The GDPR is probably not what you think is, because it barely introduces new stuff, it only enforces what already existed but was ignored because it was based on self-regulation.
There are a number a publications about RGPD explaining that there really nothing to panic about (unless you're a giant conglomerate), it's not going to kill your business unless your business is based on violating privacy and things you should not be doing in the first place because it's been illegal for a while and you had 2 years since the announcement to respect the law.
> If you want none of your personal info on the web, I have a suggestion: Don't participate in forums, social media, etc.
Does not work that way, actually thanks to RGPD it's now: if you don't want to deal with RGPD requests don't collect or process personal data.
(I wonder why this is contestable? DMCA is an afterthought, GDPR requires a lot of actual work to implement even if you process minimal data like IPs)
Now if you collect and track you may want to inform the users and let them opt-out.
GDPR is similar in a way with the Don't spam me laws, I assume you had to write code to respect this law and I did not see people complaining that they need to write code to respect that law. Or you can not do business with EU citizens.
Of course, if you do, like in this forum example, you will have to do something, but that doesn't apply to all the information/blog/brochure sites using unnecessary tracking, etc. They can simply not do so.
Since everything your site does basically is defined as “collecting” or “tracking” it’s absurd to claim you can just simply “not do so”.
If Google tracks something, whether it is via their fonts, by putting some cookie on your site or whatever, it is their problem (and they actually said so, in that Github post referring to the font issue). They are the ones collecting and processing the data, not you, so they will have to deal with the GDPR compliance.
But what’s special about fonts? If I can’t reference an asset outside my own domain because the network request could allow the 3rd party to log an IP address, How is that not antithetical to the foundation of the WWW?
Besides the fact that this goes against the last decade of advice on how to speed up your site...
Is it really that unreasonable that loading a page to x.com should only load resources from x.com and 3rd-party resources compatible with X's privacy policy?
Seems like a contradiction, and exactly my point. Trying to collect privacy policies and compliance statements from any place you might load an <img> or <script> from is extraordinarily burdensome and pointless besides. Totally absurd over-reach IMO.
And what about the 25 hops in between you and them which also collect your IP and the domain being contacted?
If someone is going to have top-notch legal team on this it is going to be Google. So if Google's legal says that it is alright because they are the data processor/controller as defined by GDPR you can pretty much take them for the word there.
I wonder whether people spreading this sort of panicked disinformation about the fonts and what not have actually read the GDPR text. It is pretty clear about who is considered to be a "data processor" or "controller" - someone who merely uses a resource like fonts is certainly not one if you aren't collecting any information yourself or having someone else do it on your behalf. That Google may be doing it is irrelevant as long as they aren't providing the data to you (which would make you a "data controller").
And if you are neither a data controller nor data processor you aren't concerned by GDPR at all.
It is well explained here: https://www.gdpreu.org/the-regulation/key-concepts/data-cont...
This is a very good point, and to be fair you're absolutely right. The definition of user-tracking extends far beyond Google analytics, and if you're not fully informed about what 3rd-party services you're using on your own website, and the ramifications of those, this could present problems.
When I said "they can simply not do so", that assumes they are aware of what tracking they're doing, which may not be the case. If you're using some WordPress.com blog theme with CDN calls built in, you might have no idea. There may even be an argument for this falling to WordPress.com (in this example) as the provider of the themes.
Realistically, I don't predict CDN calls to turn out to be in violation of GDPR in practice, even though there's a very reasonable argument for them being that in theory.
I kind of half-hope they are though, as a user. I've never been a fan of their use, and use the uBlock and Decentraleyes add-ons personally to avoid them. I wouldn't be devastated if we returned to a norm of locally linked resources (especially with HTTP2 adoption), though that's probably just wishful thinking.
I understand that you may have some small websites and you put on them who knows how many trackers/analytics and now is time consuming to go to those websites and implement something, but we needed this law the same as we needed the don't spam me law, it will take effort to fix existing sites but is for the best.
I feel a bit bad for small creators that need to fix their sites but at the same time I dislike the people that are trying to find possible loopholes around the law, fixing all this loopholes and workarounds is the reason the laws have long texts.
Do you have a website or something that is affected? I only have a simple site that I used some time ago as CV and for testing, I never had tracking scripts,analytics, referrals. I am also the opinion if you don't want to respect my privacy then tell me that and block my access.
