1. HN discussions themselves. Literally EVERY TIME this comes up, you see a massive back and forth from various crowds of GDPR; some of whom swear that it's perfectly comprehensible even as significant portions of the conversation are interpreting the same points in a variety of ways. (Are IPs PII? What exceptions can be allowed? What falls under "security requirement"? What forms of data are associated PII? What sort of deanonymization is sufficient? IS it sufficient? are some common questions I saw in the past, not even getting into the wonderful world of third party data processors.) This seems like enough pragmatic evidence that a (to give the benefit of the doubt) educated and professional community hasn't reached consensus, so to say there's a variety of interpretation seems very fair.

2. I implemented GDPR for a small corner of a notable BigCo. I do not consider myself an expert, but I certainly got my marching orders from experts, (The legal teams who interpreted the document and evaluated the implementation methods) and the sheer amount of horsepower put behind finding an interpretation we believed and were confident in was staggering. Granted this is something where we _really wanted to get it right_ but if it were really trivial to interpret I question if the process would have been as intensive as it was. (To preempt the inevitable; our (my team's) business model has _literally nothing_ to do with your data, but we had many of the same confusions/questions that I saw from companies who did, so I'd be hesitant to say that the burden isn't somewhat widespread.)

You shouldn't be getting down voted. I just went through a GDPR compliance review. We have a service model which is incredibly serious about customer confidentiality. We don't sell ads and, to my recollection, have never even bought them. Still required an army of lawyers. Two top London law firms ended up agreeing to disagree on major points, ultimately concluding the Polish data regulator would probably rule one way and the French the other.

Complying with the spirit of a law doesn't mean complying with the statue of it. With GDPR, it's the latter that's a pain in the ass.

Wait, this is being handled on the national level??? I thought you guys had some singular EU court thing for this, not a clusterF of the different countries' justice systems.

Yup, each of the EU's twenty-eight member states have a national data regular who is responsible for interpreting the law. One can appeal to EU courts. But the local context must be considered.

in the end the gdpr is more about opening new jobs.

also sites like: http://www.spiegel.de/ or https://www.bild.de/ do not care about the gdpr/dsvgo... so it won't happen that there will be many groundbreaking changes on how the governments will see privacy issues. at the end they just wanted to scare of the silicion valley.

The point if EU is/was to achieve an "ever closer union" so that war between European states would never happen again. It's not just an economic bloc.

Btw the immigration is the main issue which has nothing to do with trading.

What the poster above is lamenting over is that each member state is in charge of their own investigatory authority, and this makes a lot of sense, if you have a data leak that affects only Spanish citizens you wouldn't want the investigation being carried out by a country like Sweden or even by the EU itself. However if a data leak affects multiple member state citizens each of those member states are invited to and can enter a joint investigation. The issue they believe is that France may have a stricter interpretation of the law than a country like Poland which may make cooperating with the law more difficult as you don't know how strict to be, and while this certainly is going to be the case it's not so different from any other facet of life - In the US you may favour a certain state to be prosecuted in, you may prefer to have a different prosecutor or judge, etc.

I've never understood why people try to comply with the text of a new law that doesn't have case-law under it yet, rather than the spirit.

Surely, the first time anyone gets sued for noncompliance of the text of GDPR, when they are compliant with the spirit under which GDPR was issued, case-law will be created that "bends" the interpretation of the text more toward the spirit?

Continental Europe uses civil law [1]. Case law is less relevant than it is in the U.K. or United States.

More broadly, people try to "comply with the text of a new law" to avoid becoming the precedent. (Even if you prevail, it's distracting and expensive.)

> Surely, the first time anyone gets sued for noncompliance of the text of GDPR, when they are compliant with the spirit under which GDPR was issued, case-law will be created that "bends" the interpretation of the text more toward the spirit?

Surely? Based on what? For anyone with material revenue, that basis will be legal advice.

[1] https://en.wikipedia.org/wiki/Civil_law_(legal_system)

We're all over Europe and the U.S. It was pretty painless. Our business does not rely on the ignorance of users or the abuse of their privacy. What "army of lawyers" did you have and why was the spirit of the law not enough? We had several different business units get through compliance without any problems.

