Hacker News Reader

I think most of the larger forum software providers have implemented functions to comply with GDPR (i.e. delete, restrict and extract user data).

Concerning backups: If you have a short turnaround time (e.g. 14 days) it shouldn’t be a problem, the legislation acknowledges the fact that deleting data and ensuring data integrity (also in accordance with GDPR) are sometimes mutually exclusive from a practical point of view. You need to make sure that deletion requests also get honored when restoring from backup though, so ideally you want to store the requests in a third system and check them when you restore backups.

Concerning the democratic aspect of participating in the online world I think GDPR actually helps, as before it was not possible to reliably get your own data deleted, rectified or transferred, which is not very democratic either IMHO.

Thank you for your thoughtful response and information. I need time to digest this information to see how it affects my opinions, which might take longer than the half life of this discussion, so my apologies in advance for probably not responding :-)

Lots of software has functionality most users can't use.

You might as well tell them that compilers can provide the functions necessary to comply.

> Lots of software has functionality most users can't use

If you are using software to process my personal data, and you don't know how to do that while protecting my personal data, then I'd like you to stop using that software right away.

>Concerning the democratic aspect of participating in the online world I think GDPR actually helps, as before it was not possible to reliably get your own data deleted, rectified or transferred, which is not very democratic either IMHO

This is where the GDPR has really helped me. I posted a comment on a blog critical of a government data sharing initiative. Nothing illegal, or questionable - it was a simple two sentence opinion comment which I posted under my real name. I didn't stop to think for a minute that it would cause me any problems.

It did. I discovered that I couldn't get to work on any government projects because when a background check was carried out on me, the above comment was found and according to Revenue (the gov agency responsible for such checks) it indicated that I was hostile to the governments IT plans.

I asked the blog owner (same country as me) to please remove the comment, they refused. So I submitted a right to be forgotten request to Google to stop the blog post appearing in searches for my name.

Ireland? In Ireland, civil servants are not allowed to express political affiliation or opinion, so rather than it being a case of "we don't like what you said", it would be a case of "you said something political, and it persists."

I'm not sure if the contract for Revenue is exactly the same as the civil service, but I would presume on this front it is very similar.

Yep.

There have been three occasions where the IT contracting firm I was working for sent me to work on government IT projects as a contractor. None of them were for Revenue, but it is Revenue who do these checks for all other departments. On one occasion my employer managed to pull a few strings to get me on the project (DSP), on the other two I was told no government work for me (HSE and DoT).

On one of the three three occasions I was forwarded an email from Revenue that said "he expresses a desire for personal privacy that indicates he would be unwilling to fully embrace the governments data sharing strategy".

I did write to a few news outlets about this, none were interested. Even the ICCL wasn't interested, which really surprised me.

> I discovered that I couldn't get to work on any government projects because when a background check was carried out on me, the above comment was found

Well, that's kind of Orwellian.

The GDPR facilitated your gov's ability to censor you (via coerced self-censorship in this case).

> On a semi-related note: if you are a small SASS operator wanting to comply with such requests, what are you meant to do about your DB backups that contain data that is meant to be forgotten?

You record that these people need to be scrubbed if you restore backups, and you delete old backups.

The ICO has excellent guidance on this and other subjects:

https://ico.org.uk/for-organisations/guide-to-data-protectio...

> This will have a silencing effect for people wanting to operate non-profit sites as they won't be able to afford to comply with such requests

I can't understand what your question is.

There's absolutely no reason someone can delete spam from their public forum, but can't delete people's phone numbers from items that are pointed out to them.

If they have no search capabilities, and don't use a search capability, they're not required to create one.

The GDPR is extremely easy to comply with- European companies have been doing it for a long time (before it gained the force it has now) because it's largely a unification of existing data protection laws.

The GDPR is extremely easy to comply with

It’s really just a slight mental shift. Instead of seeing data as an asset see it as a liability. Once you do that everything comes naturally.

> [...] it seems to me that an unintended consequence is that non-technical people hosting forums/blogs etc. will be at risk of GDPR requests that they cannot comply with due to lack of technical skills [...]

If it's only due to technical skills then this problem can be solved technically.

The forum software needs to enable people to be GDPR compliant.

> On a semi-related note: if you are a small SASS operator wanting to comply with such requests, what are you meant to do about your DB backups that contain data that is meant to be forgotten?

This hasn't been tested in court, yet. But there are several possible approaches. Like delete on restoration or backing up in slices, so that the personal data becomes anonymous unless you have all the parts.

Don't forget that the "right to be forgotten" is not an absolute right. It doesn't trump everything else. Nobody would expect somebody to sue ESA for their "right to be forgotten" for a public message that they could send to ESA to put on a CD on a probe they sent into space and win.

First of all, it forces everybody involved with personal data to think about how they handle personal data and inform the users about that.

If you state "due to technical limitations, your personal data in backups can't be erased at the time of the request but will be deleted on restoration" up front during the signup of the user, this is already an improvement over the past where nobody knew what happened with their data.

Responding to myself: Of course, this could have been the intention all along. It has long been recognized that big business loves difficult to conform with regulations (regardless of their protestations otherwise) because it is hard for smaller competitors to breach the effective moat that heavy/complex regulations provide incumbents.

It is quite easy to comply with GDPR

- store as little data as needed - protect the data in state of the art ways - make transparent what you store and process and why - establish a process to delete data once it's not needed anymore

It is only complicated if you want to build a company around the abuse of data, as common in the ad world.

