" and "I really, truly don't understand how my collecting data could be considered GDPR-triggering".
I find that dishonest. Protest as much as you want.
Oh, and surprisingly, just by some bizarre happenstance, you are "Currently working on Instinctive, a B2B marketing technology company."
I can tell you immediately that whatever you're doing falls under the GDPR.
Cool, except we weren't confused about that. Figuring out what data exactly and when, along with the proper processes, documentation, and interaction with all of our clients took lots of lawyer time though.
They will learn. It's a financial certainty.
On a separate note: I feel totally disgusted with the kind of people who are totally uninterested with the the fate of their users. It's not exactly uncommon in Silicon Valley. Fuck these guys.
I don't know about you, but I have learned a great deal!
I've mostly learned that Eurocrats can't actually write useful regulation. Blah blah blah human rights blah blah reasonable measures. Next chapter. Blah blah envisage blah blah reasonable measures. Blah blah blah inter-government communications protocols blah blah codes of conduct.
What's a reasonable measure? How do I know if I'm compliant? How do I know if a vendor is compliant?
GDPR is a wonderful, incredible, essential document for laying out human rights for the digital world. It's also terrible and incomprehensible regulation.
I mostly agree that the lack of concrete measures makes it horrible from a compliance view, but I'm not sure you can have both things, especially in a relatively immature area of law.
I would have been happier if they'd done something around setting up an administrative body that authors and updated regs.
Did they ask for explicit permission to use your data? Do they provide the service if you only provide the data they actually need, rather than asking for a swathe of PII so they can sell it on? Do they provide info on how your data is stored, and who has access to it? Do they provide a way for you to view and/or delete all the PII they have on you?
Do they take reasonable measures to detect and inform me of a breach? Do they take reasonable measures to ensure it's me requesting data being deleted? Can they provide the same data about all Data Processors they make use of?
It's possible that the answers to this might not be easily and readily answered in every single potential case one might encounter when dealing with specialist vendors.
You're completely right to spell out those questions. It's just possible that there may be more to GDPR compliance - and certainty - than that in some cases.
I would say this is also applicable in reference to the unintended consequences of regulations
just blocking them doesn't seem like that bad of an idea, especially with the fines involved.
I think the things that bother me is:
1) A College student working on a side project with no revenue are treated the same as some massive multi-national.
2) It's a foreign requirement that feels like a violation of sovereignty. Most business/startup owners complain about there being too much domestic regulations, now we have to worry about things outside of our own countries -- that also can come into conflict with our domestic tax authorities on things like data retention. An international agreement would be entirely different.
3) The GDPR requires clear and concise language, but have done nothing of the sort when writing the regulations. For most websites outside of the EU, could they not have produced a concise 1-2 page infographic produced by the regulators themselves?
And why not? The result/harm is the same.
It doesn't matter a bit whether a company's web site is handing its visitors' data over to Facebook or a "private site" does.
The side project or the private site always have the option of not participating in the adtech frenzy.
But of course they want to participate (free money!), even if they find out much later that almost no money is coming their way.
These rules don't stop anything about ads, they just make them less targeted. Not a big deal, but it will increase the costs of serving users and thus decrease the total amount of commercial projects started.
Less targeted ads are exactly what we need. That's what the regulation aims for!
Your argument is like claiming that unfortunately, due to car dafety regulations, we cannot enjoy as many fatal accidents as we once did.
And to make my point of view clear: not all businesses deserve to exist. We as society decide which business models and behaviours are okay. "Decrease the total amount of commercial businesses started" cannot ever be a persuasive argument.
Nobody reasonable is arguing that it's a bad idea to let customers control their data. The actual issue is that the rules are vague and thus create a lot of confusion and waste that affects all companies, while not providing any real protection against the massive conglomerates that abuse data in the first place.
The #1 complaint about advertising is that in 2018, it has evolved into a shadowy, insecure brokerage of surveillance data that it obtains using all kinds of under-handed tactics. If the GDPR curbs this in the slightest, it will be a net positive for people of Europe.
They are playing games, and don't respect the requirements that the GDPR puts on "consent": focussed, freely given (non-punitive), fully informed.
Or maybe it's because the rules are confusing and messy and you have a different interpretation?
This a fallacy, not an argument. [1]
> Or maybe it's because the rules are confusing and messy and you have a different interpretation?
Please point out which rules are confusing and/or messy. Virtualy every single blog post about GDPR points out how it’s well written compared to other juridictions on the same subject. The language is clear and the website provides a Q/A section as well as concrete example for every point.
> Please point out which rules are confusing and/or messy.
The comment thread you just replied to -- the one where you seem to saying that random HN commenter is more accurate than Facebook's entire legal team on regulation that is supposed to be unequivocal -- is a start.
No, it does not.
Maybe your playacting is simply because you‘re „Currently working on Instinctive, a B2B marketing technology company.“?
You do not know my history, and sadly you didn't even bother to do some basic research or you would recognize that I'm one of the few in our industry that has called for regulation and data protections for years. [1] Instinctive has been on the forefront of this as well with our most recent push for net neutrality. [2]
And surprisingly you seem to miss that B2B marketing is rather unaffected by GDPR since everything we do has always been contextually targeted, consent-based, and 1st-party relationships anyway. If you want to have a discussion, base it on the ideas and not the person.
1. https://twitter.com/search?f=tweets&q=manigandham%20regulati...
2. https://www.newamerica.org/oti/press-releases/companies-urge...
--
As for Facebook breaking laws, I find that incredibly hard to believe given their resources, recent legal , 1st-party data and consumer connections in their walled garden, and the fact that consent is already given by billions of users who just want to use FB products and don't care about the rest. They have nothing to gain from skirting regulations that only serve to strength their relationship.
I have nothing against targeted ads. I am against targeting ads and collecting/distributing my data without my explicit consent. E.g. mobile companies selling my real time location because there's some obscure sentence in their 90 page terms of service.
I wish regulation like GDPR would also be implemented in US, but really unlikely.
I mostly like GDPR. Ability to opt-in and being of charge of your data, i.e. removing it from a service if you want to, and the right to export and move it to another service are great and long due.
What I don't like is that it's a principle based regulation and thus it can be applied arbitrarily and selectively.
The side effects would include:
1) Reduced number of services available to EU customers.
2) EU users will be trained to click "Agree" without reading, because web sites would ask them for permission very frequently, and users do not have time to read web site policies anyway.
That’s not a bad thing. If services that don’t want to protect their users’ privacy can’t operate, that’s a good thing.
> 2) EU users will be trained to click "Agree" without reading, because web sites would ask them for permission very frequently, and users do not have time to read web site policies anyway.
How does this have anything to do with GDPR?
Some value it until they hit XXXXXXXXX amount of extra cost. Some only value it until they hit XXXX amount of extra cost.
Most probably only value it as much as they're forced to.
From what I've read, opt-in is only supposed to be used when there's an actual voluntary choice, and "allow us to share your data with 3rd party trackers or we block you" doesn't count as a real choice.
It should be treated in the same way as opting into marketing emails. Totally optional. Not opting in shouldn't totally break a site.
Why not?
The greater the power imbalance, the less free the choice. Social networks are a great example of this. You can choose not to use a particular one, but what's the alternative if everyone is already on that platform? You can go without, but what if it's LinkedIn, and there can be a real impact on your career?
But you do have a choice. Don't use the site if you don't consent to its rules. Pretty straightforward choice.
It is, if you don't think the rest of what I wrote is worth any consideration.
Nobody is suggesting companies provide free services. We're saying that personal data is more than commodity, and we should be looking to more ethical business models. And we won't be sad to lose companies that can't adapt.
edit: And I don't think my point was silly, but I'm also not really libertarian. So I don't think it's acceptable for companies to abuse their dominant position to make things worse for society at large.
because everyone knows that it is better to not make no money at all, than just a slightly less than normal because your ads are not targeted.
> 2) EU users will be trained to click "Agree" without reading, because web sites would ask them for permission very frequently, and users do not have time to read web site policies anyway.
Sure, and it is their absolute right to do so, but other people finally have some control over their data, I especially like the fact that finally user can also remove/change the data about them.
Which is exactly what GDPR is designed to stop. You're welcome - the rest of the world.
is it though? According to https://en.wikipedia.org/wiki/Ease_of_doing_business_index#R...
USA is 3 positions behind Denmark which is in EU, and just one ahead of UK.
Sure, if you cater to users in your own country. If you cater (read: deal with data) to users from the EU, you should follow local consumer protection laws.
EU laws have always been more strict than US privacy laws: This caused unfair competition, where US companies were free to export their privacy-damaging business model overseas, while local companies were forced to respect privacy. Respecting privacy is just not very competitive/profitable at the moment.
Your viewpoint pushed to the extreme (sorry if you don't recognize your original view): China selling counterfeit goods or unsafe toys to the US, and feeling like any push-back is messing with their sovereignty of lax copyright -, trademark -, and health laws.
The old web was mostly static websites. We spoke of visitors. The new web is app-ified/interactive, walled off to logged-in agreement-abiding geolocated users, and even a single logged-out "visit" broadcasts this to 100s of trackers who will remember your every move online.
> The internet doesn't know political boundaries
Tell that to this US law the whole world has to comply with to called DMCA.
I assure you I have been against the DMCA since before it passed, though I don't think it's quite the same nor do two wrongs make a right.
I would suggest that you remove google analytics then. It only causes harm.
If a site has no US presence and blocks all users in the US, what negative repercussion can violating the DMCA incur? Maybe their domain can be siezed, but that can be avoided by not having a domain hosted in the US. The US could block all traffic to the site, but that should be moot if the site has no US users.