This isn't a hard thing to address at the end of the day (so long as your entire business doesn't depend on it). I just can't help but feel a few ways A) You didn't understand what the law says B) what your lawyers were actually worried about or C) this story is just made up.

What specifically were the discrepancies in the interpretation of the law between various countries that caused two "top" tier law firms to be unable to come to a clean consensus?

These arguments tend to be very circular. It goes something like this: GDPR is reasonable and easy to understand; if you're having trouble with it you are probably user hostile/don't understand it; you're having trouble with it which means you are user hostile/don't understand it; therefore your complaints are not legitimate; therefore GDPR is reasonable and easy to understand.

The same vague claims keep getting repeated, with absolutely nothing to back them up. Not even a "here's the problem with the law in our case" super fuzzy high level overview. It's always about the effort of adhering to the law without any discussion about why these companies are facing difficulties in the first place. Not the actual difficulty with implementing the law, just the vague effort they've put up with.

Hundreds of thousands of businesses have not had issue with the law. Suddenly some guy on HN with two "top tier" law firms at his back faces this unimaginably heavy burden and extreme obstacles when trying to adhere to the law. Sounds like a nightmare, in the sense that it never happened.

OP's post and the many others like it are just typical American business favoritism against any kind of regulation masquerading as a personal True Story (TM). I still remember when cookie warnings were "hard" to do and businesses actively implemented them in obviously shit ways, in bad faith with the regulations. It's so obviously contrived for a particular audience it's kind of absurd it immediately doesn't get flagged.

I am pretty sure that's what they're asking for. I didn't see a request for specific details. Just some high level details, rather than "we've had to spend so much money/time => clearly bad".

Heavens knows no one has ever been legally compelled to elaborate on a "super fuzzy high level overview" they previously volunteered.

Just point out the exact part of the law you guys are having a problem with. If you can't do that, it's because you're just making shit up.

> C) this story is just made up.

Was interpreted as being too hostile and uncivil.

If I'm not allowed to call out dishonesty then there's basically no point in discussing any subject.

I can't count the number of times I've posted factual, verifiable information — with sources — and been downvoted (or, often enough, downvoted, then voted back up, then down again, and so on) for my troubles, or the number of times I've seen such comments from others treated the same.

The most plausible explanation I can come up with is, "Your facts dispute my narrative, and we can't have that!"

EDIT: I'm not saying that's what's happening here, and I'm certainly not saying there's brigading or shilling going on (indeed, I think it's purely individual action), but this is a clear pattern, which I've reliably observed happening for years.

It doesn't even have to be on a controversial topic; I once linked to an explanation of a nuance of copyright law, of which the other participants in the thread were demonstrably ignorant. The extent of the response? Downvotes.

I'm going to guess what's happening here is a good amount of developers work for companies where GDPR would directly impact their revenue directly or indirectly (and most likely jobs as a whole). This is especially true for smaller "middle man" analytic firms and general web agencies. It pays to be anti-GDPR.

What? Why? How?

Given that:

- You don't sell your customer data.

- That customer data is secure

- Someone somewhere in your org can handle access requests and delete customer data on request.

What here requires an army of lawyers?

Maybe your corporate culture demands that army regardless, but that's hardly the GDPR's fault.

My personal guess was they wouldn't need consent, as it was a clear-cut case where all requested data was clearly needed to provide the service. And asking for consent to use the data a customer just typed in the site for requesting the service seems a sure-fire way to annoy them without any upside.

Then the GDPR lawyers came.

It turns out, if you interpret the company charter in a very nasty but still legal way, there might be a very rare edge cases where a service was provided to someone who was not strictly 100% a customer. Yeah, I'm a bit vague here, sorry about that.

To be clear: No real-life example was found now or in the 10+ year history records of the service, both the almost-but-not-quite customer and the company would have to do insane things, and service delivered in the case was almost non-existant, but theoretically, on paper, it was possible. I'm pretty sure nobody would care if it happened, either.

So boom goes our legal base. Consent it is,then.

> Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

and the ICO guidance is

> Consent should be separate from other terms and conditions and should not generally be a precondition of signing up to a service.