If you have a very strong right to anonymity, a right to be forgotten is less important because it's easier to separate yourself from your online identity. In fact, forgetting information is pretty harmful because anonymous systems need better tools for building and validating reputation.
If you have a strong right to be forgotten, anonymity is less important because you can just delete information you regret sharing. And similarly, anonymity is kind of harmful because you now need ways to validate who owns information and ways to control how it's spread.
EU seems to be less concerned with anonymity, and more concerned with managing and regulating information after it's already been created and shared. This also kind of rubs the anonymity crowd the wrong way because they've advocated for a while that information isn't necessarily something that you can own like property, and that the Internet should actually be far more immutable than it already is.
Exactly. Privacy also doesnt mean being invisble when interacting with people or machines. It's not a well-defined right, and the limits can often be fuzzy (e.g. a problem that kids often have with parents). Pseudonymity / anonymity can also be subject to gradation.
It is not difficult to be compliant. Most people don’t bother because they are drama queens or hiding what their business is really based on and the latter is usually not ethical by any manor and deserve to be shoved off a cliff.
People will have to do some real innovation instead of selling off data and working out how to attract people into a product that exists only to do that really.
And you're very likely using the services of one of the big players, like Google, the very ones you're suggesting should be explicitly targeted in another message below.
Like I said before, including to you: the EU does not owe companies a business model, especially when the costs of that business are externalized to citizens of the EU and of the world.
Your so-called alternative at the end is just more of the arrogant snubbing typical of the advertising industry.
There are tons of companies processing my personal data that are not web companies. GDPR isn't about "data being on the web", it's about all handling of personal data.
Public records are potentially more harmful than anything Facebook has. For example, I just shipped a 20 foot container of household goods to the US from France — that manifest, including my personal information is public record — I have to explicitly send a letter and request privacy for that shipment — and then remember to renew that request each year or else details of my entire shipment, including my address and contact information are available publicly. Thanks government. I can’t simply use another shipping company — it’s a government rule. When GDPR applies to governments, then I might become a fan, but as it is now, I am being “protected” from my Facebook likes or web history but what protections do I have from governments who traffic in my information. There is zero reason my shipment manifest needs to be known beyond Customs or the shipping company moving the goods, yet, here we are. Facebook never committed mass murder — but governments certainly have. Google Analytics data doesn’t have a realistic chance of causing harm — but someone with my address and a manifest of a shipment of expensive stuff results in a potential for real harm — that stuff is literally public record with absolutely no controls over who can buy that information.
First it allows to record and keep the relevant data for sales and legal requirements. Second it applies to government.
Comparing facebook vs government is really a dumb fallacy, why would government be unable to use facebook for whatever ? and facebook to cooperate to that ? it is already happening, look at what happened in the Philippines with Rodrigo Duterte[1].
That you are unhappy with the US legal requirement to be able to ship cargo to their country[2] is unrelated to GDPR, maybe take your complaint to the relevant governement or regulation body.
[1]: https://www.bloomberg.com/news/features/2017-12-07/how-rodri...
[2]: excerpt from world shipping council to US customs
II. Cargo Manifests: General Today a cargo manifest is the document that states what a carrier has loaded aboard a vessel for delivery to the United States. The creation, submission, and retention on board of the manifest are tasks that are the responsibility of the vessel carrier and are regulated by law and regulations. Proper manifesting is a requirement for allowing the entry of inbound vessels and for the issuance of a permit to unlade.
We recognize that the cargo manifest has become a document that is used by the government to prescreen cargo for national security reasons. It was not designed for this purpose and has some limitations in this regard.
https://ico.org.uk/for-organisations/guide-to-the-general-da... See “when does [it] not apply?”
GDPR already applies to governments. What makes you think it is not?
https://www2.deloitte.com/nl/nl/pages/risk/articles/gdpr-in-...
> Starting May 25th 2018, all organisations, including those in the public sector, need to comply with the GDPR.
Government agencies have been working their asses off to become GDPR compliant. If you have a problem with the way your shipping info is handled, file a complaint against that government agency at the French data protection authority.
Please stop the FUD. The right to be forgotten has never been absolute and applies to both companies and government.
I still have no idea what to do exactly. I don’t really think it is my responsibility but I live in a country and operate in another country where laws this vague are unenforceable.