It's been this way for nearly 20 years.
I'm still failing to see how the original claim, that everyone has to abide by the DMCA, is true. This seems like claiming that everyone has to abide by Thailand's Lese Majeste laws (laws criminalizing insults to the monarchy). Yes people may face repercussion if they have an economic or physical presence in the country. But if they don't, then theres nothing Thailand can do to enforce this law .*
* not without cooperation with other countries at least. Some nearby countries are known to enforce Thailand's Lese Majeste laws abroad and extradite people. But in most countries, this isn't the case.
Again, if a country doesn't want to abide by the DMCA then they don't have to. Extradition treaties and the Pirate Bay do not disprove this claim.
But extraordinary retention is just the fancy word for CIA abduction. So no treaties are in place here.
As a small blog, no ISP is going to give you the time of day, so it's not PII because you have no avenue for converting it to a person. If you transmit that data (say to google analytics) it might /become/ PII because google (or any other person you transmit it to) may combine it with other data they have access to, to turn it into PII.
The reasons large organizations are fretting about IP addresses are thus:
a) They have IP/timestamp records going back years, maybe decades
b) They may have ISPs willing to talk to them about who had the IP address at a specific time
c) They can't confidently allow that data to pass to partners in case their partners have access to ISP records
d) That data is a ticking timebomb, because even if they don't have an agreement with an ISP now, if an ISP offers that service for free to all takers in the future, their trove of IP/timestamp pairs could suddenly become PII overnight through no action from them
So yeah, for businesses operating at a certain scale, IP/timestamp combos are now a toxic asset. That doesn't mean your log files for your blog are suddenly a GDPR violation, unless you share them with people or have an inside track with a local ISP.
You can read more here: https://www.whitecase.com/publications/alert/court-confirms-...
It doesn't have to.
If I have a brick and mortar business in the US and some one from the EU decides to do business, do I have to follow EU consumer protection laws? Unless I have an physical presence in the EU why should I have to follow their regulations?
Further, why cannot the EU just allow its citizens just do business with other extra-national companies if they choose to? Meaning, if an EU citizen chooses to do business with a non-GDPR compliant website, why does the EU care?
>EU laws have always been more strict than US privacy laws: This caused unfair competition, where US companies were free to export their privacy-damaging business model overseas, while local companies were forced to respect privacy. Respecting privacy is just not very competitive/profitable at the moment.
So what? If the EU wants to stifle competition, why should the US care. They are only hurting themselves.
You don't.
If they're not In The Union, and you're not In The Union, then you're not required to comply with the GDPR.
> Further, why cannot the EU just allow its citizens just do business with other extra-national companies if they choose to? Meaning, if an EU citizen chooses to do business with a non-GDPR compliant website, why does the EU care?
It's impossible to give consent for something if you don't fully understand the ramifications of what you're consenting to[1].
[1]: https://www.nytimes.com/2018/03/17/us/politics/cambridge-ana...
It must feel horrible, now that the US is on the receiving end of this for a change... ;)
Am I reading this wrong? If the college student creates just a simple page, he/she is already complaint with GDPR.
If the student starts collecting personal information, then they need to know what's allowed or not. There are already things that are not legal to do, GDPR just adds private information into that.
The treatment of privacy is one of issues where it's pretty much impossible for individual protect from, GDPR tilts the scale in favor of individuals.
For normal operation system logging is pretty much a requirement for essential operation. That includes most properties of a connection like IP, UA, date, time, URI etc.
Do you disagree with this TLDR of the regulation?
https://www.smartsurvey.co.uk/articles/gdpr-compliant-with-d...
Without a bunch of work that hasn't been done I seriously doubt that they can give Right to Access, Right to be Forgotten, Data Portability, Privacy of Design and it does clearly state it is Personal Data.
It's called software cause it can be changed easily.
I can easily see small websites just ignoring GDPR and hoping they fly under the radar. Or, using something like this Cloudflare configuration to block all EU users until they reach a size where achieving GDPR compliance is feasible and worth the effort.
No, because that website doesn’t collect personal information.
> and build a system to get user consent, etc.
You need user consent to send emails or do something with their personal information (i.e. nothing since you don’t hold that information).
Yes it does. It a least records an email address and password to create profiles. And any features like tagging memes, marking memes as favorites, etc. could be argued to constitue personal data.
> You need user consent to send emails or do something with their personal information (i.e. nothing since you don’t hold that information).
Again, I specified a meme generator site that has at least some user specific personalization.
DPO is only needed in specific cases. Dank meme sites don't fit in any of: a) public authority b) monitoring subjects on large scale c) dealing with criminal conviction data.
> build a system to get user consent
It's called a checkbox. They likely use one to agree to TOS anyway. If you don't have that one, DMCA and COPA is what you should be worried about before GDPR. (If you're based on the US anyway)
However, nowhere does it actually specify what sort of scale constitutes "large". I don't see any user count threshholds or anything like that.
Also, it's possible that someone's list of authored memes is personal data. If somebody creates a lot of political memes then this could easily be covered by article 9, since political affiliation is explicitly covered there.
Additionally just saying "have a checkbox" isn't going to cut it. GDPR forbids blanket opt in or opt out schemes. You would have to build a system to track what the user has consented to and refactor all features to abide by each user's consent configuration.
I'm not saying every these tasks are hugely onerous - just that I can see the use case for blocking EU traffic to avoid having to abide by their regulations.
Themselves
> build a system to purge user data
SELECT * from users, memes, usermemes where userid = #####
You sign up for a website and upload and share a bunch of memes.... honestly... the shit isn't really your data anymore. It is the publics. You shared it and yanking it back is kind of a dick move.
It really isn't as "simple" as a DELETE statement that some people argue it is.
As for personal info, most meme websites don't require any accounts to create them, because it only makes the site less usable, but if the site do have accounts, you do have right to see/update your account, you have right to delete your account and be sure that if your account is deleted the data is actually gone.
Very generous assumption on your part. Article 9 specifically says that anything revealing personal info like ethnicity, political affiliation, etc. is covered by GDPR. If I look at a Adam's list of authored memes and there's a bunch of pro-Democrat memes and I look at Bob's and it's all pro-Republican memes, then it's very easy to see a court ruling that a memes reveal political affiliation.
This is my plan. What are they going to do, extradite me over claims that my access logs includes IP addresses? Claim that I do business in the EU when I don't take payments, every side project I've made is in English, and I've never set foot there?
If not, then worrying about GDPR which is mostly not enforceable in the US sounds disingenuous.
I'm guessing they also ignore those laws, because of posts like this one. If you're running a business complying with regulations, you likely already know how to block a country. I mean, you keep track of the current embargoes and block relevant countries, right?
How about you look at what bs comes out of the US gov't? That is the worst foreign requirement and violation of sovereignty so far, and it keeps on giving.
2. Fuck your souvereignty. Seriously. USA has no problem violating secrecy of correspondency worldwide, and argues in length for years whether wiretapping its citizens is OK, because everybody agrees wiretapping others is perfectly fine. USA forces poor half of the world to follow ridiculous copyright law, including software patents and art becoming public domain after a century or more. There's no good will earned there, so don't expect a free pass cause of your feelings. Want to serve customers from other countries - have to obey the law there.
3. they probably could. Still - I'm sure there will be "GDPR as a service" soon. Maybe some libraries, frameworks and standards how to handle personal data will finally be created? This should have been done decades ago.
The law is designed to cover pessimistic case. You can get sick because of food poisoning, you can be robbed because your identity was stolen.
I don't think my comparison was dishonest.
Nobody’s saying both are treated equally under the GDPR. The law stays the same, the way it’s enforced is adapted to the case, like any juridiction. Whatever the situation, you always get a warning before being fined.
When corporations like Equifax or Cambridge Analytica have engaged in identity theft to the tune of basically half the continent of North America, you want to repeal one of the few laws fighting against it with an argument about kids in dorm rooms? It's basically the tech equivalent of "won't somebody think of the children?"
Oops, seems you’ve forgotten about the “right to be forgotten”, and several other requirements. Better prepare yourself for those >$20 million fines — how dare you negligently handle personal data, college software engineering student!
I’m all for strengthening privacy protections and punishing bad actors in this domain, but designing strong regulations that don’t have seriously bad unintended consequences, is a really really difficult task. I’m not necessarily saying it shouldn’t be done; just that I don’t envy the jobs of those trying their best to do good for the world via regulations without accidentally destroying some really good things.
It may turn out that GDPR has few unintended negative consequences, or it may turn out the harmful side effects are far more severe than anyone predicted. Only time will tell, I suppose.
Personally, I wish there were a technical solution to privacy concerns — something akin to DRM, but applied to each individual’s personal data to prevent it from being used in unauthorized ways. That’s about the only kind of DRM I think I could really get excited about :)
Those kind of fines are simply not compatible with low quality advise like “Just add an opt-in checkbox, and you’re good to go for GDPR! What’s the big deal?”.
Overall, I like GDPR a lot (though as a disclaimer, I should say I haven’t read all ~80 pages yet).
Still, I am not as confident as many here that GDPR will have no serious unintended side effects.
Imagine for example if Google, Microsoft, Facebook, etc. all get hit with huge fines despite genuine best attempts by them to be compliant, after which they decide to cut their losses and exit the EU market entirely. Stock markets could crash globally, a new recession would occur, etc.
I very much doubt anything like that would happen, of course. But until things settle post-GDPR, I don’t think anyone can say for certain how this will economically affect the EU, and the world.
