GDPR: Removing Monal from the EU(monal.im) |
GDPR: Removing Monal from the EU(monal.im) |
> [A]n identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
I think the principle is that since an IP address could be used to identify you, it is considered personal data.
> Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person. [ECLI:EU:C:2016:779]
I’d love the opportunity to add GDPR to my current list of specialities.
>> Yes.
> Can you tell me their email address?
>> No.
This is an era many of us won't regret.
Maybe there's a legal precedent for that sort of thing, but I'm not aware of it.
Many countries outlaw face coverings as they imply correlation with lawlessness.
The direct linking of IP address as PII flies in the face of that. If I am logging IP addresses for security and to monitor against abuse, and I in fact determine that an IP address is abusive, it behooves me to have any/all data that ip address used in my system to try to identify them.
The right to be forgotten .. why just online? Why just digital?
What if a shop owner or waiter in small town notes which customer like what, or what client tips well. Which local has annoying kids that she lets wander an vandalize the store.
If that owner/waiter writes that down in a log, and shares with co-worker on next shift ... is that in violation. What if they don't write it down and just have a really good memory ... what if they just 'organically' get a reputation and word gets around.
Is old wives gossip illegal under GDPR , or the "sterotypical" Italians mothers who keep an eye out on all the kids in street and report to each other who is doing what.
Plenty of stores and bars will have a list "don't take personal checks from these people" ... are those types of lists not allowed anymore?
If the GDPR was JUST limited to "customers" or people who have explicitly created accounts that might be one thing, but over reaching to say ANY apache webserver that automatically logs IP addresses had to be GDPR compliant is absurd.
If I post a tech blog with how-tos , personal ramblings, or even example code projects I release as open source that you are completely free to use or not use ... why do I have now have some obligation to you? You chose to walk up to my storefront and look inside ... I'm free to remember whatever I want about you while you looked around.
The US passed pretty broad overreaching Computer Fraud and Abuse Act [https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act] that many have argued is so broad that a violation of TOS could be considered abuse/hacking. If you view my site without agreeing to my TOS, should I be able to have you prosecuted?
But despite the assurances of many here that it's not hard to comply, I'd probably have shut down the servers of my own hobby non-profitable location data gathering website as well, simply because even reading the GDPR document would be too much effort.
https://gdpr-info.eu/recitals/no-18/
> This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. 2Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities.
Is there any actual requirement within the GDPR that this needs to be a dedicated person, or does being a DPO just need to be someone's responsibility, e.g. in the case of a one-man open source project the guy who runs the project?
> The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests.
I guess you could say that it is literally impossible for the DPO to not have conflicts of interest if the DPO is also the owner and manager of the company.
More:
https://ico.org.uk/for-organisations/guide-to-the-general-da...
> The DPO must be independent, an expert in data protection, adequately resourced, and report to the highest management level.
If you're a sole proprietor and managing data at volume and sensitivity levels that a DPO is required, I hope you're an expert at protecting that data..
Also, my understanding is Germany allows for whistle-blowers to take a cut of fines. Language in the GDPR calls for over-estimating damages for loss of PII when compensating individuals as well.
Generally, I appreciate the GDPR. That said, it's a huge burden trying to go through many dozens of workflows, technical or otherwise, where (typically minimal) PII is recorded, catalog them, limit (and purge) intake of data to bare minimums, create documentation supporting said workflows to be able to provide the SA's, create a plan for being able to search ALL those workflows/databases/spreadsheets/apps that have PII to supply that data upon request, and then be able to delete all cases of such data upon request.
Turns out that's actually a mountain of work. It will probably force us to significantly improve workflows and combine data repositories moving forward but it's a large burden up front. Likely many hundreds, if not thousands, of hours for our fairly small enterprise.
The fine, 1000 pounds is proportionate given the size of the entity it is levied against, the resources at their disposal and the turnover of the company, if the company had been much smaller one would hope for leniency but the fine would have not been levied at all or it would have been 1000 pounds, no middle ground there.
You'd hope they learned their lesson.
Two view points to this:
1) If make to specific, big players will find a way to slip through the exceptions and game/lawyer the system
2) So vague , that only the "big players" will have the infrastructure/legal approval to actually guarantee 100% compliance. Smaller fish that the reward just doesn't justify the risk/uncertainty will certainly pull out of the market.
If the law is about "supercookies" and targeting an individual throughout the entire internet ... it should say that.
If its about the transfer/monetization of the aggregation of data ... PII being sold for money or some other in-kind transaction ... say that.
If a single entity uses a cookie and retains data for one single domain and that is ok ... say that.
If retaining logs that contain an IP Address and the logged in credentials are ok to keep for security auditing. .... say that ... if its only ok to store them for a year(??), 6 months(??) , 1 month(??) ... say fucking that!
If a company/site is aggregating PII of over a million unique users is troubling and should be specifically bound by these restrictions and need a DPO ... say that.
If a site only has a few 1,000 - 10,000 Unique PII records/users of note , and is not the focus of these regulations .... say that.
Give concrete examples, lawyer the shit out of it ... leave open for amendments so when abused can be modified.
It's just a shitty law trying to fix an already shitty situation.
That's his right, go him.
He didn't have to write a ton of incorrect nonsense about the GDPR though. He could have just skipped to the last step.
GDPR compliance is not actually that hard - I'm in the middle of doing it for a very large company - as long as you're not storing information about users it's almost trivial tbh, but there are a lot of unfortunate vague terms in the law (the intent is rather clear however).
The reaction to this law in the US is rather funny because the rest of the world has been dealing with strange US laws for decades on the web... finally something bites the other direction and people freak out.
i'm quite positive that i've seen people call for europeans to not do business with american businesses on account of said us laws (in other HN threads).
I suppose the USers would call that "aggressive marketing".
I think this guy fell for it.
This is the part that most people seem to miss.
People just don’t want to.
Article 6, Paragraph 1, seems to cover those two parts of data collection. Logging a user's IP for security is acceptable, as is logging for a legitimate interests of the user (or operator) as long as it do not conflict with the interest of the data subject in regard to their need for data protection. APNS push tokens seems to fit that description quite well.
Where is the scale balanced on this ... will it be the same in each of the different countries implemeting it?
>as long as it do not conflict with the interest of the data subject in regard to their need for data protection
Article 6.1.f
>processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
So ... I can retain IP records in my logs , as long as they aren't a child?
The other way to see it is a bridge to the US regulation COPPA, where operators in the US and EU now have to follow the same rules in regard to children. In this case Monal would have to move out of both EU and US in order to avoid the regulations in regard to children.
You’re allowed to track ips in your log, if there is a reason for it and you only keep them for a reasonable amount of time.
You do need to gather consent for push messages. But you can do so by simply asking your users, and frankly, you should always ask your users before you spam them, but it’s obviously going to be a little work to implement.
This is an overreaction, especially because no one knows how the GDPR plays out until it’s been tested in the courts.
This seems pretty clearly a case of 'Legitimate Interest'. Filling in a couple of page word document (a LIA) and keeping it somewhere on the off-chance that someone queries you, is likely sufficient from my understanding. (This is not legal advice).
/Where dust == blocking EU
He doesn't need one
> Crashes
So don't send the users IP with the crash report?
> Push
I don't know enough about this, but:
"APNS push tokens are associated with devices which can be traced back to a user if combined with info on the originating XMPP server."
I didn't think monal ran their own XMPP servers? If they don't then is there really a danger of someone combining the data from the two services?
> Honestly, I do not know if XMPP federation is legal anymore in the EU with GDPR.
I have no idea, but if the monal developer isn't running any XMPP servers then is this even an issue?
This all seems like someone who doesn't like GDPR having a bit of a tantrum and interpreting the laws in a way that makes it seem like they are in a worse position than they actually are.
I do not have the resources to hire a Data Protection Officer (DPO) or EU Representative as required by GDPR. I do not have designated EU contacts."
What? Where does it say in the law that:
a, you need one
b, it cannot be you
I mean come on, this is just a very ignorant post from the author.
I already had to fend off implementing some ridiculous features. I've pushed against misconceptions and use of non-existent terminology that's not even in the law. People are taking info from all kinds of sources, some of them sketchier than others, despite the existence of official EU guides, and the law itself.
But I bet it will be easy to comply for most non-adtech/tracking businesses. And as an internet user, I'm looking forward to better data exports, data removal and more transparency.
Article 4 point 1 in the GDPR indicates this (unless you can somehow prove that the IP is not related to the person, which I think we all know it effectively is in most cases)
1) You are overreacting. The EU isn't going to come after some small fry operation, or some non-business entity.
This is an easy thing to say when you're not personally exposed to the risk. Would advocates of this position be willing to personally indemnify open source projects / side projects against GDPR enforcement? I suspect not, but perhaps there's a business opportunity in giving them the opportunity to do so. Sort of a GoFundMe for peer-to-peer insurance.
2) The GDPR is all about not being a jerk with your users' data. As long as you don't do that, and do relatively minor things X, Y and Z, you're totally fine.
This flavor of argument might actually be true, but if I'm assuming the risk I'm probably going to want to hear it from someone with skin in the game, like a lawyer, who I can point to if it turns out to be false. Even if I had the desire to read through the law (I don't) and understand the specific implications for my project (I wouldn't), the very act of doing this represents a cost that I could more simply avoid by excluding EU residents from my service. I'd choose the latter path every time, and put "support EU residents, check into the legal implications of GDPR" on the roadmap, for "someday".
3) You're exposed to millions of risks anytime you do anything. This is just one more and you're making a big deal of it.
Often this accusation comes with a subtext that you're trying to prove some political point, suggesting that you're making a decision in bad faith to "punish" the EU. Well, I personally think something like the GDPR is needed, and have no particular axe to grind, but I also have no idea if the legal exposure is serious, and no particular desire to put in the work to find out.
Yes, business, or really any activity, involves legal risk. In this case though, the risk is pretty serious, first of all because the penalties (20M Euros max) are serious, and secondly because it will be very difficult to claim that you've never heard of the GDPR. If Tonga creates some law impacting side hustles on the internet, at a minimum I can credibly claim to be unaware of that law. The GDPR on the other hand has been all over the news for weeks. I've clearly heard of it (especially now that I've commented on a discussion of it on HN).
My feeling is there's a real risk that this law will lead to a general practice of non-EU individuals, and non-EU startups launching MVPs to at least temporarily block the EU to avoid unnecessary risk. That's not the intended purpose of the law, but laws have unintended consequences all the time. If the EU wants to avoid this unintended consequence they should provide a clear, objective, and cheap (in terms of both time and money), set of instructions that will allow projects like monal to continue operating there. If such a set of instructions exists, I haven't seen it.
I get that the GDPR regulations seem quite complex and daunting but his usecase seems pretty simple to me.
Harsh words but I feel they're warranted: If you don't want to treat my private data with the due diligence you should, then we're better off not using your service.
> we're better off not using
Just pointing out that some people may want to choose how they want their data treated case-by-case, instead of having no option to use the website because its blocked
Yes:
https://gdpr-info.eu/art-84-gdpr/
> Member States shall lay down the rules on other penalties applicable to infringements of this Regulation
So every country can create whatever penalties they want, as long as they are "effective, proportionate and dissuasive".
No, it's an easy thing to say because we have over 20 years experiences of regulation around data protection. The regulators send a letter asking you to come back into compliance unless you've been really bad. They only move to fines if you ignore them.
Here's a company that was handling sensitive personal data (medical data). They have a legal obligation to register with ICO. They didn't do so. Imagine what would happen under HIPAA. Now read what happened in EU.
https://www.bloomberg.com/news/articles/2018-04-26/u-k-healt...
People freak the fuck out about the big fines, but they don't realise they're conditioned by the pathologicaly dreadful US system which aims to over-charge and over-sentence at every opportunity.
Here's some examples: The UK Criminal Prosecution Service sent some unencrypted DVDs through the postal mail. Those DVDs got lost. They got a fine.
Some time later they did it again - this time the DVDs contained interviews with children who were the victims of sexual abuse.
Think about this for a bit: no encryption, no secure mode of delivery, a repeat offence, incredibly sensitive personal data.
Sure this requires the maximum fine, right?
https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...
No. Only £325,000 out of a possible £500,000.
But I was an american being advised by a top tier british law firm. How is a random guy releasing free (or cheap) services on the internet supposed to deal with a situation like that? The arbitrary nature of the enforcement is exactly what makes this a problem. If there were strong penalties, but clear ways to remain in compliance, this developer might have made a different call.
If I know I'm technically out of compliance, and I don't have a high powered lawyer telling me it's not a big deal, then I'm not sleeping well. And if I can solve the problem once and for all by taking the unfortunate step of simply cutting EU residents off of the service, then I'm going to at least consider that option, and probably take it in the short term.
If the EU wants to reassure people that "The regulators send a letter asking you to come back into compliance unless you've been really bad. They only move to fines if you ignore them." then they would be well advised to make that very clear. If they don't, you're going to see more of this, and really, if it's true, why wouldn't they?
"If such a set of instructions exists, I haven't seen it"
Maybe for me it is easy set of instructions, for some maybe not.
I mean, this isn't rocket science. More regulation is always going to lead to businesses leaving the market. This is not a bad thing, if your country is willing to put up with it. My guess is that the EU will not care about monal exiting the IM market, and their legislature has decided that they want to prioritize this regulation over the efficiency of the IM market. That's fine -- that's the EU's choice to make.
https://en.wikipedia.org/wiki/Hazard_analysis_and_critical_c...
> The ICO said in a statement that it would only consider “enforcement action” if a company failed to register despite ICO advice.
And they keep saying this.
A better solution would be a webpage, hosted by the state of Idaho saying "Here's what we're after, don't do these things, and you're in no danger." Followed, hopefully, by a list of things that you weren't planning on doing anyway because you're not a jerk, and that are crystal clear so you don't have to speculate about how selective the attorney general of the state of Idaho is in prosecuting these sorts of crimes.
If you are running a small business and you feel that you won't be able to operate your business because of the GDPR consider all those other laws that you have to be in compliance with as well. If that's your attitude towards legal compliance then you should probably shut your business down completely rather than to hope that just ignoring European customers is going to make the bogeyman go away.
Legal compliance is a requirement for any business, and privacy law is just one more thing to take into account and for a small business that does not process super sensitive data (such as medical information or financial information) the costs of compliance are negligible. They're not '0', but then again it is a business and costs of doing business are the norm.
Similar arguments apply to the other examples you use, I see your point and there are valid reasons to not enter a certain market because of the legal climate there but the point I am trying to make is that the OP has not raise any valid point at all other than 'I don't want to comply'. And that's fine by me but then don't bother dressing it up in a bunch of made up requirements.
I've bought plenty of raw mil cheeses (domestic and imported) in the US.
http://www.realrawmilkfacts.com/raw-milk-regulations says: "In 1987, the FDA mandated pasteurization of all milk and milk products for human consumption, effectively banning the shipment of raw milk in interstate commerce with the exception of cheese made from raw milk, provided the cheese has been aged a minimum of 60 days and is clearly labeled as unpasteurized."
As many cheeses are aged more than 60 days, the ban on "raw-milk cheeses" is basically an urban myth.
https://www.npr.org/2017/05/26/530257536/after-being-banned-...
Kinder make a different version of the Kinder Egg specifically to comply with US law.
https://www.kinder.com/us/en/kinder-joy
>Are the manufacturers of bovril overreacting by refusing to create a separate production facility that uses only beef sourced from outside the UK?
Bovril was briefly made without any beef content because of the BSE issue.
https://web.archive.org/web/20071201114613/http://www.unilev...
No, it's not, but it is legally imposible to import them, and trade them in interstate commerce (many—I think still a majority—of states allow raw milk and raw milk products, though the FDA prohibits most directly and sets standards which effectively prohibit the rest in interstate commerce, including foreign imports.)
Not that that really changes the point you are illustrating.
And they are a business. And as a business they have decided to get out of Europe as the above costs weren't worth it to them.
The article is spreading FUD and inciting others to spread it even further in the comments.
> There is a cost associated with trying to figure out GDPR regulations, finding a lawyer, vetting their feedback, acting to hire folks, changing UI to give user an opt out, implementing that in the system etc.
The GDPR is online, and has been for a long time, you don't need a lawyer but if you feel that gives you more comfort then fine, you don't need to hire anybody, that is just plain nonsense, and changing the UI to give users an opt out: that should have been done two years ago.
> All these things don't drop from the sky.
Indeed, this did not drop out of the sky. It has been in the works for years.
> And they are a business. And as a business they have decided to get out of Europe as the above costs weren't worth it to them.
That's fine with me, the way in which it is presented is not fine with me.
Opt out is illegal under the GDPR - it needs to be opt in.
This guy doesn't like regulation and is playing to the crowd for sympathy.
I've been in continuous operation with my businesses since 1986 and I guarantee you that I've been compliant with the laws as much as I'm aware of them. The major transgressions involving business assets were parking tickets, speeding tickets (< 10 km/h excess by an employee of the company in a company vehicle). Other than that not so much as a copied piece of software. Oh, and we were once late with a tax filing because the bookkeeper messed up, they absorbed the fine.
Running a small business in a way that is compliant with the law is stupidly easy: know the law.
Now, there is one thing that I did that I know full well was against the law and that came about as a result of me getting very angry about some stuff that happened to a friend of mine. In that particular case I saw my actions as akin to civil disobedience. In the end it got superseded by others doing the same thing much better and at a much larger scale but I would have fully accepted the consequence of breaking the law in that case. But it would have been a conscious decision to break the law.
