News for hackers. Stuff that matters.

A comment on How GDPR Will Change The Way You Develop. Parent comment

Re:How GDPR Will Change The Way You Develop by amarkov on Tuesday February 27, 2018 @03:27PM (#16477541)
I'm not sure what you mean by "holes". It seems like it's a fundamental and intended feature of the GDPR that you can't achieve compliance-by-default. You have to explicitly audit every interaction between every system you have, to ensure that either no personal information is present or the interaction complies with GDPR standards.
[ Parent | on HN ]
Re:How GDPR Will Change The Way You Develop by Spearchucker on Tuesday February 27, 2018 @03:45PM (#16477700)
"...you have to explicitly audit every interaction between every system..."

But would you though? If you're a large co. you'd have a configuration management system where you just pull the specs/data rather than do an audit. If you're a small co. you'd know already, and if not you'd just go look. Right?

My experience is that anyone complaining about the amount of work GDPR is causing is a. not compliant anyway (and knows it) and/or b. has terrible or no IT governance.

[ Parent | on HN ]
Re:How GDPR Will Change The Way You Develop by amarkov on Tuesday February 27, 2018 @04:06PM (#16477879)
Not right; you can't just review the specs of each system. It's very easy to accidentally combine compliant systems in a way that isn't compliant.

Just to pick one example I've seen in practice, system A might have an integration bug causing system B to periodically emit error logs, containing data which system A knows is personal but system B does not.

[ Parent | on HN ]
Re:How GDPR Will Change The Way You Develop by michaelmrose on Tuesday February 27, 2018 @07:00PM (#16479375)
"has terrible or no IT governance"

So planet earth then. Consequences must be understood in terms of how things actually are even if the rules are ultimately for the best.

[ Parent | on HN ]
Re:How GDPR Will Change The Way You Develop by LoSboccacc on Wednesday February 28, 2018 @01:09AM (#16481048)
That’s an extreme oversimplification.

The law applies to business entities so it will go and cover every piece of infrastructure they run retroactively.

Imagine having a dev with contributions and commits in a dozen projects calling github to exercise his newfound right of removing all personal identifiable information from the system.

[ Parent | on HN ]