If the side project uses personal user data, then there is no reason to treat them differently.
EDIT: Example: https://ec.europa.eu/justice/smedataprotect/index_en.htm
I hear you, but the argument is that the data doesn't care who caused the leak. A college side project leaking an SSN does the same amount of damage as a multinational leaking an SSN, so the law is going to want them to treat them equally seriously.
This is by the way the same problem with the various restaurant analogies. It makes some sense for the health department to inspect large restaurants. It would make no sense for them to subject neighborhood cookouts to the same degree of scrutiny.
GDPR seems to be based not on actual harm that could occur based on invasive, sketchy or otherwise bad data storage practices; instead, it seems based on a subjective idea that people have "fundamental rights" to various forms of state-mediated protection in relation to technology. Rights are unequivocal and almost entirely uncompromising.
>
> 1) A College student working on a side project with no revenue are treated the same as some massive multi-national.
That's false. The GDPR repeatedly refers to evaluating the risk with regards to various decisions. The ICO even has separate guidance for small businesses and big businesses.
> 2) It's a foreign requirement that feels like a violation of sovereignty. Most business/startup owners complain about there being too much domestic regulations, now we have to worry about things outside of our own countries -- that also can come into conflict with our domestic tax authorities on things like data retention. An international agreement would be entirely different.
This one I can appreciate, but perhaps look at it from our point of view:
You're violating our laws that protect our citizens.
Why would we possibly have any sympathy for that?
> 3) The GDPR requires clear and concise language, but have done nothing of the sort when writing the regulations. For most websites outside of the EU, could they not have produced a concise 1-2 page infographic produced by the regulators themselves?
The GDPR is easier to read than many US laws, and you don't have to read it anyway. The ICO has written extremely high-quality guidance for most businesses which will suffice. It should take no more than a few hours to determine how your business would be affected.
No one forced your citizens to come to my website.
But when you want to trade with Europe, you have to abide by our standards for human rights.
I guess they can afford it.
As for SV seeing GDPR as more of a hindrance: SV was build on the freemium model of gathering as much data as possible. Companies were funded under the assumption that their user growth would lead to valuable data stores.
GDPR and an increased privacy aware public are existential threats to these companies, as there is little chance to pivot to a non-data-use company. You have to start over.
I hope we will look back at these companies as ugly centralizing dinosaurs, as little by little, the consumers realize the power they gained back (or always had) over their usage and data, does not justify these business models to exist.
(Also, GDPR, even when seen as an opportunity, _is_ a hindrance to implement. Regulation in response to market evils is known to be heavy-handed and clumsy).
It doesn't matter it's ineffective. The block means they're complying with GDPR's requirement that they not target Europeans.
the only way for all businesses around the world to avoid abuse and subjugation to eu regulators, who they cannot influence, is to not exist at all?
This means that you should be criminally prosecuted by the US. The government sees this the same as hacking.
XD XD XD
I have a site that I did this with. I also wish the US would pass a law like this. And I beg to differ. No, I don't believe this is self-contradictory.
The issue is risk. I'm a one-man band - the site in question does make money most of the time, but not much, and it has always been much more of a hobby/labor of love than a business[1]. And when any legal change means I might end up with legal grief or potentially not be visit European relatives again, even if I generally approve of the change, I'm going to knife it because there is no planet on which the site means more to me than the risk.
My plan right now is to let the big boys who can afford it take the initial lawsuits and let them shake out what the vagaries mean, then come back in a year or so and see what my exposure would be if I let ya'll back in.
[1] Oh, and it should already be complaint, at least as I understand 'compliant'; I added notices and rejiggered a few things for selective denial and whatnot. I never have and never will sell/rent/share user data, don't integrate with any surveillance/ad networks, etc. But I have no confidence that someone won't see me as a likely target to use to make some point, and hiring a legal consultant for something this size would take it from slightly profitable to a future break-even measured in many years.
This makes it difficult, if not impossible, to find links to living individuals. A ton of people have done a ton of work to build a shared public tree, and some 50-100 years of it are getting chopped off the bottom.
The GDPR is even an issue for people running simple blogs and forums. Many public software for these don't even have the features for GDPR compliance.
It's a bit like a good forest fire. Out of the monocultural ash sprout (life sustaining) varieties.
When you're in "move fast and break things" mode, getting stuff working for SOME users is better than having a complete solution for all users that come much later. It's not even just about ignoring Europeans. A lot of these products and software solutions start "only available in California", or hell, only in SF. That's even true for some stuff from big companies like Amazon.
Then as you grow, you can start tackling more barriers and regulations from other countries. I mean, there's plenty of companies that won't ship to my address because they don't do business with the US. Or when I lived in Quebec, I could not participate to a lot of contests because it wasn't worth it for these entities to deal with Quebec's gambling laws. That's ok.
Even if you agree with the general idea of GDPR, even if you want to implement the tightest privacy rules you can't in your software, there's more to it than that. I've watched lawyers duke it out over some of the details. My employer takes GDPR very seriously and we've done everything in our power to comply, not just with the letter, but also with the spirit of the law. But we're big, we have money, and we're actively trying to grow internationally. 10+ years ago when the company was barely afloat? I'm not sure they would have been able to deal with the fine prints even if they wanted to.
There's more to GDPR than sending a silly email and adding a "Delete all the things!" button.
What used to be a full opt-in to the content and business model of a site, the EU wants to only get the content and choose whether or not they want to support a sites business model. You cannot have your cake and eat it too. If you want the sites content, then you should also agree to their business model to actually support it.
Unsurprisingly, now that you cannot tie a sites value with their business model, many companies are choosing to leave the EU as they assume most people don't want to pay for the content they consume (in addition to other things).
My biggest _fear_ regarding GDPR is that, to me at least, it seems like a one-size-fits-all regulation for a world where only organisations are allowed to run services, and where all services are centralized. Which is not the world we live in (yet).
http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...
I suggest you read the rest of it before opining.
Good thing different societies and cultures have never disagreed on what is and isn't morally just, amirite?
Why would these be unaffected? You have to comply with GDPR as soon as you start processing personal data.
https://www.reddit.com/r/sysadmin/comments/8litn7/gdpr_for_h...
Be annoyed all you want, the only people whining about the GDPR are those showing their true colors when it comes to user privacy and agency. If you're complaining that it hinders you from using user data as you please, that's precisely the point.
I'm going to ignore the part about my supposed true colors in respect to user privacy. Too tired.
You're not allowed to sell yourself to slavers, even if you want to. Slavers can't exist at all. It's understood that if they did, the slavers would exploit your "freedom" to create a world where, in reality, the circumstances leave you no alternative except to "freely choose" to be a slave.
There's another:
"The processing is NECESSARY FOR THE PERFORMANCE OF A CONTRACT to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;"
Then, it is surprising to me that Americans are against a national id card, but are not OK with a privacy protection law.
I guess we’re also ignoring private health insurance companies and how they can just kind of, you know, deny you for any reason. But it’s cool because your insurance is dependent on a benevolent private company providing you employment.
See where I’m going with this? The Ayn Rand “government is violence” nonsense needs to stop. It’s not corporations vs. government, it’s powerful institutions vs. we, the plebes.
Corporations can't.
(I'm European, though not in spirit apparently.)
How can you declare they're willing and eager, if you don't have their consent, and they're not informed about your actions?
You mean like America? That time when the USA decided to enforce their embargo against Cuba by intercepting a payment from one of the Nordics for a bunch of Cuban cigars? No, that's unlikely.
> Is the EU going to extradite owners of these businesses?
Extremely unlikely, besides that would require the cooperation of the other country. But - and this is interesting - the other countries typically expect the EU to cooperate with extraditions when the law is broken and we do. So who knows.
> Are EU courts going to issue default judgements on businesses and individuals?
Against individuals: Unlikely, but it could happen, against businesses, that's typically how things go when one party doesn't show up.
But note that for that to happen you first have to ignore the regulators for long enough to get them really pissed off, an action I would recommend against.
Would be easier if Europe had a coherent voice. You got the former Eastern Bloc countries desperately clinging to the US (because they, rightfully, fear that Putin will screw them over), you got the UK which is trying to not fall apart due to Brexit, France is... France and Merkel is trying to prevent the worst of the shitshow, even though she's miserably failing at that (and under heavy pressure from the AfD nazis and her own sister party which is openly copying the nazis).
In addition, Europe is so damn far behind the US when it comes to military power - jeez, German army is practicing tank shooters with broomsticks as munition, the NH90 marine helicopters are not allowed to fly over water and we all know what a fuckfest the A400M is. No money, no competence, but it wasn't a problem since WW2 as the USA had always covered the EU... now that Trump is, well, being Trump the EU has yet another giant problem to tackle.
As a European, I consider this a good thing.
Would like more spending to make sure soldiers don't die due to shitty equipment, but still largely fine.
I am ideologically more aligned to pacifism, the problem is that it does not work in a world of wannabe highschool bullies (USA, China, Russia, Iran, Saudi-Arabia, Qatar) vying for regional dominance.
Europe is so damn powerless and underfunded that we cannot even ensure that basic human rights are respected in conflict areas. On a bully stage, the tiny kid will always be the one that's bullied. No matter how economically powerful the EU is.
They have a pretty easy to defend position.
To be honest I used to think you were just a shameless self-promoter like almost everyone else, but in this case you've risen to the occasion. Bravo. I think you're now rating quite high in most people's "mental books of good people". Or at the very least, in the minds of people who actually have a strong impact.
I'd love to see the dataset you have access to backing up any of that statement. It must be fascinating.
That would make you a sub-processor.