Incidentally: not knowing you are breaking a law is no excuse for breaking the law, ignorance is not a valid defense.
This is just ridiculous, patently false and making an excuse for reckless behaviour. Only specific laws apply to your business domain and if you aren't complying with them then you are wilfully breaking the law and putting your customers and the general public at risk.
Own a cafe ? You should be cooking in a safe manner. Sell a car ? It shouldn't kill people. Run a website ? Make sure your user's privacy is respected.
If you want to criticize local laws applied internationally, abolish the US.
> Legal compliance is a requirement for any business
You are required to comply with the laws of your country, not those of other countries.
No, you are required to comply with the laws of any country you do business with. This applies to any type of business, and I don't see why "it's on the internet" appears to be the main counter-argument.
If I buy something from you (via snail-mail or on the internet) and it doesn't follow the requirements of the consumer law in my country, I can ask you to comply with the laws of my country. If you refuse, I can report you and you will be fined (if you don't pay, then you can have your right to do business in my country revoked). In practice most cases won't escalate that far, but the principle is the same.
If you are respectful of other people's privacy then there is very little chance that you will be found afoul of the law and even if you should be then you will be warned to become compliant long before you will be fined.
This whole discussion is beyond ridiculous.
Imagine the rest of the world reacting to the DMCA this way which has far wider scope and effect.
- Appoint a data protection officer (himself)
- Write down the processes of how he stores data (we keep it on this database, hosted at x provider; that provider is called the data processor) and how he deletes data whenever the subject of the data requires it.
That's it.
https://itunes.apple.com/us/app/monal-free-xmpp-chat/id31771...
He is not running a business but an open-source project!!!!
Does a cost become acceptable because it's the norm?
Please elaborate. I was unable to perceive the legal depth of interpretation.
> you should probably shut your business down completely rather than to hope that just ignoring European customers is going to make the bogeyman go away
Businesses limit liability and legal exposure all the time.
It's a tradeoff, as all things are.
As you wish:
> I frequent Europe and do not want to get into legal trouble on vacation.
There is no precedent for violators of EU law regarding privacy to cause people to be harassed on their vacation (yes, there are examples of this on the US side but that's not what we are discussing here).
Worst case you would be warned to become compliant, then if you persist in not being compliant you might be fined, then if all that fails there might be a request for extradition but I highly doubt it would even get that far. Time will tell. What will definitely not happen is that out of the blue you will be yanked from your bed in Paris or Barcelona because you decided to refuse a request for deletion.
> The days of someone making something, putting it on the internet and offering it to the world seem to be over.
No, the days of harvesting data and building profiles without consent are over. You can make something just like you did last week and you can offer it to the world just fine. Do take care of your users data, be a good steward and try to do your best not to get hacked.
> do not have the resources to hire a Data Protection Officer (DPO) or EU Representative as required by GDPR.
The GDPR does not have this requirement for the kind of business the article writer has. No need to hire anybody. Pure nonsense.
> Tracking crashes with Crashlytics introduces new issues because it is posted to Fabric from a user’s device, IP addresses are in the logs this is personally identifiable information (PII). Crashlytics is GDPR compliant but the burden is on me to show regulators that I am compliant points back to the need for DPO.
Having a DPA in place with Crashlytics takes care of this, that's all the burden there is, in fact, Crashlytics most likely has a standard form for this because they will be entering into DPA's with a lot of companies in the next couple of weeks/months.
> Even though no message traffic passes through Monal’s sever, registering for a push does make an HTTP call which logs a user’s IP and this requires GDPR compliance.
Everything you do requires GDPR compliance but not everything is impacted by the GDPR. In this case logging the IP is fine, and then when you're done with the data you can get rid of it. No need to keep it indefinitely. And that simple trick: remove data that you no longer need is going to go a long way towards establishing GDPR compliance.
> APNS push tokens are associated with devices which can be traced back to a user if combined with info on the originating XMPP server. Obviously, this is needed for a notification to be delivered to the right person. However,the fact that it can be combined to identify a person makes it PII.
So do not keep it longer than you need it.
> I believe in privacy but I do not have the resources to meet the letter of the law for compliance especially with respect to retention and processing these tokens.
But he does have the time to write blog posts complaining about having to meet the letter of the law. That time would have been better spent actually reading the law and figuring out the impact.
> Honestly, I do not know if XMPP federation is legal anymore in the EU with GDPR.
Of course it is.
> EU user data is sent out of Europe constantly.
Indeed. And that won't stop because of the GDPR.
> GDPR is written such that a user cannot agree to a user agreement that gives up GDPR requirements it’s not a matter of saying you agree to X by using this service.
Yes, that's the whole point. You can't blackmail your users to opt-out of the law by virtue of withholding your product, which is a very very nasty way of trying to deal with a legal issue, rather than to face it head on and simply attempting to try to comply.
> GDPR compliance is something the XSF is talking about right now.
Good to see not everybody has the same attitude.
The way I read it this person is not trying to limit their liability, they're simply trying to pretend the law doesn't exist, have come to the conclusion that that won't fly and now blame the law for their laziness and negative attitude towards the privacy of their users in general.
If he really cared about the users privacy then he'd at least make a serious attempt. This blog post does not indicate a serious attempt was made, it reads like someone looking for excuses.
I am all for fair taxation and privacy, but the EU should start creating the mechanisms that make it easy and automatic for startups to comply with stringent requirements instead of leaving the burden upon them.
This is the broken window fallacy. You're not creating jobs, you're destroying wealth.
That’s illogical and not the way that any business evaluates what activities to pursue or forgo.
You’re casting aspersions on this one guy and implying that he must be up to something shady, all because he’s chosen to not serve a market that has decided to pass some horrible regulation that you happen to like. Unbelievable.
You can’t have your cake and eat it too. The EU can pass whatever laws they want, but the rest of us are still free to tell you to pound sand.
No, what we're saying is OP can't complain about the burden of this onerous regulation when the fact is that almost none of it is relevant to OP and he'll have to make only minor changes to be compliant.
Several of the claims OP made are flat wrong and it's trivial to show they're wrong by simple web searches.
At the very least read this: https://privacylawblog.fieldfisher.com/2016/what-you-think-y...
As a new and small construction company we simply don't have the resources to comply with all the building codes and the related paperwork. I just can't afford to meet all food safety requirements, I just want to provide free meals for homeless people in my spare time. I just built this car from scratch for myself and now they tell me I can not drive it on public roads just because I don't have the time and money to meet the required standards?
We sleep-walked into a society where the expectation is that any and all data is scooped up and sent off remotely without adequate controls and I think it's great that the EU GDPR is making people wake up to the scale of it.
Suggesting that XMPP federation isn't compatible with GDPR seems like an over-reaction, isn't that like saying that SMTP isn't compatible?
>1. The controller and the processor shall designate a data protection officer in any case where: (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or (c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.
I thought this guy was a single person who put something on Github. How is he required to appoint a DPO? What kind of large-scale processing of personal information is he doing?
All of our infrastucture has to change to honour that. If you cannot honour that change, maybe you shouldn't have been handling personal data.
I don't have any knowledge about monal.im (don't know what it is - some kind of im client?), but this person is making some claims:
- he needs a data-protection officer: no, only larger orgs handling lots of personal data need this. If he's making an im-client and not servers that store data he certainly doesn't, but I don't know what his setup is.
- crash analytics: This can be handled by telling the users clearly that you'll be gathering the data (and defaulting to not gathering if they don't actively approve). As long as you have a proper PURPOSE for gathering and storing the data and don't use it for anything else you're golden. You do have to document this, in case of a review (hyper-unlikely).
- Push: he's getting a message and storing the device/ip combination. This seems to be central to the service he's providing. Therefore he can and should put that in the description/terms of his service (as he cannot deliver the service without this). As long as it is clearly explained to the end-user this is fine, and he can keep doing it. If he stores it and does anything with this data other than the central purpose that he informed the end-user of he's in violation. I'd suggest putting it in clear text in front of the end-user and deleting the data as soon as it's no longer needed. Don't do any non-approved analysis on it. If you want to analyse - ask for permission.
XMPP federation may be a problem, I agree with that. The problemer here (as I see it) is that each service getting the personal data must only process it for the purposes explicitly agreed to by the end-user and honour any subsequent notifications of rectification and deletion. This is a hard nut to crack indeed.
Does the author seriously believe this could happen? Enforcement of GDPR is similar to antitrust law. A regular police officer isn't going to fine you for that.
The author's anxiety makes as much sense as not traveling to the United States because you're worried that your one-person pottery business might be considered a monopoly under the Sherman Act.
> In July 2006, their then-CEO, David Carruthers, was arrested while changing planes in Texas on the way to Costa Rica from the U.K. In April 2009 he pleaded guilty to federal racketeering charges, and in January 2010 was sentenced to 33 months in prison.
> BetonSports plc is a British online gambling company founded by Gary Kaplan in 1995. The company was one of the biggest players in the United States online gaming market, drawing in several billion US dollars in wagers in the early 2000s.[1] In June 2006 US authorities indicted the company and a number of its executives on RICO, mail fraud, and tax evasion charges arising from its supplying online betting to customers in the United States (the alleged crimes took place before the adoption of the Unlawful Internet Gambling Enforcement Act of 2006).
This is about federal crimes committed by executives of a billion-dollar company.
OP seems to be a solo open-source project, and violating the GDPR is not a criminal offense. This isn't even close to being comparable.
You certainly don't need to hire extra people like author suggests and federation should be just fine. (it's essential to what the service does)
We're talking about chat.. you shouldn't be logging the contents, at most a bit of metadata to prevent abuse (eg. a connection log to identify and block spammers).
If you don't store that metadata longer than needed (a couple of weeks? storing it for years would be hard to defend) you have legitimate reasons to keep it, and don't need to worry about deletion requests
Even if it was in the EU, it wouldn't require a DPO, and your use of IP addresses is very reasonable and within the standard allowances which don't require user consent.
Maybe bother reading _anything_ from an official source before coming to this conclusion? This reads to me more as something you want to have a rant about because you don't like it - rather than as any kind of pragmatic decision.
We’ve spent tons of money & interacted with lots of official sources trying to get opinions about what GDPR means and it just isn’t available.
Everything is a risk mitigation technique right now with no real answers in sight. If I had any personal projects serving traffic in the EU right now that weren’t profitable I’d likely shut them down.
I think it’s likely that the regulatory agencies will act with restraint and this will all be hysteria without merit, but I’ve seen enough legal opinions to know that’s not the worst case scenario.
> For the 3.7 million small businesses with 1 to 4 employees, the Census Bureau figures show average annual sales in 2007 were $387,200.
Given that, who wants to risk a 20M fine? All this advice in this thread to do this, run it through a lawyer (lawyers are expensive especially international ones), makes no sense to the majority of the businesses in the USA: there are less than 8M employers in the USA and a very small percentage has a yearly turnover of even a mil not to mention the ~600M USD where the fine changes from a constant to a percentage.
To give you another idea of how much money this is, about a quarter of public companies have less than 25M USD market cap.
As a dual Canadian-EU citizen I am stupefied by this law.
European regulation typically treats personal data as being the property of the person being identified; US tradition considers data generated by a company to the be the property of that company, not of the person.
This made the whole massive unnecessary panic by primarily US-based small companies much more understandable to me.
GDPR can be scary for developers, because nobody actually knows how a website or app is supposed to work (I have yet to see a single example), and it requires a series of steps that are not trivial on the administrative side. The Right to be forgotten is the easy part. Having to document everything you do and introduce data-dumping mechanisms that are both anonymous and secure is administrative burden. Having to do that for every little project that you release, even if it has 10 users, is a bit too much. Many developers cast a wide net, releasing products often, and this is practically unnecessary work unless you have a significant amount of users.
Introducing opt-in forms everywhere is also not great. It didn't work for Windows Vista so why do we expect this to work on the web? Opt-ins for things like cookies should be implemented on the browser. What's the point of warning a person before sharing their email? What's the point of warning them even you 'll install a cookie? IP addresses and cookies etc are integral parts of the HTTP protocol and the browser so why not introduce anti-tracking regulation that targets browser vendors and telcos instead of introducing regulation that targets every developer on the planet? It doesn't seem like an optimal plan imho. The example of the cookie law (for which it's hard to argue that it has not utterly failed) should act as a bad precedent, not a good one.
It's easy for US developers to be positive of GDPR because they can avoid the overreaching parts, but for us in the EU its something we have to abide by 100% of the time. I 'd like to hear what other people think about those, because otherwise i hear a lot of emotional praise for GDPR which is blind to how problematic it is at day 0.
You only need a DPO if you are a public authority, if you do large scale processing or large scale processing of sensitive data (ambiguous in the GDPR).
If you collect some data, all you need is a privacy policy outlining such, stating what you collect in general and that your legal basis for doing so is to provide the user a service and to monitor for app crashes / bugs - both within your legitimate interests.
Many people have interpreted GDPR to be stricter than it is. In fact, those who have to do the most work are those that cause incredible damage to individuals when they lose data - especially those that have had recent, massive data breaches e.g Equifax.
Are 1 million IPs in my logs 'large scale'?
I've got a call with a lawyer on Monday to clarify some bits of the GDPR. Number one Q for me is "how far can you take legitimate interests?".
Some lawyers are advising that marketing data and usage falls under legitimate interest, in a way that these higes drives for consent seem unnecessary.
If anyone else has any questions, I can ask and feedback. I'm sure I'll have those questions too.
"personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, [...] genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation"
Then I actually spent a little time to find out more and, as someone who cares about privacy, quickly realised the positive intent behind it, and how simple it is to comply with in principle: let users know what data you collect and what you do with it, and give them the possibility to request it or request it's deleted.
TBH, if someone requested any of this, I'd do it without the GDPR.
A DPO is most certainly not required by all organisations[0], and I would be suprised if it applied to this project. I know lots of blogs are saying it is, but it is simply untrue. I'm not saying that this totally relieves the burden however.
[0]:https://ico.org.uk/for-organisations/guide-to-the-general-da...
How are they suppose to fill the positions by 25th of May?
Most certainly simply untrue?
A lot of people are claiming that a DPO is required. GP is saying that a DPO is most certainly not required and that the claim [that a DPO is required] is simply untrue.
Lots of people are responding to the DPO side of this sentence, saying that it's not as onerous as the author of this article is making it sound, but as someone who's also not based in the EU it's the "EU Representative" part that I'm more worried about myself.
Article 27 says:
> (1) Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.
Article 3(2) is the bit that says the GDPR applies to processing outside the EU of EU citizens' data etc.
> (2) The obligation laid down in paragraph 1 of this Article shall not apply to: > a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or > b) a public authority or body.
It's clear here that not everyone outside the EU needs to have an EU representative, but 2a is wordy and confusing enough that it's real hard for a non-EU non-lawyer to figure out with certainty whether or not they need one. The ambiguous combination of 'and's and 'or's don't help, but 'unlikely to result in a risk to the rights and freedoms of natural persons' sounds like something that's ambiguous enough on its own that you might need an EU lawyer to actually interpret it.
Read the law or, at least, read the official FAQ. Your evaluation of the impact of the law on your project is lazy.
It looks like a simple thing like embedding a Youtube video in your blog post is no longer so simple. As well as loading any external JS dependencies.
The fault lies entirely with those companies, which did the wrong thing with impunity until it was literally outlawed.
Is it possible to self-host something that handles user data (name, comment, IP address) and comply with this regulation? What if there's more data, federated data? Can one just spin up an instance of Friendica, for example, or are there additional steps required for compliance? I'm honestly not sure anymore.
1. Isn't this person allowed to be the Data Protection Officer themselves? 2. Is APNS inherently not compliant or if there something unique about this use-case?
What's kind of great about this new regulation is that we get a clear view on businesses that can't adequately protect user's privacy. It's painful for businesses such as these, but ultimately it seems that consumers would come ahead of it.
If the weak link in this case may not have been the developer themselves, but external factors but it's still a pretty interesting data point.
https://gdprchecklist.io (was on HN a few days ago IIRC)
On top of that, this isn't american lawyering. If you make a mistake or are simply trying but not having a good time at it, you're not automatically destroyed, put in jail, fined for billions of euros etc.
The GDPR is beneficial to everyone, except people with bad intentions or bad practises (like having big budgets for PR, Ads and the CEO but not for tech).
The GDPR for basic FOSS and other single-person software boils down to:
- Don't capture data and not ask first - Don't capture data and not tell - Don't capture data and now show - Don't capture data and not say where it is - Don't capture data and not say who can access it - Generally, users should be able to CRUD their data - Delete data on request - Export data on request
Most of that is common sense and in most non-commercial services this is available anyway. You can make it even simpler:
- Only CRUD when a user CRUDS and tell them that is what they are doing while they are doing it - Make sure the delete/opt-out/close account button actually works - Have a line somewhere saying "i'm hosting this on platform XYZ in country ABC"
Since you are likely going to build CRUD + delete account anyway, that's a solved problem. Unsubscribe/Delete account usually already exists, no problems there either. That leaves writing a few lines telling users where you are storing stuff and how to contact for issues.
