You shouldn't be getting down voted. I just went through a GDPR compliance review. We have a service model which is incredibly serious about customer confidentiality. We don't sell ads and, to my recollection, have never even bought them. Still required an army of lawyers. Two top London law firms ended up agreeing to disagree on major points, ultimately concluding the Polish data regulator would probably rule one way and the French the other.
Complying with the spirit of a law doesn't mean complying with the statue of it. With GDPR, it's the latter that's a pain in the ass.
Wait, this is being handled on the national level??? I thought you guys had some singular EU court thing for this, not a clusterF of the different countries' justice systems.
Yup, each of the EU's twenty-eight member states have a national data regular who is responsible for interpreting the law. One can appeal to EU courts. But the local context must be considered.
in the end the gdpr is more about opening new jobs.
also sites like: http://www.spiegel.de/ or https://www.bild.de/ do not care about the gdpr/dsvgo... so it won't happen that there will be many groundbreaking changes on how the governments will see privacy issues. at the end they just wanted to scare of the silicion valley.
The point if EU is/was to achieve an "ever closer union" so that war between European states would never happen again. It's not just an economic bloc.
Btw the immigration is the main issue which has nothing to do with trading.
What the poster above is lamenting over is that each member state is in charge of their own investigatory authority, and this makes a lot of sense, if you have a data leak that affects only Spanish citizens you wouldn't want the investigation being carried out by a country like Sweden or even by the EU itself. However if a data leak affects multiple member state citizens each of those member states are invited to and can enter a joint investigation. The issue they believe is that France may have a stricter interpretation of the law than a country like Poland which may make cooperating with the law more difficult as you don't know how strict to be, and while this certainly is going to be the case it's not so different from any other facet of life - In the US you may favour a certain state to be prosecuted in, you may prefer to have a different prosecutor or judge, etc.
I've never understood why people try to comply with the text of a new law that doesn't have case-law under it yet, rather than the spirit.
Surely, the first time anyone gets sued for noncompliance of the text of GDPR, when they are compliant with the spirit under which GDPR was issued, case-law will be created that "bends" the interpretation of the text more toward the spirit?
Continental Europe uses civil law [1]. Case law is less relevant than it is in the U.K. or United States.
More broadly, people try to "comply with the text of a new law" to avoid becoming the precedent. (Even if you prevail, it's distracting and expensive.)
> Surely, the first time anyone gets sued for noncompliance of the text of GDPR, when they are compliant with the spirit under which GDPR was issued, case-law will be created that "bends" the interpretation of the text more toward the spirit?
Surely? Based on what? For anyone with material revenue, that basis will be legal advice.
We're all over Europe and the U.S. It was pretty painless. Our business does not rely on the ignorance of users or the abuse of their privacy. What "army of lawyers" did you have and why was the spirit of the law not enough? We had several different business units get through compliance without any problems.
This isn't a hard thing to address at the end of the day (so long as your entire business doesn't depend on it). I just can't help but feel a few ways A) You didn't understand what the law says B) what your lawyers were actually worried about or C) this story is just made up.
What specifically were the discrepancies in the interpretation of the law between various countries that caused two "top" tier law firms to be unable to come to a clean consensus?
These arguments tend to be very circular. It goes something like this: GDPR is reasonable and easy to understand; if you're having trouble with it you are probably user hostile/don't understand it; you're having trouble with it which means you are user hostile/don't understand it; therefore your complaints are not legitimate; therefore GDPR is reasonable and easy to understand.
The same vague claims keep getting repeated, with absolutely nothing to back them up. Not even a "here's the problem with the law in our case" super fuzzy high level overview. It's always about the effort of adhering to the law without any discussion about why these companies are facing difficulties in the first place. Not the actual difficulty with implementing the law, just the vague effort they've put up with.
Hundreds of thousands of businesses have not had issue with the law. Suddenly some guy on HN with two "top tier" law firms at his back faces this unimaginably heavy burden and extreme obstacles when trying to adhere to the law. Sounds like a nightmare, in the sense that it never happened.