Even when consent is given, the users interests still have to be considered during processing, so it's not like it's a do-whatever-you-like card. Just because a user says they consent to you doing something with their data, doesn't necessarily mean you can if that thing is obviously not in their interests.

I wish the fact that consent is only a weak basis under GDPR were made more clear, since if we just end up with an internet that requires consent on every site then the law has just made things worse and made nothing better.

And it is even more insane blindly accepting this sort of advice with GDPR, worrying about getting sued for for theoretical edge cases when the first round of warnings haven't even gone out to the worst offenders yet.

https://gdpr-info.eu/art-6-gdpr/

There are 6 options. Option a is the consent you are talking about. I am talking about option b.

Basically, having multiple legale bases can't hurt, so our lawyers said: Get both option a and b.

Defining what those simple statements like "customer data is secure" means in the context of hundreds or thousands of use cases throughout a complex organization.

But if you're not, or you're not sure what the boundaries of "personal" are (is a first name only personal?) it's harder.

https://www.eugdpr.org/the-regulation.html

Hands up. Who has actually read all of it?

Speaking as somebody who actually has - was teaching computer security last term - I found it relatively easy to read (as legal documents go) - but it still took a weekend. I will guarantee you, that not all of the high powered lawyers whose job it is to read it, have done that.

True story: back in the days when libraries still stamped your book with the date it was due back, I took out a copy of Keynes General Theory from the main library where I lived. It's not that thick of a book, and according to the date stamps it had been borrowed at least 20 or so times. About half way through the pages hadn't been cut.

It was a few years before the significance of that finally dawned on me. As in many things in life, HN discussions on the GDPR are a wonderful example of nobody actually reading it, and everybody having an opinion of it.

Well now I read that link, but I don't think that's the actual law...

Regarding your point about consensus, that's fair - however this has not been my experience. Most parties that you would ask for advice on the matter have a pretty good handle on what the different terms mean.

Your second point is mostly evidence (to my mind) of large corporations trying to get away with as much malicious compliance as they can possibly manage. You really do have to put a lot of effort in that, as you cannot assume the agency checking you will see good faith (which is, as far as I understand it, one of the requirements for not being slapped with fines very quickly).

The law is pretty clear (not 100% clear, obviously, there is going to be loophole and unclear things), and it's easy to decide about unclear spots by following the spirit of the law, and by understanding that any unclear technical requirements really means "what a sane engineer would do, that you could defend against a jury of your peer".

To answer a few of your questions (obvisouly IANAL):

- are IPs PII? Yes, there are legal case about that, your lawyer should have a more detailed answer.

- what exceptions can be allowed? When you have a case you could defend that doesn't go against the spirit of the law

- what falls under "security requirements"? You should be able to defend your choices securiy-wise against a jury of your peer, using your internal documentation. If you have unsalted passwords hashs for example, you are in trouble

- what sort of deanonymization is sufficient? Best practices at the current date.

Technical details aren't going to be in the law, because the goal of a law is to not be outdated every year.

Laws are enforced by humans, not by computers. Your company should be prepared to defend its interpretation of the law (that's your lawyer job) and your technical choices (that's your job).

Edit: obviously, that's a simplified vision, and you should always consult your lawyer. The biggest your company is, the more important it is to try your best to be compliant.

But as for 1): IPs are distinctly /not/ PII (AKA: PD). They're identified /by name/ in the regulation, unless you sell that info. Anyone who brings this up as a topic has not actually read the regulations.. or they have and are trying to create uncertainty for some objective.

It sounds like you've done enough of reading the regulation to actually know this, it's part of your job and you've spoken to legal experts (as I have).

Have you yourself read the regulation? You are wrong.

The regulation makes a single reference (by name) to IP addresses. In recital 30. In that recital, it specifically declares IP address to be PD (GDPR doesn't use the term PII at all).

Not to confuse the matter, but if you stopped there, and decided IP addresses were PD, you would have stopped short. It requires deeper analysis. Here are two good ones:

https://gdpr-info.eu/issues/personal-data/ https://www.whitecase.com/publications/alert/court-confirms-...