Don't forget: laws comparable to the GDPR were already in effect long before the EU came up with a EU-wide version. In the UK for example, you could ask a business to send an export of all the data they have on you via mail, and they were bound by law to comply. In the netherlands, if you store PII of people who are not your clients and send them mail/spam/offers, you get fined. Hell, they even had a more universal version where you aren't allowed to put mail in someone's mailbox unless it was addressed specifically to them, and there was one where you weren't allowed to put any ads in if the mailbox was marked for that. And you have a system where cold-calling was not allowed, same for fax-ads.
So is now every standard apache2 installation a non-compliant (illegal?) service, as it logs GETs?
I don't think that's the case.
//edit: It seems to be the case that you are ok if you do log-rotation and delete old ones - which makes sense, so you can still use them for debugging.
Could you be sued to the poor house from it? Maybe. But that's the risk of operating a business in the US every single day.
It introduces a fixed cost for operating with any user-related data, which effectively kills any companies operating below that cost.
It's especially funny when small to medium German companies suddenly panic because of the GDPR and when you look at their situation all you can say is "yeah, you should have implemented that 15 years ago, it's already been German law that long".
In Germany not much will change, but at least companies like Facebook can no longer just move to another country with worse privacy laws (like Ireland) and call it a day. For us the GDPR means that protecting user data will no longer be a competitve disadvantage. But if you're a small company and handling data reasonably, the GDPR won't hurt you anyway.
Any business that is shut down by GDPR is, to me, a good business to shut down.
You're required to have a fire safety officer at these companies too, but it's not a full-time position.
And then the next would be that it's inexpensive to "make your case" if you get reported.
https://iapp.org/news/a/polands-proposed-gdpr-exemptions-spa...
Can my small company be trivially bankrupted by any sociopathic gamer skid with an EU address and a grudge when DDOS attacks fail?
"You can beat the rap but you can't beat the ride."
Your dude with a grudge can only lodge a complaint with the relevant regulatory entity, they're the ones who will verify whether you complied or not with his GDRP requests and if they deem that you are in violation fine you after negotiation fails.
This isn't the US: you can't be sued by random people for anything.
(1)A random person complain to his regulator that you are not complying with GDPR. If he asked for his personal data, jump to (3)
(2) His regulator contact you, tells you that wht you're doing is bad: you have some stuff in opt-out, not clicking "opt-in" cause a degradation of service, or you are sending him 3rd party cookies he did not accept.
(3) Depending on the complexity and your ressources, you have X months to comply.
(4) You got caught again, you are fined.
Assuming you are American, the only court you need to worry about is American court. Your company is American? Your bank is American?
What's the actual liability here? Worst case?
There is no misconception on GDPR: the idea is good, the implementation is horrible and retarded and it is lead by people who do not understand a single thing about technology.
1. Enforcement is not arbitrary, but like all regulation the goal is compliance rather than punishment.
2. The idea is good, and the implementation is widely regarded as good by anybody familiar with data protection regulation.
3. Most of the panic seems to be from woefully misinformed US tech companies.
It would be entirely possible for someone to not be compliant with a side project and get fined 20M because there is nothing that explicitly forbids this it is entirely up to interpretation.
Given that US companies have already been targeted in the EU, unfairly [1], I find that law terrifying because I have to trust regulators that don’t have my best interests in mind with possible penalties that are very high.
[1] https://www.treasury.gov/resource-center/tax-policy/treaties...
What if you don't want to deal with any of that. You can no longer just create some useful, free service and make it public.Heck, I don't even like having to be familiar with software licensing just to add something in Github.
What if you don't want to deal with the rules of the road?
Then the law should say that. For instance when India implemented uniform goods and services tax processes, it explicitly excluded businesses below a certain revenue threshold and gave them a simple % of gross alternative to all the processes. GDPR doesn't make any such distinction, so such decisions to drop EU support are to be expected.
Sure, but that's not actually written anywhere.
Well that's a disappointment.
So you can profile without consent IFF you can convincingly justify said profiling via one of the other lawful bases. But those won't really let you do blanket profiling willy-nilly either and come with other strings attached.
One really can. It took me all of a few seconds to shrug of the GDPR when I first heard of it. Then, with all the scare mongering (webserver logs will be illegal!), I spent a few minutes reading up on it. It's all more than reasonable: if you're not doing anything shady, or are being negligent bordering on incompetent, you can just shrug it off and sleep soundly.
The monetary and time cost is minimal, but the mental benefit is pretty damn good.
To put it another way, I go to Central Park and start to juggle. I don't charge people, I just juggle because I like to juggle. Some people watch; others simply ignore me. I write observations about a couple of the people who watched me perform in my journal. One of those guys was from France. He later looks me up in a phone book and calls me to demand I give him any observations I wrote in my journal. I tell this fellow to piss off. A few months later I get a letter saying I need to pay 20 million euros because I wouldn't give away my personal observations stemming from something I did publicly and for free.
It's most certainly not a blanket "Everybody who is not in compliance with the GDPR will get a 20 million Euro fine".
Secondly and most importantly, GDPR is not about preventing people to get information, but rather about preventing people to track customer. If I use your example, GDPR would prevent you from following someone after they watched you juggling. It would prevent you from following them home, noting where they work, who are their acquaintances, what kind of food they eat and so on: it's technically legal but incredibly creepy. If someone were doing this to you you would be the one to tell them to piss off. You can perfectly write what are the observations of the passer-bys who watched you, as long as the log is anonymized. Which is easy to do and not harming for your business. You didn't want to track them anyway, did you?
No, you'll just sell it to the highest bidder. And enough people do this in such an underhanded way that the EU decides to regulate the shit out of you. So maybe you should have asked permission before recording identifiable people's behavior or otherwise earned their trust. Instead of being shady and myopic about it.
Such a car cannot be driven on the road within The Netherlands without it being validated as safe (plus some other inspections).
For US, same seems to apply. Per https://www.dmv.org/car-registration.php it mentions: "Pass a vehicle safety inspection.". So again you need to deal with paperwork and read what those safety regulations are.
They don't do safety inspections in the US?
Doesn't the vehicle need to have brakes, a means to change direction, emission checks and so on?
You could build and use a service with no regards for your personal privacy - it's your service after all, and it's your business if your data gets leaked. But could you offer such a service?
In doing that he's as equally compliant as any company who has jumped through the various GDPR hoops.
And maybe one day the USA will pass some privacy legislation...
Why would this particular regulation suddenly cause you to close your business unless you were doing something really shady?
Maybe one could argue that there is something to be gained by differentiating the rules based on the industry but, at least to me, it is not obvious that the result would be better and not just more complex. Also there are already rules and laws for specific industries and how they have to handle personal information, think for example medical or financial data.
Is your creative reuse scheme for sawdust and broken drywall bits no longer allowed?
Should any of these be banned? Now if I tell my friend, 'Hey, you can store stuff in my shed/grab a plate of food/take the gokart for a spin', should any of it be banned?
Some of my friends fought for the right to do so in Connecticut with Food Not Bombs, in fact.
That is not allowed. GDPR is only enforced for things which do not comply after in goes into effect. Further, it's not specific to the internet.
No, they fined everyone that owns homes commercially that did not upgrade the homes to comply. And then fined them again. And again, until they complied.
Some prevent loss of life.
Some are pointless or even harmful to society. HN complains constantly about insufficiently dense housing....a situation caused by none other than building codes.
When possible, build in places with good codes, not bad ones.
US law has surprising respect for the hacker ethos, so that even in highly regulated activities, there is a much less rigorous licensing regime for small-scale practitioners. . Experimental aircraft certificates, private pilot licensing, amateur radio licensing, etc. You can build yourself a car, cook food for a party, etc. without being subject to the laws about those activities under corporate mass manufacture.
That said I do think there should be an expectation that your participation in crash reporting would be voluntary and explicit.
For example, IP addresses are considered personal information but what that means is you just can't blindly collect them. If the service you use relies on IP addresses as a basic point of operation then its fine.
CDNs aren't going out of business for example.
Genuinely curious, what about all of the web servers that log every request which usually by default includes the client IP? Not doing anything special with the IP, they are just there in log files and archives.
We used to live in a society where webmasters' rights to the fruits of their labor weren't trampled on by inane regulation (to this degree at least). Now if you run a website in the EU, any user who signs up to it has control over the contents of your servers and you have to ask in extremely specific detail to do anything with some of that content, and that "consent" can be revoked at any time.
The EU has shot themselves in the foot and more and more companies are going to refuse to do business with them because of it.
So someone having a copy of my data that I wish be removed is trampling on a webmaster's rights? That makes no sense whatsoever.
> Now if you run a website in the EU, any user who signs up to it has control over the contents of your servers
This isn't even true. They have _a tiny bit more_ control of what you can do _with their_ data. That's it.
Buckle up because this type of regulation is only going to happen more frequently and in large part because of your attitude that it is "your" data versus the user's data.
You are saying that's a bad thing?
Services that require you to sign up, should provide the possibility for users to look at, modify and delete their user data - that's all. Where's the problem?
In a society where the webmasters have shown that they can't uphold their duty to secure PII (or any kind of data really), as evidenced by ~monthly high-profile data leaks, they deserve to be restricted in their "rights to the fruits of their labor".
Further, the US law is based on risks of heavy punishments but few regulations, while the law in many parts of Europe is based on strict regulations but less high fines. It looks like the EU has too many rules, but that is a subject of perspective.
Problem here: The internet gives a shit about borders and society.
We still do. Nothing has changed on that front.
"Now if you run a website in the EU, any user who signs up to it has control over the contents of your servers and you have to ask in extremely specific detail to do anything with some of that content, and that "consent" can be revoked at any time."
As it should have been from the beginning. Having the standard being that the company hoovers up all your data all the time without telling you what they're doing with it or why they need it was a terrible, terrible thing.
"The EU has shot themselves in the foot and more and more companies are going to refuse to do business with them because of it."
I highly doubt it.
Government intelligence organizations like the NSA and foreign equivalents will now have a monopoly on unsolicited data collection. Which, combined with selective enforcement to prevent disruption of gov cartels, is one of the few reasons it went through.
Under the GDPR, you must appoint a DPO if:
you are a public authority (except for courts acting in their judicial capacity); your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking); or your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences.
So - no?
And I copy-pasted direct text from the regulation. Note how it says "large scale". Twice. If he is actually processing personal data on a large scale, then maybe it is not unreasonable to have a DPO.
clause a: not a public body
clause b: not systematically monitoring (eg. installing video cameras all over the streets)
clause c: not processing large scale sensitive or criminal information.
doesn't look to me like a DPO is needed based on this article?
I'm struggling to understand why that's unclear. Is it the use of "public authority or body"?
Edit: Art 30 "The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10."
So, DPO is not necessarily a person with no other duties. In most smaller organizations that deal with sensitive data the DPO role will be shared with the CCO (Chief Compliance Officer), only at a certain scale of processing and with certain data would you need to budget for a dedicated DPO from day one, but presumably your business plan will also foresee in other things such as office space, computers and so on. Certain businesses come with implied costs.
> I keep telling people - the thing that changes with GDPR is that personal data you handle is now still owned by the person and only in your custody as long as they explicitly allow it. > All of our infrastucture has to change to honour that. If you cannot honour that change, maybe you shouldn't have been handling personal data.
What if I didn't want you to visit my website. Sure, by the letter of the law I am collecting PII (your IP address) but I think I can reasonably argue that it's quite a technical feat for a private layperson to go from "sudo apt-get install apache2" to "removing IP addresses from log files".
Sure, this is tongue in cheek - but most of that panicking I read was people concerned about their personal websites, especially with the "might be taken as professional work stuff just because of ads or you're blogging about tech as a tech freelancer.." - didn't really hear anyone with a company panic.
This is called the "technician's responsibility" where I come from. To only track/store/process what is absolutlely necessary, in order to not be liable for the consequences when someone you cannot feasibly stop wants to do something untoward with the date (i.e. unconcented analysis, government extraction of data, breaches)
I am assuming the answer is no, but would a startup be able to build a SMTP or NNPT like system today? It would be a shame for the GDPR to be yet another force moving the Internet from its historical decentralization reinforcing the current centralization trend.
That person doesn't own those bits on that hard drive.
How you decide to store it makes little difference as long as it's digital.
Fun aside: if you store it on paper you're not beholden to GDPR. Crazy.
I can't find any exemption for small companies in Article 37 of the GDPR. Can you give me a hint what part do you interpret this way?
> To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping. 4In addition, the Union institutions and bodies, and Member States and their supervisory authorities, are encouraged to take account of the specific needs of micro, small and medium-sized enterprises in the application of this Regulation. 5The notion of micro, small and medium-sized enterprises should draw from Article 2 of the Annex to Commission Recommendation 2003/361/EC¹.
It is an utter failure but mostly because services try hard to turn it into a travesty and simultaneously manage to deceive their users by attributing blame for the annoying cookie warnings to regulators.
"We are required by law to show you this stupid warning because our site uses advanced features that need cookies to work. Without them, you couldn't even login! (OK)"
Which, of course, is utter bullshit. If you can stop this deception, things might actually work out as intended. Sites may rethink their need for personal data gathering if cookie warnings would have to look more like the following.
"We'd like to analyze your site usage for ad targeting and other things that make us some more money.
Do you agree we use cookies for that? (yes/no)
NOTE: Even if you disagree, standard site functionality like logins will continue to work unharmed."
"Second class citizens" might not be the right term, but would "segregation" be an appropriate term?
This is free market with 550 mil potential users/citizens, void will be filled pretty quickly by other companies/developers that actually spent some time reading about what GDPR is.
Being a first class citizen means being tracked like an animal with an implanted chip.
And let's face it, 99% of web sites and tools aren't really needed, more like a waste of time.
"(...) including for the processing of special categories of personal data (‘sensitive data’)", special categories are mentioned on Article 9. "(...) personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation"
Do you store or transfer or process any of that data on a large scale? Is it personally identifiable? "Processing" is defined on Article 4.
I believe the original legal text, though not the easiest to read, gives you a fairly clear idea on where your organization or project should stand with respect to GDPR.
(1) What data do you process? (2) How is it connected to your economic activity? (3) How do users consent this use of the data? (4) Is your data "sensitive data"?
If you're some random guy online doing large scale processing of "sensitive data" you better hire a law firm with GDPR expertise to understand and comply with the law, I mean, that's the whole point.
(1) The controller and the processor shall designate a data protection officer in any case where: ... (c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or ....
Article 9 describes personal data as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, ...
I would say that messages send via IM are personal data like described in Article 9. I also would check the "large scale" checkbox. So in my interpretation he will need a DPO.
He has no data of the kind described in Article 9.
That seems a very pejorative way to describe it. You can say the same thing in terms of "you could probably keep operating if you put a lot of effort into understanding the details of the law" which kind of proves the author's point: this creates work for people and why should someone do that work for no return? Where does the presumption that people owe EU citizens these services at a higher standard than the rest of the world is content (legally) to accept?
DPO is required only if you really store race, religion, credit card data, health records. If you keep name and IP you do not need a DPO.
There is so much FUD about GDPR, it will pass after a year. Now compliance vendors are having part, a lot of champagne will be opened on May 25th.
In the end if you know, what data you have, why do you have it and who you share it with, it should be good enough.
https://gdpr-info.eu/recitals/no-18/
> This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. 2Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. 3However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.
Yes. There's something called GDPR legitimate interest (a subcategory in the "Lawful basis" someone else mentioned here), which lets you store e.g. IP addresses for security reasons, without asking for permission.
See: http://www.privacy-regulation.eu/en/recital-49-GDPR.htm
I think Talkyard ( = open source comments, no ads, no tracking) is GDPR compliant. For example, people can download their personal data and delete their accounts. (I'm developing it).
1. Some procedure that allows him to answer users privacy requests ("what information about me do you have?", "Please delete my personal data from your servers.")
2. A so called "directory of procedures" which states what data you collect and who's responsible for it.
If your fail to comply with 1. the user can call upon their local data protection agency who will contact you and request the contents of 2..
At no point would he need a lawyer or spend money, even if he were based in the EU. That's not saying it's a bad idea to ask a lawyer for advice if you do handle lots of user data.
Most of this stuff has been law in Germany for years, I've dealt with the German data protection agencies many times (from both sides of the aisle).
- They helped me force my university remove personal information about me from the public uni website (by constructively explaining to them why it's a bad idea to have this information about student online in the first place).
- When someone trolled me by registering me to a dating platform which refused to delete the fake profile and spammed me for a year, one mail to the agency was enough to stop these idiots.
- When I worked with social workers, the data protection agency (after a client accused us of mishandling their data) helped us go through our communication procedures and identified some point where client privacy could easily be improved.
As a US company, if you don't want to deal with this, just don't. If you do handle user data you should, though.
> I do not have the resources to hire a Data Protection Officer (DPO) or EU Representative as required by GDPR. I do not have designated EU contacts.
If a single user decides to send him/her the letter (https://www.linkedin.com/pulse/nightmare-letter-subject-acce...), he/she would either have to spend an enormous amount of resources to reply, or be non-compliant and risk him/herself.
But as I said in another reply to the parent poster, there are states which allow raw milk products in intrastate (but not interstate) commerce.
[Edit: Wow my text got mangled by autocorrect. Fixed so that it makes sense now!]
This really isn't a burden.
The comment I replied to seemed to reference far more than chat.
1. you're a public authority (NHS practices are an example)
2. Large scale processing
3. Large scale processing of sensitive data
They don't specify what large scale means. They also haven't specified how sensitive data qualifies the third statement. One can assume the threshold is lower but the GDPR doesn't specify any thresholds with regards to this.
