Hacker News Reader

Comment by whimsicalism | Hacker News Reader

4. have a system for tracking every single dataset you have lying around including ones that might just be for experiments and in a different format and purge people who have requested to be forgotten or be fined 10s of thousands of dollars

5. frequent new legal interpretations that become the basis of enforcement and then you have to rearchitect the whole way you were handling data

always good to impose onerous rules on R&D when you are critically losing the R&D and capital race

View on HN

4. If it is personal data, you have to know where they came from, where they are stored and why. If you don't want to do that, then invest the minimal effort it takes to anonymize them during ingestion and then you can do whatever you want with them.

5. Now that is just false, or you have some really bad architects, if you are so sensitive to new legal interpretation (which there haven't been any significant ones)

Why does everything needs to be pro EU or anti EU. Yes, consumer privacy is more protected in EU. And yes it has directly caused EU R&D budget to become significantly smaller. And yes it has led to ad revenue decrease and created more problem for small companies who can't use non targeted ad.

If you are arguing against any of these, for which there are lot of data I think you are not up for discussion.

Where is the GP taking a pro-EU or anti-EU stance? Where are they arguing against "ad revenue decrease" which "created more problem for small companies", or the impact of GDPR on the EU R&D budget?

>And yes it has directly caused EU R&D budget to become significantly smaller.

Source?

1. all text data is personal data so yeah you can’t anonymize it, you need to have. a central metadata tracking of all datasets - this is a more challenging problem than it appears from on high.

2. i don’t see how you can look at, for instance, random EU jurisdictions not allowing Google Fonts on your website due to GDPR ( but only some jurisdictions and only years after the law was passed) and see that as inconsistent and moving target enforcement - and that is just one well known example of many many many

> all text data is personal data

Where did you get that from lol

publicly? https://gdpr-info.eu/issues/personal-data/

Quote me the exact part because I don't think we're reading the same text

Well, yes.

Handle PII as you would handle live ammo. Always know where you store it. Don't toss it randomly. Don't experiment with it; neutralize it first!

Use it to hit particular targets, and never shoot it at random directions.

> Handle PII as you would handle live ammo.

But thing is, PII is not "live ammo". Artificially designating it so simply raises the cost of working with it. Doing that designation through an amazingly dumb law just makes EU Internet startups unfeasible. Meanwhile, US and Chinese startups flourish since they don't have this limitation.

Self-own, really.

I worked for a number of American companies, not beholden to also serve EU markers. They still did not demonstrate any cavalier attitudes towards PII though. Nobody wants to be the subject of some data leak front-page story.

Of course not, but there is a huge difference between market-demanded standards and quality and government-mandated ones. In more ways than one: cost, difficulty of implementation, UX, etc.

A real, practical example is that US web startups do not have to annoy their US users with cookie banners for simply using Google Analytics on their website - like the EU ones must. Underneath, the implementation and PII data protections are exactly the same, but the UX is night and day.

Yes. You should have a system for tracking every single dataset containing personal data: that data does not belong to you. You are just its steward.

You should have had such a system even before GDPR came into existence, but after it did? Your organization's lack of organization is not the legislator's problem.

I am describing a higher level of compliance than like 95% of shops that have data do in practice

Even this website you are commenting on isn’t GDPR compliant lol, they won’t delete your text if you request.

It sounds like 95% of shops - of shops you know well enough to have an opinion about - should get their shit together, then. Why should people tolerate their sloppiness?

Not deleting texts does not breach gdpr rules.

Gdpr is about personal data, not anonymous (you can always put your real name, if you want) texts. Nor does hn do any tracking.

Try actually looking at the gdpr, easily findable [even using google search] - it's not what you seem to believe it is.

Reply on news.ycombinator.com