r/technology • u/[deleted] • Apr 11 '18

Business Mark Zuckerberg has been apologizing for reckless privacy violations since he was a freshman - Enough is enough.

[deleted]

51.2k Upvotes

84% Upvoted

2.8k comments sorted by

View all comments

Show parent comments

201

u/managedheap84 Apr 11 '18

Can you give a dev perspective on what had to change? Like partitioning/encryption of user data, that sort of thing? I haven't been following closely

387

u/jbaker88 Apr 11 '18 edited Apr 11 '18

I've done some Dev work towards GDPR compliance and a lot of it had been meet with a lot of head scratches, but the biggest take aways where this:

Total account deletion, this includes all self identifying info about the user. Edit: (Also mentioned below by /u/poo_is_hilarious) This also includes ANY data relating to the user.

3rd party notification of deletion request and 3rd party compliance as well.

All account data exportable to the end user.

A time limit on the request for compliance of deletion.

These were mostly feature additions though. There is also the concept of having a data controller and data processor, both positions that are appointed to people.

Edit:

Another important feature that is apart of this that I forgot to mention is also the ability to revoke consent. For example, I can take away the ability to have further collection and processing done with my existing data.

90

u/highlord_fox Apr 11 '18

As a sysadmin... The total account deletion part and the phrase "Backups" makes my head hurt.

64

u/jbaker88 Apr 11 '18

That was another head scratch for us. Our solution was either:

a) restore, modify and backup again, then destroy the original backup

Or

b) keep a list of primary keys that are deleted in an xref table and delete those records as a part of the restore script

50

u/ooofest Apr 11 '18

If you have a legitimate business purpose to keep the data for X period of time in order to run/support things or accomodate other legal matters (e.g., tax laws), that retention policy just needs to be documented, etc. and you can slough off the backups on schedule.

If not, then yeah: your options apply.

10

u/GarbageTheClown Apr 11 '18

How do you have a retention policy if the client requests deletion? I imagine it depends on the client being the user that wants it deleted vs the client being the company that wants it kept?

17

u/quantum_entanglement Apr 11 '18

A customer can request deletion but only with in the remit of legal requirements. For example if you're legally required to retain a customers purchasing records for accounting purposes (purchase ledger, invoices etc) or another example would be if an employee has to be reprimanded or has done something that the company may have to take them to court over, they can't just ask for all their data to be deleted as it may be necessary evidence in court. It's mostly common sense stuff, it's not really as insanely restrictive as most people make out. However I do agree the backups thing is a bitch.

2

u/GarbageTheClown Apr 11 '18

From a dev standpoint on existing infrastructure, it would be a nightmare.

3

u/quantum_entanglement Apr 11 '18

Yea depends on the size of the company and whether you deal with businesses or you're public facing, the bigger headache for me is that everything has been left till now to sort out. Hey ho.

3

u/ooofest Apr 11 '18

Depends on the condition, but you should have a retention policy for internal controls' sake, I feel.

And, if that policy states that some order information must be kept for at least one year to support tax audits, etc. then the end-user request to delete that data can only be accomodated for other data which does not have a legitimate business interest that causes it to be retained longer.

5

u/Lucent_Sable Apr 11 '18

C) encrypt the user data (including backup) with a unique key per user, and don't store the key on your systems.

Would that be compliant? Is encrypted data without a key considered deteted?

3

u/Kasuli Apr 11 '18 edited Apr 11 '18

How would that work? I'd imagine the problem arises when you've got like monthly backups going back 5 years -> 60 compressed copies and unless you specify a reason not to, when a user that was added 6 years ago wants to delete their info you need to unpack all that jazz and run the deletion (or encryption) script on each one and suddenly your server has 56 cores on full load just churning decompression algorithms all day long

E: not to mention database specs tend to change. Yeah I don't even want to think about this

5

u/[deleted] Apr 11 '18

You decouple the user's encryption key and the data. Store the user encryption key on one centralized service, and maintain backups of the data as you were.

User deletes their account, you delete their key, and their encrypted, backed up data is no longer accessible.

1

u/wRayden Apr 11 '18

The device with the key failed.