Even ICO says legitimate interests might be okay for some marketing.
https://ico.org.uk/for-organisations/guide-to-the-general-da...
I think the majority of users on HN are from the US. And going by the GDPR related comments over the past few months, it seems the litigious US stereotype really is true - a lot of people seem to be prepared to "lawyer up" at the drop of a hat!
The EU is not the USA.
The authorities have limited resources, and are only interested in large-scale privacy abuses.
Agree, that's why I never implied that.
Not exactly an ironclad source, but better than nothing, hopefully.
The GDPR has really made me think about minimising the collection of data that I don't need - absolutely a good thing.
Anyone whose software logs IPs by default should stop, so that the admins who choose to log IPs must voluntarily choose to log protected information and handle it appropriately.
i think you are being a bit naive and dismissive. the law could easily be interpreted as his endeavor requiring a Data Protection Officer. the guidelines (http://ec.europa.eu/newsroom/document.cfm?doc_id=44100) for the DPO require that processing "special categories of data" needs a DPO. those categories include tings as benign as "trade union membership."
so if his chat app has someone in the EU chatting about trade union membership while this chat service then "processes" that data, they might be held liable to the DPO requirement.
This is a ridiculous argument. No, someone in the EU chatting about trade union membership does not magically require him to hire a DPO.
Please.
This is the other kind of free, where it genuinely is being done out of interests sake as a public service, like guerilla gardeners. In this case, it's perfectly reasonable to say that you got into this because you're interested in solving the technical challenges, not because you enjoy wading through bureaucratic rules, and decide to stop offering that free service in the EU because the fun has gone out of it.
Probably you're completely right about how easy complying would actually be, and in that case you could certainly take this code and run your own push server that serves EU clients.
You don't need a privacy person either (I suspect you mean DPO), but you do need to know what you are doing.
> I am all for fair taxation and privacy, but the EU should start creating the mechanisms that make it easy and automatic for startups to comply with stringent requirements instead of leaving the burden upon them.
That I agree with, it can still be better. But VAT/MOSS took the sting out of the VAT reporting and the privacy law is entering a shake out period now and will also end up to be manageable.
That rather makes the anti GDPR arguement sound like "yes I know that is the law, but I was breaking it over the internet so that doesn't count"
Also, i think the DPAs can fine any company in the EU, not just the companies of the country the DPA is in.
Compliance. It doesn't matter if you delete your logs, if you had them in the first place you're subject to compliance.
Like the example in the article. Not sure why people are still thinking this doesn't happen, this is exactly what is happening in the article.
FWIW, dmv.org is not an official government site.
See: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se... (starting at "Howewer, some cookies are exempt …")
As far as I know the GDPR doesn't change these requirements here. So even if you're a company of 5 people and just handling some email addresses or similar data you certainly don't need a DPO.
What makes you believe that the "large scale" refers to the size of the organisation and not on the amount of processed data.
Think about. A person doesn't own the random bits (data) about them that goes through and is stored on various systems they interact with. Under the GDPR in the EU, they might have a right to know what is stored about them on various systems, but they don't "own" that data.
That's impossible and doesn't make sense.
Do you have a source for this?
From some quick googling that doesn't appear to be true.
https://www.orsgroup.com/news/compliance/how-the-gdpr-affect... https://www.winterhawkconsulting.com/4946-2/ https://www.p4p.uk.com/gdpr-compliance-paper-documents/
https://ico.org.uk/for-organisations/guide-to-the-general-da...
Recording IP addresses in a web server log does not qualify as "regular and systematic monitoring of data subjects on a large scale" by any stretch of any definition.
And that's besides the fact that they don't have any presence in the EU. GDPR's scope only includes companies with at least some presence in the EU. That's not just because it'd be unenforceable - the laws make no attempt to include a wider scope than that.
It only takes one opportunistic apparatchik to make your life hell and this GDPR thing is now law in such places like Hungary where I haul from and if they can get away with it, trust me, they will go overboard. Maybe not 20M overboard but still.
Almost no restaurants score a perfect 100% during food inspections.
Many regulations understand that real life works on a gradient. That is why cars have varying safety standards that they have to meet based on their size and class, and why consumers can pay more for cars with a higher safety rating.
The 'federal crimes', were precisely enabling US customers to gamble over their phone lines. That was enough to get a publicly traded company in a friendly nation categorised as 'organised crime'.
The other thing you mention about how it's not a criminal offense is something important a lot of people seem to be missing. If you're violating the GDPR and someone notices, the first thing that happens is that they work with you to try to correct the problem, not that they hit you with huge fines and laugh while twirling their mustaches.
As you correctly note, the GDPR is an EU regulation that will be enforced by national regulatory bodies through warning letters and fines. Unlike for criminal offenses, there simply is no way for it to be enforced by a police force or through arrests.
This feels dishonest. If, for example, I wish to ban certain people by IP Address, your solution is to take my entire service offline?
I know the "logging by default" comes from a different age of the internet, and I'm absolutely for minimizing data collected - but I'm sticking to my opinion that as long as the default of every internet-facing package is logging IP addresses by default, it's not good that private owners have to face problems or a lot of work because of that.
It doesn't matter if European law has a history of being "principle based", if it can fuck you then someday it just might. Europeans might be fine with this, but I think most Americans would not be. If I was in OP's position I would do the same thing, by simply blocking an IP range all possibility of being made an example of by some people from another continent is flushed down the drain. I'm absolutely baffled why people think this is absurd, if you're not even making any income off of it, why would you ever open yourself up to such expensive potential liability?
I will leave the reader to make their own jokes.
If owned or controlled by big-co in an non arms length manner, then it wont be considered a 'small company' in terms of the GDPR.
Edit: These corporate control laws have teeth, otherwise every small & large business owner would do something similar by making all of their corps 'offshore' in some zero tax jurisdiction and pay 0 tax locally except for business done actually in the territory itself.
Or the could be completely legitimate small businesses doing this device for anyone.
It's not 0, but large corps already do this. https://en.m.wikipedia.org/wiki/Double_Irish_arrangement
In fact the construction sector is a very bad example here, because old buildings are usually covered by separate regulations , thats not true for software.
And even if such a conflict does arise, as it surely will somewhere, the text linked states that the controller and processor shall ensure that such a conflict does not exist. It does not say that "You can't do this because 'conflict of interest'", it just says those two roles will ensure there will be no conflict of interest. If you read all the guidance, you will see that the DPO is the most protected role. It has the least liability. The data controller and processor have their own responsibilities, from a liability pov.
Unless you are the business owner/executive, DPO, data controller and data processor...I can't see this being a conflict of interest. Ever.
> The absence of conflict of interests is closely linked to the requirement to act in an independent manner. Although DPOs are allowed to have other functions, they can only be entrusted with other tasks and duties provided that these do not give rise to conflicts of interests. This entails in particular that the DPO cannot hold a position within the organisation that leads him or her to determine the purposes and the means of the processing of personal data. Due to the specific organisational structure in each organisation, this has to be considered case by case.
> As a rule of thumb, conflicting positions within the organisation may include senior management positions (such as chief executive, chief operating, chief financial, chief medical officer, head of marketing department, head of Human Resources or head of IT departments) but also other roles lower down in the organisational structure if such positions or roles lead to the determination of purposes and means of processing. In addition, a conflict of interests may also arise for example if an external DPO is asked to represent the controller or processor before the Courts in cases involving data protection issues.
In summary, if you have power to decide how or for what purposes the processing of the data is to be carried out you're probably not allowed to serve as DPO. Of course in the end it's the company's decision who to give that role to, but not following the guidelines increases the chance of non-compliance.
1: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_...
When instead it is up for interpretation, that comes with issues. The first is selective enforcement, there is also the chilling effect on both sides. Those who ought to be protected worry about the slack given to their potential predators. Meanwhile those who are 'potential predators' need to worry about the slightest move that is illegal under some interpretation.
The end result of this chilling effect is fewer willing customers, fever willing companies, and less mutual trust. Notably, this lack of trust persists even if you presume everyone still follows the law. At that point it seems to me a law has failed.
The kind of law making you’re implicitly advocating is tantamount to despotism. Drafting a law that outlaws islam might well be clear in it’s wording, but it needs to be tested against the law that allows freedom of religion, freedom from persecution, and a ton of other laws no doubt. The claritiy of language with which a ban on islam is articulated is all for nought if it’s contradicted by, and incompatible with other laws.
Although, GDPR has been explained very clearly. And we’ve been given a loooong time to digest, understand, implement, and question it. I don’t think any reasoable person can make a compelling case against GDPR. But unreasonable people can, and as we’re seeing, they will.
citation needed
> if you do not collect data that you have no use for you are 95% there.
I have always been respectful and even never required emails on signups. I am not 95% there because there is a ton more to do. In fact i am at 5% because i have a lot of small scale past projects. Not everyone is a VC-funded startup.
That's the kind of emotional reaction that everyone has to GDPR. Yes we like respecting privacy, it's a good thing, but there is a lot that is problematic with this legislation.
Every statement issued by EU regulators to date.
> I have always been respectful and even never required emails on signups.
Good.
> I am not 95% there because there is a ton more to do.
Such as?
> In fact i am at 5% because i have a lot of small scale past projects.
You've had two full years to get this done. The law came into effect the 14th of April 2016. It is now May 2018.
> Not everyone is a VC-funded startup.
If you can build it you can also build it in a way that is compliant with the law and if you built it in a way that requires a lot of work to be compliant with the GDPR then you likely were already riding a very fine line with respect to the DPD which has been in effect for much longer.
> That's the kind of emotional reaction that everyone has to GDPR.
Emotions are a bad guide when it comes to legal stuff.
> Yes we like respecting privacy, it's a good thing, but there is a lot that is problematic with this legislation.
Such as?
Everything. Even if you process just an IP you need to document your procedures, change privacy policies. If at any point you ask for anything you need to implement opt ins, a way for (unauthenticated) users to request their data (even if it's just 1 IP) etc. My point is that having negligible private data is not less of a compliance burden than having a lot of private data.
> You've had two full years
You mean i ve had 2 years to attempt to interpret a vaguely written law. Actionable information is just now coming out, and even that is contradictory (cue this topic). Even the EU parliament's website does not comply yet.
> you likely were already riding a very fine line with respect to the DPD
First, that is a directive, not a law and compliance can vary widely. Second, gdpr requires new procedures which means it requires amendments anyway
> Such as?
I have posted another comment
The 20 years of data protection enforcement we've had.
That would have been a wonderful thing to see. The DMCA has had a chilling effect on speech worldwide, and has created difficult barriers for small businesses to deal with if they want to host user-created content.
I think you unintentionally made your opponent's point!
AFAIK, most of the "safety committee" regulations usually have waivers for small companies.
I’m fairly left leaning for a US citizen & find the idea that the default should be big companies abhorrent.
But I recognize my bias & am not st all convinced it’s in any way objectively correct.
- US company A controls the market for idea B
- EU creates GDPR which scares away company A
In that case where there is a proven market demand for idea B you can either compete with company A (which presumably has more resources than you), or enter into a market that company A has willingly forfeited.
I think the second option will have plenty of takers if it turns out that US companies are that scared of GDPR.
For many reasons indeed, this is broad topic and GDPR doesn't change anything if we are talking about big US players and their domination. None of them is getting out of EU.
> And I am afraid GDPR has just added another one.
I disagree, it's the other way around. Small single person companies/developers that will get out from EU market will could only strengthen local market. Any other US/EU/outside EU startup/developer can fill that void.
> Europe doesn’t have a stellar record when it comes to high tech startups
Which automatically implies that you were talking about non-EU tech companies leaving EU because of GDPR and EU startups filling their space. And now you fail to see how this will make more likely succeed EU companies? What?
I think you fail to understand what the point of my argument was. It doesn't matter if this will be EU founder or US founder or XX founder, if there is a void it will be filled, doesn't matter who will fill it. This is an axiom describing the free market.
> onerous regulation
I am conducting online business in EU handling personal data and I don't find it onerous at all. Adding to that as EU citizen I am happy that this regulation was introduced in EU law system.
In a world where lots of small shitty businesses (and some bigger ones) don't care what happens to your personal data it's long overdue for this being finally regulated.
"protecting people's rights is expensive, therefore we shouldn't do it".
That's your argument? Really?
Don't most have a bond alternative to insurance?
"While most Porsches can import quite easily from Europe to the USA, the 959 had complications abound, making it impossible for US citizens to get their hands on one of these supercars. One of the citizens was Gates, who ordered a 959 from Porsche, only to have it impounded at customs. The reasoning provided to justify the impounding was that the 959 had not yet cleared crash-testing requirements and did not meet EPA standards. Gates’ German supercar sat idly by for over a decade."
https://blog.dupontregistry.com/celebrity-cars/bill-gates-am...
Wouldn't a better alternative be to design a messenger that complies with GDPR? Simple user accounts that can be deleted at the request of the user, peer-to-peer encryption (and where possible, communication), a "storage cabinet" for each user where encrypted data end in when the user is offline (with an encryption/decryption key that is generated client-side and transmitted while both users communicate) and can easily be deleted and i think this covers most uses.
This is just an idea that i came up with right now, but if you start your design with the goal to store as little data as possible and anything you store needs to be both encrypted and easy to delete, then i believe you can come up with several ideas for most issues.
It also helps to see this as respecting the users' privacy and giving them control, as opposed to a development burden :-P.
In other words, are we moving towards a world where unless you are VC backed (Signal, Telegram, Whatsapp, etc) don't bother building an IM client? Also note, I don't think there might be anything wrong with that - if we expect all our communications to be E2E encrypted, maybe Joe Shmoe shouldn't be writing an IM client.
That's not a given. Further, it's more important to look at what's better for society as a whole. Further, less regulation within banking caused some big profits.. but also some hefty problems.
Can you hint me to one of those German laws which do require one of the above?
It literally translates to "federal data protection law" and has been German law since 1978. In certain conditions it has also mandated a DPO (https://de.wikipedia.org/wiki/Datenschutzbeauftragter) since then, but in fact the first DPO position in Germany was created in 1971.
The right to be forgotten is mandated by article 35 BDSG (https://www.gesetze-im-internet.de/bdsg_1990/__35.html).
The right to a data export is mandated by article 34 BDSG (https://www.gesetze-im-internet.de/bdsg_1990/__34.html). It has always been common use this law to get a free copy of the data which our credit reporting agencies have about you, I've done that multiple times.
However, this cases will be fought with the Googles & Facebooks, not with 5 person companies.
So all he's done is save himself the time and effort of dealing with the GDPR and cost himself nothing.
And yes, he has saved himself the time and the effort of dealing with the GDPR, has also managed to position himself as someone who pays lipservice to privacy but who does not care to actually be compliant with privacy legislation when it matters. I wouldn't want my data in his hands after that anyway (not that that would ever happen because I don't have a smartphone in the first place).
I'm sure another free and open source product will seriously impact his profit.
Frankly this post has prompted me to reevaluate your other legal advice in this thread.
Every business owner here who would complain about how the GPDR is taking their rights to their personally earned data away would be the same people who launch a lawsuit because one of their competitior's products had a typeface that was vaguely similar to theirs
There are regular people here, they just don't go starting businesses that have abusing their customers as a business model because they couldn't sleep at night if they did that
Surely anyone who disagrees with your feelings on this matter must be a sociopath, though.
The GDPR didn't arise out of some feeling that companies we're making too much money. It arose out of the fact that the industry refused to self regulate. They were given years to do this and the standard operating procedure for security around data right now is to lol because who cares if you have a breach, that's a problem for the people you harvested data from, not you.
The bad side effects from this data harvesting are called negative externalities. A similar set of negative externalities is pollution.
Do you think it's immoral for regulations to make certain business model that rely on dumping poison into the water or air unprofitable, just because those companies could have made some money if only they could do what they liked regardless of the harm to others?
Which is why you are perfectly capable of giving consent to other websites to do that.
"Surely anyone who disagrees with your feelings on this matter must be a sociopath, though."
No, just those who insist on a "take it or leave it" approach.
Sociopath is a tough word, but in the original non insulting meaning of deviation from the common society, I think the word is right.
You could be breaking the law in any number of countries. What steps are you taking to comply with the laws of Saudi Arabia or North Korea?
Not the courts, but "Brexit"
The EU on the other hand...
Also almost all laws stay in one jurisdiction, they don't go beyond their own country.
He's not handling sensitive personal data.
He doesn't need a DPO.
See also the derogation for micro companies:
https://gdpr-info.eu/recitals/no-13/
> To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping.
> How do you guaranty that nothing in the messages being handled by the server is "sensitive personal data".
You guarantee it by reading the rest of GDPR. It defines sensitive personal data separately than personal data. Sensitive personal data is defined by GDPR to be things that can be used to discriminate against the individual, such as race, ethnicity, religion, health information, credit information, age, etc.
EDIT: And what I mean to say is that if the messages aren't passing through the server or being stored on the servers, then the only info being handled by the server is the meta-data including IP address, which is not included in GDPR's definition of _sensitive_ personal data.
How do you guaranty that nothing in the messages being handled by the server is "sensitive personal data".
Sounds to me like they are not a) processing b) collecting message data.
Edit: DPO Network says this which I think is a pretty good summary (though it's not part of the explicit legal policy, it's someone's opinion)
> CAN WE ASSIGN ONE OF OUR EMPLOYEES AS OUR DPO?