Yes, like America. This may shock you, but America isn't always right.
That was exactly your parent's point?
Disappointing to see so many EU apologists defaulting to whataboutism.
Ahh yes, one of my favorite logical fallacies: https://en.wikipedia.org/wiki/Tu_quoque
If Jamaica passed a law fining any company that hired homosexuals, we'd consider it bullshit even if they tried to abstract it a level up by only passing it as a local law, and then passing another law saying companies that serve Jamaicans have to have local representatives. I'm not sure why you think this is any less bullshitty a tactic, other than the fact that the law they're trying to push seems more reasonable (which I agree with).
If you don't like foreign markets, don't enter them.
> Against individuals: Unlikely, but it could happen
AFAIK IANAL: GDPR doesn't apply to individuals that e.g. host mastodon instance.
>> Agreed
Not a lawyer too, but I'm interested what makes you (and jbfoo) believe that it doesn't apply to individuals. It's a EU regulation it should apply to natural and legal persons.
Ok, it has an exception for the processing of data by natural persons in the course of a purely personal or household activity but that doesn't mean it doesn't apply to individuals in general.
If you set up a service that operates in the same way as a similar service would operate if it were done by a business then I suspect that you being a private individual is not going to be much protection, after all you are effectively roughly in the same situation as a sole proprietor business minus the incorporation.
If you process data for family and friends then that would most likely be enough to trigger the exception.
So the dividing line in the case of a Mastodon server would likely be whether or not you allow total strangers to make use of the service and whether or not you respect their rights.
However, some non-commercial Mastodon instances are now supporting thousands of users. An argument could be made that operating such instances is no longer a "personal or household activity".
Whilst I would hope that the local data protection agency would side with the Mastodon instance operator, it does put them in a rather difficult situation.
I think this possibility raises a lot of concern for operators of Mastodon instances and other online services.
I get the impression that a big part of the motivation for GDPR is this type of resentment against America.
If Facebook was german there's no way that GDPR would of passed.
So while blocking the EU isn’t required, the other tests they use to determine whether or not you intended to offer services to EU residents are a bit murky. In light of that, what better way is there to make your intention to not serve EU users clear to all than to block EU users? That’s the main reason to do it. This kind of blockade will not prevent all EU users from accessing your site, but it doesn’t matter. You’ll have made your intent to not serve EU users clear, which will preserve your immunity to GDPR.
But I don’t disagree that some EU countries that intend to abuse the GDPR for the purpose of generating massive amounts of revenue from fines may try to make this kind of claim. One of the problems with GDPR is that when you combine unclear regulation with the lack of moral hazard that government agencies enjoy and the financial incentive of massive fines, you create a monster that will constantly seek to expand who and what is covered under it.
Regardless, it’s one more reason to block radioactive EU traffic.
Probably you can offload some challenges to the ad network, if they don't tell you enough of their business, but that's between you and them. For me I'm accessing your site.
You aren’t serving any ads in the case of an ad network. You contracted with an ad network that is within the US and the site on which you served their code is not otherwise subject to the GDPR. Your intent to not serve the EU market is clear.
Note that a common response by foreign banks to FATCA is to refuse to do business with Americans, which is very likely the best course of action. So it shouldn't be surprising when companies take similar precautions because of GDPR.
That being said, the starting point shouldn't be, "there's no need to imagine that I'm violating GDPR. I only serve Americans". The starting point should be, "I had better imagine that I might be violating GDPR even though I only intend to serve Americans. Are there things I haven't considered? Are there resources I should seek out? As a service provider of some kind, hadn't I better spend a day or two imagining the ways I might run into trouble and plan to avoid it?"
I'm biased for the GDPR, since I think every site should follow its principles regardless of legal obligation, but I don't think the rationale you're proposing is scalable.
I'm not even sure about sane way to map IP address to country. There are some geolocation services, but I doubt that they are 100% precise and probably paid. Also if I'm using geolocation service passing IP of the incoming request, does that mean that I'm already violated someone's privacy? This is weird.
Its your favorite dictator, the leader of Crazystan and from 29th of May 2018 I ask that from that date, for every site accessed by citizens of my country I require the hosting company to send one employee to be sacrificed to our mighty gods.
Failure to comply will attract a fine of 50 Gazillion dollars.
It's when you start collecting personal data on EU residents, send their personal data to third parties for analytics/targeted advertising, and so on, that things get interesting.
I run a small UK based IT firm. So far I've turned down some of the logging on my HA Proxy instances and stopped logging IPs and user agents in general and a few other things. If I need to do some diags then I'll turn them on again. That's on the long term stored logs (due to backups). So far, my backups are smaller 8)
I do keep very detailed logs with IPs (actually full packet capture) in the ES cluster for IDS purposes but those are turned over (deleted) within a few hours. Less detailed logs last a lot longer.
Or, maybe, just block all of the EU.... probably a lot easier for a small site.
- You make a note that this data is being logged.
- You state for how long this is logged (6 months is reasonable), and justify that time frame.
- You state who else has access to these logs.
- You state what steps you have taken to try to minimize unauthorized access to these logs.
- In a register (these statements should be delivered on request of a law supervisor) you also provide your personal details, which users are affected by this data processing, and your goal (which should be something along the lines of: "fraud prevention and intrusion mitigation" to have legitimate interest. Expect big companies with law firms to push this "security interest"-angle hard, as they try to justify their data processing).
Pretty reasonable, no? It would be nice if the large web logging softwares provide standard options to automatically limit disclosure of PII web logs.
I wouldn't call that a similar law at all, because the spirit of it is so that the government can have access to that data…
A) The law seems to extend beyond the borders of the EU.
B) It's extremely long and vague, doesn't really offer a lot of actionable advice, and nobody outside of privacy lawyers seems to really understand it fully.
C) The penalties are harsh.
Further muddying the waters, the EU and US already have some existing bilateral agreements with respect to data privacy [1], but does the GDPR supersede or unilaterally invalidate these...? Who knows?
[1] https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield
Hi guys,
It's Kim from the Best Korea, and we just decided that we are going to allow our people to access the Internet.
There is a tiny little thing though, our internet policy stipulates that for every traffic hit to sites outside our borders, the country of origin either donates 1 nuke or if it doesn't have nukes an item of great value, or a 24 hour TV broadcast featuring me.
A) It covers behaviour towards the citizens (ie passport carrying members) of the EU. It basically says: "please do not be evil" - OK it says a lot more but I think you get the idea.
B) It does cover a lot of ground but it is written in pretty accessible language for such a large and complex subject.
C) The possible maximum penalties are set at a level that will not destroy a serial transgressor but should hopefully deter anyone from becoming such a beast in the first place.
Overall, GDPR is really a manifesto for how people should be treated in the burgeoning data economy. I still find it hard to understand how such a reasonable and farsighted set of regs came to be designed in the first place. As a citizen of the UK, at least I am reasonably certain that the GDPR will stay on the local statute books post Brexit because to contemplate otherwise is economic suicide.
If you have a lawful basis for collecting the information, you're only passing it along to others as necessary to provide your service to your customers, the customers have clearly consented, and you employ reasonable protection of that data... it's extremely unlikely that you're in violation.
And if you were, they'd come to you first with a warning (at least based on past behavior). They're not going to seize assets unless you seriously provoke them.
1: ignore GDPR, you'll probably fly under. And if you dont, fine are scaled for business and people affected, as well as privacy infraction. Encrypt your backups, encrypt PII if you can do it effortlessly, and you're good. If you are not using emails except for checking double inscription, encrypt them too, the entropy is low BUT this is better than nothing .
2: If you have some time and money to spend to try to improve your services: self-report. A public agent will point you the weakness of your data processing.
The entire point is, NO you can't just ignore GDPR. Your lack of action toward compliance is negligent.
Anyone not up to shady activity can afford to wait for the case law and best practices to settle before doing anything.
I don't comply with laws from many other jurisdictions either. Should I start applying censorship laws for China and Saudi Arabia too? Why should the EU be special?
People get used to accepting the stupid cookie law and it becomes a habit, and in a couple of years the law lost it's meaning (people blindly accept cookie law) and no-one cares about "the great privacy laws of the EU".
This is probably how GDPR will end up, no sane person would have the time to read all the privacy notices and the crappy opt-ins to just order food as fast as possible.
Hey I'm starving I need that food ordered now, here's my location so you can deliver food here, I don't give a rat's ass about your privacy statement and clickady clack are there any more opt-ins to check before I can finally order my food?
My feeling is it is going to end up like the cookie law, but who knows at this stage.
GDPR only applies if you are providing a service to a EU citizen. That also explains what EU will do if a company doesnt comply with GDPR (where it should); they will stop the company from providing those services to the EU citizen.
This is also why blocking EU traffic doesnt make you GDPR compliant (I can use a vpn or visit your site when travelling, and then you are still providing a service to a EU citizen).
If the case really is as you say, with just serving http request, then you have no issue with being GDPR compliant, because you dont store and information about the EU citizen. If however you are not just serving http requests, but track the user or otherwise store information on the site visitor, then you may have GDPR issues. But if you do store data about your users, you really should treat the data correctly.
GDPR is common sense, and if you bother to understand it correctly, its fairly easy to be compliant. Though I’d say, the bigger the company the more complex the implementation.
As Americans we're particularly sensitive about having to follow rules made by people who don't represent us and are not accountable to us. This is a totally fair and justifiable reason to be against GDPR even if you agree with its objectives.
That may be one of the most ironic comments I’ve ever heard. I love americans, but as a super power you stick your nose into so many other countries business, directly or indirectly. So, lets just say that argument is not gonna change my view in any way.