The soundbite-sized answer is: it depends.

IP, when tied to other data becomes the scope of personal data.

However, removing the other data renders it no longer personal data.

This firmly puts it in the "it's not personal data" camp. Since it's the other data that is personally identifiable that gives it context.

It's only relevant for ISPs really, but really good job on proving my "creating confusion for no reason" point.

In the context of online accounts (in video games, where I work) it can't be used to identify real world people because we don't ever link to a real world identity. In cases where you log details about people individually (as in- a bank) you just don't log user details beside access logs and you're set. IP on it's own is not personally identifiable, and is out of scope for GDPR.

The tricky thing about GDPR is choosing the correct lawful basis. I think people reach for the legitimate interest card too quickly because they see it as a "get out of jail free" card. But then it ends up complicating things enormously -- especially since legitimate interest can be objected to. I've seen people agonising in public about what to do because the personally identifying information is necessary to provide the service they are offering. If you're in the situation where if someone objects to the use of their data, then it breaks the whole service -- well you're in contract lawful basis territory.

IP addresses are potentially complicated, though. I'm not sure what's supposed to happen when you receive personally identifying information from someone that you don't have a contract with. The law does seem to be vague on what constitutes a "contract", because in some cases it seems to imply something different than what contract law says (i.e. if there is no consideration, it seems I can still use contract lawful basis). In this situation, if I have a P2P network and I need your IP address to fulfil my side of the protocol, then I should be able to use it under contract basis. However, I'm unclear about the actual legality of it -- especially when the information is sent to you by an intermediate node.

To me, that's what needs to be cleared up. I expect it will be over a period of time. I don't think the law was written with that kind of stuff in mind. It's kind of interesting, though. I imagine it is a violation of the GDPR to track what individuals are downloading in bittorrent without giving them a legitimate interest notice, though (and allowing them to object! and be forgotten!). It will be interesting to see if anybody complains about that kind of thing.

Check Patrick Breyer v. Bundesrepublik Deutschland.

Literally a website just logging IP addresses of visitors.

You’re making it sound incredibly cut and dry when it’s clearly not and there’s case law on record confirming it’s not so simple.

https://curia.europa.eu/jcms/upload/docs/application/pdf/201...

I also looked up some additional explanations.

That case literally does not support the claim you make. The court decided that:

* dynamic IPs can be considered personal info if the entity collecting them has legals means to get additional information related to that IP (these legal means exist in Germany, if the entity believes they are being cyberattacked)

* furthermore, the court noted that this particular law is more restrictive than general EU law (which eventually becomes GDPR, as far as I understand: http://germanitlaw.com/patrick-breyer-v-federal-republic-of-...)

* according to the less restrictive law though, "The operator of a website may have a legitimate interest in storing certain personal data relating to visitors to that website in order to protect itself against cyberattacks"

* and this opened up the question as to which law should be followed in Germany, at least until GDPR comes into play (again, see explanation in http://germanitlaw.com/patrick-breyer-v-federal-republic-of-...)

* note then that: this issue is no longer an issue (since GDPR is in play now) and that GDPR actually allows the collection of dynamic IPs if the entity needs to do this to protect from cyberattack

I was responding to a person that was claiming that essentially IP addresses are only personal data for ISPs or ISP like businesses. Which is simply not the case.

I didn't say IP addresses were always considered personal data, I simply said it can be personal data, which you also stated in your post. That it's not cut and dry. The person I was responding to was posting that IP addresses are definitively NOT personal data.

The point is, context for IPs matters. The person I was replying to was way over simplifying.

I'm not entirely sure what claim you think I made that the case doesn't back up as you essentially stated what I did just with more specificity. In any case I totally agree with your post since it's the same point I was making :)

I'm guessing not. People who are willing to put their reputation on the line, who are paid four figures per hour to understand this stuff, disagree with eachother on interpretations of GDPR.

Forget about violations. Even if you're in perfect compliance, any EU resident can complain to their data authorities if they think you're non-compliant. That then prompts a regulatory inquiry, which requires lawyers to competently respond to, which is distracting and expensive.