OP's post and the many others like it are just typical American business favoritism against any kind of regulation masquerading as a personal True Story (TM). I still remember when cookie warnings were "hard" to do and businesses actively implemented them in obviously shit ways, in bad faith with the regulations. It's so obviously contrived for a particular audience it's kind of absurd it immediately doesn't get flagged.
I am pretty sure that's what they're asking for. I didn't see a request for specific details. Just some high level details, rather than "we've had to spend so much money/time => clearly bad".
Heavens knows no one has ever been legally compelled to elaborate on a "super fuzzy high level overview" they previously volunteered.
Just point out the exact part of the law you guys are having a problem with. If you can't do that, it's because you're just making shit up.
> C) this story is just made up.
Was interpreted as being too hostile and uncivil.
If I'm not allowed to call out dishonesty then there's basically no point in discussing any subject.
I can't count the number of times I've posted factual, verifiable information — with sources — and been downvoted (or, often enough, downvoted, then voted back up, then down again, and so on) for my troubles, or the number of times I've seen such comments from others treated the same.
The most plausible explanation I can come up with is, "Your facts dispute my narrative, and we can't have that!"
EDIT: I'm not saying that's what's happening here, and I'm certainly not saying there's brigading or shilling going on (indeed, I think it's purely individual action), but this is a clear pattern, which I've reliably observed happening for years.
It doesn't even have to be on a controversial topic; I once linked to an explanation of a nuance of copyright law, of which the other participants in the thread were demonstrably ignorant. The extent of the response? Downvotes.
I'm going to guess what's happening here is a good amount of developers work for companies where GDPR would directly impact their revenue directly or indirectly (and most likely jobs as a whole). This is especially true for smaller "middle man" analytic firms and general web agencies. It pays to be anti-GDPR.
What? Why? How?
Given that:
- You don't sell your customer data.
- That customer data is secure
- Someone somewhere in your org can handle access requests and delete customer data on request.
What here requires an army of lawyers?
Maybe your corporate culture demands that army regardless, but that's hardly the GDPR's fault.
My personal guess was they wouldn't need consent, as it was a clear-cut case where all requested data was clearly needed to provide the service. And asking for consent to use the data a customer just typed in the site for requesting the service seems a sure-fire way to annoy them without any upside.
Then the GDPR lawyers came.
It turns out, if you interpret the company charter in a very nasty but still legal way, there might be a very rare edge cases where a service was provided to someone who was not strictly 100% a customer. Yeah, I'm a bit vague here, sorry about that.
To be clear: No real-life example was found now or in the 10+ year history records of the service, both the almost-but-not-quite customer and the company would have to do insane things, and service delivered in the case was almost non-existant, but theoretically, on paper, it was possible. I'm pretty sure nobody would care if it happened, either.
So boom goes our legal base. Consent it is,then.
> Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.
and the ICO guidance is
> Consent should be separate from other terms and conditions and should not generally be a precondition of signing up to a service.
Even when consent is given, the users interests still have to be considered during processing, so it's not like it's a do-whatever-you-like card. Just because a user says they consent to you doing something with their data, doesn't necessarily mean you can if that thing is obviously not in their interests.
I wish the fact that consent is only a weak basis under GDPR were made more clear, since if we just end up with an internet that requires consent on every site then the law has just made things worse and made nothing better.
And it is even more insane blindly accepting this sort of advice with GDPR, worrying about getting sued for for theoretical edge cases when the first round of warnings haven't even gone out to the worst offenders yet.
https://gdpr-info.eu/art-6-gdpr/
There are 6 options. Option a is the consent you are talking about. I am talking about option b.
Basically, having multiple legale bases can't hurt, so our lawyers said: Get both option a and b.
Defining what those simple statements like "customer data is secure" means in the context of hundreds or thousands of use cases throughout a complex organization.
But if you're not, or you're not sure what the boundaries of "personal" are (is a first name only personal?) it's harder.
https://www.eugdpr.org/the-regulation.html
Hands up. Who has actually read all of it?