I don’t think I am mistaking intent with implementation. The regulation’s written text leavea many details to be answered along the way and the first couple of rulings on GDPR will (hopefully) bring us a lot of insigts into how to interpret and implement GDPR in practice. So I guess no one really knows the implementation yet. Until then we have to go by what is reasonable and the intent. And if you store data on private citizens you better treat it correctly.
I’ve been in the “online payment processing” space for decades. When I first got involved, there were no central guidelines for handling sensitive credit card data. And to be honest, there was a lot of neglect within the industry as a result. As I share memories with my colleagues of what was done in the early days it is laughable and a horror at the same time. We were all learning on our feet.
When PCI was introduced in the mid-early 2000s, it was not easy to undo / redo things to be compliant. It took time and cost money. At the time I wished I was working on features rather than “compliance”. But we got there. It didn’t kill us, and in the end we had a better service because of it.
Fast forward a decade and I found myself working on another startup in the payments space. PCI compliance was in the very fabric from which we started - we designed things from the very beginning with PCI in mind. And that made PCI much easier overall because every decision contemplated PCI.
I feel GDPR will be similar. It will be a transitional burden because existing businesses will have to undo some practices and that is hard. But going forward startups will build services with GDPR in mind from day one, weaving compliance into the fabric of the product piece by piece, and everyone will be better off for it.
I’m sympathetic to small businesses that face a difficult transition. But I do feel that the burden is in the transition, and not something that will hang overhead forever.
> Please don’t take us seriously
> This is an example of all the things you can do with Cloudflare Workes and our API. If you like it, please spread the word! But hey, don’t take us seriously. We just wanted to take the drama out from all the GDPR madness out there.
Anyway: just for academic interest I’m curious how much this increases the overall request latency, as there would be one additional blocking HTTP call at the beginning. Do you have any benchmarks for that API call to check the blacklist?
But Cloudflare has servers very close to our endpoints around the world, so I guess < 50ms if you don't use SSL could be a good estimation.
We are working hard to reduce the amount of time to establish the connection. It's about 80% of the time of the request.
What makes a response cacheable is a little complicated. There's cache headers, but also some heuristics involved. However, you can override all of that from a Worker by passing an explicit cache TTL to fetch():
fetch(url, {cf: {cacheTtl: 86400}})
Probably I will give it a try on Workers another Friday afternoon.
It's a Friday afternoon blog post to show how cool my product is with Cloudflare Workers and having fun at the same time!
That's an excellent attitude to take towards your users.
Valuable, dear, beloved users for which the business has boundless sympathy, empathy, and compassion are now awkwardly the source of compliance concerns for which the costs outstrip the reasonably expected revenues enabled by compliance. While compassion is unlimited, it is possible the budgets and time may not be.
Better?
The GDPR is not about revenue but about privacy. It's not meant to be cost neutral. Bank robbers could also quote you to complain about the burden of anti-robbery laws.
However, is it possible that in a context where companies are weighing the cost of GDPR compliance against the benefits of GDPR compliance (i.e., keeping their EU business) some might come down on the side of jettisoning the EU business? They might even opt to do it by using a tool, like Cloudflare Workers, that they can convince to block everyone in the EU.
You would be absolutely, completely, 100% right to consider this fully in line with the intentions of GDPR. Protect privacy or GTFO, right?
With that said, it's possible that a fragmented market with fewer legal business models may not be as conducive an environment to all possible businesses. It's even possible that as a result, not all gaps will get filled.
Different legal models also provide grounds for experimentation. Who knows what works better in the long run? Wild West or regulation like GDPR? We don't know.
Which is to say that you could be right! Absolutely and completely! Or you could be really wrong. Time will tell. The economic history of protectionism could be read by some to provide some clues, though.
More than USA citizens with dubious DMCA takedown requests?
Both seem wrong, can we agree on that? DMCA is a disgusting weapon, as is a lot that the US has done. Does that make weapons created by Europe ok?
Are they really pests for demanding privacy? In today's environment?
"I want to use your free service without participating in your monetization model. K thanks" -- EU citizens
My take is that consumers need to be aware of what 'free' really means for each service that advertises it. What are the real implications - not just something hidden in doublespeak in a ToS or privacy policy.
Everything spelled out in the GDPR is a great thing for users and should have been there from the very beginning - being able to erase all their data, see all their data, export their data, and get notified when data is accessed.
I hate this "empowering users" philosophy of the EU. It's reminiscent of "right to be forgotten" type regulation where EU believes users should be in control of "their" data, when it reality it isn't "theirs" to begin with. Once data is "public" you can't ever "erase" it because it's not "yours". I'm sorry, if you shoplift in my store (online or no), I'm keeping track of you no matter how much you demand that I erase "your" information.
"I want to use your free service and to participate in your monetization model only after you explicitly tell me how you are going to do with my data. If you can't tell me this, and get me to accept the trade off, why should I trust you?" -- EU citizens"
So it's more like "if you can't do this according to the whims of my government regulators, I'll still be using your service, AND prepare for a large fine."
No one is asking.
Rather, the right question is whether the entity demanding (the EU government) has the right to do so on the basis that their jurisdiction extends to anywhere that a citizen of theirs can reach via the Internet. I argue no.
You probably disagree, which is fine, but this ultimately comes down to enforcement. And for now at least, I win on that front.
I think we’re perfectly fine with telling you we use your data for ML training, internal analytics or showing you relevant ads. That is standard stuff you consent to in a TOS.
If you can't easily delete or export my data, it means that you don't have a coherent, legible record of exactly how my data is being processed. You can't be sure if my data has been leaked or stolen. You can't guarantee that you'll be able to notify me in the event of a breach. You can't prove that my data was lawfully collected. I can't check the data you hold on me to ensure that it is accurate.
The GDPR is easy to comply with if your data protection policies and processes were decent to begin with. If you have read the text of the GDPR and can't see how you could bring your business into compliance, then you are almost certainly doing something seriously negligent or seriously shady.
What we can do, is set a little deleted flag on your profile to treat you as "deleted".
> ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
So not a database query itself, but the thing that drives the database query. It also extends to things like logs - aka don't keep a log full of SQL queries that are full of peoples personal information. Don't ship that log off to some third party, or make it available to random people.
For web apps it's mostly the storage and retrieval aspects that are important. Don't store too much PII. Don't allow anybody to access it at the DB level. Implement appropriate access restrictions at the web-app level.
It is perhaps a bit too abstract, but that's because it's covering a highly complex topic, but I don't think it's too vague on this: If it contains PII, protect it. Which, of course, you should be doing already.
For the longest time companies have been able to market something as 'free' when they have been the ones who have been trying to hide the fact that users' data was being sold, etc. So I would argue that if someone is 'stealing', it is actually the companies themselves.
The "stealing" is because they are trying to get companies to give their content out for free without paying the cost which requires targeted advertising (and no, generic ads pay shit which is why tons of companies are blocking all the EU because they now aren't worth the server costs).
You don't need to create a specific feature for European users if you don't want to, just as European users don't need to do business with you if you don't value their privacy. Economic exchanges are voluntary. If you think ignoring European customers is something that pays off for you, go for it.
If we would not care about privacy to a greater degree than other regions we would presumably not pass legislation that protects private information and cuts into ad-revenues.
After all, if someone exhibits a certain attitude towards their users' data that is a good indicator that there is more that isn't done properly.
It's funny that you think that it's totally ok to do this.
What's really being affected on the backend side of things is bulk data collection and storage and sharing with 3rd parties without consent.
If you're sick of people using your product and not giving anything in return, Charge. A. Fee.
The GDPR specifically forbids giving users the option of paying with data. (In that you can't deny access if the user doesn't agree to the data usage).
Charge. A. Fee.
It turns out that a whole lot of users don't want microtransactions for everything they do online, and would rather allow providers to monetize their data in exchange for access. You not liking those agreements is not a reasonable justification for forcibly banning them.
If it's too hard for you to copy paste a GDPR compliant privacy policy and monitor a GDPR email address then well, maybe you're in the wrong job.
We have business reasons for collecting user data, and users have no real reason to tell us to delete it at will, other than the fact that it makes them feel "creeped out".
The future is probably going to be super creepy. If you want to participate, get over it.
-Other than the fact that it makes them feel "creeped out".
Pick one.
My mother does not understand where data is kept, what is encryption or anonymisation even if you darw it for her...
and if my father wants tp watch porn he’ll pop his CC where ever just to jerk off...
Obviously it's "safer" to let others make rules and force us inside the fence to keep us sheep away from the dangerous wolves out there. I do understand that perspective to some extent. However I would never trade my freedom for security. The former is not easy to regain.
Your example where you "want to give your data away to a sketchy website" is not in any way representative of reality when a) the website is as ubiquitous as for instance FB, and thus in no way perceived as sketchy, and b) the user makes no conscious decision to consent (let alone "wants it").
> Hoping you've blocked access to the EU so I don't happen across it :)
Being glad that he doesn't have the freedom to use the site, thanks to a government law (whether a side-effect of the law or a direct effect is irrelevant, because the law brought it out just the same).
That is, if you're offering such a service that exploits users for their data, then I would never want to use it, so it might as well be blocked, for all I care.
Maybe even desirable if it was, so you don't come across it by mistake and sign up without doing proper diligence.
Freedom of choice is nice, but there's an argument that putting rat-poison in food products isn't ok, even if you label it on the package.
thinking it’s a good idea to give your personal data to FB is not FBs fault, it’s yours.