It doesnt apply to security-related services, and the governements are allowed to override it for most purposes as outlined in article https://gdpr-info.eu/art-23-gdpr/
1. Each EU member state has a different legal framework and so a Regulation (which has direct effect, meaning it applies as-is and does not have to be "transposed" into national law) would not be appropriate when dealing with criminal investigations;
2. The EU can only act in areas where it has been given "competence" to do so under the Treaty on the European Union and Treaty on the Functioning of the European Union. Member states are reluctant to give the EU broad competence to establish criminal offences or to regulate the investigation and prosecution of offences;
3. The treaties explicitly exclude almost all activities related to national security because that is a fundamental feature of being sovereign, which EU member states are and the EU is not.
Due to points 1 and 2, the EU passed the Law Enforcement Directive (2016/680/EC) which regulates processing of personal data in a law enforcement context. Being a Directive (and not a Regulation) means that each member state has latitude to adapt it to their respective legal frameworks when transposing it into national law.
Incidentally, point 3 will cause huge problems for the UK when we eventually leave the EU. The Court of Justice of the European Union - the EU's highest court - cannot take in to account laws of a member state relating to national security (insofar as they _only_ relate to national security) due to their exclusion by the treaties, but they can take in to account laws of a third country.
https://twitter.com/bainesy1969/status/1001902266620764160?s...
> ICO rules that ICO failed to comply with timescales laid down in the FOI law that ICO regulates link: https://ico.org.uk/media/action-weve-taken/decision-notices/...
This, for example:
> Germany's spy agency can monitor major internet hubs if Berlin deems it necessary for strategic security interests, a federal court has ruled.
> In a ruling late on Wednesday, the Federal Administrative Court threw out a challenge by the world's largest internet hub, the De-Cix exchange, against the tapping of its data flows by the BND foreign intelligence service.
> The operator had argued the agency was breaking the law by capturing German domestic communications along with international data.
> However, the court in the eastern city of Leipzig ruled that internet hubs "can be required by the federal interior ministry to assist with strategic communications surveillance by the BND".
https://www.yahoo.com/news/german-spy-agency-keep-tabs-inter...
Also see the much controversed "legitimate interests" exemption to GDPR that has been carried over from the 1995 EU directive.
My point is that Europeans overall are more comfortable with government snooping, and less comfortable with snooping by private interests, than Americans are. In practice, of course, American government agencies snoop far more than European ones do, but the American ones must be more covert about it.
GDPR doesn't introduce a requirement to delete data upon request.
I can visit site A and B, not put any of my data intentionally on them but still my data get be funneled to 25 third parties that know what I visited.
So your point is don't use internet or turn of javascript and open each link in private windows and maybe use some proxyes or Tor
Now everything loads in an instant, no more shenanigans that jump around the screen as I scroll, no Facebook/Twitter/Google buttons (that nobody even uses), no pop-up/in/out/over adverts, and even those asinine cookie warnings are gone by default!
I cannot recommend it well enough.
Ever try running traceroute?
sensible regulation that defines workable limits of what personal information can be collected, combined with requirements for anonymization when needed is a better solution.
In this case the operator's usage of the word troll to describe what happened is telling. Anyone can send any kind of threatening letter they want, and they are free to report you for non-compliance, but that doesn't mean any action will be taken against you, let alone actual fines.
IANAL, but IMHO the chances of any solo forum operator being sanctioned by EU regulators is effectively nil—the purpose of the law is specifically to address usage of personal data, not old-school off-the-shelf forums and other one-off websites where the scope of the data is essentially the core of the service itself.
You can argue the only thing that matters is the end result, but I'm not sure there's any way to write meaningful privacy regulation that will not generate a huge wave of FUD, especially with the traditional SV stance that we ought by default to have carte blanche to monetize user data in any way that's effective.
No, but it is a strong signal of my critique: That the EU is a 900 pound gorilla and that is a large part of the problem here. Small operators will, in fact, be impacted by this because they don't have the resources -- including time -- to cope with this and this will cause substantial fallout. Suggesting that "The details of the law are sensible" is not a rebuttal of the cincerns I am expressing.
GDPR is also quite weak in this regard as it has few new additions: explicit consent (thanks to snowden exposing prism and despite the largest lobbying campaign against it orchestrated by silicon valley[1]), max possible fine increased so actor like google and facebook would stop paying 150,000€ fines right and left while laughing in the face of European laws, and class actions.
