It feels like all these tiny companies, one-man shops, and early-stage startups are going to be collateral damage to a regulation designed to stop facebook and google from knowing a horrific amount about everyone. In fact, it feels like a regulatory moat that will do very little to impede any big tech company while forcing me to do twice as much work for any side project I try to develop.
There's so much smugness about the GDPR being a "good reflecting moment", etc. which makes me think that people who support the GDPR believe that there's no way detractors could disagree with it in good faith or for good reasons.
> It feels like all these tiny companies, one-man shops, and early-stage startups are going to be collateral damage to a regulation designed to stop facebook and google from knowing a horrific amount about everyone. In fact, it feels like a regulatory moat that will do very little to impede any big tech company while forcing me to do twice as much work for any side project I try to develop.
If you don't store PII, you don't have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights
> There's so much smugness about the GDPR being a "good reflecting moment", etc. which makes me think that people who support the GDPR believe that there's no way detractors could disagree with it in good faith or for good reasons.
I think it's mainly a difference in viewpoint: this is my data for me. Not yours. GDPR makes it easier for me to enforce that. From my perspective I don't care about you violating my rights "in good faith", just like most people don't cares if you trespass on my property and steal something "in good faith".
The problem is not the work that the GDPR requires, the problem is the work I'll have to put into understanding the GDPR.
I think it's mainly a difference in viewpoint: this is my data for me. Not yours.
This is the part that I don't understand. If I own a shop, and you come in and buy something, you have absolutely no right to demand that I forget your face and your purchase. In the real world, it's not your data, it's my memory. If I go home and write in my diary that today hekfu bought lots of broccoli, you don't have the right to come to me in five years and demand that I remove all mention of you from my diary at my own cost.
I don't understand the concept of data ownership, because it does not align with how I understand the real world to work.
This is where there's been a divergence on thought. In the real world you have limited capabilities to collect and store the data that is currently being collected. You're physically limited in how much you can retain and retrieve. In your old timey example I assume the diary to be sitting there in the back of the shop just being a record of my name and what I bought, but that's not how a lot of data is being used or being collected online.
The equivalent would be you making the diary automatically write down a potential unlimited amount of data on me and then using it to sell advertising the moment I enter the shop.
If I went past your store and it automatically retrieved physical details about myself, what I'm wearing, my interests, hobbies, location and you then built a profile and then sold this information to advertisers there absolutely would be regulations regarding this in the real world.
A better example:
http://www.bbc.com/news/technology-23425297
Privacy limits As retailers trial such tech they are well aware there is a risk of a privacy backlash.
Clothes store Nordstrom recently cancelled a scheme which tracked customers' movements through its stores using their phones' wi-fi signals after complaints.
"Are we willing to accept our everyday movements being monitored and analysed, not to keep us safe but purely to allow advertisers to target us? I think people will start to say no, our privacy is worth more than a few advertising dollars."
--
You say shop with a diary to present the most innocent of examples but for every shop with a diary there's billions of stalkers following people everywhere they go to learn as much about them as possible in order to sell them products and influence how they think which they never agreed to.
I asked this question in a comment [1] here on HN a few weeks ago. There were affirmative responses that yes, the shopkeeper should in fact be held to account for keeping notes on who came into his store.
You might call it poaching, but that only became a crime when society made it one, and that's what the GPDR is doing now with personal data
Data about users has become a valuable asset, and taking it from people now is depriving them if that value, whether or not you personally use it to make a profit.
I hate to break it to you but yes I do: by doing business within the EU market you're accepting that. In fact you're accepting that the very same way that you're accepting that you can't store all your clients' credit card/cvv numbers that are used on your store.
I freely admit that keeping a diary is not the same as keeping customer details, but that's the point here: why are they treated the same?
Even just the first two, seeing and writing down, are legally distinct. Supermarket checkout staff handle hundreds of credit cards a day. How do you think the law would react to such an employee writing all of them down?
It's not discriminatory against old people, because even a completely amnesiac person armed with a notepad can permanently capture vastly more information than all but a photographic memory.