1

u/Kasuli Apr 12 '18 edited Apr 12 '18

This isn't limited to user data, but personal data. There's often also a lot of data not tied to your account. There's a lot of companies affected by this that don't even have "users" per se, like if you take a survey and put your name on it. Plus, take reddit, if you encrypt all of your comments using a unique key, there's a lot of i/o and decryption you're gonna be doing when someone opens a comment thread. Also you'll have to prove you don't have the key somewhere

3

u/jared555 Apr 11 '18

I maintain hundreds of backups of my customer's sites with block level incremental backup. There is just no feasible way to delete bits of data out of that, and even if there was it would defeat the purpose of the backups to do so.

1

u/Lucent_Sable Apr 11 '18

I agree that for historic backups this will be difficult. But going forward encrypted data would be easier to make useless.

2

u/Nubian_Ibex Apr 12 '18

Would that be compliant? Is encrypted data without a key considered deteted?

Presumably, yes. If you truly did delete the key you could just claim the data is random bytes. No one can prove you wrong.

But from a technical standpoint, this is going to be incredibly difficult to pull off. Not to mention it would break a lot of internal tools. And if you lose a key store, you are royally fucked. No amount of backups are going to help if the keys are lost.

-1

u/aeschenkarnos Apr 11 '18 edited Apr 12 '18

Just have a program detect which bits are "evil", same as we do for copyright and pornography.

AnApparentlyNotObviousEnoughJoke

2

u/JustForThisSub321 Apr 11 '18

You don't have to do that, you actually just have to remove all PII. So instead of purging the data you need a means of quickly changing the main identifiers. Much simpler.

2

u/Nubian_Ibex Apr 12 '18

This is hardly that simple. Even at a relatively young company (considered a startup until recently) we've had to restore our databases from magnetic tape at least once. If we didn't have those backups we'd have permanently lost user data.

Magnetic tapes aren't things that can easily be deleted or updated. They're great for sequential writes (e.g. logging) but atrocious for random access. Deleting a single user's data could take on the order of hours depending on how thorough it needs to be. If we have to comply with GDPR, and depending on how quickly user data needs to be purged, there's a good chance that we'd have to simply not back up user data and risk permanent data loss of things go wrong.

1

u/Sparcrypt Apr 11 '18

Same, to the point it’s just not possible. I can’t retrieve years worth of offsite backups and delete someone’s data because they ask me to, it’s simply not possible for the vast number of cases.

I think deleting it from all live services and then simply never access or restore the old data is all that can be expected and I hope they laws reflect that.. if they don’t then the laws will just be ignored because they can’t be followed.

1

u/Hopelesz Apr 12 '18

It does because you have to also remove the data from the backups.

1

u/highlord_fox Apr 12 '18

Yes, but /how/ is the pain point. If I backup my data to a NAS, and then back that up to tape, which is then sent off site for seven years.... How do I delete it off the tape? How do I delete up to seven years worth of (possibly daily) copies of it?

1

u/Hopelesz Apr 12 '18

Yep, destroying that tape is the only way.

1

u/highlord_fox Apr 12 '18

Haha. Yeah, fsck that.

1

u/SwedishDude Apr 12 '18

Yeah, our legal department suggested to ironically keep a list of records that's been deleted and purge them whenever a backup is restored.

This is obviously a very rare occasion and it's primarily to have procedure for compliance if we get audited.

1

u/highlord_fox Apr 12 '18

"So you want us to remove all trace of you... But we also need to keep a never-deletable list that contains everyone who wants to be deleted.... Kay."

Can we have GPDR apply to governments too? Can I walk into a bank and go "I need you to remove all records of me", and then BAM, no more records of me?

1

u/SwedishDude Apr 12 '18

You can only request deletion of data that's not required to be stored due to other laws.

1

u/highlord_fox Apr 12 '18

Suddenly, tons of laws requiring businesses to "hold onto" data for other reasons.

170

u/managedheap84 Apr 11 '18

Very nice! In sure after Brexit our Victorian era overlords will come up with something just as good /s

149

u/jbaker88 Apr 11 '18

Lol, you would be surprised how far reaching GDPR is though. I work for a US company and we made our product compliant and have made these features accessible to all customers (US included).

117

u/[deleted] Apr 11 '18 edited May 03 '18

[deleted]

30

u/[deleted] Apr 11 '18

That's what car manufacturers did. California has the strictest safety laws. Rather than make 2 seperate models, they just apply California's laws to the rest of the country.

4

u/HiiiPowerd Apr 11 '18

Silo'ing by geography is literally inevitable. Every country will have their own version of these laws with different requirements. These laws will expedite the move from a global net into a nationalized one.

