‘Everyone is breaking the law right now’: GDPR compliance is falling short

You shouldn't be getting down voted. I just went through a GDPR compliance review. We have a service model which is incredibly serious about customer confidentiality. We don't sell ads and, to my recollection, have never even bought them. Still required an army of lawyers. Two top London law firms ended up agreeing to disagree on major points, ultimately concluding the Polish data regulator would probably rule one way and the French the other.

Complying with the spirit of a law doesn't mean complying with the statue of it. With GDPR, it's the latter that's a pain in the ass.

https://www.eugdpr.org/the-regulation.html

Hands up. Who has actually read all of it?

Speaking as somebody who actually has - was teaching computer security last term - I found it relatively easy to read (as legal documents go) - but it still took a weekend. I will guarantee you, that not all of the high powered lawyers whose job it is to read it, have done that.

True story: back in the days when libraries still stamped your book with the date it was due back, I took out a copy of Keynes General Theory from the main library where I lived. It's not that thick of a book, and according to the date stamps it had been borrowed at least 20 or so times. About half way through the pages hadn't been cut.

It was a few years before the significance of that finally dawned on me. As in many things in life, HN discussions on the GDPR are a wonderful example of nobody actually reading it, and everybody having an opinion of it.

Regarding your point about consensus, that's fair - however this has not been my experience. Most parties that you would ask for advice on the matter have a pretty good handle on what the different terms mean.

Your second point is mostly evidence (to my mind) of large corporations trying to get away with as much malicious compliance as they can possibly manage. You really do have to put a lot of effort in that, as you cannot assume the agency checking you will see good faith (which is, as far as I understand it, one of the requirements for not being slapped with fines very quickly).

The law is pretty clear (not 100% clear, obviously, there is going to be loophole and unclear things), and it's easy to decide about unclear spots by following the spirit of the law, and by understanding that any unclear technical requirements really means "what a sane engineer would do, that you could defend against a jury of your peer".

To answer a few of your questions (obvisouly IANAL):

- are IPs PII? Yes, there are legal case about that, your lawyer should have a more detailed answer.

- what exceptions can be allowed? When you have a case you could defend that doesn't go against the spirit of the law

- what falls under "security requirements"? You should be able to defend your choices securiy-wise against a jury of your peer, using your internal documentation. If you have unsalted passwords hashs for example, you are in trouble

- what sort of deanonymization is sufficient? Best practices at the current date.

Technical details aren't going to be in the law, because the goal of a law is to not be outdated every year.

Laws are enforced by humans, not by computers. Your company should be prepared to defend its interpretation of the law (that's your lawyer job) and your technical choices (that's your job).

Edit: obviously, that's a simplified vision, and you should always consult your lawyer. The biggest your company is, the more important it is to try your best to be compliant.

But as for 1): IPs are distinctly /not/ PII (AKA: PD). They're identified /by name/ in the regulation, unless you sell that info. Anyone who brings this up as a topic has not actually read the regulations.. or they have and are trying to create uncertainty for some objective.

It sounds like you've done enough of reading the regulation to actually know this, it's part of your job and you've spoken to legal experts (as I have).

Forget about violations. Even if you're in perfect compliance, any EU resident can complain to their data authorities if they think you're non-compliant. That then prompts a regulatory inquiry, which requires lawyers to competently respond to, which is distracting and expensive.

It's totally fine for it to be vague. I very much doubt we'll see any cases where the general public disagrees with a DPA ruling of LI applicability. As a business owner, it means you need to strongly justify it and consider if a "reasonable person" would consider your use of LI to be justified. If you have doubt, you should seek consent instead.

Do keep in mind, that growing your business by using PD for marketing purposes is explicitly excepted from LI.

And that is exactly what sites are doing now. And there is noone on earth that will ever believe it isn't deliberate.

Processing of data is legitimate so long as you still have a reason to process that data, as well as if you have a contractual obligation with the subject to process that data. If that contract involves keeping an account registered indefinitely, until deletion is requested, then so be it. State it clearly and plainly when the user registers an account, and if you're that concerned about the ambiguity of the situation then the solution seems a simple one, no? Allow the user to choose to have their account deleted after a certain period of inactivity, or email users that their accounts will be deleted after lengthy periods of inactivity. It should be noted that 'inactivity' is industry specific, for something like free services online it could be industry standard to keep accounts for years, it's hard to imagine that a user would be upset about having an account they haven't used in 4 years be deleted, and really, do you need to keep that account after 1 year of inactivity? 3 Years? 5 Years?