Again it's only thanks to snowden revelations that the GDPR weakening personal data protection was overturned.
The real change that matters is that now the law can and will apply.
So far there have been a few people just giving up before the regulators get involved, which seems like a massive over reaction.
What a fucking stupid thing to say.
GDPR requires a few things: don't collect too much data; be honest about why you're collecting it; allow corrections; in some situations allow deletion.
This isn't a a boot crushing people.
Would you please stop going on tilt like this on HN? You know we ban people for commenting this way.
It's perhaps more poetic than is the norm here. That doesn't make it a fucking stupid thing to say.
The reality is that since we don't yet know how this will play out, those who are risk averse, whether by personality or positioning (because some people just can't afford to take risks), will tend to flee from what could be a crushing burden. Furthermore, if someone is essentially in survival mode and can't spare the time and energy to read the GDPR and become confident they know how to deal with it, then just needing to read it and adapt can be a de facto crushing burden without any fines being levied.
Google, Facebook, Twitter, etc. got websites to implement their like buttons everywhere. The information gathered by them is collected and everybody is being tracked wherever they go.
If we aren't as a world terrified of what is being done by small groups like the open source organization announcing it is shutting down in the very post under discussion, why are you defending the GDPR on the idea that it somehow reins in the abuses of FB, Google, etc? Do you have evidence that it is, in fact, reining them in? Or are they just getting with their lawyers, finding cute ways around the problem and carrying on while entire organizations smaller than them suddenly shut down and die because the EU wrote words somewhere that these mega corps likely care relatively little about?
Then again what you say is a misrepresentation and biased idea, what proof do you have that GDPR will disproportionately impact small organizations ?
Have you read the actual annoucement posted here ? asking because it does not say that it is shutting down but that it is moving its community discussion from a self hosted discourse forum to a third party hosted subreddit because discourse lacks the ability to properly address GDPR request and lack of time to do so.
Of course GDPR also applies to FB, Google, etc. Have you followed the discussions 5 years ago when GDPR was in the making and witnessed the intense lobbying from silicon valley against strong protection ? Probably not.
Are you aware of the noyb.eu[1] initiative, Max Schrems again, currently targeting google, facebook, whatsapp and instagram for their "forced consent" (more to come) ? La Quadrature du Net a french internet rights organization is currently working on 12 class actions targeting google, facebook, amazon, apple and microsoft, etc.
> Do you have evidence that it is, in fact, reining them in?
We will see what happens. The first complaints against Facebook and Google have already been filed.
If the entire world currently agrees that a handful of companies are The Problem, then there should be some means to go after said handful of companies and get them to stop being The Problem without creating blanket laws negatively impacting the entire world, especially smaller organizations.
Dealing directly with a problem company usually involves charging them under existing laws (anti-monopoly laws?) and things like that. It usually does not mean making unenforceable laws that name them by name or define things in a Jim Crow style that clearly targets them in specific and that is unlikely to stand up in court.
Google, Facebook, Twitter have a roster of the web pages you have viewed, whether you interacted with them or not.
Verizon, AT&T, T-Mobile and every other phone company has a complete log of your location history (for mobiles), message & call history, and unencrypted browsing history. They have no need for it to provide service (beyond the month or two in which these actions occured), but they do sell it to third parties, the list of which you have never seen.
Your credit card company does the same with your credit transactions.
This is already 30 companies or so, just in the US, and it is just the tip of the iceberg.
GDPR says "a person's data is their own property", which is easy to understand and enforce. You may not like it, but it's along the line of copyrights and trademarks, except the beneficiary is mostly the common man.
People clueless about privacy and privacy abusers are no longer welcome to the data of EU citizens.
Most countries handle private persons with larger income differently, e.g. they need to pay more income tax.
Most countries handle startups differently, e.g. they don't need to pay taxes in the first years.
Most countries handle farms differently than other corps, e.g. they give subsidies to them.
Most countries handle people with no income differently, e.g. they get social security payments.
Most countries handle banks differently, e.g. they are regulated.
Most countries handle health companies differenty, e.g. they are regulated.
What makes you think we don’t already do that? GDPR is about privacy 101; there’s nothing in it that shouldn’t apply to small companies.
Do we allow small restaurants to poison their clients because they’re just starting and you-know-it’s-hard-to-build-a-restaurant-so-let’s-wait-a-bit-before-applying-regulation? Of course no.