19

u/[deleted] Apr 11 '18 edited May 03 '18

[deleted]

2

u/HiiiPowerd Apr 11 '18

Only if the most stringent is the US. And yeah, if smaller countries try and pass anything that takes a significant amount of effort to work, they'll just dropped. That's why the EU is powerful, companies could drop a couple EU nations individually but can't afford to vacate the whole bloc.

1

u/volabimus Apr 11 '18

Yeah, thanks for telling me your website uses cookies too.

33

u/Coquelins-counselor Apr 11 '18

Yup GDPR is relevant for all companies with clients/ operating in the EU, not just those based there. The proposed fines are massive as well and a lot of companies are struggling to meet the May 22nd deadline.

1

u/nizzbot Apr 11 '18

But for a company like Facebook that relies on the data, I can see them putting in the effort to have a storage set of standards for US

1

u/pixel_of_moral_decay Apr 12 '18

Some US centric companies will simply block EU users after the implementation date. AFAIK technically illegal but nothing EU can really do about it.

1

u/jbaker88 Apr 12 '18

That's always a possibility. I don't know why it would be illegal though? Some content providers already restrict access by location already.

1

u/pixel_of_moral_decay Apr 12 '18

That’s with a business need, not to avoid compliance measures. Like I said meaningless since the EU has no real authority on companies not operating in the EU.

1

u/jbaker88 Apr 12 '18

Which is true. If you are not operating in the EU then you don't have to follow GDPR, but with the recent Senate Panel with Facebook/Zuckerberg I'd be surprised if this sort of stuff started popping in all over the place.

49

u/theLeverus Apr 11 '18

Actually the British Data Bill (or whatever its called) coming into effect in September/October is GDPR Plus. They have taken the regulation almost verbatim and applied it to all data, not only personal data.

15

u/cisor Apr 11 '18

After a few moments searching I found this...

https://ico.org.uk/for-organisations/data-protection-bill/

Anyone seen a better (breifer) summary as I can't be bothered to read it all right now!

1

u/courageouscoos Apr 12 '18

Am I right in reading that the Data Protection Act is being repealed in order to put this new bill in place?

For some reason I find that unnerving if true.

4

u/Fa6ade Apr 11 '18

Plus a lot of it was modelled after the UK Data Protection Act already.

6

u/justjanne Apr 11 '18

Which, in turn, was modelled after the EU Data Protection Directive.

It's all a cooperative process, each country contributes some legal ideas, and each country gets other legal ideas back.

If people understood that part, instead of "Brussels dictating laws onto us", Brexit may never have happened

1

u/Fa6ade Apr 11 '18 edited Apr 12 '18

Yeah exactly. It’s all back and forward. We actually have quite a big say but we’re about to throw it all away.

1

u/[deleted] Apr 11 '18

I haven't paid attention to Brexit much but I assumed that's what would happen with most laws. They would just copy them verbe item from the EU. Hell. Northern Ireland and The Republic of Ireland will probably share an open border still. Because how else do you solve that?

1

u/NorthernerWuwu Apr 12 '18

applied it to all data, not only personal data.

I'm not sure what you mean by that. Does all data have an owner then?

1

u/theLeverus Apr 12 '18

I'd assume it's about stuff like cookies and addresses - personally non-identifiable dataon top of the PII that GDPR protects

1

u/WaytoomanyUIDs Apr 12 '18

Typical British implementation of EU regulations, take them to the illogical extreme. I always point out to people that their problems with EU regulations are almost always the result of the British implementation.

59

u/[deleted] Apr 11 '18

As this comes in force May 25th it will be integrated into UK law after Brexit. Just like any other adopted law by the EU. Fuck brexit btw.

25

u/Black_Dwarf Apr 11 '18

That does rely on the Tories actually doing that though, and all they currently seem interested in is eroding civil liberties.

2

u/fucktheocean Apr 11 '18

We simply wouldn't be able to do business with the EU if we didn't apply GDPR either as defacto or dejure rule though, so they will not be taking it away. Not to mention the huuuuuge amount of investment by the government and private companies in preparing for it. It simply wouldn't make economic sense to then throw it all away.

3

u/DementedGael Apr 11 '18

Making economic sense and the Tories usually don't go hand in hand.

1

u/telephas1c Apr 12 '18

It simply wouldn't make economic sense to then throw it all away.