Speaking as somebody who actually has - was teaching computer security last term - I found it relatively easy to read (as legal documents go) - but it still took a weekend. I will guarantee you, that not all of the high powered lawyers whose job it is to read it, have done that.
True story: back in the days when libraries still stamped your book with the date it was due back, I took out a copy of Keynes General Theory from the main library where I lived. It's not that thick of a book, and according to the date stamps it had been borrowed at least 20 or so times. About half way through the pages hadn't been cut.
It was a few years before the significance of that finally dawned on me. As in many things in life, HN discussions on the GDPR are a wonderful example of nobody actually reading it, and everybody having an opinion of it.
Well now I read that link, but I don't think that's the actual law...
Regarding your point about consensus, that's fair - however this has not been my experience. Most parties that you would ask for advice on the matter have a pretty good handle on what the different terms mean.
Your second point is mostly evidence (to my mind) of large corporations trying to get away with as much malicious compliance as they can possibly manage. You really do have to put a lot of effort in that, as you cannot assume the agency checking you will see good faith (which is, as far as I understand it, one of the requirements for not being slapped with fines very quickly).
The law is pretty clear (not 100% clear, obviously, there is going to be loophole and unclear things), and it's easy to decide about unclear spots by following the spirit of the law, and by understanding that any unclear technical requirements really means "what a sane engineer would do, that you could defend against a jury of your peer".
To answer a few of your questions (obvisouly IANAL):
- are IPs PII? Yes, there are legal case about that, your lawyer should have a more detailed answer.
- what exceptions can be allowed? When you have a case you could defend that doesn't go against the spirit of the law
- what falls under "security requirements"? You should be able to defend your choices securiy-wise against a jury of your peer, using your internal documentation. If you have unsalted passwords hashs for example, you are in trouble
- what sort of deanonymization is sufficient? Best practices at the current date.
Technical details aren't going to be in the law, because the goal of a law is to not be outdated every year.
Laws are enforced by humans, not by computers. Your company should be prepared to defend its interpretation of the law (that's your lawyer job) and your technical choices (that's your job).
Edit: obviously, that's a simplified vision, and you should always consult your lawyer. The biggest your company is, the more important it is to try your best to be compliant.
But as for 1): IPs are distinctly /not/ PII (AKA: PD). They're identified /by name/ in the regulation, unless you sell that info. Anyone who brings this up as a topic has not actually read the regulations.. or they have and are trying to create uncertainty for some objective.
It sounds like you've done enough of reading the regulation to actually know this, it's part of your job and you've spoken to legal experts (as I have).
Have you yourself read the regulation? You are wrong.
The regulation makes a single reference (by name) to IP addresses. In recital 30. In that recital, it specifically declares IP address to be PD (GDPR doesn't use the term PII at all).
Not to confuse the matter, but if you stopped there, and decided IP addresses were PD, you would have stopped short. It requires deeper analysis. Here are two good ones:
https://gdpr-info.eu/issues/personal-data/ https://www.whitecase.com/publications/alert/court-confirms-...
The soundbite-sized answer is: it depends.
IP, when tied to other data becomes the scope of personal data.
However, removing the other data renders it no longer personal data.
This firmly puts it in the "it's not personal data" camp. Since it's the other data that is personally identifiable that gives it context.
It's only relevant for ISPs really, but really good job on proving my "creating confusion for no reason" point.
In the context of online accounts (in video games, where I work) it can't be used to identify real world people because we don't ever link to a real world identity. In cases where you log details about people individually (as in- a bank) you just don't log user details beside access logs and you're set. IP on it's own is not personally identifiable, and is out of scope for GDPR.
The tricky thing about GDPR is choosing the correct lawful basis. I think people reach for the legitimate interest card too quickly because they see it as a "get out of jail free" card. But then it ends up complicating things enormously -- especially since legitimate interest can be objected to. I've seen people agonising in public about what to do because the personally identifying information is necessary to provide the service they are offering. If you're in the situation where if someone objects to the use of their data, then it breaks the whole service -- well you're in contract lawful basis territory.
