An example is in big data repositories where personal data may have been provided but not used for anything. Yes it’s there but nothing uses it. To enable the reporting and deletion requirements you build a system that keeps track of all that, now the data _is_ trivially correlated which seems like the opposite of the intent.
Even when I build systems that prunes the data on ingest it feels weird. To conform with a privacy law I’m building a sophisticated filter for finding personal data I don’t even want.
In that case you have to delete it, you know this, right?
Some process will ingest and index the valuable data and throw the original file into non-indexed storage in case it needs to be re-run.
Ideally you filter that data at ingest time but even that is building a capability that feels against the intent.
But let’s say you didn’t even know to build the filter. Now you need to go in and scan all those files to remove the personal data. A capability that requires you to read data you hadn’t prior.
You’re literally the reason the law was passed. Don’t do that. Like what happens when you get hacked or leave an Amazon bucket public and someone sells all your customers’ PII on the dark web?
A lot of HN’ers “”struggle”” with the concept that the law isn’t “confusing” or “bad” it’s that they themselves are taking actions that are socially harmful and laws have been passed to target this behavior. But it’s difficult to make a man understand something when his paycheck depends on not understanding it.
The axiom has been for businesses to hoover up as much data as possible, and that’s explicitly the mindset the EU wants you to stop. Being asked to at least catalog what you’re hoovering up is a tiny tiny ask, let alone the immense risks you’re running with other people’s identifiable data. Don’t create these targets for people to hack in the first place, especially when they self-admittedly serve no useful purpose even to your marketing.
You’re literally the guy getting mad the government is making him clean up his superfund site. Moving the drums is riskier than just letting them sit there forever… up until they inevitably rust out.
https://en.wikipedia.org/wiki/Valley_of_the_Drums
“I ain’t hurtin’ nobody, it’s a free country!”
My concern is once it has, is it better to build a capability that can specifically be used to identify personal data to remove it or to let it lie.
I’m glad you have moral certainty on that. It’s certainly never been that clear to me.
...and then presumably deleting it, as required by the law if there is no business or technical reason for having the personal data. That seems like a pretty good pro-privacy move, vs leaving that data hanging around forever.
If the end goal is to improve privacy, not collecting and storing the data seems a much stronger protection than crossing your fingers hoping someone doesn't go rummaging around looking for personal data.
GDPR's goal was to make PII into "toxic materiel", to be only handled if you really, really need it and are willing to deal with the toxicity.
Having a pool of toxic sludge and declaring everything is fine because you do not use it after filtering what was useful for you does not stop it from being a dangerous pool of toxic sludge.
If you delete any data that can single out people when you're ingesting it, then nothing more needs to be done. So you delete any user identifying data by default, not keep it from the very start, unless you have a very strong use case. You can also have completely anonymised but still useful data. There are many statistical methods to collect useful but reasonably and provably anonymous data like differential privacy.
If the businesses that give you data don't provide the option of completely deleting it then they are non-compliant as well.
Unbeknownst to us (or the hr system owner) after a software update it started sending us extra fields which would occasionally include the office managers name and contact details (including home address at times).
Had another case where a pos vendor was supposed to be sending us aggregate sales data. Again, not in the agreed spec, they included the names of any loyalty users who had used each pos.
I once saw a script kiddie spew a whole credit card file into a non existent endpoint filling the request logs with pci scoped data.
Many web based api (especially json based ones) will not refuse requests that have extra fields in them, so you can get in the case where poorly crafted clients are sending data they shouldn’t.
My point is many many systems don’t ask for personal data and still get and store it.
It's strange that your response to it is "yup, it's totally fine who cares" and not "the systems should be updated to not do that".
My central concern is there is a trade off to be made between keeping the data in place and building a capability to actually read/index the actual personal data. My opinion many times is that not having the technical capability to read that data is often a better privacy control in practice than building it to delete data and hoping it doesn’t get repurposed.
That seems to be a minority opinion here.
I have had similar cases covered by GDPR as well of course but my broader point is that the idea that you only get the data you ask for doesn’t align with my lived experience.