How about "data accuracy" - you are obliged to make sure that data you store are accurate and be able to prove that you've asked users to confirm that data are accurate.

How about the duty to export user data on request?

How about player consent management? Consent updates, etc.

Those are not simple thing neither to implement nor to manage, especially if someone will accuse you and you need to prove that you are compliant.

> Perhaps some people will say "good, if you cannot run a site conforming to all laws of the land then you should shutdown". If you think that, consider this: as these laws pile up it will get more and more difficult to operate, leaving only the very tech/law savvy, and big business.

Some things are too dangerous to the public to allow part-time hobbyists to do. We don't allow part-time hobby doctors, or lawyers, or banks, or toxic waste disposal services, and most of us think that's the correct tradeoff. GDPR puts processing people's personal data in the same category; given how much damage a careless processor of personal data can cause, that seems appropriate.

You realise this is equivalent to "the decentralised social web cannot be allowed to exist", and heading in the direction of "the public cannot be allowed general purpose computers"?

Like with almost every other Directive, the EU has made a huge mistake by not including de minimis exemptions in the regulation. In practice this isn't a problem in most countries because there isn't enforcement against tiny operators either, but the fear and confusion it creates is very real.

(On the other hand, without this kind of thing you get phone companies selling your real-time location to criminals. If only there were such a thing as a sense of proportion)

> You realise this is equivalent to "the decentralised social web cannot be allowed to exist"

I'd put it as: the decentralised social web cannot be allowed to exist unless and until a way to do robust privacy enforcement on it can be found.

> and heading in the direction of "the public cannot be allowed general purpose computers"

Slippery slope fallacy. GDPR exists not out of some abstract desire to regulate but as a response to the massive privacy breaches that have directly affected the general public. If and when general purpose computers are shown to have a similar negative effect on society, we can have a conversation about whether regulating them is appropriate given the costs and benefits of doing so.

>Like with almost every other Directive, the EU has made a huge mistake by not including de minimis exemptions in the regulation.

Proportionality in the GDPR is based on the scale and sensitivity of your data activities. The size of your organisation or your technical capability is irrelevant; if you're not competent to safeguard the data you handle in accordance with the law, the EU doesn't want you to handle it. It's exactly the same principle we'd apply to toxic waste - you're not allowed to dump it in the woods just because you're a small business or a hobbyist.

Some examples of why there is no de minimis exemption:

A small charity accidentally sent a newsletter using "to" rather than "bcc". In doing so, it accidentally revealed the identities of 56 people who are HIV positive. It was fined £250 by the Information Commissioner's Office, because of the small size of the organisation and because the ICO was satisfied with steps taken to prevent further breaches.

https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...

A non-profit trade organisation with a single employee worked to facilitate information sharing between construction companies. That information consisted of files on trade unionists, political activists and advocates for health and safety, constituting an effective blacklist of "known troublemakers". The organisation's files were seized by the Information Commissioner's Office, leading to enforcement notices against 14 construction businesses; settlements under the Data Protection Act totalled over £50m.

https://en.wikipedia.org/wiki/Consulting_Association

Hmm. Good examples, but I note that they're both concerned with what the rules call "sensitive" personal data rather than the ordinary kind.

The To/BCC one is both very important given the sensitivity of such data and a horrifyingly easy mistake for most organizations to make.

I feel like it's only easy if the organization has no clue what they're doing... If a standard email interface allows easy slipups of sensitive data in that manner, you definitely shouldn't be using an unmodified interface.

Re: the backups.

Rolling backups, e.g daily and weekly, are fairly common. When the request comes in, just acknowledge there will be a time period before the deletion is fully purged from system backups - as is still legal post-GDPR. The user data will still be removed from production data, which is of primary concern.

I don't want my private info be gathered by people who have no idea what they're doing.

I understand that there's forums/websites run by people who have no idea what they're doing. And regulations like GDPR make sure that services they are using have baseline encryption and guarantees. Like, it should encrypt passwords and private data, don't store it if not necessary and have functionality to delete users.

It is not about people running the websites/forums, it is about software they are choosing to use. Baseline should not be "it works", but it should be "it works and provide reasonable level of security". I know it is some work on part of people who have no idea what they're doing, but ultimately it is up to developers to set up CMS and forum engines to comply.

> They will be forced to either shutdown, or be in breach of law

Or just block EU traffic and ensure no seizable assets rest in the bloc.

Backups has many potential exceptions, some being security and archiving for the public, but there is also language like reasonable steps and to not have the data influence any future decisions.

But backups has to be stored securely, and the data within can't naturally be used if restored beyond exceptions.

It's not CCP? Because Iceland is not a member of the EU although I suppose they could be subject to this somehow(?)

Iceland is part of the EEA and is actually subject to EU rules in order to maintain single market access.

quick guide for sysadmins: what I actually do

https://reddragdiva.dreamwidth.org/606812.html

It should be noted that the right of access to personal data held about new is not new to GDPR and has been law in Europe for years. Likewise, existing law requires personal data are not to be kept longer than necessary.

For example, in the UK both of the above are law since 1998. And that only implements an EU Directive from 1995.

Sometimes I feel that the main effect of the publicity around the GDPR has been for many people to discover existing laws...

regulation leads to less freedom. yes, it is known.