If you want to collect the data, then it must relevant for your business and that warrants you should treat it properly.
Upon request to erasure you should go use reasonable measure to remove it. Wiping your memory is absurd and is never considered reasonable – no need for a lawyer to rule that out.
A server 'processing' (which seems to include using it in any way, not just storing [1]) your IP address appears to fall under the GDPR[1], and said server would be in violation of the law unless its processing falls under one of the exemptions.
The main exemption appears to be getting the user's explicit consent, though there's also this super vague exemption: "for your organisation’s legitimate interests, but only after having checked that the fundamental rights and freedoms of the person whose data you’re processing aren’t seriously impacted." [2]
In general, it seems very hard to avoid the GDPR because what is considered 'personal data' is extremely broad.
Maybe I'm misunderstanding something.
---
[1] https://ec.europa.eu/info/law/law-topic/data-protection/refo...
[2] https://ec.europa.eu/info/law/law-topic/data-protection/refo...
I used "legitimate interest" as my lawful basis for logging IP addresses and website usage information. From the UK ICO's guidelines [1]:
"It is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing."
There's a three part test:
1. Identify the legitimate interest: ensure the security and stability of my systems.
2. Show that processing is necessary to achieve it: need to know when and how the site is used in order to troubleshoot problems and detect abuse
3. Balanced against individuals' interests: We pseudonymize logins so usage information is not obviously related to specific individuals. There is no sensitive data on the site that can be revealed by usage data. The retention period is short which further limits what can be revealed.
Now, people here on HN might nitpick my logic, but fortunately they're not the regulators. I'm confident that, in the very unlikely event that a regulator even notices my little businesses, that I'll be able to correct any mistakes before fines come into play.
[1] https://ico.org.uk/for-organisations/guide-to-the-general-da...
Every business owner in Romania knows two things:
- the IRS equivalent will investigate them periodically, usually every few years - they will ALWAYS find something to fine the company for
Sure, you will have to correct the something, but that doesn't mean you don't have to pay the fine anyway.
Also, incidentally, the company I was branch manager for has been once investigated by the police for credit card theft (they received a complaint). They couldn't find anything (because we didn't steal any credit cards - we just had a lot of computers because we were programmers, working for the main company in the US) but, in order not to have wasted the raid, they decided to prosecute us for copyright violations (they found a few pirated games).
So, at least in Romania, there is no such thing as "correcting mistakes before fines come into play".
As in your example, they'll use any law to beat people over the head. That should not be an argument against a privacy protection law.
It's actually a human problem. The history of political bodies granted immense discretion to fine and punish is consistent and terrible.
I doubt you'd be able to fix any issues before they get involved.
PS. it's Cambridge Analytica
GDPR has no concept of PII. Personal data is anything relating to a natural person. It's not just an identifier like an address or phone number.
1. I have been using Google analytics for their entertainment value. I assume that's verboten now.
2. I assume the IP addresses in my logs are PII. Should I shut off logging?
1. yeah, probably.
2. There's a comment elsewhere in the thread to this effect, but short-term logging for the usual purposes of managing stability/security of a system almost certainly qualifies as legitimate interest. Don't keep the logs indefinitely, but I figure nginx's defaults with a week's retention period is quite reasonable.
The relevant authorities also have a track record of giving people warnings and time to fix things, so especially for something so trivial, I'd basically just make a good faith effort and not stress about it.
2. You can simply exclude IP addresses from logging.
You don't give a damn; neither do those computer illiterate people who use the same email address and password for everything, and one leak of some shitty inconsequential website may obliterate their entire online presence.
But the thing is that GDPR affects all PII not just sensitive one so your random small useless app/blog/game/forum that has some personally identifiable but harmless and unimportant data stored is now under the same restrictions like your email or FB data.
Unimportant like your email address and your one password you're reusing everywhere? Yes, they should know better but that's neither here nor there.
Are you aware that setting “delete=1” is essentially what file systems do when deleting a file? What file system do you suggest companies to use when they want to comply with GDPR?