> Yes. However, you must ensure that other professional duties of this employee must be compatible with his/her new duties as DPO and do not result in a conflict of interests.
Being the sole owner and manager and being the DPO is clearly a conflict of interest.
Could you clarify why you think this is so? As an owner, my interests would align with the DPO's interests so it's hard to me to find where the conflict of interest would reside in the case of being the sole employee _and_ DPO.
Now if it's a large company where they make money per GDPR policy workaround then I could see it being required another person than the owner, but it could still certainly be an employee.
And I think this is as it should be. I'm not sure why people think software meant for use by a broad audience, however cheap, should not be subject to basic safety, security and privacy regulations.
What's more, it's pretty clear the author doesn't actually have a lot of GDPR obligation. They need to maintain a contact point which Apple is actually doing for them. They need to forward RTE requests to crashlytics. If they're doing ANYTHING else with personal data, that's shady as hell and I'm glad they're not doing it to EU citizens anymore.
> I'm not sure why people think software meant for use by a broad audience, however cheap, should not be subject to basic safety, security and privacy regulations.
There is a major difference between cheap and free. There is an especially major difference between cheap and open-source, because most open-source licenses include specific text to disclaim any implied warranty. Without contractual consideration, the author's words don't form any kind of contract with those who choose to use his software.
This is not a difficult concept to grasp. If the author made any money off his project, then yes, a very strong warranty is implied, but without that, the warranty is rather weak. Under common law, those giving things away for free can only be held liable for 'gross negligence', which is different from the automatic warranties that arise when you sell things, regardless of price.
Anyway, how should the ICO be able to be more concrete then the GDPR?
The problem is that there's no justification for having the right to coerce other people just because they have information you gave them. If users enter names into your website, you're not allowed to run a statistical analysis of what names are most common on your website without asking. If people named Jane are more likely to eat ice cream, you can't target ice cream ads at them and help keep your site free, without asking them. Worse than just this kind of coercion of what you're not allowed to do, users can coerce you into taking time out of your day to expunge records about them. It's all entirely backwards.
If forcing low-earning EU citizens off the internet because every website requires a subscription is a social good to you, then sure, it's a long term benefit.
Apart from the fact that people named Jane aren't more likely to eat ice cream, you seem to criticize that it gets harder to target ads?
Oh no, that's a real pity. Oh no, poor webmasters.
Why are the rights of people who own websites less important to you than the rights of other people?
Regardless, you might not still be saying this once half the websites smaller than Google become subscription-based in the EU or just block the EU altogether.
They don't have that right. GDPR only applies to business. If you mean you wrote it in your house for some business reason then yeah they have the right to know you've done so and why and the right to ask you to remove it if you don't need to have that information.
In no situation do they have the right to come into your house. That's a touch too far into the absurd.
I feel like your statement here is basically "you are a business, therefore it is impossible for you to run out of money", which -- superficially -- seems very naive.
It seems more like a cultural difference, whereby some one-man shops from US find privacy not important.
The GDPR is not going to cause any but the weakest businesses to close shop, in fact if the GDPR causes a business to close (which I highly doubt other than people voluntarily throwing in the towel because they can't be bothered) then I am not sure if I'm going to shed tears over that because it likely means that that business was so weak already that other things besides GDPR compliance were suffering as well (such as security).
It bans "raw-milk cheese", which is a distinct kind of product, not one way of many to make a particular product ("cheese"). If you ban raw milk, you ban certain types of product entirely, and there is no workaround.
It would be like saying a prohibition on planes does not ban automobiles, and after all, both are a kind of vehicle. True, but not really relevant.
Back to the GDPR case, it's closer to a producer of pasteurized-milk-cheese saying they are going to get out of the cheese business altogether because of the ban on raw-milk-cheese, and labeling their cheese as such and documenting however briefly that the cheese is made out of pasteurized milk is just too much effort, and they are afraid of being sued by people claiming it is raw-milk-cheese.
Whatever.
"As GDPR approaches, I get the impression that it is an end of an era for the internet. The days of someone making something, putting it on the internet and offering it to the world seem to be over. "
And this particular thing GDPR ruins pretty goddamn well.
Mind you Belgium us 1/30 the size of the US
Here's a statement from the CPP, connected to the 2015 lawsuit. They mention Facebook being in breach of Belgian privacy laws from 1992.
https://www.privacycommission.be/sites/privacycommission/fil...
[1] - none of the other reporting I found on the subject(Guardian, Bloomberg, etc) mentions the GDPR. They also don't show the court order, which is frustrating.
That lawsuit is being interpreted as a signal that they intend to be very aggressive in their enforcement of GDPR.
Article 83 states that any penalties must be proportionate to the nature, gravity and duration of the infringement, the intentional or negligent character of the infringement, action taken to prevent or mitigate an infringement and the degree of cooperation with the supervisory authority.
I think you can also log the ip, you just have to get your user's explicit consent.
I will also remove Google Analytics, and switch AdSense to contextual ads. I am a bit worried about the latter step, but if the losses are too great I can still try to get consent from my visitors and switch to personalized ads again. As for Google Analytics, I never did get that much out of it, but perhaps I should have used it more. I never activated the "deep personalization" options in GA to begin with.
It bothers me to pester my visitors with consent popups. On the other hand, looking at what Google proposes for compliant AdSense, it also bothers me that apparently multiple companies get to track my users if I enable personalized ads. I wasn't really aware of that, and just accepted Google as tracking because they know everything anyway.
So much as I dislike the new privacy laws, at least the made me reconsider my AdSense settings.
Also the section of the GDPR that talks about pseudonymization using a token how should my user DB table be GDPR compliant? Contains ID (primary key), username, password hash, email, etc and the ID is also in other DB tables for obvious reasons (such as user posts/actions).
If you have a site where users can make posts, I'd say they pretty much give you consent by signing up. IANAL, though.
No
> It rightfully belongs to the webmaster.
No, you are completely wrong here. The basic point of the legislation (and other privacy legislation in the EU that came before GDPR) is that a users personal data absolutely does not belong to the someone else once collected.
Your personal info, username, account settings, marketing anayltics, etc. are definitley you're data and you should be free to have them deleted.
The two year old IPs in a server log sitting in backup, or a chance occurrence of your username in a random call stack for some web exception is not your data, and you shouldn't force a business to have to dig through that mound of digital noise to satisfy your deletion needs
I think most people agree that unless those pictures are gathered with very specific consent, subject to many restrictions, they are not "my data". This is obviously an extreme example, but the reasoning extends to more data that is considered sensitive. The point being that "data ownership" is a complicated issue.
Pictures probably aren't a good example because they are covered by intellectual property laws.
I'm not arguing for or against it, just pointing that the resulting unintended consequence is protecting large companies. Exactly the opposite of the original intent.
Nonsense. I look at another high tech data driven start-up every week and not a single one has stated that the GDPR costs are 'prohibitively high'. Sure, there are some that need to do more work than others (medical, ad tech). But on the whole companies that were already doing their best to not fuck up with their customers data have very little to do in order to get to where they should be and the remainder has a bit more work but will mostly likely be more-or-less compliant by the 25th and what work remains will be done long before the eye of Sauron will turn their way by virtue of their size.
The cost is strongly related to the size of the organization and the amount of sensitive data you hold as well as whether or not you were a bad steward of the data in the past.
There is a correlation between the number of GB you store and eg. how many DPOs you require?
A small business or a startup should have a relatively limited amount of data capture, and that data should be stored in a relatively limited number of places. In most cases, it should be straightforward to make sure that this is documented and appropriate controls are in place.
On the other hand, large companies have vast quantities of uncontrolled data gathering that nobody is responsible for.
What this gives the EU is the hammer to hit persistent abusers of user data. They want you to be careful with user data and not treat it like you own it; you do not. It is not yours to sell or share or publicize.
Edit; note as well that every country has a compliance office; if they know you are in complaince as in you are ‘good people’ (best effort, no giant holes etc; just best practice in our field which you should do anyway) they will not bother you with every (or any) user complaint after that. I have good experiences with this with far grave (and potentially criminally punishable) matters in a few EU countries.
The regulator is the effective judicial remedy.
In the UK there's also a First Tier Tribunal and probably an upper tribunal. These are when the regulator has made an error in law.
https://gdpr-info.eu/art-12-gdpr/
"The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests."
Regulators. "Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation".
So, 28 countries, each with 1+ organizations. So you could find yourself having to deal with multiple parties in different languages.
Example: Parts of our software run on customer servers and as such they are processing data in their control and not ours, hence can for example used to filter out personal data before they are then sent to our servers, without causing any GDPR related triggering of sending personal information to a third party (our company).
However, if you do that, good luck ever getting a mortgage, credit card or other post-paid services ever again if all credit report requests come back with the reponse "no data available". So I wouldn't recommend that.
How does that work for people who never had a Schufa history? If for instance I decided to move today from Brazil to Germany, would I be unable to do all these things there, since they would have "no data available" on me?
https://www.gov.im/about-the-government/data-protection-gdpr...
So he wants the funky TLD from Europe but he doesn't want European law 'hassle'. Hypocritical.
If I want to put an open source app in the App Store, that’s not a business model for me. It’s more just personal expression.
Try convincing a regulator of that.
But it doesn't matter, you're still logging PII. GDPR doesn't make any distinction of profit vs. non-profit vs. personal ownership. You're as liable as an individual as an organization.
So don't hold IPs if you can't be bothered to know where the might end up and if you don't want to update your privacy policy. Why would you?
> My point is that having negligible private data is no less compliance burden than having a lot of private data.
And no data means no compliance burden.
Note that holding data already has costs associated with it no matter what you do: you need to secure that data, you need to back it up, you need to process it and eventually you will need to get rid of it. All of those cost money and effort.
> You mean i ve had 2 years to attempt to interpret a vaguely written law.
As laws come the GDPR is surprisingly clear. I was quite skeptical until I actually got a copy of the draft and I was positively surprised. They actually got it mostly right, there are some minor things that I would have liked to see different but on the whole I am not complaining.
> Actionable information is just now coming out, and even that is contradictory (cue this topic).
The hysteria is ridiculous. Anybody that has spent even so much as a couple of hours on this subject - and from a somewhat serious point of view rather than the ridiculous fear mongering - knows enough to not have written a silly blog post like the one on display here.
> Even the EU parliament's website does not comply yet.
That article was not exactly enlightened to put it mildly.
> First, that is a directive, not a law and compliance can vary widely.
Yes, but if you did take it serious then you are well underway.
> Second, gdpr requires new procedures which means it requires amendments anyway
Yes, there is some overhead. But this is mostly to ensure that the law will not be ignored like what happened with the DPD. As you say 'it was a directive' which many companies interpreted as 'can be ignored'. What they failed to realize is that if you don't self regulate after a directive is issued that there will be a version of the directive with teeth that has the strength of law. Congratulations, we are there.
No. This is the myth that "consent is always required". There are several justifications for processing personal data, and consent is just one of them. There are others.
https://ico.org.uk/for-organisations/guide-to-the-general-da...
At that point you can check your understanding of the law and what you're doing and write back letting them know why you think you're in compliance; or you can change your process; or you can take it to court.
He did this several times before the corporate veil was pierced and they took him for all he had.
The other case was one that is probably best described as mismanagement ('onbehoorlijk bestuur') where the CEO/sole shareholder of a company started using the corporate account as though it was his personal account. When the company was unable to meet payroll taxes the taxman seized his private assets after piercing the veil.
Anyway, it is not the act of having the information about other people that is problematic, it is the act of collecting, using, or sharing it. Do you think I should be able to follow you around and write down every step you make? Should I be able to use that information in every way I want? Do you want me to tell your significant other what you actually did on that »business« trip, tell your coworkers what you got from the sex shop? Should your doctor be able to tell everyone about your health status, your bank about your financial status?
It is just naive to pretend that handling information is inherently without any concerns and therefore no rules should apply at all. And it is just silly to pretend that writing down an observation you made in the park in a notebook is the same and should be treated in the same way as systematically collecting information about every website visitor.
And your examples are not all the same. If you’re in public, you have no reasonable expectation of privacy. So yeah, take all the notes about me you want. That’s entirely different from my doctor sharing my health info.
And while you personally may not have any expectations of privacy in the public, that is certainly not true in general for everyone and in every country. Here in Germany the constitutional court ruled just this week that having a dash cam in a car violates the privacy rights of the people you capture.
You are also generally not allowed to take photos of people in the public without their consent. It is not a problem if they randomly appear in a picture you took of a building or whatever, but you are not allowed to take photos were people are the main motive.
I imagine when running a business one faces many stupid bureaucrats, this could be another one (or they could be competent and understand and accept the technical explanation of how my imaginary company complies with GDPR).
But yeah, why quit because of the n + 1th bureaucrat, when you've dealt with n of them while starting and running of your business?
No, like Google, Microsoft and Intel before the European Commission.
Let alone full review of every system and legal review of the DPAs you have to sign and or create with every single co and processor.
If you are using only contract basis for the data it's really easy. You tell them that you are using their data for purposes of fulfilling the contract. The great thing about contract basis is they can't object. The only thing you need to do is to inform the customer of any 3rd parties you send their information to in order to fulfil the contract.
It only gets complicated if you want to use the data for other things. For legitimate interest (which is essentially exactly the same as the laws that are currently on the books) you need to be able to exclude processing the data if someone objects. You also need to make sure that you don't delete their data if they exercise their right of removal (which is completely bass-ackwards, but whatever). Consent is similar actually, but you have to get the consent up front. The other lawful bases are very unlikely to show up in most organisations.
I think the main problem with most organisations (and it's the case with the company I work for at the moment) is that control of private information is very loose. For example, we use several SaaS systems for our marketing. Some of them are clearly unnecessary and so we either have to remove that functionality or get consent. So there's lots of discussions about whether it is worth a huge wad of text thrown at the user in order to have cat emoji's or some stupid thing like that.
The other main problem is that if you want to use something other than contract basis, you need to build something that allows the user to exercise their rights. It can be a manual process, but if you have a lot of users it might threaten the margin.
Anyway, long story short: If you are only gathering the information that you need to do the work you are doing, there is likely very little (or in a lot of cases I bet nothing) to do. If you are gathering the information to use for your own purposes, then there may be a lot that you need to do.
Not to put too fine a point on that, personally I highly approve of this. I really could care less if somebody's business model is destroyed because it is now too expensive to collect information that you don't need to do the job. Even in the company I work for, where we don't actually use the data for nefarious purposes (AFAICT ;-) ), we're finally having some long overdue conversations about what stupid SaaS crap we're using under the hood. Not to be unkind, but I utterly fail to understand how marketing people fall for the same lies that they spew out themselves... "If only we send our customer's data to this service, they will find a way to drive more business our way! And we don't even have to pay them!" Yeah... right...
how could you "not need" data if the loss "destroyed" the business model?
Not the OP, but it's pretty straight forward for most people (including the author of TFA). You need to identify what private information you collect.
Fair enough.
You need to decide what lawful basis you are using to collect that data. If you have no lawful basis, you have to stop collecting that data.
Right, but probably the most practically relevant basis for anything non-trivial will be legitimate interests, which of course involves balancing tests. Even today, just a week before this all comes into effect, there is little guidance about where regulators will find that balance.
If you are using consent lawful basis, you need to get consent in an opt-in manner. You need to record what statement you have shown to the user and any consent that you receive.
But this is retrospective and stronger than the previous requirement. Even if you have always been transparent about your intentions and acquired genuine opt-in from willing users, you are now likely to be on the wrong side of the GDPR if you can't produce the exact wording that was on your web site or double opt-in email a decade ago. The most visible effect of the GDPR so far seems to be an endless stream of emails begging people to opt in to continue receiving things, even where people had almost certainly genuinely opted in already before.
For legitimate interest (which is essentially exactly the same as the laws that are currently on the books) you need to be able to exclude processing the data if someone objects.
Not quite. There also appear to be a balancing aspects here, though with some additional complications involving direct marketing, kids, and various other specific circumstances.
Take a common example of analytics for a web site. These may include personal data because of things like IP addresses or being tied to a specific account. Typically these have relatively low risk of harm for data subjects, but if for example a site deals with sensitive subject matter then that won't necessarily be the case either.
A business might have a demonstrable interest in retaining that data for a considerable period in order to protect itself against fraud, violation of its terms, or other obviously serious risks. Maybe the regulators will consider that those interests outweigh the risk to an individual's privacy if their IP address is retained for several years, at least in some cases. Maybe they will find differently if it's the web site for a drug treatment clinic than if it's an online gaming site.
Even if the subject matter isn't sensitive, where does the line get drawn? A business that offers a lot of free material on its site to attract interest from visitors might itself have a legitimate interest in seeing who is visiting the site and tracking conversion flows that could involve several channels over a period of months. This is arguably less important than protecting against something like fraud, but nevertheless the whole model that provides the free material may only be viable if the conversions are good enough. But equally, maybe it's not strictly necessary for the operation of the site and whatever services it offers for real money, so should the visitor's interest in not having their IP address floating around in someone's analytics database outweigh the site that is offering free content in exchange for little else in return?
That's just one simple, everyday example of the ambiguity involved here, and as far as I'm aware the regulator in my country has yet to offer any guidance in this area. Would any of the GDPR's defenders here like to give a black and white statement about this example and when the processing will or won't be legal under the new regulations?