IP addresses are potentially complicated, though. I'm not sure what's supposed to happen when you receive personally identifying information from someone that you don't have a contract with. The law does seem to be vague on what constitutes a "contract", because in some cases it seems to imply something different than what contract law says (i.e. if there is no consideration, it seems I can still use contract lawful basis). In this situation, if I have a P2P network and I need your IP address to fulfil my side of the protocol, then I should be able to use it under contract basis. However, I'm unclear about the actual legality of it -- especially when the information is sent to you by an intermediate node.
To me, that's what needs to be cleared up. I expect it will be over a period of time. I don't think the law was written with that kind of stuff in mind. It's kind of interesting, though. I imagine it is a violation of the GDPR to track what individuals are downloading in bittorrent without giving them a legitimate interest notice, though (and allowing them to object! and be forgotten!). It will be interesting to see if anybody complains about that kind of thing.
Check Patrick Breyer v. Bundesrepublik Deutschland.
Literally a website just logging IP addresses of visitors.
You’re making it sound incredibly cut and dry when it’s clearly not and there’s case law on record confirming it’s not so simple.
https://curia.europa.eu/jcms/upload/docs/application/pdf/201...
I also looked up some additional explanations.
That case literally does not support the claim you make. The court decided that:
* dynamic IPs can be considered personal info if the entity collecting them has legals means to get additional information related to that IP (these legal means exist in Germany, if the entity believes they are being cyberattacked)
* furthermore, the court noted that this particular law is more restrictive than general EU law (which eventually becomes GDPR, as far as I understand: http://germanitlaw.com/patrick-breyer-v-federal-republic-of-...)
* according to the less restrictive law though, "The operator of a website may have a legitimate interest in storing certain personal data relating to visitors to that website in order to protect itself against cyberattacks"
* and this opened up the question as to which law should be followed in Germany, at least until GDPR comes into play (again, see explanation in http://germanitlaw.com/patrick-breyer-v-federal-republic-of-...)
* note then that: this issue is no longer an issue (since GDPR is in play now) and that GDPR actually allows the collection of dynamic IPs if the entity needs to do this to protect from cyberattack
I was responding to a person that was claiming that essentially IP addresses are only personal data for ISPs or ISP like businesses. Which is simply not the case.
I didn't say IP addresses were always considered personal data, I simply said it can be personal data, which you also stated in your post. That it's not cut and dry. The person I was responding to was posting that IP addresses are definitively NOT personal data.
The point is, context for IPs matters. The person I was replying to was way over simplifying.
I'm not entirely sure what claim you think I made that the case doesn't back up as you essentially stated what I did just with more specificity. In any case I totally agree with your post since it's the same point I was making :)
1. HN discussions themselves. Literally EVERY TIME this comes up, you see a massive back and forth from various crowds of GDPR; some of whom swear that it's perfectly comprehensible even as significant portions of the conversation are interpreting the same points in a variety of ways. (Are IPs PII? What exceptions can be allowed? What falls under "security requirement"? What forms of data are associated PII? What sort of deanonymization is sufficient? IS it sufficient? are some common questions I saw in the past, not even getting into the wonderful world of third party data processors.) This seems like enough pragmatic evidence that a (to give the benefit of the doubt) educated and professional community hasn't reached consensus, so to say there's a variety of interpretation seems very fair.
2. I implemented GDPR for a small corner of a notable BigCo. I do not consider myself an expert, but I certainly got my marching orders from experts, (The legal teams who interpreted the document and evaluated the implementation methods) and the sheer amount of horsepower put behind finding an interpretation we believed and were confident in was staggering. Granted this is something where we _really wanted to get it right_ but if it were really trivial to interpret I question if the process would have been as intensive as it was. (To preempt the inevitable; our (my team's) business model has _literally nothing_ to do with your data, but we had many of the same confusions/questions that I saw from companies who did, so I'd be hesitant to say that the burden isn't somewhat widespread.)