The flurry of activities is only driven by companies who keep data about their users. Of course "legitimate" will be defined by the courts. That's the price you have to pay now for all the abuses that have been going on for the past two or three decades. History has shown that to define "legitimate" the text of the law is to open the doors to avoidance. Sorry mate, we can't trust you to be honest. It's too late now.

The burden for filing a lawsuit is significantly higher than the burden for making a regulatory complaint.

Of course, just as you mentioned above, responding to complaints is distracting and expensive, which is why all insurance companies folded up the business up here, and there's no more insurance to be bought in Washington.

(I'm kidding of course, insurance companies work here just fine.)

I'm a huge fan of complain-and-respond frameworks. I have complained to my state Attorney General when my cable company change pricing on me mid-contract. I complained to my state Department of Financial Services when a rebate issuer sent me a card instead of a cheque. I complained, the other night, when a construction company decided to run jackhammers on 26th Street at 1:30 in the morning.

Complain-and-respond regimes work. They're also expensive, and cause known incumbency biases. Deploying them should be carefully considered. For insurance and financial services, the tradeoff makes sense. For literally every business that might ever touch a European's data, it's a bit overblown.

That's a fair argument to make. The counterpoint is that before GDPR we had so many problems with companies mishandling data that "a bit overblown" is not something that everyone would agree with. Additionally, some countries (e.g. above-mentioned Poland) had GDPR-like laws (Ustawa z dnia 29 sierpnia 1997 r. o ochronie danych osobowych) for over two decades now, with a corresponding regulatory office (Generalny Inspektor Ochrony Danych Osobowych) that regularly looked into complaints. In practice it turned out to work great, local businesses easily complied with the law, and nobody saw this as a huge hassle in the two decades of the application of the law. I find it hard to believe that it's going to get much worse than that with GDPR. Many companies are just overreacting here really.

GDPR should have had a minimum revenue threshold for the bulk of its requirements. Enforcement should have also been centralized in a single EU enforcer. A simple process for obtaining non-compulsory affirmative compliance certificates, for businesses at or below the revenue threshold, would have also been nice.

> I find it hard to believe that it's going to get much worse than that with GDPR

I see Facebook and Google gaining market share and failing to change their behavior. In addition, Europe is no longer a market one launches in simultaneously with the U.S. and Asia for most foreign businesses.

This whole episode is deeply frustrating as I'm strongly anti-Facebook and pro-privacy rights. The degree to which the EU turned an opportunity to lead into a wholesale boondoggle is jaw-dropping.

Since that's a broad statement, would you care to back it up?

> I see Facebook and Google gaining market share and failing to change their behavior. In addition, Europe is no longer a market one launches in simultaneously with the U.S. and Asia for most foreign businesses.

Are you saying that Facebook and Google are not GDPR compliant, and that furthermore, the EU doesn't care that they are not GDPR compliant?

Yeah, but in this case that "anyone" is not spending a dime of his own, instead the limitless resources of EU will be coming after you. By the time the court decides, virtually any small company will bankrupt.

No, it doesn't. It requires you to answer the questions the regulator asks, and to see if you're currently following the guidance the regulator gives you.

Most companies would--and do--retain lawyers to answer regulators' questions. Particularly when in respect of a new law, and doubly so given the political uncertainty currently present across the Continent. Naturally, one is free to self represent with regulators as one is in a court.

This is not America. We do not regularly put people/companies into bankruptcy just because we can.

You have much, much bigger things to worry about as a small company. You could have your bank cut you off because you’re suddenly deemed too risky - happens every day. You could run into a contractual dispute that drags out for years and costs you tens of thousands of euros. You could violate a patent you never knew about. Your supplier goes bust just after you’ve spent weeks negotiating a large order, and now you don’t have enough inventory. You could perform some action or inaction that results in injury to someone, and your insurance could refuse to pay out. It turns out that one of the products you sell kills people, and the Government decides to take you to court over it. Your customers might fail to make good on any credit you give them. One of your key employees could develop a chronic, life-changing illness. You didn’t realise that some tax or other applied to you, and now you’re not making enough money to stay afloat. As a business owner, have you worried about any of these things as much as the GDPR?