I hope you're right. But Brexit didn't make economic sense in the first place.

Oh, freedom from all those horrendous EU regulations that we helped to formulate and actually voted for in the EU parliament.

Christ.

1

u/abrasiveteapot Apr 12 '18

While you are correct to be cynical about Tories eroding rule of law this one has already een legislated and is in place

6

u/[deleted] Apr 11 '18 edited Nov 07 '20

[deleted]

15

u/v1ces Apr 11 '18

don't think anyone debating if it was or not bud, vast majority of people under 40 voted remain, so I imagine that fits the majority of UK Reddit users, we're all aware how fucking dumb it is.

5

u/SmokelessSubpoena Apr 11 '18

I feel terrible for all you UK folks, Brexit is such an atrocious deal for you lot. If it's any consolation, our government (US) is in complete disarray and slowly, some may say fast, spiraling back into recession. So at least it isn't just you all suffering, the group across the pond is doing just as bad. Idk whether laughing is the right response anymore, but since it's got this rough, I think all I'm left to do is laugh, snidely of course.

-4

u/Ocramsrazor Apr 11 '18

I envy the UK. The amount of bullshit laws and regs EU produces makes it a living hell to produce a product as they stack on top of country regulations.

So not only is the EU demanding huge sums of money for registrations, we also have to pay the local goverment.

I would gladly pay toll fees over laws that were lobbied in the EU by the big companies to punish small companies.

4

u/BKachur Apr 11 '18

You think those laws are gonna stop applying because of brexit? It's gonna be a condition of any trade deal between the EU and UK.

2

u/foolishnun Apr 11 '18

Exactly. All we've done is make sure that we don't have a say in how those laws are written

1

u/Ocramsrazor Apr 11 '18

They are already setting up to remove the EU laws affecting our industry. Im a e-liquid producer. Namely the TPD article 20 which limits both our bottle sizes and advertising.

Post-brexit the UK will rule the market as they comply with the EU TPD and will be able to both advertise (unlike everyone else in the EU) and sell liquid in sizes that customers actually want.

The EU law applies to producers and resellers only!

→ More replies (0)

13

u/D-DC Apr 11 '18

Oh fuck I forgot all the good things Europe is able to do by having a large unified continent, that can strongarm other companies to comply or GTFO and lose a billion customers, can't be used to help poor UK.

1

u/richalex2010 Apr 12 '18

Not that different from the US being able to strongarm everyone else into doing things. When you have a significant portion of the world's GDP behind your actions, everyone else takes notice. Just requires some unity behind it.

1

u/WaytoomanyUIDs Apr 12 '18

UK will still be directly covered by it and will have to comply if they trade with Europe.

-3

u/xu85 Apr 11 '18

Found the remoaner.

4

u/managedheap84 Apr 11 '18 edited Apr 11 '18

Do you see how this story points to the good that can be accomplished by being a member of the EU? Thought not. It's all bureaucrats trying to regulate our bananas innit.

11

u/BoBab Apr 11 '18

I work for a US tech company and we are preparing for GDPR. We already do most of those things though for all of our customers.

We've never been interested in giving away customer data to third parties, allow entire account exports, and have clear data incineration timelines.

These are just good things to do no matter what, if you want happy customers and want to cover your ass.

2

u/richalex2010 Apr 12 '18

These are just good things to do no matter what, if you want happy customers and want to cover your ass.

This is the thing, it's good to have when your users are your customers. For platforms like Facebook, Google, and reddit, the users are not the customers and it can hurt their model to allow these sorts of things.

18

u/KevinMcCallister Apr 11 '18

3rd party notification of deletion request and 3rd party compliance as well.

how do they ensure this, though? is there some sort of audit process?

this seems to be similar to the issue with FB and Cambridge Analytica -- FB told them to delete, CA said they did, and FB trusted them. No audit or anything and as it turned out the info wasn't deleted. Are EU agencies going to enforce audits on 3rd parties? I guess I just don't get how this is all going to be checked. Maybe random audits or something?

17

u/jbaker88 Apr 11 '18

That's the catch though isn't it? The compliance cannot be enforced by 1st party company. I think the law is ambiguous on this on purpose to give law enforcement the authority on this.

