News for hackers. Stuff that matters.
Re:Facebook to change user terms, limiting effect of EU priv... by morgante on Thursday April 19, 2018 @05:57AM (#16874583)
The law could have easily been tailored to target large social media companies. Instead it applies to everyone, including tiny businesses who accidentally have one European visitor.

I'm strongly considering simply taking down all my old blogs/sites because it's far too much work to deal with GDPR for anything less than a medium-sized business.

Re:Facebook to change user terms, limiting effect of EU priv... by vincnetas on Thursday April 19, 2018 @06:56AM (#16874802)
And then huge media company just creates small subsidiary (tiny business) to "accidentally" collect personal information. Got caught? No problem, close that one, open another...
Re:Facebook to change user terms, limiting effect of EU priv... by dannyw on Thursday April 19, 2018 @08:21AM (#16875223)
There are plenty of laws and legal instruments / concepts (controlling stake, anti-avoidance laws, etc) that stop large companies from doing this.
Re:Facebook to change user terms, limiting effect of EU priv... by morgante on Thursday April 19, 2018 @10:40AM (#16876265)
And that is just as "possible" under the current structure of GDPR.
Re:Facebook to change user terms, limiting effect of EU priv... by pilsetnieks on Thursday April 19, 2018 @11:58AM (#16876960)
Not really. For example, if Facebook Inc. establishes a "Totally not FB LLC" for the purpose of skirting GDPR, Facebook Inc. is still the data controller according to the law, as it is directing the data collection and purpose, even if "Totally not FB LLC" does all of the handling as a data processor. Except now the fine is levied on the total turnover of both companies, not just one.
Re:Facebook to change user terms, limiting effect of EU priv... by morgante on Thursday April 19, 2018 @12:13PM (#16877102)
Right, I meant it's just as "possible" in the sense of it not really being practically possible.
Re:Facebook to change user terms, limiting effect of EU priv... by pbhjpbhj on Thursday April 19, 2018 @07:46AM (#16875025)
What PII are you gathering? Can't you just remove those fields, add a consent field, drop old PII from your DBs?

I imagine most CMS will have the option to do that at update?

Re:Facebook to change user terms, limiting effect of EU priv... by grabeh on Thursday April 19, 2018 @08:25AM (#16875256)
It would be a shame to take down your old blogs as I'm sure people get value from them.

My approach is one very much based on risk - how likely am I to receive requests from data subjects requesting deletion of their data? How likely am I to be subject to a targeted attack where people try to remove information from my server? How likely am I to be the subject to enforcement action if my server is hacked and data is leaked?

On one argument operating a blog is a purely personal activity and so out of scope of GDPR in any event. If you're outside the EU, GDPR will only apply if you are actually offering goods/services to those in the Union, or are monitoring them. I take the point about analytics in the second place, but in the absence of analytics, I don't see that making available a blog constitutes the offering of goods/services?

Re:Facebook to change user terms, limiting effect of EU priv... by morgante on Thursday April 19, 2018 @10:42AM (#16876276)
> My approach is one very much based on risk

Mine too. The risk is massive fines, while I currently derive virtually no benefit from my online presence.

> On one argument operating a blog is a purely personal activity and so out of scope of GDPR in any event.

I also own a business and previously several of my clients have come through my blog postings.

Re:Facebook to change user terms, limiting effect of EU priv... by grabeh on Thursday April 19, 2018 @03:43PM (#16879390)
Just to be clear, there is little to no risk of someone running a simple blog getting fined by a data protection regulator.

In the UK for example the ICO who regulate data protection matters concluded 17,300 cases, in which only 16 of them resulted in fines.

I’m just intrigued as to how you have developed this perception of GDPR and data protection law looking to regulate small one man blogs out of existence?

/edit oh and my other point still remains - even if you’ve got some customers through a blog, you don’t appear to be within scope of GDPR on the assumption you’re not directly looking to do business with EU based customers (for example through offering payment options in European currencies).

Re:Facebook to change user terms, limiting effect of EU priv... by pilsetnieks on Thursday April 19, 2018 @05:59PM (#16880549)
> I’m just intrigued as to how you have developed this perception of GDPR and data protection law looking to regulate small one man blogs out of existence?

There are huge industries with vested interests against privacy and consumer data protection and they have deep pockets. That person, if not instrumental in spreading misinformation, must then be a victim of it.

Re:Facebook to change user terms, limiting effect of EU priv... by pilsetnieks on Thursday April 19, 2018 @12:00PM (#16876980)
Do you habitually post personally identifiable information of other people in your blog without their consent?