I realise the law is purposely ambiguous here especially when applied to things like user accounts, but it helps to understand that storage limitations and retention plans apply less to things like accounts and more to things like metadata that you may be collecting. It's perfectly reasonable to keep user accounts registered for years even after inactivity for example, it's less reasonable to collect data for marketing campaigns and keep that data for years. Retention limits are also far more relevant to processors of data rather than for controllers of data, if you're a third party service you shouldn't need to keep data for longer than your contract with the controller specifies, however controllers have far more of a legitimate need to process data for longer. The push to have retention limits may as well be seen as a push to anonymise data that no longer needs to be tied to an identified person rather than a need to delete everything that hasn't been touched in 90 days.

>Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun.

IP addresses become problematic when you can tie them to an identified person, i.e., you're linking user accounts and IP addresses. As far as generic logs go, if the only personal information you're collecting is IP addresses then you shouldn't need to worry too much, treat the logs with some care as they still do contain personal information but don't sweat it too much. Make sure that if your logs are leaked that you inform users (i.e., through a blog post) that logs were leaked and the only personal information contained is IP addresses. IP addresses are one of the easiest things to justify needing to keep as a legitimate interest as well as needing keeping indefinitely, and if only IP addresses are leaked it's not really a big deal. If you have other personal information in your logs, especially if it's linked with more information, i.e., 'ip address 1.2.3.4 who has username asdf searched for jkl; [etc]', you should take steps to justify why you need to keep that extra information and maybe look at implementing a retention limit, or better yet, anonymise some of the extra data after you are finished processing it. If the metadata you're collecting is kept to a minimum and/or anonymised as much as possible, the need for a retention limit drops almost entirely, not that retention limits are entirely needed.

>Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers!

In every other industry you are responsible for when you choose a shoddy third party vendor who makes a mistake, I fail to see why the tech industry should be any different. I realise there is going to be a lot of teething issues on this particular issue, but part of the reason GDPR has as much scope as it does is because of these clueless third party vendors who misuse and abuse data. Maybe look into using European third party vendors in the future, as they would be just as culpable for their mistakes as you would be and they would be liable for fines too. :-)

>It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...)

For what it's worth, the GDPR makes explicit exemptions allowing for processing data where you have a legal obligation to do so. There is absolutely no conflict between financial laws and the GDPR in this respect.

In another comment you posted:

>I'm still not sure that recording everyone who walks past your store 24/7 is legitimate interest.

Stores and businesses need to display signs for when they are recording in the areas they're recording, inside a store it may be obvious that the store is recording, so a sign may only be needed on a door. Outside of a store you may need more prominent signs. If it's not obvious that the area area is being recorded then even more signs need to be posted still. The degree to which stores and businesses can record outside of their businesses will vary by country, but for the UK the ICO provides information for consumers [0], and businesses [1].

[0] https://ico.org.uk/your-data-matters/cctv/

[1] https://ico.org.uk/for-organisations/police-justice/

As a matter of fact: If you operate secutrity cameras in a public -, or semi public place you need a written procedure why something is captured, what is captured, how long it's kept, who can see the footage and under which conditions the footage is retained.

"If not, why?"

Because this is not a reasonable request if the footage is anyway deleted after, say, 72 hours.

I very much doubt this for a few reasons, the first being that it would be completely out of scope for the GDPR to have any say on what happens or who should be sued in a private lawsuit. The recital itself would also be contradictory, immediately before it says that the representative 'should be subject to enforcement proceedings' it says,

>Recital 80(4), The designation of such a representative does not affect the responsibility or liability of the controller or of the processor under this Regulation.

Additionally,

>Article 27(5), The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.

