6 ms·

I really hope nothing remotely similar to gdpr is written into legislation in the US. I do not even know how I would get started writing a website that would ad

I really hope nothing remotely similar to gdpr is written into legislation in the US. I do not even know how I would get started writing a website that would adhere to GDPR requirements

rubidium 8y ago
Then you have no business with users data.
- tested24 8y ago
  Can you tell me what I need to do to make a gdpr compliant website? Is it the hacker news mindset that you should need a law degree to launch a website now? GDPR is so bad that I would rather make a HIPAA compliant service than a GDPR compliant service.
  - losteric 8y ago
    The GDPR is long but trivial to read, probably high-school level at worst. The EU website has the full text here: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE... (warning: MASSIVE page) If that's still too hard, a summarized form can be found at https://www.gdpreu.org https://www.gdpreu.org
    - tested24 8y ago
      Thank you for showing me the supposedly trivial guide to understanding GDPR. The only thing that website has shown me is that no globally competitive tech company will ever grow out of the EU for the next hundred years or so.
      - jkachmar 8y ago
        So? Perhaps one of the facets of the GDPR is the EU’s willingness to accept that fostering “globally competitive tech companies” may not be in the best interests of itself or its citizens.
        BookmarkSaver 8y ago
        If that's the case, then they are absolute morons.
        tested24 8y ago
        Yes building tech companies that people love to use and provide high paying jobs does not benefit the citizens of a country
        losteric 8y ago
        Meth labs also create products with mass appeal and briefly high-paying jobs. Considering how social media is eroding American political discourse, Europe may be better-off in the long run even GDPR is as bad as you imagine.
x0x0 8y ago
So, on the one hand, I really would like a GDPR equivalent law in the US. OTOH, anyone who says they clearly understand the implications of GDPR for their site has either spent a lot of money on lawyers or is lying. Let alone someone who has implemented it. Privacy by design requires deletion of data after legitimate interests and/or consent have expired, probably (!!!) in 3rd party systems. How, precisely, do you implement that? Can you shadow-delete accounts for some period of time to allow users to change their minds? If no, what UI do you put on a "delete my account" button that has absolutely no undo, even in the 24h regrets period? Do people have GDPR privacy rights over eg comments on YC that may mention them by nym? Given the GDPR covers EU residents (not just citizens), as an American can I buy a plane ticket to Dublin and start requesting full data dumps? What rules are those provided to me under, and how do you make software that can do that?
- desas 8y ago
  There are plain english guidelines available for the GDPR, in the UK they are published by the ICO which is the government agency tasked with enforcing the law. I'm sure there are edge cases which aren't fully documented but as long as you're not pushing the edges of the law and are trying to stay within the spirit you will be fine. Probably. 0. You require the third party you passed the data on to delete data when you tell them. The third parties should tell the person that they now have their data, where they got it from, how they will process it and how to get in touch with their data protection officer. 1. You can but you must also allow someone to delete in full (assuming none of the many reasons to reject removal requests apply or you don't wish to exercise them). 2. This is murky, but probably not. There's a right of freedom of expression and information. 3. No, you have to be a resident not a visitor. You'd have to see how Eire define residency.
- losteric 8y ago
  > OTOH, anyone who says they clearly understand the implications of GDPR for their site has either spent a lot of money on lawyers or is lying. Let alone someone who has implemented it. http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE... It's long but the language is far easier than American legalese. The implications depend on your site/service behaviors. An RSS reader is pretty trivial, interactive social media... less so. > Privacy by design requires deletion of data after legitimate interests and/or consent have expired, probably (!!!) in 3rd party systems. How, precisely, do you implement that? Privacy by design is a design philosophy, it might be a pain to refactor into an existing system but the design constraints aren't onerous. If your "3rd party system" is something like AWS, just delete the data. If you're sending it off to some other service, they do need to be GDPR complaint (the law covers this situation). re: legitimate interests, we partitioned our data. Access logs, for example: one stream gets anonymized for simple analytics, another gets dumped into in-depth weekly analytics jobs, and the final log stream outputs encrypted auto-expiring S3 files with strong access control for infosec purposes. When a user withdraws consent, we just stop logging new information. Truly anonymized data is OK, our in-depth analytics data is purged within 14 days, and InfoSec is a justifiable legitimate interest. > Can you shadow-delete accounts for some period of time to allow users to change their minds? Yes. GDPR does not require instant response. You should be transparent about what will be kept and how long, a clearly communicated 24h shadow-delete is completely reasonable. > Do people have GDPR privacy rights over eg comments on YC that may mention them by nym? This is a good question, I'm also curious about quotes. The recent Google case suggests both fall under GDPR. > Given the GDPR covers EU residents (not just citizens), as an American can I buy a plane ticket to Dublin and start requesting full data dumps? What rules are those provided to me under, and how do you make software that can do that? Assume everyone is covered by GDPR.