> If a country in the EU choose to make an example of my company for whatever reason would would be preventing them from doing that?

GDPR states all fines need to be proportionate.

Look at all the food serving establishments: almost none of them have a lawyer to check they're compliant with food hygiene regulation.

Look at all the companies who advertise: almost none of them have a lawyer to check if they're compliant with advertising regs.

Isn't that a little vague? It seems to imply that if a business can show that collecting your personal information will grow their business, they do not need to provide a way for you to 'opt out'.

[1] https://ico.org.uk/for-organisations/guide-to-the-general-da...

It's totally fine for it to be vague. I very much doubt we'll see any cases where the general public disagrees with a DPA ruling of LI applicability. As a business owner, it means you need to strongly justify it and consider if a "reasonable person" would consider your use of LI to be justified. If you have doubt, you should seek consent instead.

Do keep in mind, that growing your business by using PD for marketing purposes is explicitly excepted from LI.

Consent may not apply:

> Consent is presumed not to be freely given if... the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

And that is exactly what sites are doing now. And there is noone on earth that will ever believe it isn't deliberate.

While others say the opposite, any data derived from a single individual is still considered personal data.

I could fit a planet into that "reasonable means" caveat.

The regulator interprets the gap. "Planet-sized gap" means the regulator can choose to be lenient or capricious based on their own preferences. That kind of uncertainty is anathema for modern businesses. (It's also beneficial to those who pay to build relationships with said regulators.)

This is classic anti-regulation BS. I would like to see a regulation which did not have this issue brought up against it. Heck, isn't this the core of the anti-regulation camp? Clearly though, regulations have not destroyed the world...

Technically, it will be the courts who (ultimately) interpret the gap, and it's worked so far for other standards like 'beyond reasonable doubt'. Courts have a tendency to be less capricious than a regulator.

I'd even go so far as to argue that "reason" is one of those things where specific examples can illustrate, but no more. Especially with regards to technology -- what is reasonable today, can be unreasonable tomorrow (eg: SHA1).

In the meantime, I'm positive that as of right now, 99% of the interpretation is performed by the data processors, and in most cases to their own benefit.

Dynamic IPs were considered as possibly being personal info, since a law existed which could allow an entity to connect dynamic IPs they have connected to other information (from an ISP), if they believe that connections from the dynamic IP are undertaking cyberattacks against them. Proto-GDPR actually considered collecting dynamic IPs in this case reasonable, and it was a specific German law that was more restrictive. The main question thus became: should proto-GDPR be used, or the existing more restrictive German law? Going off topic though. Point is that "reasonable" is used not as a mathematically precise definition, but in a human language sense of "reasonable". If you don't get what reasonable means, then I am sorry to say that in the case of law, you will generally have to suffer what most people consider to be reasonable in spirit.

In other words, you have a problem with all laws in general, since they are not nearly precise enough for you.

Be reasonable! Just as even interpreted software must eventually appeal to hardware actions to give them meaning, laws must eventually appeal to human-judged concepts, including reasonabless.

A definition like the one above actually strikes a good balance. It leaves it up to courts faced with real situations to evolve rules about what constitutes "reasonable"; while giving those courts a definite thing to judge the reasonableness of.

Use of magic moves it from reasonable to improbable.

Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun.

Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers!

It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...)

Processing of data is legitimate so long as you still have a reason to process that data, as well as if you have a contractual obligation with the subject to process that data. If that contract involves keeping an account registered indefinitely, until deletion is requested, then so be it. State it clearly and plainly when the user registers an account, and if you're that concerned about the ambiguity of the situation then the solution seems a simple one, no? Allow the user to choose to have their account deleted after a certain period of inactivity, or email users that their accounts will be deleted after lengthy periods of inactivity. It should be noted that 'inactivity' is industry specific, for something like free services online it could be industry standard to keep accounts for years, it's hard to imagine that a user would be upset about having an account they haven't used in 4 years be deleted, and really, do you need to keep that account after 1 year of inactivity? 3 Years? 5 Years?