The wording of these two alone make it clear, to me, that the responsibility or liability lies solely on the controller/processor. The term prejudice also has a very specific meaning in Civil Law, and while it may have different meanings in Common Law (UK) I'm sure the more specific Civil Law version is intended and relevant. The wording of recital 80(6) as well as (5) '[the representative should cooperate] with the competent supervisory authorities with regard to any action taken to ensure compliance with this Regulation.' also tie in with other areas of the GDPR, particularly article 31 and 58(1)(a) which essentially state that supervisory authorities have the power to order the controller/processor as well as the representative to provide information that is required for the authority to perform its tasks. I think recital 80(6) with this context is basically just confirming that representatives need to to be present when supervisory authorities undergo enforcement of legislation.

If it were such a legal headache for representatives, it is concerning that no law firm has put forward an analysis of the situation. As far as I can tell from a brief search it is only amateurs interpreting the GDPR that have come to the conclusion that representatives may be liable for fines. With DPOs, who have many more responsibilities and requirements, there was much analysis by the legal community on what those responsibilities would include and whether DPOs could share liability. The WP29 even put out guidelines for DPOs[0] stating plainly that DPOs are not responsible for non-complaince, only the controllers/processors are responsible for non-complaince. It just seems odd to me that representatives who receive almost no mention in the legislation may be responsible for non-complaince where DPOs aren't responsible.

[0] http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_... [very bottom of page 24]

It was the result of name squatting, as I described earlier.

I know of no search engine which has always shown what I'm trying to find.

that's part of being a us citizen, and complying with your own law. you can renounce citizenship if you prefer to not comply with IRS.

> Australia has laws that about child sex tourism aimed at those that go to Asian countries with lax laws or enforcement. These crimes are committed in other countries

So if a US citizen violates Australian laws in Thailand, are they guilty and punishable by Australia? The example above is still against Australians, even if the crime is committed overseas. But... it's only against people who've been convicted, and it's basically just shutting down their ability to leave the country.

The customer in question was stating that simply someone being a citizen of a European country, then visiting my client's shop somehow subjected my client to European law. I don't find any examples you've cited above to be remotely comparable to this situation.

No, I take it back, your banking situation is sort of similar, except the banks in question are likely directly or indirectly connected with US banks. If they want to continue to enjoy whatever status that gives them, they're probably going to comply with those regulations. I also suspect that it's really their own government's financial regulators which have an agreement with US regulators (the wikipedia page seems to jive with that). Those FFIs are voluntarily(?) agreeing to the terms of FACTA because they enjoy some level of benefit (not being shut down by their own govt regulators, perhaps).

There are laws about heresy and apostasy in middle eastern regions - I'm probably violating their laws on a regular basis. Beyond a highly unlikely fatwa that may get issues against me, I'm not sure what they can really do (or indeed, that I would really be 'liable' in any real sense of the word)

They're doing the minimum necessary to claim they tried to comply while changing absolutely nothing about the way they do business. They're waiting to see how serious enforcement of the law is before making changes that negatively impact their business. It's not about whether they'd lose in court or have a regulatory judgment against them, it's about the likelihood that non-compliance will get them in trouble.

If EU regulators show a willingness to do the legwork to fine smaller companies, you'll start to see a lot of these site become much more compliant. But those companies are not going to spend all that time and money proactively only to see that the EU doesn't have the teeth to enforce the rules, so they need practical precedents of companies being hit with huge non-compliance fines to scare them into making the necessary changes.

My limited understanding is that generally, it doesn't mean much. However, if you are actively targeting/marketing to Europeans, then you might fall afoul of this, but probably won't be affected legally without hitting some sort of moderate commercial size.

So what does that tell you about dramatic changes?

I’m being ironic, a decent chunk of Europeans want this (I’d say a majority but I don’t have hard numbers).

I am referring mainly to the media hype and how it becomes the issue de jure and then ceases to matter. The media jumps on it and amplifies anyone who chimes or confirms the fear. Why? So they can run a 'if it bleeds it leads' type headline. While there could have been stories after the fact of problems for unpatched systems I don't remember any of those stories. And it is not because everyone patched their systems either.

I mean there were posts online about GDPR where some small insignificant company just folded up for fear of what would happen as if the EU was really going to go after that type of target. Anyone who has been in business for a long time knows that is not what is ever done.

To your point you are right because this isn't even (for US companies) a US regulation and if they have no customers in the EU then it is a stretch to be concerned about it (at least relative which is my point to the attention given to it by the media).

A job well done!

Seriously, that is my impression of all conversations here, US companies trying to understand a law written in EU. I imagine this to be very hard.