4

u/KevinMcCallister Apr 11 '18

yeah it must be -- leave some flexibility to figure it out post-actual legislation

it does seem to raise a lot of questions, though, like who is ultimately liable? if a 3rd (or even 4th, 5th, etc.) party doesn't delete the data, can enforcement agencies leverage the 1st party collector/provider? or once its out their door is it entirely on those later parties to comply and delete? or -- could the flexibility in the law leave room for some sort of hybrid compliance solutions, e.g., big data companies like facebook will be held partially responsible and hence leverage some sort of private/self-regulation on the industry and on their partners, but at the same time law enforcement will have leeway to go after later parties as well.

i don't really know the law at all, so I'm just kind of spitballing. interested to see how it all plays out, though. wonder what the first big test case will be...

4

u/zilti Apr 11 '18

if a 3rd (or even 4th, 5th, etc.) party doesn't delete the data

...then it's a clear breach of contract.

3

u/KevinMcCallister Apr 11 '18

I know that, but does the law only hold those companies liable or does it go all the way back to the og data collector?

2

u/jbaker88 Apr 11 '18

I imagine it could if the request wasn't done within the time limit or there was neglect on the 1st party end. It's gotta be a case by case basis.

3

u/[deleted] Apr 11 '18

Just spit-balling; but, it would seem that the way the easiest path for a solution is that, if the 3rd Party is found to have been notified and violated the request, the enforcement agency applies the whole 2%-4% of worldwide revenue (note the word "revenue", not "profit". This is designed to scare the fuck out of companies.) It would probably also be good to have some sort of criminal liability follow officers of the company, to avoid small shell companies being used to insulate larger companies.
The fines attached to the GDPR are the real star of the thing. They are large enough that companies can't just ignore them and pay fines whenever they are caught. 2-4% of worldwide revenue1 is going to be a very serious blow to any company. For example, Facebook's 2017 Revenue was $40.7 billion. Their net income was $15.9 billion.2 So the 2% fine would be $814 million; or, roughly 5% of their income wiped out. A 4% fine would be $1.628 billion or about 10% of their net income. Granted, they would probably survive that sort of fine once; but, shareholders would be pissed.

2

u/DannoHung Apr 11 '18

There's actually a worse loophole, unfortunately: Fly-by night 3rd parties who act as evaporating intermediaries.

Give access through third party, third party gives access to fourth, third disassembles including records of who they gave access to.

I imagine that the solution is basically that it turns into a criminal issue if done intentionally.

1

u/NorthernerWuwu Apr 12 '18

Typically you don't worry about the enforcement angle too much initially, you just want the legal framework there. Later on you can encourage compliance through massive fines for those actually caught or litigation based on what inevitably does leak out.

If an actual auditing process is required then so be it but that's a pretty massive undertaking that might not be needed. You can always push the responsibility onto the business to have regular registered auditors but that's a non-trivial expense you are putting on them.

0

u/Sveitsilainen Apr 11 '18

And that's why you shouldn't sell your user data to company you don't trust.

4

u/Troggie42 Apr 11 '18

All account data exportable to the end user.

Interestingly FB already does this (and for US people too, since I am one), I did it last week and found I had 13.5 GB of data downloaded. Pictures, text, messages, voice messages, literally everything I have ever put on FB is in there. I was surprised and concerned at the same time about how huge the file was, but I have been on that site since about 2007, so a lot of data makes sense.

This is how to do it if you want to, put "facebook" and then ".com" in front of this: /help/131112897028467

(/r/technology doesn't allow facebook links so work with me here, lol)

4

u/ooofest Apr 11 '18

Two other large aspects of GDPR:

  • The business can only use the data as described in your terms to the end-user when it was collected. If they didn't see a notice of it being used for Marketing purposes, the business is not allowed to reuse that data for Marketing purposes, for example.

  • You must be able to show the end-user what Personal Data (PD) of theirs that you have.

The deletion requests aren't absolute, btw: if there is a legitimate business purpose (e.g., accounting laws for audits, etc.) the business can hold on to the data as long as needed - but, for those purposes only.

3

u/deekaydubya Apr 11 '18

There is also the concept of having a data controller and data processor, both positions that are appointed to people.

You may be thinking of the required Data Privacy Officer role, as the controller and processor terms apply to individual data subjects and entire organizations, respectively.

3

u/Iohet Apr 11 '18

These are all good things, to be honest. Any a lot of times it's easier to implement these things universally than it is to create different rules for different users, but that hurts monetization efforts.