It looks like our experience on implementing GDPR is different.
Essentially GDPR is like being PCI and SOX compliant from the first day - and looking at what companies go into to not be under PCI compliance, like use Stripe forms, this looks like significant overhead. After implementing GDPR, SOX and PCI in several companies, from an IT perspective they are comparable, with PCI the easiest to implement, especially on the process side, GDPR a little bit more than SOX on the documentation side but no monitoring of code changes and traceability.
Paying 10.000+ EUR for a missing word in your data protection declaration is no problem for a multi billion dollar company, but can and will kill startups.
If your GDPR is not on the same level as a SOX implementation, there will be a rude awakening if you get a review and are fined.
Paying for a data protection officer is hindering small companies and startups.
Updating your deletion infrastructure with every feature you implement is overhead. If you do not automate this and keep it updated and respond to information request by hand, plan for significant manual work.
Having a process documentation of 100+ pages which needs to be updated with everything you do and every new feature that captures or transfers personal data or stores data is a huge overhead for iterating on your product.
Do a risk analysis and data protection sign off for every test feature decreases your speed a lot.
You need to document every process (what data, where stored, when deleted, what cloud/saas/systems involved, who has access, how it is protected, ...) - like sending marketing mails or cold calling or going to a conference collecting business cards or giving stuff away to winners on Facebook - if it touches personal data.
Encryption in the database of personal data and encryption on the storage medium is a lot of operation stuff - this will lead to converging every startup to only use PG instead of being polystorage.
Implementing access controls to your office (if you use Excel with personal data) as if you were a data center is a lot of overhead - no more starting at home or in the garage. Probably best to go to WeWork who have proper office access control, if you have the money.
Investing into training days, planning and updating training material and managing training and with your staff is a lot of overhead for startups. Together with staying up to date with court decisions on GDPR will cost startups 1 FTE (see above). From now on instead of hiring that second developer I'd consult startups to hire a security officer first.
Having a data processing contract for every prototype feature you test is a lot of overhead to being agile and lean.
Marketing signing up with a credit card to try out some automation in a startup - these days are gone.
I'd say it is significantly more difficult to follow the lean startup methodology than before.
From working in some large companies and some startups, implenting GDRP, SOX and PCI, GDPR will help large companies who already have a large legal team, large compliance teams and who are SOX compliant against disruptive startups. Google and Facebook are the main beneficiaries from the GDPR.
You can hammer one app Facebook but you can’t hammer all apps.
Just consider revery Chrome extension that is malware. You can though hammer Chrome to block functionality that enables malware.
If you don't want to get robbed, don't leave your home.
Precedent? It's hardly the first time one powerful body politic has enforced its own standards on others. A very, very, very long way from the first time.
Facebook and other data aggregators build profiles of you even if you don't participate directly in those services. The web is different now than it was in 1996.
It's the path currently explored in a class action against facebook for forced consent and we'll see what happens.
So closing the offices wouldn't help.
Yes, they are based in Ireland.
I suggest using the identifier you received at birth to make the request plus your e-mail.
They do have jurisdiction, because the laws apply to companies that want to reach Europeans.
It's up to companies whether they think it's worth the effort to reach this market.
Companies do some crazy stuff on the other end of the spectrum to have a presence in China, right..?
This law will only make things (even) more expensive and cumbersome for EU companies wrt. the rest of the world. This is going to be the asinine Cookie Warning all over again, times a hundred.
EU regulators could domesticate their judgments in the jurisdictions where these companies are based. It's entirely possible to do this in most states in the US, for example.
Failing that, they could target assets held in the EU or take action whenever corporate officers travel to the EU.
Isn't this the sort of thing people accuse the US of? The rest of the world makes ugly jokes about "Be careful what you say about the US or they might come liberate you too." The EU is now in the protection racket. When the mob says you should give us a few bucks because it would be a shame if something happened to your business, people recognize that is not nice behavior. But the EU can do the same on the web and some people laud it is a good thing for individuals in the name of personal privacy.
If you want none of your personal info on the web, I have a suggestion: Don't participate in forums, social media, etc.
(Yes, I am guilty of having this opinion without having actually read it. I blogged previously about my opinion this would do bad things to forums. I am shocked to see negative fallout happening so very soon.)