I realise the law is purposely ambiguous here especially when applied to things like user accounts, but it helps to understand that storage limitations and retention plans apply less to things like accounts and more to things like metadata that you may be collecting. It's perfectly reasonable to keep user accounts registered for years even after inactivity for example, it's less reasonable to collect data for marketing campaigns and keep that data for years. Retention limits are also far more relevant to processors of data rather than for controllers of data, if you're a third party service you shouldn't need to keep data for longer than your contract with the controller specifies, however controllers have far more of a legitimate need to process data for longer. The push to have retention limits may as well be seen as a push to anonymise data that no longer needs to be tied to an identified person rather than a need to delete everything that hasn't been touched in 90 days.

>Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun.

IP addresses become problematic when you can tie them to an identified person, i.e., you're linking user accounts and IP addresses. As far as generic logs go, if the only personal information you're collecting is IP addresses then you shouldn't need to worry too much, treat the logs with some care as they still do contain personal information but don't sweat it too much. Make sure that if your logs are leaked that you inform users (i.e., through a blog post) that logs were leaked and the only personal information contained is IP addresses. IP addresses are one of the easiest things to justify needing to keep as a legitimate interest as well as needing keeping indefinitely, and if only IP addresses are leaked it's not really a big deal. If you have other personal information in your logs, especially if it's linked with more information, i.e., 'ip address 1.2.3.4 who has username asdf searched for jkl; [etc]', you should take steps to justify why you need to keep that extra information and maybe look at implementing a retention limit, or better yet, anonymise some of the extra data after you are finished processing it. If the metadata you're collecting is kept to a minimum and/or anonymised as much as possible, the need for a retention limit drops almost entirely, not that retention limits are entirely needed.

>Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers!

In every other industry you are responsible for when you choose a shoddy third party vendor who makes a mistake, I fail to see why the tech industry should be any different. I realise there is going to be a lot of teething issues on this particular issue, but part of the reason GDPR has as much scope as it does is because of these clueless third party vendors who misuse and abuse data. Maybe look into using European third party vendors in the future, as they would be just as culpable for their mistakes as you would be and they would be liable for fines too. :-)

>It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...)

For what it's worth, the GDPR makes explicit exemptions allowing for processing data where you have a legal obligation to do so. There is absolutely no conflict between financial laws and the GDPR in this respect.

You're totally right about the 3rd party vendor thing, and this will get better with time, but it doesn't change much that right now, it's a problem. Even vendors who take security seriously and have awesome engineering teams might have garbage lawyers and you have to deal with them. At the end of the day, no amount of security is perfect and you need DPAs. Getting rid of a vendor over this might be hard.

Basically, the whole point is: no, this isn't easy: large companies can have insanely complex problems. Small companies may not have access to the proper lawyer (or even have an IT department!). It's painful. What's worse is having to deal with European laws when you don't have a European presence (foreign lawyers can be tricky or expensive!). And companies who just decide to just avoid dealing with EU customers as a workaround (even small ones who might simply no longer be able to deal with this) get burnt at the stake.

In another comment you posted:

>I'm still not sure that recording everyone who walks past your store 24/7 is legitimate interest.

Stores and businesses need to display signs for when they are recording in the areas they're recording, inside a store it may be obvious that the store is recording, so a sign may only be needed on a door. Outside of a store you may need more prominent signs. If it's not obvious that the area area is being recorded then even more signs need to be posted still. The degree to which stores and businesses can record outside of their businesses will vary by country, but for the UK the ICO provides information for consumers [0], and businesses [1].

[0] https://ico.org.uk/your-data-matters/cctv/

[1] https://ico.org.uk/for-organisations/police-justice/

As a matter of fact: If you operate secutrity cameras in a public -, or semi public place you need a written procedure why something is captured, what is captured, how long it's kept, who can see the footage and under which conditions the footage is retained.

"If not, why?"

Because this is not a reasonable request if the footage is anyway deleted after, say, 72 hours.

If you think this, you've misinterpreted it. I don't think even the biggest GDPR advocates would claim that it is "pretty clear".

What about Article 27? It's unclear, and you don't have to have a shady business model in order to have no idea how you are supposed to deal with it. All it takes is that your business is not established in the Union.

