Hacker News Reader

Comment by clay_the_ripper | Hacker News Reader

Totally disagree. Complicate is not the same thing as following the spirit of the rules. Compliance is proving you followed the rules. Totally different. Also, you have to define what you mean by “respecting privacy”. Something that I do on my website, like basic retargeting marketing for abandoned shopping carts doesn’t feel to me like an invasion of privacy. To you, it might. The rules have to be defined clearly.

View on HN

If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem.

If you have a shopping cart, you must collect billing and shipping information. But you don't need to use it for any other purpose.

By your rule, companies should not engage in A/B testing to figure out how to make their sites easier to use. Because that involves tracking users for a purpose that is not actually essential to delivering content and services.

Does this outcome make sense to you?

(Disclaimer, I have worked in adtech a little bit, but I have worked a lot more with A/B testing.)

I suspect that A/B testing is doable without collecting user information. Except for the OS, of course. But certainly nothing that's not in server logs.

Do you have an error log on your web server? Does that only collect data that is essential or do you do something like log a referer or IP address or user id in hopes that it might be useful un debugging. Is there an access log? What happens if a user asks to delete their data. Do you go back and scrub all such logs? What about if you have a backend service that logs errors about what data it had problems accessing. Or an SQL server that logs bad queries?

It's not so straight forward as you make it seem.

I'm no expert. But typically, when installing web servers, I don't enable logging. I'm more familiar with the issue of logging by VPN services. And I've been assured, by someone who runs one, that logging isn't necessary. Everything can be done in real time, with any "logs" retained briefly in RAM.

I'm an expert. The correct answer is to not log any PII data. Logging obvious PII because it might be useful in some hypothetical future sounds like plain incompetence. If you really need to log PII, log it separately and set clear policies about how this data is stored, how it's replicated, who can access it. If you need to log some PII IDs in common logs, use some fuzzy hashing: good enough for logs, not good enough to restore the original PII.

Thank you.

PII that you don't need can become like radioactive waste. If it gets subpoenaed, and it comes out that you retained and produced it, your reputation may be hosed. But if there's nothing to produce, no problem.

That's actually not quite correct. If you're required by law to retain that PII, you'll be hosed if you can't produce it. But then, maybe you should be doing business in a different jurisdiction.

I'm thinking of Private Internet Access. To my knowledge, logs have been subpoenaed in two US criminal cases. And they just said that they didn't retain logs. But then, VPN services aren't required to retain logs in the US.

> If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem.

That's pretty ambiguous. For example, I'm pretty sure everything Google does that can be considered against privacy can and is tied to the service they provide as features. The fact they keep a history of everywhere you went to can be used by users to recall the locations they've been too. That Google keeps one's contacts can be used in case you lose your phone and get a new one. That Google uploads your voice to their servers is to improve their speech recognition. All privacy violations can be made "essential" by tying it to a feature.

That's really stretching the meaning of "essential to delivering content and services". If I search using Google, all I want is the results. If I have Gmail, all I want is an email account. Anything else is clearly extraneous.

Edit: And they can always offer more. With clear explanation of what information they'll need to retain. And users can either accept, or decline.

> If I search using Google, all I want is the results.

They also remember your searches to provide personalized results, and many people do like that.

> Anything else is clearly extraneous.

Isn't the point of a business to provide the best product or service they can (for the price they ask)? What's the point of a business that does the bare minimum? How are they supposed to compete?

In any case, the point is that it's not as clear cut to know what violates privacy and what doesn't. To tie it back to your original comment:

> The gist of these laws are all the same. Just respect ALL users' data from the start, and you shouldn't have any difficulty with compliance.

They aren't necessarily going to be the same. What is to respect all users' data? There's no concrete consensus on what violating privacy consists of. Is saving searches for personalized results consistent across personal devices violating privacy? Some will say yes, others will say no.

Also, if you err on the side of caution and avoid providing features, you're going to lose edge. It seems to me that it's very important to a business's survival to know where the borderline is.

That's why I would agree with rdlecler1 that

> a small startup needs to ensure they comply with hundreds of regulatory jurisdictions

if they want to have a chance for survival and peace of mind that they aren't even technically guilty of anything in any one jurisdiction even if in their own eyes they did everything to respect their users' data.

The internet probably wouldn't have gotten as big if it weren't for the fact that it's largely lawless. If every geographical region makes their own regulations, only big world corporations will be able to comply.

I don't use Google services at all, but Google still collects data about me. That's a serious problem.

The IRS may see that differently.

Good point, perhaps. I'm not familiar with reporting requirements for online sales in business returns. I did manage a small restaurant at one point, and I don't recall that we had to track customer identity.

> Something that I do on my website, like basic retargeting marketing for abandoned shopping carts doesn’t feel to me like an invasion of privacy.

It sure does to me. So much so that if it happened to me, I'd be sure to never buy from that site again.

I'm with you.

I was on a web site with several items in the shopping cart. I went to the bathroom on my way into another room of the house to get my phone to make a payment on my credit card so I could make the purchase. When I got to my phone I already had one of those abandoned cart remarketing e-mails from the company.

I went back to my computer and closed the browser tab. No sale, creeps.

And what's to stop you from selling that data about what was in my shopping cart to a third party? Would you be compelled to notify me, or ask for my permission? After all, I agreed to share that with you in exchange for the product in the shopping cart. But I didn't agree to anything else.

It's not for the operator of a website to decide what is an invasion of _my_ privacy. It's for the consumer to decide. And that's precisely why we can't rely on website administrators, or the "recipients" of data to determine whether something is private.

I'm one of those website administrators who wholeheartedly welcomes something like GDPR here, even though it would make my job harder. But hey, that's fine. Putting privacy back in the hands of consumers is the right thing to do.

Reply on news.ycombinator.com