I really hope nothing remotely similar to gdpr is written into legislation in the US. I do not even know how I would get started writing a website that would adhere to GDPR requirements

rubidium 8y ago

Then you have no business with users data.

tested24 8y ago
Can you tell me what I need to do to make a gdpr compliant website? Is it the hacker news mindset that you should need a law degree to launch a website now? GDPR is so bad that I would rather make a HIPAA compliant service than a GDPR compliant service.
- losteric 8y ago
  The GDPR is long but trivial to read, probably high-school level at worst. The EU website has the full text here: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE... (warning: MASSIVE page) If that's still too hard, a summarized form can be found at https://www.gdpreu.org https://www.gdpreu.org
  - tested24 8y ago
    Thank you for showing me the supposedly trivial guide to understanding GDPR. The only thing that website has shown me is that no globally competitive tech company will ever grow out of the EU for the next hundred years or so.
    - jkachmar 8y ago
      So? Perhaps one of the facets of the GDPR is the EU’s willingness to accept that fostering “globally competitive tech companies” may not be in the best interests of itself or its citizens.
      - BookmarkSaver 8y ago
        If that's the case, then they are absolute morons.
      - tested24 8y ago
        Yes building tech companies that people love to use and provide high paying jobs does not benefit the citizens of a country
        losteric 8y ago
        Meth labs also create products with mass appeal and briefly high-paying jobs. Considering how social media is eroding American political discourse, Europe may be better-off in the long run even GDPR is as bad as you imagine.

x0x0 8y ago

So, on the one hand, I really would like a GDPR equivalent law in the US. OTOH, anyone who says they clearly understand the implications of GDPR for their site has either spent a lot of money on lawyers or is lying. Let alone someone who has implemented it. Privacy by design requires deletion of data after legitimate interests and/or consent have expired, probably (!!!) in 3rd party systems. How, precisely, do you implement that? Can you shadow-delete accounts for some period of time to allow users to change their minds? If no, what UI do you put on a "delete my account" button that has absolutely no undo, even in the 24h regrets period? Do people have GDPR privacy rights over eg comments on YC that may mention them by nym? Given the GDPR covers EU residents (not just citizens), as an American can I buy a plane ticket to Dublin and start requesting full data dumps? What rules are those provided to me under, and how do you make software that can do that?

desas 8y ago
There are plain english guidelines available for the GDPR, in the UK they are published by the ICO which is the government agency tasked with enforcing the law. I'm sure there are edge cases which aren't fully documented but as long as you're not pushing the edges of the law and are trying to stay within the spirit you will be fine. Probably. 0. You require the third party you passed the data on to delete data when you tell them. The third parties should tell the person that they now have their data, where they got it from, how they will process it and how to get in touch with their data protection officer. 1. You can but you must also allow someone to delete in full (assuming none of the many reasons to reject removal requests apply or you don't wish to exercise them). 2. This is murky, but probably not. There's a right of freedom of expression and information. 3. No, you have to be a resident not a visitor. You'd have to see how Eire define residency.
losteric 8y ago
> OTOH, anyone who says they clearly understand the implications of GDPR for their site has either spent a lot of money on lawyers or is lying. Let alone someone who has implemented it. http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE... It's long but the language is far easier than American legalese. The implications depend on your site/service behaviors. An RSS reader is pretty trivial, interactive social media... less so. > Privacy by design requires deletion of data after legitimate interests and/or consent have expired, probably (!!!) in 3rd party systems. How, precisely, do you implement that? Privacy by design is a design philosophy, it might be a pain to refactor into an existing system but the design constraints aren't onerous. If your "3rd party system" is something like AWS, just delete the data. If you're sending it off to some other service, they do need to be GDPR complaint (the law covers this situation). re: legitimate interests, we partitioned our data. Access logs, for example: one stream gets anonymized for simple analytics, another gets dumped into in-depth weekly analytics jobs, and the final log stream outputs encrypted auto-expiring S3 files with strong access control for infosec purposes. When a user withdraws consent, we just stop logging new information. Truly anonymized data is OK, our in-depth analytics data is purged within 14 days, and InfoSec is a justifiable legitimate interest. > Can you shadow-delete accounts for some period of time to allow users to change their minds? Yes. GDPR does not require instant response. You should be transparent about what will be kept and how long, a clearly communicated 24h shadow-delete is completely reasonable. > Do people have GDPR privacy rights over eg comments on YC that may mention them by nym? This is a good question, I'm also curious about quotes. The recent Google case suggests both fall under GDPR. > Given the GDPR covers EU residents (not just citizens), as an American can I buy a plane ticket to Dublin and start requesting full data dumps? What rules are those provided to me under, and how do you make software that can do that? Assume everyone is covered by GDPR.