No, the service provider will rather ask himself: "Where can I find a really good lawyer who can tell me how to handle shitty EU laws without getting into a risk of getting sued?"
In other words: this law is a job creation scheme for lawyers.
Lawyers mainly worked on producing disinformation about it because confusing people made for better consulting fees, but especially once guidance on "legitimate use" filtered out from legalese, they kinda stopped having an angle
... unless what you actually want to do is to violate GDPR and trade in PII, then you need to lawyer up
If your claim was true, the solution would be easy: I simply find a need for all data that I collect.
Problem solved? For sure not, which obviously falsifies your "idea" that it is so easy.
Is it necessary for performing the service to end user? Is it necessary to support technical or legal issues in providing the service? (Trading data with other entities, marketing, etc ARE NOT, logging, debugging, security/audit logs ARE).
Creating BS claims for "legitimate interest" like IAB does is just setting yourself for big fines for breaking the law.
It's not being used until somebody decides to use it.
Also I put a bit of responsibility on us, the consumers. It does not seem to me that popups are such a real issue since no website reported: we are removing popups because users are so annoyed that they stopped visiting our website.
Then tell us how companies should implement this law both
- without annoying the user
- not being in a risk of getting sued
If the law does not make this relatively easy, one has a right to be furious about the EU.
Shysters/pettifoggers are very "flexible" (in a negative way) in the interpretation what is "necessary for your site to work". :-(
Just keep them out of hands of parties that might want to use them for other reasons.
The main problem, and the reason certain parties are working so hard not to comply, is that GDPR makes several business models illegal. (Not that I see that as much of a problem.)
This is what the law says, but not how shysters/pettifoggers interpret it. :-(
That isn't how the law works for things like this though; what is plain to a lawyer is different to an untrained person. People make that mistake with tax law all the time; they read something and come up with a plain interpretation that shows they don't have to pay their taxes and that delusion persists until someone explains the actual, less plain, reading.
It isn't the worst starting point but winging the law with untrained readings is not really acceptable for running a business.
But you don't (typically) get into trouble with the law enforcement agencies if you don't/didn't understand the laws of physics correctly.
If there is a pop up there, for just accessing the home page of the European Union, is that site collecting too much data?
There's even a bit at the bottom of https://gdpr.eu
> We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.
It’s not an EU site.
GDPR.EU is a website operated by Proton Technologies AG, which is co-funded by Project REP-791727-1 of the Horizon 2020 Framework Programme of the European Union. This is not an official EU Commission or Government resource. The europa.eu webpage concerning GDPR can be found here. Nothing found in this portal constitutes legal advice.
Would you be surprised if there was a big banner at the bottom of the page that read
This site uses cookies. Visit our cookies policy page or click the link in any footer for more information and to change your preferencesOn a technical level this would likely mean turning off access logs and other tracking mechanisms. (IP addresses are considered personal data last I checked.)
https://gdpr.eu/eu-gdpr-personal-data/
Looking back at the GDPR’s definition, we have a list of different types of identifiers: “a name, an identification number, location data, an online identifier.” A special mention should be made for biometric data as well, such as fingerprints, which can also work as identifiers. While most of these are straightforward, online identifiers are a bit trickier. Fortunately, the GDPR provides several examples in Recital 30 that include:
Internet protocol (IP) addresses;
cookie identifiers; and
other identifiers such as radio frequency identification (RFID) tags.
These identifiers refer to information that is related to an individual’s tools, applications, or devices, like their computer or smartphone. The above is by no means an exhaustive list. Any information that could identify a specific device, like its digital fingerprint, are identifiers.A very common example is recording the IP address for technical (debugging, ensuring site functionality) and legal (security, audit logs) does fall under Legitimate Interest.
Worst case you have to mention it in privacy policy.
The thing you can't do is let your marketing team or others grab at it in any way, or sell it to other vendors, and arguably you should not move outside of safe countries.
In today's world users hand over their data to a huge number of companies for all kinds of different reasons and it's important to know that those companies are pushed by the law to only collect and retain the information they need to provide their services.