This is the article that requires companies who are not in the Union but are subject to GDPR due to Article 3(2) to appoint a representative in the Union. The representative serves as a contact point that regulators and persons can communicate with instead of the company on all GDPR matters concerning the company. The representative is also required to keep a bunch of metadata about the company's data processing, according t Article 30.

According to the recital for this article, "The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor".

What does that mean?

Some people claim it means that your representative in the Union will be liable for any fines you incur from EU regulators or any damages a plaintiff wins in a private lawsuit over GDPR if the regulator or plaintiff is not able to force you to pay up.

Others think it just means that if regulators or plaintiffs serve notice on the representative, that legally counts as if you were served, meaning that if you do not show up at the hearing or trial and lose by default, you cannot try to weasel out by claiming you had no notice of the hearing or trial. In other words, these people think that the representative is very similar to the "registered agent" that many jurisdictions require foreign businesses to have in order to do business in that jurisdiction.

Personally, I was leaning toward the latter, as the idea of making the representative liable seemed pretty absurd...but it has been pointed out that in earlier drafts of Article 27 and the recitals, it did in fact actually clearly do so. That language was taken out before the final draft, but was that change because they wanted to remove that aspect, or because they decided "subject to enforcement proceedings" already implied it and they were just tightening the language?

This is important because if representatives are actually liable for fines and damages, it is going to be a lot more expensive to hire people to be representatives than it will be if all they have to do is be a contact point and a repository of metadata.

For small businesses outside the Union this could be a major expense if they must have a representative, perhaps a big enough expense that it will be worthwhile to just stop doing business in the EU.

So we must ask, "Who needs a representative?". The answer, it turns out, involves still more vagueness.

Basically, you are excused from needing a representative if you meet three conditions. Two of them most small businesses easily meet as long as they are not doing high volumes of certain particularly sensitive data, and their processing does not result in a risk to "the rights and freedoms of natural persons" (more vagueness!).

The third condition is that your processing "is occasional". What is "occasional"? No one seems to know.

I very much doubt this for a few reasons, the first being that it would be completely out of scope for the GDPR to have any say on what happens or who should be sued in a private lawsuit. The recital itself would also be contradictory, immediately before it says that the representative 'should be subject to enforcement proceedings' it says,

>Recital 80(4), The designation of such a representative does not affect the responsibility or liability of the controller or of the processor under this Regulation.

Additionally,

>Article 27(5), The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.

The wording of these two alone make it clear, to me, that the responsibility or liability lies solely on the controller/processor. The term prejudice also has a very specific meaning in Civil Law, and while it may have different meanings in Common Law (UK) I'm sure the more specific Civil Law version is intended and relevant. The wording of recital 80(6) as well as (5) '[the representative should cooperate] with the competent supervisory authorities with regard to any action taken to ensure compliance with this Regulation.' also tie in with other areas of the GDPR, particularly article 31 and 58(1)(a) which essentially state that supervisory authorities have the power to order the controller/processor as well as the representative to provide information that is required for the authority to perform its tasks. I think recital 80(6) with this context is basically just confirming that representatives need to to be present when supervisory authorities undergo enforcement of legislation.

If it were such a legal headache for representatives, it is concerning that no law firm has put forward an analysis of the situation. As far as I can tell from a brief search it is only amateurs interpreting the GDPR that have come to the conclusion that representatives may be liable for fines. With DPOs, who have many more responsibilities and requirements, there was much analysis by the legal community on what those responsibilities would include and whether DPOs could share liability. The WP29 even put out guidelines for DPOs[0] stating plainly that DPOs are not responsible for non-complaince, only the controllers/processors are responsible for non-complaince. It just seems odd to me that representatives who receive almost no mention in the legislation may be responsible for non-complaince where DPOs aren't responsible.

[0] http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_... [very bottom of page 24]

/s

Exactly this. Even the big reputable publishers (who wouldn't <em>dream</em> of breaking the law, oh no) accept money from companies directly targeted by the GDPR, who collect copious amounts of data on visitors across multiple sites.

Do users on site A consent to company B collecting data through ads, even if they tick a box? Probably not.

https://sheep.horse/2018/6/the_eu_general_data_protection_re...