So we should stop government from enforcing food safety and accept poisonings as fact of life...
Counterpoint: Cigarette companies poison you, and they found it's an amazing way to gain repeat customers.
like do they MAKE you smoke? cos government MAKES me pay taxes Marlboro does not MAKE me smoke...
* XIX century wants it's snake oil back * Didn't hear about China and melamine milk scandal? * Would you buy food from Amazon if it was co-mingled in current way? * VW emission scandal
It is easy to be freetard when you do not get diarrhea every so often due to food that was "optimized" (like in XIX century ;)
https://en.wikipedia.org/wiki/The_Jungle
Consider how many modern food standards regulations came about, and what abuses they were addressing.
The milk scandal is interesting tho. I don't disagree that there are people/companies out there that are horrible human beings (or run by horrible human beings), but these are exceptions. There is also a market-based recourse for consumers. Lawsuits and liability is a big deterrent for example. It's also illegal to harm someone (as it should be) so jail time for the offenders is quite possible without having enormous and onerous regulations. And haven't you noticed that it's the giant companies that often push regulation? Because it raises barriers to entry for competitors. Big companies have the resources they need. Using the government to hurt your competitors is one of the oldest traditions in countries with governments big enough and powerful enough to do so.
[1] https://www.history.com/news/7-things-you-may-not-know-about...
[2] https://www.libertariannews.org/2012/11/15/meat-packing-lies...
[3] https://www.zeroaggressionproject.org/uncategorized/upton-si...
The government isn't the only source of power and coercion; private companies are too. A lot of these regulations are the one countering the other.
Riiiight. You sound like the perfect person to be handing my personal information and I would trust you to take full care of it.
Not.
EDIT: Not allowed to say what was previously put here.
> Your laws may say differently
Sure, Canadian laws in this area are very scattered and backwards. I wouldn't put that forward as a good thing though, or use it as a pretense to not bother protecting or managing your users PII.
"I shoot this sex tape myself with my camera, climbed my tree on lawn, zoomed with my long focus lens, stored it in my computer. It's my data. If they don't like it, they should have pulled their curtain."
There must be a threshold somewhere. When does it stops being acceptable, and starts being creepy?
Public places are one thing (he entered this building with that woman at this hour). Looking through private property is another.
But if I do not use your service, then I want that you delete all my personal data. Why is that so hard?
There are pieces of information that are particularly problematic for other parties to know. An email address is not one of those things.
I realize that it was a user error, am a bit miffed about it for two minutes, maybe mail them that they should be more careful with mail addresses.
If, OTOH, it's a business misusing my mail address intentionally and for monetary profit, I hope that regulators stomp on them.
I’d take a big issue to an organization storing a social security number or something of that nature, because its leak would represent a significant risk, but email addresses are fairly disposable items that we only voluntarily attach to ourselves to.
EU citizens turned into "pests" two years ago. Much like Y2K was a "pest" years before January 1, 2000. But unlike EU regulations, Y2K was like The Terminator: there was no appeal process, and it absolutely would not stop...ever, until you fix your Y2K bugs.
GDPR OTOH, eh, maybe there's some way to wiggle out of it? And two years later, when Compliance Day comes, here we are.
At $200 a year there's no point spending even a few hours to figure out if I need to ensure GDPR compliance in the first place much less to do so. No point in figureing out how to erase users if I should ever be asked to, etc.
Last night I tried to log into AdSense and turn off targetted ads because I figure that handles most of my risk and is one of the evils people seem to be trying to kill. I couldn't find the option, only found old articles about it "coming soon" on Google, and got nowhere in a half hour or so.
Are there any limits to the sizes of companies that have to deal with this? Blocking EU might be the only real option I have (although some say that's not even enough).
/s, obviously
This is only slightly more hysterical and illogical than the typical fan of the GDPR on HN seems to be.
IANAL, but if I were in your shoes, I'd either block the EU if that's easy, or just ignore this entirely. They can't enforce anything.
https://support.google.com/adsense/answer/9031649?hl=en
You can just turn off ads for a while and then turn them on again when Google has gotten their shit sorted out, or leave them on because honestly you're very unlikely to come to the attention of the regulators -- especially since they're not yet fully staffed and funded for this. :-)
Blocking EU users doesn't actually protect you, and will just piss people off -- not to mention look shady, and thereby increase the chances of you coming to the attention of regulators!
Commenters who work as 9-5 employees or have never started a company (or at least, don't mention as having done so in their profiles) tend to be more supportive of the GDPR.
Funny how that works..
Funny how that works...
I support GDPR. It's the first reasonable solution to privacy I've seen. And I hated the cookie alerts. The transition is tough and we're fighting to figure it out at the moment. But the basic principles in GDPR are solid.
If every business owner commenting those GDPR post on HN could act the same and not like headless chicken, discussions would be more healthy.
I'm curious about your product too if you are comfortable enought to disclose it :)
You're far ahead of the curve. May you profit from it somehow.
Not parent commenter btw, just my two cents
This is EU, not USA, Russia or China. At most his visa will be denied (and i'm not even sure immigration services will actually care)
Smells like another right+ forward from grandma.
We'll soon get used to websites following good privacy policies, so your SaaS will just look less appealing to Europeans.
Is it really hard paying attention to how you handle people's sensitive information without selling it to third-parties?
I just wrote the post because if you want to overkill and you are lazy, you can follow our recipe to 'implement' GDPR. I just wanted to be sarcastic and also show how easy to implement Cloudworkers + Apility.io.
No crazier than thinking you have to comply if you have no connection to the EU.
Just to be clear, I treat all my users fairly and protect their data, and I am not intentionally targeting any EU users with anything I do online.
We're not compliant with the letter of the law of GDPR (and according to some it doesn't apply to us at all due to the above), but we treat all user data seriously, regardless of where they come from. If that's not good enough, then people can stop visiting / subscribing / purchasing, or the EU can try to levy a fine and collect it. I'm not particularly worried about either scenario.
I do not agree that I have any sort of implicit responsibility to treat my users in a way that an EU bureaucrat deems fair.
If the customer joins your Japanese site while in Japan, its governed under Japanese law, not EU law. Your citizenship is irrelevant.
You need to comply with the laws of the jurisdiction you operate in. If you don't operate in the EU (and having a presence on a global communication network does not qualify), EU laws are not applicable.
The onus is on concerned EU citizens to stick to .eu domains with a feel-good GDPR-VERIFIED banner if they are so inclined, not on the rest of the world to bend over.
As a non-EU business, I will pay my GDPR "fines" right after I'm done paying my Iran and North Korea issued fines. Cheers!
Seriously though, I made no comment on the law itself so I'm not sure what your point is. Most reasonable people would agree it's a good law in spirit, and I wish I had some of those protections where I live.
But the notion that it can be enforced on non-EU entities is ludicrous.
(There are countries with up to 30% non-citizens, and there are plenty of multi citizens. The distinction is entirely relevant.)
No. The law applies to people physically in the EU, not blanket to EU citizens. An American in Paris is protected by GDPR laws - a German living in NYC is not.
GDPR doesn't mention citizenship, it applies to any Data Subject who is a 'natural person'. The scope is stated as 'whatever their nationality or place of residence' which is universal.
So just blocking EU residents is not enough, one would have to also ensure that no other data is processed (1) within any country implementing GDPR or (2) anywhere in the world if you have a controller in the EU, his role being a sort of GDPR proxy.
Even saying 'within EU' is actually inadequate; the Isle of Man has implemented GDPR but isn't in the EU and there are probably other examples.
Dropping a IP block on the EU seems to be a pretty clear indication that you arent targeting EU users.
EDIT: Found the article https://www.troyhunt.com/free-course-the-gdpr-attack-plan/
How the hell does the EU claim extraterritorial jurisdiction over the entire world? And people complain about America being “imperialist?”
When my ad-blocker tells me that 50 to 200 trackers are interested in me reading some innocuous, unparsable word-blob, or watching some throwaway video, I see that as a symptom of thoughtless hoarding and unreasonable prying. This is not gathering intelligence: quite the opposite.
Were there some demonstrable, substantial benefit to all this for the end-user it might make a bit more sense. But there are no upsides to seeing shark fins at the beach.
When I guesstimate the costs -- just those of energy usage, bandwidth and man-hours, not to mention the rest -- and compare that to the supposed results (only imaginary to me, the end-user)? Sorry, it looks like madness.
It's a symptom of people not paying for content and news. Also the fact that publishers want to provide equal and easy access to everyone regardless of affordability.
> demonstrable, substantial benefit to all this for the end-user it might make a bit more sense.
The content you're consuming.
> publishers want to provide equal and easy access
What they want is money. 'Content' is what they've got to sell. And they hire pros to jazz it up and fluff it up, never mind reality or reason.
You're never going to convince me that the commercialization and infiltration of interpersonal communications is an improvement. (Except for snoopers and exploiters.) And I'm very sure that I'm in the majority on that one.
If it were up to me I'd limit all the advertisers to one TLD: .stripmall . And then avoiding all the B.S. would be REAL easy. All the 'news' websites that scrape their content would be there.
Ok, then live in the past I guess? Both content quality and quantity has vastly increased over the past 2 decades to meet the modern demands of billions of people who are now online. This is fact, the world has moved on. Either way you are not the arbiter of what is valuable content or not for someone else. People choose for themselves.
Yes, publishers are businesses. They must make money to create commercial content. This doesn't mean there isn't free content available, and in fact there's more of it than ever before due to the trivial costs of publishing media, but the rest of the stuff has to be paid for somehow.