The other lawful bases are very unlikely to show up in most organisations.
I would think the basis that you have to comply with some other law is also likely to be quite common. It will immediately cover various personal data about identifying customers and recording their transactions for accounting purposes, for example. But again, since that will include the proof of location requirements for VAT purposes in some cases, how much evidence is a merchant required to keep to cover themselves on that front, and when does it cross into keeping too much under GDPR?
The other main problem is that if you want to use something other than contract basis, you need to build something that allows the user to exercise their rights.
And once again, those rights are significantly stronger under the GDPR, particularly around erasure or objecting to processing. Setting up new systems that comply may not be too difficult, but what about legacy systems that were not unreasonable at the time but don't allow for isolated deletion of personal data? To my knowledge, there is still a lot of ambiguity around how far "erasure" actually goes, particularly regarding unstructured data such as emails or personal notes kept by staff while dealing with some issue, or potentially long-lived data in archives that are available but no longer in routine use. And then you get all the data that is built incrementally, from source control systems to blockchain, where by construction it may be difficult or impossible to selectively erase partial data in the middle.
Not to put too fine a point on that, personally I highly approve of this. I really could care less if somebody's business model is destroyed because it is now too expensive to collect information that you don't need to do the job.
But what if an online service's business model relies on processing profile data for purposes such as targeting ads to be viable, and regulators decide that a subject's right to object to that processing outweighs its necessity to the financial model?
It's easy to say a lot of people might not like being tracked, but on the other hand, if services like Google and Facebook all disappeared in the EU as a result of the GDPR, I'm not sure how popular it would be. There are two legitimate sides to this debate, and neither extreme is obviously correct.
You are aware that there is a time and monetary cost to comply for those with legitimate data collection purposes, right?
Even if you had a business that was whiter than white in terms of compliance with previous data protection laws and had perfect documentation of all its data collection and processing activities, it would surely cost far more than that just for the time to write some basic notes on the extra things you now have to tell data subjects and/or your regulator, get them reviewed by a lawyer, incorporate them into the relevant policies, and send notifications to anyone affected about your updated privacy policy.
What about your salary?
Your risk in GDPR is similar to your risk in IP law. If you don't comply with the law and someone calls you on it, you might have legal proceedings against you. In most cases it's pretty obvious if you are compliant with the law (Well, to be fair, it's completely unobvious if you are going to get randomly sued for patent infringement, but I digress...) If you are have a very complex situation, then maybe it is worth some legal advice, but it's pretty freaking obvious if you need the data you have collected in order to fulfil the contract or not.
Anybody that tries to sell you one is full of it.
You claim to know a lot about the GDPR, I’m not sure my business is compliant. Can you take a look and tell me?
What’s that called if not an audit?
Implying that the majority of user's wouldn't just instantly click the largest button that says "make this annoying wall of legal text go away" whether that is agreeing to tracking or not?
While the inability to target ads based on data about you and your search history searches removes some amount of advertising income. Websites would still be allowed to show ads, and I would imagine that those ads can be specific to the article currently being viewed.
This is exactly how conventional TV advertising works, just because you don't know the gender, race, political views and entire life story of a website user, doesn't mean you can't get almost the same effect. You can target ads in general at specific content and hit most of the correct users anyway rather than targeting specific users and the content they have viewed in the past.
https://www.emarketer.com/Article/Behavioral-Targeting-Doubl...
Why haven‘t all those doomsayers closed down their businesses long before the GDPR?
I was just pointing out, that when a lawyer says "probably", he usually has a good reason to do so. And it's my strong belief that the reference cases in court will not be fought by small companies, because they rarely are.. There is just not enough money to make fit the effort you need to put in winning the first case. Before there is not one single case, I don't think it's necessary to panic and shut everyone out.
You don't need to believe me or agree with me, but reducing this to "my personal appetite for risk" is really weird.
Even if it would all be a net benefit, why is it ok for all of these companies to be so misleading about it. No one out a simple EULA, for what is happening with the data. Hell half the agreements just say that the companies can do whatever with the data, but an average person does not have the ability to parse the output of the legal teams of every company they interact with every day. The only way this could get even close to an equal footing between users and companies is if every single person was a lawyer
Yes, but then again: if you don't implement them society as a whole will end up holding the bag. Polluter pays is a very good principle.
> All regulation costs money to implement.
Yes. But that's called the cost of doing business. And most software based businesses have insane margins anyway because of their ability to scale.
> Even if each regulation by itself is cheap, these things add up -- it's death by a thousand cuts.
That's one way of looking at it. Another way of looking at it is that it levels the playing field between those that ride roughshot over their users rights and those that try to be nice.
> Another way of looking at it is that it levels the playing field between those that ride roughshot over their users rights and those that try to be nice.
Neither of those viewpoints are in opposition. You can both believe that more regulation kills some businesses through a 'death by a thousand cuts' and that these regulations level the playing field.
Please, don't take my words as granted but talk to an actual lawyer. You'll probably even find a free session for startups somewhere in your city, at least in Europe.
https://ico.org.uk/for-organisations/guide-to-the-general-da...
https://ico.org.uk/global/contact-us/advice-service-for-smal...
What hav the Danish & Belgian regulators been doing lately?
The mere act of pulling all my database backups from glacier at once would cost enough to force me to just shut down my personal projects.
Months later, I discover that I can sell my stock of credit card information on the darknet for some nice extra income.
Should I be allowed to do that? What if it weren't credit card details but just postal addresses?
If you think they might be used illegally, I believe there are already laws to charge you with that relate to facilitating a crime.
If you don't think they will be used illegally, then what's the harm in selling them to someone else?
Nobody likes getting a lot of junk mail, but it's not the end of the world. I actually got my first credit card from a pre-approved offer found in junk mail.
No its not as they now have regulations in place to prevent that, before GDPR you could. You can only be sued to the poor house from it if you do something like leave your patients health information on the bus.
http://blog.quantum.com/backup-administrators-the-1-advice-t...
"The GDPR is open to interpretation, so we asked an EU Member State supervisory authority (CNIL in France) for clarification. CNIL confirmed that you’ll have one month to answer to a removal request, and that you don’t need to delete a backup set in order to remove an individual from it. Organizations will have to clearly explain to the data subject (using clear and plain language) that his or her personal data has been removed from production systems, but a backup copy may remain, but will expire after a certain amount of time (indicate the retention time in your communication with the data subject). Backups should only be used for restoring a technical environment, and data subject personal data should not be processed again after restore (and deleted again)."
Other opinions have concluded that you must keep an index of requested deletes in the face of backups, for instance.
You can still log accesses and aggregate them into statistics, just don't keep the IP addresses. You can still log IP addresses to detect DOS attacks or whatever, just delete the log when you don't need it anymore, after a day or so. There's no need to get backups from glacier, because you know there is no personal data in them.
You do need to have a documented and implemented backup retention policy and communicate this if you receive a request to delete a user's data.
Database backups are only a problem if you save them forever, though it sounds like you are. GDPR generally requires that you regularly archive, rotate out, and clean up old data.
What you're describing is a good thing. If you're going to treat my data like an almost stale slice of pie selling it off cheap to anyone who will buy it - Please do block my access!
For example, my business model might be to ask you for your login and password information for your bank so that I can help myself to the contents of your bank account. In return I'll send you a newsletter on how to get rich quick :-)
I doubt you are asking seriously, but in case you are, the distinction is: if I need the information to complete the contract, then it is under contract basis and I'm allowed to use it for that purpose. If it's not needed for completing the contract, but I have a legitimate reason for using the data anyway (kind of vague, but includes marketing -- basically all the stuff that was legal before GDPR) I can do so, but I need to tell you I'm doing it. You can object and then I have to stop. If I have no legitimate reason for using the data, but I want to anyway, I can still do it. I need to ask for your consent (which has to be opt in). My service can't depend on you opting in (because I have no legitimate reason for needing the data). I can't deny service just because you opt out. You can also withdraw your consent at any time.
So in my silly example at the top, I could literally ask for consent to use your login details for you bank. If you agreed, I could use them. However, since I have no legitimate interest in your bank login details (other than I wanna look at your bank balance), I can't make my service depend on that.
If your business model is based on making money from data that you have no legitimate interest in and you have no consent for... well, I really, truly have no sympathy at all. I understand that some people may have a different opinion, but I don't think mine is really that unreasonable.
Vs to package and resell the subject.
It is a matter of making subjects of data collection in control of their data being sold without their consent to the real customer, someone else.
You're out of touch.
Compliance just isn't as simple as you think it is no matter how much you double down in these comments. Laws aren't black and white. Do you not use an accountant, either?
Frankly, your advice is terrible.
But that's just trying to stretch what we are discussing here: that it is possible to comply with the law in principle. That some overzealous prosecutor with a grudge could nail you might happen - in Russia, maybe even the USA. But frankly where I live I have not yet seen a case like that. We probably have them but not frequently enough to make the news and in general the legal system here works quite well.
You might be from Europe and to you it may just seem sensible but 1-5 person companies often have to make tradeoffs like this. It is not right to say just comply with the law - it is so easy! The company, here, has decided that the cost is too high and that they are out.
I also have to be compliant with US laws if I deal with US citizens. What's the difference?
> You might be from Europe and to you it may just seem sensible but 1-5 person companies often have to make tradeoffs like this.
Not the ones that want to stay in business.
> It is not right to say just comply with the law - it is so easy!
But it is easy, he's just making it seem as though it isn't. There is so much factually wrong in that blog post that if that's the level of thinking that goes into the decision making then there most likely are other issues.
> The company, here, has decided that the cost is too high and that they are out.
Probably good riddance. But for all the wrong reasons.
OP can just rely on "legitimate interests", and describe the data they're processing and why.
Also you are responsible for downstream guarantees of legitimate interest.
He is right that open P2P protocols like XMPP, such as NNTP, IRC, bitcoin, ethereum, etc are not handled clearly.
It is a headache for him I can sympathize.
It's easier just to say "this tool blocks Europeans" and problem avoided.
All the laws, worldwide?
Are you in compliance with anti-blasphemy laws? Laws that forbid insulting the monarch? The tax regime of every country in the world?
The creator of Monal has decided the easiest way to be compliant with another country's laws is simply not to do business there, and I think you're underestimating the difficulty of the alternative (trying to comply with every country's laws).
And as for the 'don't insult the monarch' law, we have that law here in NL and I purposefully broke it as a private individual to make a point.
The tax regime of every country in the world has no impact on me, I reside in NL, my businesses are here as well. But when I had several businesses in Canada and one in the USA I complied with the tax laws there too.
> The creator of Monal has decided the easiest way to be compliant with another country's laws is simply not to do business there, and I think you're underestimating the difficulty of the alternative (trying to comply with every country's laws).
He's taking the easy way out because there never was a real business behind this. This is my conclusion because he feels that his holidays are more important than the rights of his users.
Why should the creator of free software spend their own money to support users in a region that imposes extra regulations?
There are professionals who spend their entire careers just "knowing" very specific parts of the law, and who are still frequently found to have misinterpreted it when tested in court.
Is doing your company's annual financial returns also stupidly easy, because you just have to know accountancy?
What about security? Just write all the software you use yourself based on your expert knowledge of cracking and cryptography?
Incidentally: not knowing you are breaking a law is no excuse for breaking the law, ignorance is not a valid defense.
This is possibly the greatest conceit in the history of legal systems. No human being in any Western nation could even read every word of law that applies to them in an entire lifetime, never mind fully understand the implications and the motivations behind those words that might be relevant to interpretation. Ignorance may not be a legal defence, but not being magically aware of the sum of all human knowledge about every legal system that you interact with is certainly a reasonable excuse for doing something illegal but otherwise apparently ethical and sensible.
Maybe you have huge assumptions that people reading what you say will add all kinds of limitations to what you say? I don't. It leads to terrible discussions, like this one.
Regarding the personal risk comment, I could've been more clear: From what I got, no lawyer can give you a guarantee at the moment, that what he says is actually what will happen. So in the end you'll have to take action based on recommendations, and take a risk - or, as the op, shut out all European users completely. My personal risk is continuing to do business in the EU, even with this uncertainty. You couldn't have guessed all that from my earlier comment, so I agree it was bad..
I'll try to do better.
Similarly we sometimes get asked to incorporate silly things into our service because the marketing people think that it will create engagement. Again, these are free SaaS businesses that are scooping up data and selling it. Although I made up the cat emoji thing, it's not that far off what we sometimes get asked to incorporate. With GDPR, those businesses are going to have to charge for their services and that's going to have to come out of our budget. We don't have to argue "We're not shipping our whole customer database over to a SaaS just so we can have cat emojis on the the system". Similarly, it makes our systems simpler because if they really want cat emojis, we can implement them -- it's just not "free" (it never was, but it's hard to have that conversation sometimes).
I probably should have left the SaaS thing out of my explanation because it's confusing and only slightly related to what I was talking about :-). Like I said, we use some great services for marketing and will continue to do so under GDPR.
There are varying degrees to which people see laws as affecting them. Small business tech owners, when a law says they have work to do, are going to feel affected. If there was a securities or accounting law that felt similarly overreaching one could expect a similar reaction. This is especially true if there is an alternative (locking out markets) that is easier. It's not helpful to try and compare the situations. It's also not fair to consider people weighing the costs of these laws as doomsayers. They aren't closing down their business, they're just restricting it to more business-friendly environments in their view.
People in other parts of the world have gotten used to that. As a current example, see US threats re: European business with Iran.
Even if the GDPR were overreaching (and I vigorously dispute that notion), it would simply be a taste of America‘s own medicine.
No lawyer or accountant has ever given me anything that I couldn't have come up with myself, with sufficient study. I still paid them, because the law is very complex and I have other things to do with my time. That's how any country with a nontrivial legal system works.
You seem to have great confidence that you understand how the GDPR will be enforced. I'd suggest that:
1. Not everyone knows as much about EU law as you do. This is especially true for people who don't live in the EU.
2. You might be wrong. Maybe GDPR compliance really is dead simple, and the lawyers who keep answering "it depends" are just cheating their clients; but from my experience in complying with similarly complex regulations, I wouldn't bet 20M EUR that's the case.
Because by default any web site has, in the past, been open to people from any country that doesn't censor the web.
Regulations like GDPR are making doing business in more than one country more difficult and encouraging a Balkanized web.
This has never been true since the internet was international. You have always had to comply with laws of countries you interact with, it's just that most people who ran internet businesses decided to ignore the law (just try hosting some copyright or patent infringing content on the internet and see how long it takes to have legal action applied, even if you aren't a resident in that country). And, despite the ethical questions about censorship, censorship is usually done through the laws of a country (for instance in Germany). So complying with censorship requests (or having your entire site blocked) is actually an example of complying with laws of other countries.
The world is made up of sovereign nations, and businesses that wish to interact with other sovereign nations must obey the restrictions that the both nations place on that interaction. If you don't like it, then don't do business with that nation. I cannot think of another industry where this concept is seen as foreign -- it's a very fundamental part of how the world has been structured for thousands of years. Just because it's much easier to conduct businesses overseas than it was 200 years ago doesn't change the fundamental properties of what you're doing.
And the cost of regulation, which used to be negligible compared to the cost of the enterprise itself, has now become a significant barrier for small businesses.
Just think of what China would do to the Internet if it could.
Prove that.
Because that's not how "the law" works. I am Canadian, my business exists only in Canada, and there are only two types of laws that apply to me. Canadian laws, and treaties that Canada has signed on to comply with.
No other country in the world can just make some "arbitrary" law that affects me. Unless my country agrees. And to my knowledge, Canada has not signed a treaty with the EU regarding enforcement of the GDPR.
The EU is primarily leveraging the fact that most everyone wants to travel to the EU eventually.
While you in your home country you have no need to comply with the GDPR unless a treaty between your home country and the EU exists to mandate it.
The EU is also leveraging their trade agreements.
What they don’t understand is that China is next and they have totally diametrically opposed views on consumer privacy. But when has the EU ever been farsighted?
The US is quite opposed to extrajurisdictional law enforcement which is why they don’t sign onto things like the International Criminal Court.
Unless you wish to do business with that country, in which case you need permission from that country in order to do business with its residents. If you break their laws they can place sanctions against you, and if you find a way to break those you can theoretically be punished legally through extradition.
If you don't do business with those countries then you're off the hook. Obviously.
Just look at the recent Project Gutenberg copyright lawsuit for an example of how breaking the law of a country you are not in can cause you legal troubles.
For example, with small numbers for the argument's sake, say in 2000 there were 5 good webpages and 4 bad webpages added to the internet every day. Now there are 10 good webpages and 50 bad webpages added every day. That would mean we're getting more good information per day than before, but the signal to noise ratio has gotten worse, as you said.
For all intents and purposes the information doesn't exist if you can't find it, you can only find information as a certain rate, and a larger and larger chunk of that information bandwidth every day is bad information. The practical result is that the rate of good information someone has access to has decreased even if the total system has a nominally higher rate
If you decide to sell a couch to someone in America, you have to comply with American tax laws, American import and customs laws, American consumer laws, American patent laws, American copyright laws, American trademark laws, and any other laws involved with doing a financial transaction with someone in America. The same logic applies for Australia, the United Kingdom, Germany, Belgium, South Korea, Japan, etc. Pretending otherwise is naive, and if you don't believe me then try to sell something patented in America to an American.
