Hacker News Reader

Comment by krageon | Hacker News Reader

No, it is not legally compliant. It maybe has lost a little bit of value to actually discuss this as it's been done so, so much. If you are very interested in what is and what is not compliant, you can read the resources published by the EU on the GDPR. They are very legible and relatively easy to understand.

View on HN

Thank you for answering. I assume you are a subject matter expert qualified to interpret the legal documents?

I have actually read some of the resources AND been there whilst customers received advice from lawyers. From what I had understood this model looked dubious.

I have not seen a discussion of this that didn't just end up in talking about morals. Even excluding this I really only wanted input from experts - answers from actual lawyers about GDPR have surprised me compared to what developers had assumed about it...

NB If I had a customer that proposed this model I would still insist that they consulted with their own legal advice before proceeding!

For various reasons I am and have been deeply embedded inside the process of making a medium-large sized business (if you really look you may be able to figure out which one it is - in case you do: My opinions are my own and do not reflect those of my employer in any way, shape or form) GDPR compliant. I have heard proper lawyers explain the terms to different kinds of people and found their conclusions match my own, coming from the literature. I feel like that allows me to talk a little bit about what this legislation means.

Given what you have said, perhaps the literature is not as obvious as I thought. As far as this model is concerned, it would not be compliant with the law as I read it and as I have had it explained to me. I don't deny that a party with enough money might be able to muscle a reading into existence that allows them to do this anyway, but that is I think an established risk of the legal system. For now we must operate with the law as written and broadly interpreted inside the EU.

> you can read the resources published by the EU on the GDPR. They are very legible and relatively easy to understand.

Reading the guidelines is not the tricky part of GDPR. The hard part is: "I have a website, am I compliant or what do I have to change to become compliant?" Mapping the guidelines on to real world systems is where the difficult analysis comes in.

I was implying that this was not complicated because I did not find it complicated. I have since learned that this was a lack of empathy on my part.

Don't beat yourself up! I think the problem is that there is so much FUD and inaccurate groupthink around GDPR issues. Whenever I have spoken to subject matter experts they have pointed out what you did that it actually is not that complicated.

But I guess that the average lawyer knowledgable on GDPR issues would struggle to sort an array even in O(n^2) time so what do they know...

I.e. all things are simple to those that understand them!

Reply on news.ycombinator.com