As stated, consumers do not like to pay (often due to bad value assessment and inability). Ads are much more granular, passive, and equally accessible whether you're a billionaire or a 3rd-world farmer. This also doesn't mean subscriptions and other patronage options don't exist, there are millions examples of those as well.
Does the implementation of advertising online suck? Yes. It's slow, frustrating, privacy invasive and filled with fraud, but you're talking to one of the few people who has pushed for regulation for the last 5 years. It's not a new complaint and it'll take time to change a 12-figure global industry.
However if you think the world hasn't benefited from the commercialization of the internet, with education, entertainment, and information creating progress in every corner of the world, than you are most definitely not in the majority. You're actually in such a minority that it's basically considered the same as any other conspiracy group and largely irrelevant in any serious economic, societal, political or business discussion.
I recommend revising your perspective and acknowledging the differences between advertising as a concept vs the implementation, and especially the progress that it has brought that has led to the world that you seem to take for granted today.
Which brings up a question, is the complexity of building and offering a GDPR-compliant solution really any different than building a solution that conforms to best security practices? I wouldn't think there is much difference. What is the remaining overhead to comply with GDPR? I am sure just understanding it is a notable piece, but would the developers already be aware of all CWEs, BCPs, existing laws and standards for their components which would also be overhead?
Article 4.1 defines an identifiable natural person as one who can be identified, directly or indirectly, in particular by reference to for example an online identifier.
IP addresses are specifically mentioned as online identifiers in recital 30:
> Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags
Only time will tell how this will be interpreted specifically but we have at least one court decision already [1]:
> What makes a dynamic IP address personal data?
> The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if:
> there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and
> the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual.
[1] https://www.whitecase.com/publications/alert/court-confirms-...
I experienced this myself. EU is absolutely powerless outside their borders.
In practice, GDPR is binding on businesses that operate within the EU. An EU citizen in the US doing business with a US-only company is not afforded any protections under GDPR.
https://ec.europa.eu/info/law/law-topic/data-protection/refo...
1. Collect only what is necessary for providing your service 2. Make clear what you store and for what reason 3. Ask consent and give the opportunity to retract this consent as easily
Deletion:
1. PII means information that makes a person identifiable. This is the type of information that you need to remove 2. So if you are storing PII information for the use of profiling you will need to disconnect the profile from the PII information. E.g. you could use user table where you would overwrite the PII information with generic information. You can still use the now stale profile withou PII information (for example in statistics, aggregations etc), but you cannot tie it to a single person anymore. Ie. You should not be able to reconnect the person to profile you have stored. 3. As technical possibilities evolve you need to improve the disconnection over time.
There are legitimate business reasons to store some PII information. E.g. for security reasons, other laws etc. So IP addresses don’t need to be deleted from your web logs, but if not given consent you cannot use them for ads, sell them etc.
The required clarity that GDPR will bring to your data is actually going to benefit you. Your data scientists will love it, because the tooling that helps with Gdpr also helps with discoverability, data quality etc.
Enjoy GdPR, there is a lot of business opportunity in it.
I love GDPR, getting rid of the WHOIS database stuff alone is enough to make me a huge fan. The option to delete my data is also amazing.
You think businesses are that forward thinking? You think there is some grand conspiracy to annoy users so that they hate regulation?
Yeah? U.S. companies do this all the time. They did it with the cookie warnings and tried to act like they didn't know they were creating an absolutely terrible experience.
Companies acting in bad faith against regulations is basically the default.
Definitely. Adhering to new regulations costs man hours and $, companies understandably would rather not be forced to comply. No grand conspiracy just long term bus dev.
The simpler explanation is that these ultra annoying pop-ups make it more likely for people to accept the ToS and allow the service to begin monetizing.
Because people wouldn't give up Google Analytics, targetted ads and "re-targetting" they opted of silly pop-ups, often delivered by a 3rd. party that will scan your site to keep track of all the data collectors your marketing department added without considering the users privacy.
The GDPR is written the way it is because companies refuse to accept the intentions of the cookie law, and choose to look for loopholes. At least that's my take.
Isn't that the law that required these updates, pop ups, and new consent forms? Not sure how the companies could be blamed for that.
You're still allowed to have personalization and targetted ads, but now you actually have a responsibility for the data you collect and I don't view that as unreasonable.
If you use data that the user actually enter, or their IP for some reason, then yes, you do need to ask, but you could just ask when they are entering the data.
If you want to target based on activities across website, then you'll most likely need to ask, but that's already the case with the cookie law.
You do have me wondering if I'm correct, but I would still claim that if you noticed that browser with the "cookie XYZ1234" read five article related to child and then ask your ad partner for an ad for "people with children" would allow you to be GDPR complaint without any pop ups. It does flip the current ad tech model upside down though.
Regulations usually favor big businesses at the expense of their competitors, and the GDPR is no exception.
This is a very weak and lame attempt at just getting people to use your service when it's already built in...
The rest of the world will continue on without them, especially as the ~middle class~ population explodes in countries where there previously wasn't one.
The US is really only the "center of the Internet" for primarily English speaking countries, as the others have regional variants of popular US based services. There is no real reason why things wouldn't just split out to Europe and Oceania even more.
- Agree to cookie
- Forced "Do you want our newsletter" prompt
- Request to show notifications
- Pop-up icon to subscribe to notifications
Edit: fix list formatting
If it's the latter, then someone with both US and German citizenship could be covered even if they've never been to the EU.
Which is to say your hypothetical dual citizen would have zero rights under GDPR in their dealings with purely US entities.
While GDPR is a good idea, its legal impact can only be for business conducted within EU boundaries, or we are going to open up a Pandora's Box like this.
Come on: you're whining but you're doing that kind of extra-territorial stuff for decades!!!
Geoblocking is not enough. A user in Europe that bypasses an EU block with a VPN is still covered (this has been explicitly stated).
https://gdpr-info.eu/art-3-gdpr/ Art 3 (2b)
People (regardless of EU citizenship status) who are physically in the EU.
This isn't so hard.
An expat living in the EU is protected because they reside in the EU. If you are living in the USA, you must follow American laws.
It's a basic idea, and HN prides itself on being smart, but there aren't global laws. No one gets to enforce civil penalties outside of their jurisdictions, without exceptional circumstances. If they fine you and you don't have offices there just ... don't pay? The EU might not exist in 10 years anyway.
Recital 23 (referring to Article 3, Territorial Scope)
> In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union.
An attempt to prevent EU users from accessing the site at all is about as strong a signal as it gets regarding this. When you're blocking all of Europe by IP, it's pretty fucking obvious you're not envisaging offering services there.
For larger companies with offices in the EU (especially the ones headquartered there for tax purposes), they obviously have no choice to comply. But what about a small startup, with its only domicile and employees in the US?
What exactly could the EU do to punish a startup in that case? Unless they have some enforceability treaty with the US, I don’t see how they have any legal ground to extract fines for arbitrary laws defined in their jurisdiction. The worst they could do is ask EU ISPs and/or payment networks to block the offending sites, right?
Such a suit could be ignored too, but it would certainly be a PITA for vacationing executives who get locked up in Italy for an outstanding summary judgement.
It's a good thing there are a lot of beautiful parts of the world other than Italy.
I suppose when I asked the question, I am assuming internet businesses for the most part don't isolate themselves to a specific region, so their reply probably makes more sense for the businesses that operate in a small locality. Perhaps they have such a business. I should have considered that prior to asking.
Where this might start to get interesting is if people use infrastructure that is in multiple regions and that infrastructure provider has an agreement to block companies that do not comply. So if AWS for example had such an agreement, then non compliant companies could find their sites broken, even if they are only hosted in the U.S., not that this would ever happen, but it could.
[0] - https://userstyles.org/styles/9038/hide-down-vote-arrows-and...
There are precedents for the opposite. If you have a grandparent born in some EU countries, you have EU citizenship according to the law of that EU country, even if you never set foot on that country and have no contact at all with the EU. There is a (non-EU) country which says that if you're a citizen of that country, you have to pay income taxes to it, even if you never set foot on that country and have no contact at all with it. At least one country says that its law applies to buyers of widgets manufactured in that country, even if they are sold by someone who never set foot on that country and has no contact at all with it, to someone who likewise has no contact with it. And so on.
https://github.com/donohoe/simple-gdpr-lockdown/
This does NOT solve the problem, its just (IMHO) a better alternative to blocking.
This is good for both companies and users. It gives companies clear goals and policies for how to treat users, their data, and what their users want to do with their data.
I think what we're seeing is a light shining brightly on some pretty scummy practices. It's understandable why developers who rely on user ignorance to make a profit/revenue would be bummed about this, because these regulations are correctly placing the burden on you, the developer, to be forthright and honest about what you're doing with people's personal and private information.
To developers who don't want to do business in an open and honest manner, who rely on low brow tactics with user data, who didn't have the good sense to know what was coming and plan for it: Good riddance. Try again.
As a victim of identity theft, I say that burden should be on entrepreneurs to learn and write good code. I have written a lot of bad code myself but back then everyone was writing bad code to get to market as fast as possible. People who wrote good code and followed best practices for their users’ privacy and security were at disadvantage. This regulation evens out the playing field, so now good guys/gals can compete too.
Also this is not hard if you were already following the best practices for security and user privacy. Sure there is some new stuff like real deletes instead of soft deletes. I can tell you from my experience that the people who are the most stressed about GDPR are those who are working at the companies where they had very bad dev practices. One of my friend who works at a decent-sized ecommerce shop, had to finally get rid of CC numbers in their logs. That guys had been pushing for better security and dev practices but would get overridden by managers and team leads.