The key question is what happens if you break those laws. In most cases you will be given a fine, and if you don't pay then you will no longer be allowed to sell goods to consumers in that country. If you continue to break the law then you are probably breaking an international treaty on border control or customs, which means that you could be extradited or tried in your own country. Some of the laws I mentioned above are mediated through international agreements, but the fundamental point is that if you break their laws they can place sanctions against you to stop you from doing business with them.
Of course, for a couch business things would probably never reach that level. And for an internet business you probably would just be IP blocked or something similar.
> No other country in the world can just make some "arbitrary" law that affects me. Unless my country agrees.
But it only affects you if you make the positive decision to do business with a country that has those laws. If you don't decide to do that, then you don't have to follow those laws (obviously). You can't have it both ways though (the benefit of having access to a market without having to follow the laws of that market).
In the case of enforcement you're right that they wouldn't have the right to compel to you to pay a fine, but they can in theory place sanctions against you. So if you continue to do business with sanctions in place then there is a process for extradition through international treaties.
A foreign country could arbitrarily decide I owed them a certain fine, or was no longer allowed into their country, or that they didn't want to allow my products into their country, at any time, whether or not I followed their laws.
In my daily life I've done, and continue to do, things that are illegal under e.g. Iranian law. That's fine and normal - I have no obligation to comply with Iranian law. Iran can make its own decisions about whether e.g. I'm allowed to enter their country, but that would always be the case.
every country has the right to enforce it's own laws within it's own borders. you don't get a pass to do whatever you please in another country without their permission.
edit: i noticed "my business exists only in Canada"
if you mean to say you aren't doing business in another country than what you've written isn't speaking to the point of "you are required to comply with the laws of any country you do business with"
A point is that often statements of a law are defined not by the language but by the ruling of lawsuits that occur around those statements and that is what most companies and lawyers are waiting for, what do courts rule when these lawsuits happen.
The biggest issue that I have heard of (Im no expert) is what does the right to be forgotten actually mean ? Does that mean all your backups are now illegal as you are retaining the customers information after they asked you to remove their records?
I think some of the fear that smaller business have is that this will encourage lawsuits until people understand how the courts will rule on each item.
But to answer your question about the right to erasure, here is the law: https://gdpr-info.eu/art-17-gdpr/
I can't find it right now (and I have to get back to work), but there is a reasonableness requirement for requests. So things like backups might be covered by that. I wish there was some direction on that because it's a problem for me at work as well.
My opinion is that the directive's view is that all personal data retention should be temporary. There should be a defined point where the personal data is deleted. Either that's when it's no longer necessary for the contract, or when you no longer have a legitimate interest in it, or when the user asks for the removal.
Up to this point, most of us have been building databases with the intent of retaining the information indefinitely. So we never thought about this. Although I'm a fan of this law, I admit that it's going to be troublesome transitioning from where we were to where we need to go.
And as the parent briefly stated, immutable databases are going to be a serious problem.
If a data subject requests their data to be erased, you should remove their data from active systems so that it is no longer being processed, but you don't have to remove it from backups or other passive systems. You should however store some sort of marker so that if you need to restore data from backups, the data subject's data will be re-erased or otherwise stopped from entering active systems again.
And if a data subject asks, you have to tell them how long you store your backups of their personal data.
I think that's perfectly reasonable. And if your backup retention policy is "forever", now might be a good time to re-evaluate that policy.
That concern really is unfounded, though. The primary means of enforcement of the GDPR will be action by national data protection regulators. It isn't some carte blanche for trigger-happy lawyers to start suing every business that gets a little detail wrong or anything like that.
The general concern that the picture is unclear until something happens to clarify it is, unfortunately, much better founded.
forgive my frank language, but too fucking bad.
edit: my right always outweigh your profits. Sorry.
The data collected under the former is simply the IP and a timestamp in webserver and app logs, usually purged within 7 days and then any user data included in backups, purged after 3 months.
"better user experience" is not really personal data but I included it anyways; browser type (mozilla/edge/etc.), viewport resolution, pageload time, OS. And not stored in a way that allows correlating them.
For analytics that is really all I need.
https://gdpr-info.eu/art-6-gdpr/
> processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Over the thumb: you can use it for things were you need PI for your service to work, it is normal, that you request address if you operate the online shop, you can't deliver the goods without it, while analytics is something users don't need and is not required for your service to operate.
I was just writting complaint letter to my phone/isp company where they showelled marketing, questionars, threat assesment (not IT security, customer assessment) analytics and few other fishy things into legitimate interest, without even providing information about which data they use and why exactly. Legitimate interest is a really nasty thing and it is hard to get it right, it is not free "get out of jail" card.
Consider adventured's sibling post - it quite astutely points out that GDPR discussions are much more vitriolic than you'd expect for discussions of the minutiae of data handling. People who say that GDPR compliance is hard are being attacked on a personal level. He explains it as 'emotional investment' in GDPR but I don't think that's a good explanation; the people arguing most strongly for it are also those saying it's not much work, so that seems backwards. You'd expect people who put in the most effort to be most emotionally invested in it.
There's a much better explanation available: your view on GDPR is a direct consequence of your assumptions about human nature. If you believe in the existence of benign and enlightened technocrats then GDPR seems like excellent progress towards building a better world - it's extreme vagueness and severe penalties are exactly what's needed to foster obedience to technocratic elites. People who complain about this are just being unnecessarily awkward ... just be reasonable after all, and you'll be fine! The EU are reasonable so if you're reasonable too, you have nothing to fear! From this perspective, anyone who objects to GDPR or actually decides compliance is impossible must - almost by definition - be being unreasonable. What are they hiding? Why can't they just get on board; the only answer available is that they have flawed characters and any points they make about gray-area debatable things like cost:benefit ratios must be some sort of obfuscation.
If on the other hand you believe the whole idea of wise and beneficent bureaucrats is naive, then GDPR looks like a hell of a lot like a power grab by the very sort of people who shouldn't be able to grab power. Vagueness is of deep concern because it's in the shadows of vagueness that abuse can be found, and when a law is nothing but vagueness, it even makes sense to question to motives of those who created it - that's a problem because lots of self-styled Europeans have bought into the EU's utopian rhetoric and can't separate criticism of the EU from criticism of themselves and their desired future.
There's no real scientific way to prove whose assumptions about human nature are right. The USSR was a rare example of a real-life experiment in who was right and for a long time it proved the American style, conservative, small weak government is better mentality to have superior results. But that was decades ago and many have forgotten or weren't alive back then, so now rule by technocratic dictatorship seems attractive again.
As a consequence GDPR discussions will always have the same flavour as Clinton v Trump debates, or Brexit debates, or whether to restrict spending on political campaigning. They are ultimately about the same issues.
There is no GDPR debate or fight: it's done, it was done six years ago, and the only people pushing back are American companies who are unhappy that Europeans don't want their data hoovered up by corporations they have no control or oversight of, for who-knows-what purpose.
Maybe I'm wrong, but I think that parent example is not US-specific at all and is applicable to just about any country where there are people that learn toward different beliefs (that "direct consequence of your assumptions about human nature" part of the post)
The assumptions may be wrong, but that was generally constructive.
This is also why in all cases you'll see the GDPR supporters go after the character of the site/service owner (including always questioning their motives to muddy the waters). It's an attempt to short-circuit any reasoned debate, to destroy the credibility of the opponent. This has happened numerous times on HN in the last month or two.
Are you expecting GDPR (or any law for that matter) to define an exhaustive list of every definition, that holds true now as well as for the future? Have a rethink about that statement...
Just as companies need to be specific about how they use data now the legal-judicial system needs to be specific about what it means and intends.
It is a double standard because the legislators are not interested in the commercial impact.
Article 63 of the GDPR specifically covers consistency of enforcement across the regulatory agencies.
You keep daily backups for 1 week, and after one week the users data is gone from all backups.
The only possible window for restoring deleted user data is the time window from deletion to backup. To "solve" this you need to make more backups, ideally live backup and replication with really frequent snapshotting. And this is something you would want even without the new law, because you don't want to lose user data in case of a server failure. Why would you restore from an old backup? (And if you really need to restore from an old backup you most likely want to merge this backup with the newest one to reduce data loss. In this case you can reapply all deletes.)
The new laws don't change anything. For me at least. Also my lawyer is totally fine with "only" minimizing the problematic time window. We both know that it will never be zero.
You just can not keep backups of everything for the purpose of everything.
My example can not include all cases and was written in the spirit of "we are a bunch of devs with a small project". As is monal.im .
Invoices for VAT MOSS have to be archived for ten years. And until today nobody really knows (it is another EU law disaster) which information you have to keep to prove the origin of your customer.
Do you invoice for a different country than the recipients country? Why?
Unless you want to business with another country, in which case you need to follow the laws of that country when you conduct that business. Which is what I've been saying the whole time.
> Just think of what China would do to the Internet if it could.
If you want to provide a service to China you need to follow Chinese laws or they will block you using their firewall. China is a (not very nice) example of how a country has the right to decide who it does business with -- if you won't help them conduct surveillance of their citizens then they won't do business with you and will block you from doing business with their people. You might not agree with their laws or how they act, but it is their right as a sovereign nation to create their own laws.
I never said you need to follow the laws of every country in the world, and I really don't understand how so many people are reading that out of what I said (and keep saying). If you want to do business with a country you will have to obey the laws of that country. That's the way international trade has always worked.
I am just saying that the EU will not be the only jurisdiction following this model. Be prepared.
And as others have pointed out, no the users don't get to put a leash on webmasters, it just allows the users to retain some degree of control over what the webmasters are allowed to do with personal information about their users. But feel free to argue that it is your moral right to sell user's e-mail addresses to some spammer or whatever.
I'll let that excerpt speak for itself.
And yes, I'm arguing it's anyone's moral right to profit off information voluntarily entered into their website unless a specific agreement was made on the website to the contrary.
Views like this are exactly why we need the GDPR.
I find it utterly ridiculous - disgusting even - that you really believe you have the right to do whatever you want with someone else's personal information. When you provide an email address, physical address, name or other PI, it's with the expectation of it being used for a specific purpose - you should absolutely not give you the right to sell that information to the highest bidder.
The GDPR prohibits me from doing that, and in fact requires that I have the ability to rewrite history by removing that fact if the user who had 192.0.2.7 ever requests it.
Some people, on hearing this, say, 'well, that's fine, you can just store 192.0.2 or 192.0 instead.' That seems pretty silly to me, since the whole point of logs is that they contain full information.
The GDPR tries to do the right thing, but it's broken. Immutable logs are a fundamental right.
It appears to me that as long as you don't use the logs for nefarious purposes you'd at least have legitimate interest in processing them (including the IP addresses), and so could keep them. This is the stance I am taking with respect to my personal webserver (together with a time limit after which logs are deleted); if a regulatory body informs me to change my approach, I'll gladly adapt.
Note also that IP addresses can be personal data, but do not have to be. Most claims here seem to relate to a ruling, where the IP address was deemed personal data in the hands of an ISP, who would be able to resolve it to a real person [1]. If you hold an IP address, but can't connect it to a real person (e.g. by having legal means to convince the ISP to give you that name based on the address), then it seems the IP address would not even be personal data in the first place. In the particularly ruling, the operator of the webserver was the German government, which presumably has more legal power to make an ISP turn over identifying data on a customer than a random website would have.
In any case, I hope some more clarity about this will emerge soon. But what you are talking about here would at best be a borderline infraction (and probably just be covered under legitimate interest). OTOH, what the person starting this thread had in mind seems to be that all the data he might collect on his users is fair game to do with as he pleases.
[1] https://www.whitecase.com/publications/alert/court-confirms-...
No it doesn't.
> and in fact requires that I have the ability to rewrite history by removing that fact if the user who had 192.0.2.7 ever requests it.
No it doesn't.
I absolutely agree. If you feel a law is wrong, it is your absolute right to say so and demand change. This is the basis of all law and civilisation. The consensus of what is right-or-wrong is what makes a society.
Go for it.
If it is a fundamental right, how far does it go? Should I be able to sue you for watching me walk in a public place? Photographing me? Video taping me? What about a privately owned but still public place?
There are a lot of questions here that I think people tend to skip over about users owning information about them and being able to control it.
Making some observations out your window of cars passing by is something no one ever had a problem with. Taking down every single identifier you could and coordinating with others to track that person, for a profit, is something that would not be kosher in meat space.
Why this different just because it's on a computer?
What? Because you just decided that it does?
It's people like you why we need GDPR-like laws. I'm curious, what's your stance on the Equifax data breach? They had data that belongs to them and they could do with and treat it as they pleased, right?
Or for that matter, someone running a social platform that allows socially "undesirable" speech, speech that is openly critical of government policy, or speech that exposes the wrongdoing of powerful people.
For about 20 years, yes.
And I’m saying that’s bullshit. You’re breaking laws left and right, but you just don’t get caught because enforcement of those laws is so inconsistent. And the GDPR is so much worse; I’m sure you’re not compliant with GDPR given how vague and over-reaching the law is, but you’re probably mostly compliant and you’re too small for anyone to care.
Well, you know my business better than I do I guess.
> And the GDPR is so much worse; I’m sure you’re not compliant with GDPR given how vague and over-reaching the law is, but you’re probably mostly compliant and you’re too small for anyone to care.
And my business is about 100x the size of the one of the person writing the article. And I'm not worried. So I see the article writer as someone who uses the opportunity to make a whole bunch of fuss over something that (1) most likely would never impact him and (2) has indicated clearly that despite his opening sentence he probably doesn't give a damn about his users privacy.
So as far as I can see the law is working as intended.
You might not think the costs are fair (and in practice that should be taken into account by regulators, to avoid removing all international trade and thus losing the benefits), but that is not really justification for arguing that this is a departure from how things have always been. Nor is it justification for arguing that you shouldn't care about the laws of other countries you do business with because you don't live there (which is what GGGGP was insinuating).
The EU can certainly demand that web creators jump through hoops, but then they can hardly complain if creators outside the EU decide that interacting with the EU isn't worth the trouble.
(My whole point is that a lot of people arguing about GDPR want it both ways, and don't see that it's not strange that countries have rules for doing business with their residents.)
If I create free software that concretely and demonstrably aids in worldwide human trafficking and has negligible utility elsewhere, would you still consider my refusal to comply with regulation reasonable because my software was free?
How free the software is not a determining factor, either morally or legally, in determining whether or not the GDPR is or should be applicable.
You can hardly complain that someone who gave you something for free wasn't willing to spend their time or money to comply with additional demands.
But why would someone who is literally giving something away accept that liability, or even any perceived risk of liability, if they have an easier option?
If you sell electronics that are a fire hazard, you can be punished for breaking consumer laws. I mean, for an extreme example, if you sell an illegal substance in America from overseas you can be punished for breaking those laws too.
If I buy something mail-order from Canada, I'm considered the importer and would have to pay duty on it, just as if I had driven a truck over the border, bought the couch over there and driven it back.
If it's something as big as a couch, chances are it's going to be held at a customs warehouse for me to pick up (after I've paid the duty).
If I need to do this on a regular basis, I'm going to hire an import/export broker or possibly go through an actual furniture importer. That's the company that's doing business in the US that owes US incomes taxes, has to comply with US consumer protection laws and any of those other regulations.
In all of these scenarios, at no time did the Canadian couch store do any business in the US, even though I, the customer doing the "buying" may have been initiating the transaction over the Internet (or phone or with a paper mail-order form) physically in the US and/or with a US credit card.
If that Canadian couch is a fire hazard, the US's recourse is to stop it at the border and not let it in (or punish the US company, only in the case of the furniture reseller), and possibly punish me, the importer, since I'm the one legally attempting to bring it into the country. AFAIK, they have no recourse against the Canadian company.
That came from the legal departments from our German, UK, and French entities.
> Purpose of security doesn't change if its PII or not.
Security is the legitimate interest, an important part of collection under GDPR.
If you're too worried about this, remove the last octet from the IP or and/or it with a mask. And especially don't associate the IP with the user (by default you can't find out who's the user only by IP).
This guy quite clearly states that he doesn't have resources to become compliant, while it is too risky to make a mistake here.
There are fans of GDPR on this website, who prefer to ignore the fact that the compliance has its cost, and added to that still unknown risks of practical interpretation of legislation which also have their cost. But these are real life things.
So, for example, he says he is required to appoint a DPO.
The U.K. Information Commissioner has this to say:
>Do we need to appoint a Data Protection Officer?
A> Under the GDPR, you must appoint a DPO if:
> you are a public authority (except for courts acting in their judicial capacity);
> your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking);
> * or your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences.
I suppose it depends where in Europe he would like to visit
Essentially that's it.
I am no lawyer but I am a CPO.
Pro tip: Speak with the regulators they are on your side.
https://www.today.com/food/kinder-joy-chocolate-eggs-are-com...
I mean, it never really took off here, very few people prefer it over the original, but better than not being able to sell it outside of the US at all.
And why should the French cripple a delicious and traditional product, which is gladly gobbled up by millions of happy consumers to sell their product in the US?
Case 1: CompanyA is already doing business in CountryB. CountryB changes regulations. CompanyA pulls out of CountryB because of regulations
Case 2: CountryB has regulations. CompanyA choose not to do business in CountryB because of regulations
am I missing something?
P.S. I sincerely hope my country gets out of this ASAP.