That is vague, for sure, but hopefully you have the engineering skills and domain knowledge to make a good call.
Dealing with credit card data? Think a lot about it.
Dealing with movie preferences? Deleting from the database should be adequate.
Dealing with attendants from a local conference? Delete the files when you don’t need them.
(And remember: nobody will ever show up with a fine one day. It will always start with a warning and a chance to improve before any fine is applied – unless there is serious neglect.)
A filesystem will remove the entry pointing to the data on disk, and mark that region as free and ready to be reused - and it will get overwritten.
If you are storing backups for longer than this then perhaps you have to ask yourself why.
For instance, the last company I worked for deliberately didn't keep database backups past 30 days and had that policy for some years prior to GDPR. The idea being that it would be expected by a user that when they hit "delete" on something in the web app it would actually be deleted.
(Additionally there is a whole minefield of crap that could happen if you got subpoenaed and had to due process on months or years worth of backup data, but this wasn't the primary driver of the policy)
This is a pretty good read on the matter:
https://ico.org.uk/for-organisations/guide-to-the-general-da...
But on the topic in general, could someone explain to me what the real world consequences are likely to be for a small business not based in the EU, of not complying? If I've never cared where my users were as long as their payments cleared (oh, is that where they get you? the payment processor?), and I'm selling handcrafted bobbins online in Canada without letting people delete their email address, what is likely to happen if someone complains to EU authorities?
Databases such as Cassandra are made so that updating doesn't actually delete the old data until some time later so frequent updates will degrade performance and storage. Other databases that allow for immediate overwriting the data will cause fragmentation and thus performance decline and wasted storage until you compact (basically recreating the entire database) which is not something you want to do all the time, especially on SSDs.
1. GDPR gives you 40 days to respond. You don’t have to run VACUUM everyday.
2. The entire point of my post was acknowledging that there are costs to being GDPR compliant, and why it’s responsible to have that cost.
If it takes a week to garbage collect that's fine, it just can't stick around forever.
Maybe a percentage will be better educated, and actually request data deletion here and there, sometimes but I don't thing anything is going to massively change in general customer behavior. The GDPR just gives the means to those who really want to control their data (which were there before, by the way, just not really enforced. Now that there's a number figure to the possible fine, now is everyone paying attention.)
The pessimistic case sounds like trying to remove things within hours.
It isn't an impossible problem to solve, but the GDPR is a significant time and a money burden that will especially be an issue for small startups that don't have millions in venture funding to spend on this.
If you for instance save all the user data like user preferences under a random userId, and then delete the personal data (such as email address, name etc.) associated with the userId I would expect this to be GDPR complaint without having to do a cascading delete.
It's a law, not a technical constraint. No one gives a fuck about some foreign key relations, they care that personal data cannot be accessed, or somehow reconstructed.
"Anyone can design a lock that they themselves can't pick"
I can see two reasons why this would be a problem:
You have a really shitty un-normalized database design. Granted that you may have to denormalize specific columns for performance reasons. But why that would be the case with, for example names, phone numbers or sexual preferences, totally escapes me.
Or, you're referring to actual cascading deletes, meaning that you need to get rid of child relations, based on deletion of the parent relation. If this poses a problem then I'd argue that you're guilty of a shitty database implementation, arguably with criminally bad definition of your primary / foreign key pairs.
I really don't see a problem here, unless the database schema is implemented in a totally incompetent manner.
Edit: Clarity
But often all you need to do is overwrite the name, address, or similar bits of information, and you can then leave the rest of the data intact and set your delete flag.
> "you could easily not switch to a CASCADE, but instead set delete=1 and mark every sensitive field with a special value"
Emphasize on the part after “and”
If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all.
To your example, you could easily not switch to a CASCADE, but instead set delete=1 and rewrite every sensitive field with a special value. Doesn’t even require a DB migration.
If your attitude to properly handling sensitive information is “it’s too complicated and costly, so we’ll just not handle it and YOLO”, perhaps GDPR is a good reflecting moment for you.
[edit:typo, edit:clarification]