I am glad that GDPR is finally forcing higher ups to finally improve their dev and security practices.
A more effective way might be to ask on page load if the user is an EU citizen. You know, like some financial website asking you if you are a US citizen on page load [0] (i remember marshall wace's old website doing it, it looks like they do not anymore).
And EU traffic being the "most malicious" ? Is this satire, irony, or something else ? Seriously, if I go on website W and they go through all the dark patterns possible to collect and share my data without me knowing about it and I'm the malicious one ? Better read that than being blind...
[0] https://www.quora.com/All-of-a-sudden-Bank-of-America-is-ask...
Do you mean a company and its customer, both located outside the European union, would still fall under this law if the customer happens to be a citizen of a EU country?
Ah, found it: "... is the Foreign Account Tax Compliance Act (FATCA), which was passed in 2010 and will go into effect in January of 2013. The act requires all foreign banks to identify and report on US citizens with accounts holding more than $50,000 in an effort to clamp down on tax evasion. If banks refuse to comply, they could face a punitive 30 percent withholding tax on all payments from the US."
I believe you have that the wrong way round. The territorial scope (as it applies to processors outside the EU) is defined as "processing of personal data of data subjects who are in the Union".
"Q: How do I delete my account?"
"A: Please get in touch with our Customer Services team if you have any worries or concerns. If something at {website} has troubled you, we'll be happy to help sort it out."
To their credit, the support chat person was very efficient in complying with my request.
Yeah you changed your EULA, but at least you don't need to completely review it for compliance.
The GDPR applies to any residents of the EU, not EU citizens regardless of location.
I was going to go to town on it until I did a quick pre-emptive search but I had no idea about this being a thing: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/451 - 451 Unavailable For Legal Reasons
I'll assume that 451 is designed to be available if a canary might be required at short notice.
If I run a business putting up American flags on people's houses on patriotic holidays (an actual business in my neighborhood), then ignoring the EU market is an easy decision because I already was.
Like say a software service which I would assume is more common investment target here rather than flags.
For all its noise and bluster about "500 million customers lost!" the European Union is still less than 7% of the world. I think most businesses would be happy to serve the other 93%.
I would imagine that the stock market value would take a rather strong dip if a company proclaimed that they revenue would be cut down to 75%. Investments and stock options are not only valued by the companies current ability to survive, but also speculative value.
You make two mistakes:
1 - Assuming every business has investors. The majority do not.
2 - Assuming every business is suited to a global audience. The vast majority are not.
"what does the investors think when a company volentarly leaves the EU market?"
This question has 4 predicates.
1) investors. If no investors then there is no investors that can have an opinion.
2) Company. If no company then no investors, and since you have no investors than point 1 applies.
3) leaves. If the company don't leave the market then the investors can't object to a company is leaving, as such point 1 and point 2 applies.
4) EU market. If the company is not leaving the EU market then the question about what investors will think about a company leaving the EU market is not relevant, and thus point 1, point 2 and point 3 applies.
> Assuming every business is suited to a global audience
That was the question. What does investors assume when investing in a software company such as those ycombinate investors usually invest in, for which HN is a forum created by ycombinate.
http://webcache.googleusercontent.com/search?q=cache:xrEsOXE...
Judge for yourself!
No serious and earnest would/should consider this.
Your work affects lives. Period.
does the gdpr suggest that, if a "data subject" in the eu accesses my website without my consent, the eu will view me as subject to it's legal system?
But this thread and others just show how people will continually lie when it comes to the politics of GDPR. And when they don't want to lie, they partake in whataboutism. Even EU bureaucrats seem to be willing to partake in at least promoting the idea that it's a global law for their political agenda, when they know it's not.
I don't know why people continue to lie about the jurisdiction of this law, when everybody here knows it's not true.
Or is it really just identification details like name, address, etc.?
Here is a example of blocking all EU country codes without using any external API's.
https://gist.github.com/icodeforlove/9d22e44d0f227cb2740fd3d...
- This is insufficient for GDPR compliance. Besides the other points mentioned in this thread, you also need to delete any data about EU residents you have already collected.
- CloudFlare sets a geolocation header, you can probably just use that without consulting a third party, without adding any latency!
Block EU is totally reasonable for all these. Is it necessary?
Because: do you need personal informations from users? If yes: why?
Payment & Accounting => allowed ("legitimate use") Technical Monitoring => allowed ("legitimate use")
And if some user want to cancel its account: is it a problem (if he doesn't owe you anuthing)??? No? Well... then you'll have no problem
https://gist.github.com/botsplash/bf494ea9e95d945229a0a667a5...
(Some of the more famous blocked websites are similarly misinformed, e.g. the chicago tribune tries to tell me I'm in the EU and blocks me.)
I won't get into intentions, but it seems like the law is so broad that it just allows any EU government to selectively enforce the law and collect fines from any company they choose...
But the moment you try to access the EU market....
Not that we got the best UX from that one, where I'm constantly reminded cookies are a thing, via a large blocking box requiring user interaction, like a pop-up ad for something I already know and can totally control on my end.
There's a saying about how internet considers censorship damage and routes around it? Maybe better: the internet considers regulations information, and anycasts them, regardless of their quality.
China's a bit of a counterexample. Maybe the firewall is bidirectional, keeps democracy out and censorship in?
Maybe that's the endgame, balkanization. Some people will get to live under paternalistic maximalism, some under authoritarians hunting dissidents, some under anarchocapitalism, all dystopias in their own special way. And some of us will flee to Tor and .onion sites and encrypted signatures where we manage our own privacy and prevent third parties from auditing our communications.
Edit, "brevity."
I asked a data protection specialist, a real expert on the legislation, but they couldn't answer that question for me.
Two years ago (14 April 2016) the regulation was adopted, and a 2 year notice period was put in place so businesses could prepare
That notice period ended today
There is no possible way they can enforce any law, fine or penalty outside their borders. They won't even try.
Imagine if the law was layered, as in - below a certain size, you could get away with unintentional mischief.
Or is handling user data responsibly one of the new "three greatest challenges in computer science"?
In other words, an EU citizen residing in and accessing the Internet from the US has just as much right to invoke the GDPR with these sites as an EU citizen residing in and accessing the Internet from the EU. Blocking people accessing your site from the EU does not allow your site to not respond to such requests.
Or we get better privacy abroad.
Seems a win-win.
A simple, straightforward guide to GDPR compliance for small-medium size websites who otherwise would have difficulty complying, including FOS well-executed software extensions that make it even easier:
* Backup compliance
* Database deletion performance improvements
* Legal explanations à la tldrlegal [1]
Haven't done general population-facing web dev for a while, but it seems fairly straightforward. How to monetize it, if at all, I'm not entirely sure. Maybe charge a reasonable fee for short consultations which consist of essentially running down a checklist?
"This Regulation applies to the processing of personal data of data subjects who are in the Union"
I'm not in the EU. You don't need to block me.
It works for me now.
I decided to make a little change in the URL (Europeans instead of EU) and that's why there was a short period of 404 errors before I created the redirect.
If you already have information on EU users, you may be violating GDPR anyways.
Maybe someday they will learn?
The law makes perfect sense, it's not that hard to be compliant, and businesses with good ethics will already be compliant!
If I have a user agreement that my users agree to, I don't particularly care what another country thinks about what kinds of privacy they think my users are entitled to. I would already have a legal agreement in that case.
Enforceability will generally be based on revenue streams coming from the EU (oh you want a credit card processed from an EU user? We'll be taking that money as a payment towards your fine.) If you're a particularly flagrant violator, they may arrest you if you ever dare set foot on European soil.
The last item is nothing like the first two. The EU is now going to see the natural conclusion of a society based on its conception of contract rights. Digital technology magnifies the effect of everything by several orders of magnitude, so I suspect we'll see dramatic consequences flow from the law.
Same as how in California non-compete clauses are illegal.
The last is only thrown out by courts because of statutory interference/intervention in contracts.
b) Common law was perfectly fine with slavery until it was outlawed by statute.
c) Even in the American system, common law is just one more source of law, alongside statute. Common law prohibits "unconscionable" contracts, but that doesn't mean statute law is prohibited from prohibiting other kinds of contracts (which it does all the time). Hence the boilerplate "void where prohibited" language in all kinds of contracts.
Europe has got most of its wealth through imperialism back in time robbing countries of Africa and South Asian countries.
This is the primary reason countries of South Asia/Africa so poor today.
Before imperialism, most of Europe was poor while countries like China and India were way richer.
India is just 70 years old by comparison which is not long enough to make back the lost wealth due to its sheer size and diversity.
Now, American companies are able to an extract huge amount of money from European nations using mostly legal (maybe unethical?) using companies like Google and Facebook. They are set to make this illegal.
It's nothing more than a wealth preservation strategy. European nations can't compete against America and rising nations (India, China etc...) due to their aging population in near future.
So, they are going to shut off the market by making unreasonably harsh laws which are quite difficult to comply with.
You are finding compliance difficult because it's intentionally part of their design.
Keep an eye open and expect more unreasonable laws coming out of EU in near future. They are not going to stop here.
I tried to be sarcastic, but I think my English is not good enough :-)
That said, a constant source of miscommunication from native english to native english that is written, is missing sarcasm. Just a side effect of not having non-verbal communication cues.
I am very disappointed in all of you guys, just got one thing to say: FUCK YOU!!!
Just use Content-Security-Policies to block your pages from loading anything but safe assets/services.
You will need to politely ask those not using browsers that support CSPs to switch/upgrade.
Hey, blame the ones who planned your project, not the EU.