It takes some special talent, even as an adult, to take such a big bite off of a classic Kinder egg that you'd have any chance of accidentally swallowing the plastic capsule or somehow else hurting yourself on it.
And with the new egg, I'd be concerned that my kids swallowed that plastic spoon. Like, that's something they actively have to put into their mouth and it's not as interesting as the toy for them to be motivated to not swallow it.
It's also small enough for them to realistically pull this off.
I haven't found a single case of a child getting hurt in Germany. Only news reports about them being unhealthy (big surprise).
EDIT: Turns out the US-style kinder eggs are indeed available outside the US.
https://www.candywarehouse.com/assets/item/regular/kinder-jo...
But I'm not sure it's typical.
Most people seem to prefer the original, though. They lost a lot of charm by going from toy+edible+tinfoil to plastic+toy+plastic+edible+plastic spoon+plastic.
I have seen this outside of US also (pretty sure it was doing a Europe trip)
> the information used to determine the place where the customer is established or has their permanent address or usually resides.
Sadly this regulation doesn't specify which kind of information this could be.
Your customer could try to get a better price by pretending to be from a country without VAT. Therefore the address given by the customer is more or less worthless in this regards. One more realistic information is the IP address. But as this also is pretty easy to spoof it might be reasonable to also keep information about the country were the cc card was issued, if possible.
Partly because there is a much broader political spectrum -- Democrats in the US roughly line up with, for example, the Conservatives in the UK or the CDU in Germany -- but also because it's just a different set of issues and preoccupations.
I do think it's fair to say that within the EU there is a general consensus about the importance of data privacy, and I also don't detect any resistance to the GDPR in general, or any question that it should be repealed. (That was partly sealed by the revelation of US spying on Europeans a few years ago, which hasn't been forgotten.)
Second, if I'm honest, I find the whole "assumptions about human nature" is a bunch of hokum and quite the opposite of constructive. Nothing about GDPR has to do with "obedience to technocratic elites", and is in fact about rejecting the ability of institutions which are not democratically accountable to gather personal data and monitor people, or make decisions that affect their daily lives, without their informed knowledge and consent.
GDPR is not a "power grab" (hah!), it's about distributing the power that comes from control of information more evenly. The EU has a lot of flaws, but this is one of the most democratic and equalizing bits of regulation that they've produced, and frankly the concessions it makes to large companies are huge.
I don't accept the argument that to be in favor of this I must be in favor of USSR-style totalitarianism. If anything, the inefficient planned economy of VC-funded startups, with their cults of personality around founders, that want to collect data and influence populations with impunity are the petty dictators of the 21st century. Personal rights should trump the rights of corporations, and I am deeply suspicious of people who would equate the two.
But that's all making a mountain out of a molehill: most of what GDPR does is harmonize existing regulation across the EU to make it easier for companies within and outside of Europe to do business here, adds enforcement teeth to the regulatory agencies and harmonizes the penalties, and sets out in actually rather specific detail what is required to be compliant, while giving everyone years to implement this regulation.
If people don't want to comply with GDPR and just block all EU users, then that will make the internet a nicer place for us, so by all means go ahead!
Nothing about GDPR has to do with "obedience to technocratic elites"
No? I think you missed by points then.
The GDPR was created, is enforced by and serves the interests of regulators. It specifies so little it is essentially a direct grant of power to those people - they can do whatever they want within its framework and that framework allows nearly anything.
As for 'technocratic elites', did you see political parties campaigning on this issue? I sure as heck did not. Right now the hot topics in European politics are immigration, terrorism and economic growth. Not data protection.
is in fact about rejecting the ability of institutions which are not democratically accountable to gather personal data and monitor people
Of course companies are democratically accountable - outside of monoplies (rare), you can just not trade with them if you don't like their data handling practices.
> Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, ... or a computer IP address.
Emphasis mine.
I said:
> IPs don't count as long as you're collecting them for security purposes and don't have a way to identify a person using the IP.
- the ip addresses never uniquely identify someone or
- you have a legitimate interest to collecting this data.
Neither provides carte blanche for collecting IP address.
If you have "other ways to identify somebody based on an IP address" then that wouldn't meet the criteria laid out by the lawyers.
You might be thinking of this pseudonymization stuff. My advice is not to play with it. Just delete your logs after a month unless you have a demonstrable and immediate security need for them.
"Analytics" is not what his company is for, ergo, using my Personal Data to do analytics isn't okay. He sure as hell isn't doing it for my benefit. I'm also not hiring him for security, so the same reasoning applies: he doesn't get to store my IP address in his logs without asking.
And when I say "no" to his opt-in modal, he'll still have to provide me non-degraded service. The fact that he can do so is yet another indicator that the data collection is not a legitimate interest.
Look, you can definitely discover and monitor for problems by simply hashing IPs and storing the hash instead. Once you've detected a potential problem (say, a lot of requests from the same hash), only then do you have a "legitimate business need" to record the actual IP addresses and do some short-term analysis of the situation.
The spirit of the law is simple: if you don't absolutely need to store personal data, DON'T. Just don't. Store something else. Or just drop the data into /dev/null. Saying that you'll delete soon the personal-data-you-don't-need isn't sufficient.
And really, if this is the way GDPR compliance is going to go, "muh security" is quickly going to gain the reputation as the bullshit reason shady people trot out who want to disobey the law. People who actually care about security should push back on that strongly.
"There must not be a conflict of interest between the duties of the individual as a DPO and her other duties, if any."
Specifically they recommend against also being the data controller. I.e. you shouldn't be responsible both for handling personal data and verifying compliance of said handling.
That's why some independent DPO jobs are appearing.
But the DPO is a small cog in the machine. Updating the processes is the most time and resource consuming regarding the GDPR.
Keeping detailed information about everyone that enters your store isn't illegal, as far as I know. Especially not information that is gained from observation (what color shirt they're wearing, their IP address) and information that is submitted willingly (their name given for a reservation at a restaurant, their username).
That's the whole point of the law is to say it's illegal, the same way laws made stalking people illegal
I guess an XMPP Server could be considered a communication service an could be subject not to the GDPR but to regulations concerning ISPs and Phone companies.
Toy is also in US version but different design
They comply later than everyone else not because they didn’t see it coming or didn’t prepare for it, just that it wasn’t in their interest to do it earlier
I run a business that follows EU DP best practices (and so was mostly GDPR compliant already) and the first I heard of it was mid 2017. My country's data protection agency made no attempt at raising awareness despite having my email address on file :-D It's only been frequently hitting non-EU industry news and places like HN since late 2017 so I can appreciate how non-EU folks might feel blindsided by it.
Likewise. This idea that the GDPR has been in the works for years so it's somehow implausible that very small businesses have only just heard of it doesn't stand up to scrutiny. No owner-run microbusiness is spending the time necessary to keep up with the vagaries of EU debates.
Similarly, the idea that the GDPR is plainly readable and so that shouldn't be a burden and no-one needs to consult experts makes no sense. The document is many pages long, there are many more pages of guidance and interpretation produced by both the EU itself and the various national regulators, and it's still fundamentally ambiguous on many significant practical points.
It is entirely reasonable for a small business that does relatively little trade with the EU not to want anything to do with this, and it has little if anything to do with how good or bad their practical data protection measures and respect for privacy are. If small businesses are overreacting then that is on the EU for failing to pass better law and provide sufficiently clear, concise and timely publicity and guidance on what it really means.
My business interests are in the UK, so we're stuck with this one. However, if we'd realised ahead of time how much trouble the new EU VAT rules would cause a few years back, we would gladly have sacrificed the modest part of our revenue that comes from other EU member states in order to avoid that mess, and it wouldn't have been a close decision. So I find it very hard to criticise anyone running a small business outside the EU for wanting to avoid the latest round of heavyweight EU regulations if they have a way to put themselves outside of their scope.
I only found out about GDPR earlier this year from a random HN comment. I can't understand the attitude from some HN commenters that everyone should have known about this for years. Where/how should every small business that could be impacted by this regulation be notified?
As you noted, the regulation is readable, but verbose and frustratingly vague. I ended up reading most of it along with countless articles from various third parties debating what it means and how to comply - and I'm still not 100% certain if the steps I've taken mean I'm actually "GDPR compliant."
I too got stuck having to comply since around 30% of my customers are in the EU. However, I gladly would have foregone all of that revenue and focused on non-EU customers only if I had known what was coming back then...
That's the price of sitting in your office with your head down though, you can't ignore changes such as these.
This is one of the oldest HN mentions about the GDPR I could find:
https://news.ycombinator.com/item?id=11764073
But it sank without a trace.
VOGON CAPTAIN: [On Speakers] People of Earth your attention please. This is Prostectic Vogon Jeltz of the Galactic Hyperspace Planet Council. As you no doubt will be aware, the plans for the development of the outlying regions of the western spiral arm of the galaxy require the building of a hyperspace express route through your star system and, regrettably, your planet is one of those scheduled for demolition. The process will take slightly less than two of your Earth minutes thank you very much.
MANKIND: [Yells of protest]
VOGON CAPTAIN:
There’s no point in acting all surprised about it. All the planning charts and demolition orders have been on display at your local planning department in Alpha Centauri for fifty of your Earth years so you’ve had plenty of time to lodge any formal complaints and its far too late to start making a fuss about it now.
From "Hitchhiker's Guide to the Galaxy" by Douglas Adams
sorry I couldn't resist
The decision to exclude a portion of your user community should be explained.
Unless you personally know the developer you are making a number of assumptions about their resources and time to deal with this issue.
Presumably the developer wants to continue to offer this app and service. His understanding of GDPR and how it affects his service will grow over time and he will likely eventually take action to reintegrate the EU into his service.
Unless you personally know the developer you are making a number of assumptions about their resources and time to deal with this issue.
The only thing certain are the insane crippling fines.
It is extremely naive to believe you don't need a lawyer for that. You do - the same way as in some of EU's less market-oriented countries, after a VAT reg you need a registered accountant.
Having a data processing officer in the EU for some definition of significant business is not a natural law and requires careful parsing of the legal text.
In this case, a lot of people base their argument on a fundamental right to privacy which is not generally accepted by everyone and therefore it has to be explained because it's an important part of the discussion.
Also, no one who actually does this stuff for a living uses the term "webmaster".
Have I been hallucinating my workplace this whole time?
* We've known about the GDPR for around 2 years.
* The GDPR text, national regulators' comments, industry opinion, sample docs and a plethora of free resources have been readily accessible on the Internet for about the same length of time.
Having worked on the GDPR docs for a medium-sized business that builds learning management systems for corporate customers (about 100 live systems + dev and testing platforms where we are a processor of their personal data), it took about 3 weeks-worth of time to re-audit our platforms, complete a more detailed risk/impact assessment and write this all up together with some procedures for handling enquiries.
Yes it took time, and we went the extra mile with diagrams and tables because the docs are customer-facing, but handled in a timely fashion, GDPR compliance is not a brick wall to business continuity.
If a business already has in place a baseline level of good information security practice, GDPR compliance is not that hard.
Sure, the regulation was there, but nobody talked about it, and it's unreasonable to expect people to magically learn about EU regulations, especially if they don't live in the EU.
6 years, it's a 2012 directive.
And no, this is not about demolishing our way of life, the town we live in or the planet, it's about respecting the privacy of your users, which - for a change - is actually a positive thing. Unless of course you weren't going to do that in the first place you should welcome the development, I imagine that in a just world the Vogons would be on the receiving end of it.
Oh, and in this case the plans were not on display in the locked filing cabinet in a basement of a building where the lights had gone off and where the stairs were missing.
A handy URL has been provided for a long long time and all the debates have been recorded in public as well.
Sure make it illegal to mistreat user data then punish those who fail. Don’t punish everyone up front
I never said that you have to follow the laws of the country of nationality of your clients. That'd be a ridiculous thing to say, and I'm not sure why you're arguing against that particular strawman (the GDPR only talks about EU residents and doesn't mention EU citizenship at all).
An EU resident visiting" your business which is hosted and operated in the United States, is the same as a Saudi Arabian coming to the United States to buy alcohol.
This is the reason why the GDPR requests an EU designated representative, so there is someone to charge locally.
Except the EU resident isn't "visiting" your business, you're providing a service to them across the US-EU border (and just like any cross-border service there are rules). I really don't get why this case is any more complicated than any other kind of consumer law (you can't sell electronics that blatantly catch fire to Australian customers, even if you're based in a country where consumer laws don't exist).
Why would Saudi law apply in New York?
> (1) The controller and the processor shall designate a data protection officer in any case where:
> a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
> b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or
> c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10.
As poisan42 points out - it echoes the words in the actual article, directly.
Bottom line, he doesn't need a DPO.
The GDPR replaces the 1995 Data Protection Directive.[4] Because the GDPR is a regulation, not a directive, it does not require national governments to pass any enabling legislation and is directly binding and applicable.[5]
So, no local laws. It's a regulation.
The buyer is the one responsible for knowing their own local laws and should be responsible for managing them.
If a Saudi Arabian couple ordered a gay wedding cake from a baker in Montreal, over the phone from Saudi Arabia, in preparation for flying to Canada to get married, which laws apply? To whom?
This is a bad solution to that problem. So many people's data was stolen that preventing future data from being stolen isn't the most important thing we should be doing. Last I heard it was 150 million people - that's enough that it no longer really matters to the average person if their data is leaked in the future because there's such a high change it already has.
The real solution is to change our systems so that data leaks aren't a big deal. If people didn't ask for a 9 digit number to identify me, as if that's a reasonable thing to keep secret, then it wouldn't matter if everyone in the world knew it. That's the problem with data breaches like this. That's what we should be fixing in response to it.
This isnt even users feelings, this is data that can a:have monetary value and b:can be plain wrong and damage a user.
Do you think that merely by observing data you have right to it? Do you not believe in any IP law? If you agree with any type of IP law then you are just being hypocritical by insisting that webmasters get to take and use whatever data they come across
Yes, with some exceptions for actual copyright and the like.
>Do you not believe in any IP law?
IP law, yes, but I don't feel a user's entries into a website automatically qualify as IP owned by the user. The terms of many websites actually say that whatever you upload to them is owned by the website, unless a prior IP applied to it. I've only ever heard the claim that your name et al. are your inherent IP from "Sovereign Citizens" before.
If
* core activities * require * large scale * regular * systematic
If you tick all those other boxes, but are concerned that your processing may be teetering on the boundary of 'large scale', I would be cautious and assume your liable.
I agree that it is safer to imply you're liable.
To say that local courts and laws will have no influence is complete rubbish.
I don't see a way to declare one bad and not the other unless you're just saying that new things are bad.
Additionally the terms of websites can say whatever they want but it doesn't mean they are legally defensible. I could put into my terms "by finishing this sentence you agree to be enslaved by Lovich LLC" but that doesn't make it happen
Do you remember many people's lifes crippled by this?
Now, if there was someone from Italy (I don't know, the site's gone for years now, highly unlikely but theoretically possible) does this means I'm a possible law offender and should avoid visiting Italy?
Oh, it also had no cookie banners, too...
Could be, the reason no one was hurt is that those laws weren't actually enforced any much? If so, I believe GDPR's promised to be different.
The truth is that obviously the authorities don't have an incentive to come after a minor player.
Selective enforcement of commercial law is a routine tool of unfree states--look at something like the tax charges against The Cambodia Daily. To trust in regulatory discretion is to trust that no government in the EU--a continent that within living memory hosted Francisco Franco, Giorgios Papadopoulos, and much worse--will ever be run by people you disagree with. In the extreme, a dictator can always ignore or rewrite the law; but somewhere in the slide from our present democracy to that, I don't think it's unimaginable that the GDPR could be abused.
I support privacy regulation. I don't see why it requires us to abandon the rule of law.
ETA: Downvote if you trust Viktor Orban, I guess? I'm presuming a strong case of "it can't happen here"....
The above statement will apply to everybody or nearly everybody (still not you).
And what am I missing? They were dictators of Spain and Greece respectively. There are millions of people who can remember their rule alive in those EU countries today. What changed in the last fifty years to make a recurrence impossible? Turkey narrowly missed joining, and it's basically there now. Hungary seems well on its way.
[1] https://en.wikipedia.org/wiki/Copenhagen_criteria#Political_...
[2] https://en.wikipedia.org/wiki/Article_7_of_the_Treaty_on_Eur...
Spain just crushed a political movement trying to organise a referendum through force. It arrested the leaders and the rest of the EU is helping them catch the ones that fled. They call it a rebellion and state that Catalonia can never be independent.
Not an Article 7 violation, apparently. According to the EU it's merely an internal matter.
Hungary elects a government by a wide margin, it's a popular government, and the government reflects its people's disagreement with EU policies that aren't in any treaties and weren't in anything Hungary previously agreed to. This is apparently a violation of "rule of law" and "not democracy".
The EU's definition of democracy is anything that helps the EU, simple as that.
Why do you think the GDPR needs to give the government that much power? For a simple example: Why is 20M EUR the right statutory maximum? If the regulators would never enforce it, then why does it need to be so high?
So if applying the law is "crushing a political movement", let's crush it all the way. Nobody is above the law.
However a coup is a military overthrow of a government. What the Catalonians tried to organise is a vote, not a coup.
The 20M seems insane to me. If the standard for smaller companies were e.g. 100% of the last five years of revenue plus 50k EUR, then can you imagine a case where it would be cheaper to violate the law and keep paying the fine? That would be a lot less menacing to small, non-commercial or semi-commercial projects.