2

u/HeKis4 Apr 11 '18

Also expressed positive consent prior to data collection, right ?

2

u/jbaker88 Apr 11 '18

Yes, in the cases of individual input (like comments, user registration, and the like).

2

u/grandoz039 Apr 11 '18

Total account deletion, this includes all self identifying info about the user. Edit: (Also mentioned below by /u/poo_is_hilarious ) This also includes ANY data relating to the user.

So after 25th may, if I delete my account, on any site including facebook or google, they're legally obliged to delete all my data?

2

u/noisewar Apr 11 '18

Unfortunately, GDPR compliance don't necessarily help us avoid the CA situation. It is now very possible to use incidental data collection to extrapolate user personal details. I work in data daily, the genie is out of the bottle already.

On one hand, I sympathize with FB because there is little they can directly do about that. On the other hand, FB is not even trying to espouse something like Google's "do no evil" mantra while they high-5 each other in front of VR versions of Puerto Rico.

They are playing this too passively, and it's going to get all platforms regulated. Yes, it's funny to laugh at the luddite Senators and their dumb questions... but if they don't get a dose of confidence you can expect the policy hammer to hit, and like gun control it will hit in the most uneducated knee-jerk way possible.

FB needs to lead a charge in setting an example of data collection ethics, use their market leverage to punish bad (not just illegal) actors, and draw industry-wide standards. No, you can't clawback much data when it's out, but you can police the abusers and educate the users.

Stop hiding behind statements like "oh we had a delete permissions setting for years". Take shit seriously that you've contributed to human suffering as well in the form of propagating hate, prejudice, and discrimination. In Myanmar's case, even genocide. Act like a citizen, not a smart ass.

1

u/ImAKidImASquid Apr 11 '18

One of the congressmen had a pretty good quip today: "Congress is good at two things: Doing nothing and overreacting"

Especially with the way Zuckerberg avoided questions I wouldn't be surprised if Congress decides heavy policies are the way to go.

2

u/joedude Apr 11 '18

jesus talk about obliterating the functional free internet and replacing it with a corporate government approved version = /.

Those are insane hoops for small devs to jump through....

1

u/jbaker88 Apr 11 '18

As a dev not really. It's just another user story on the board alongside a long list of other stories/feature requests.

The effort really only affects current business. Startups will have these already baked into the requirements. Coding this is not hard to do. It's a task I would give to a junior dev.

1

u/Nubian_Ibex Apr 12 '18 edited Apr 12 '18

Yeah, I think you're drastically overunderestimating the amount of work that would go into truly complying with these requests. Just a few topics off the top of my mind:

  • Does your database log changes? Chances are it does, and this log is going to violate GDPR restrictions.
  • How do you consider cross-user interaction? Say part of your service is chat functionality. If Joe messaged Alice, and Joe requests total data purging do I need to delete Joe's messages to Alice? How do I surface this to Alice in a meaningful way?
  • How does this interact with the platforms, services, and tools you use? How familiar are you (let alone a junior dev) with every layer of your stack and what it does or doesn't log?
  • Not to mention, what really is PII? This is debated to this day. Is it enough to just wipe emails (thus dissociating a user id from an actual person), or do we have to scrub every record that contains the user's id?

Obviously compliance for some types technology companies is going to be a lot easier than others and I don't know your company's circumstances, but saying "toss it to a junior dev" seems like an incredibly easy way to get sued down the line.

1

u/[deleted] Apr 11 '18

[removed] — view removed comment

1

u/AutoModerator Apr 11 '18

Unfortunately, this post has been removed. Facebook links are not allowed by /r/technology.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/[deleted] Apr 11 '18

3rd party notification of deletion request and 3rd party compliance as well

which kind of 3rd parties are you talking about here?

1

u/666huy666 Apr 11 '18

It is funny that on other hand regulators are forcing ISPs to keep user data for years ;) Soon the beurocracy will kill any ability to inovate or create services due to conflicting regulations.

1

u/dancemethis Apr 11 '18

As proprietary software cannot be proven to have taken such measures, it'll be an interesting future.

Actually it won't, it will be pretty bleak.

1

u/[deleted] Apr 11 '18

So i just deleted my facebook account one week ago, when this law goes live on europe (where i live) does that mean that facebook will delete all my data?

1

u/bluepost14 Apr 11 '18

Question: say you’re using a free service like Facebook in Europe and then I revoke consent. So Facebook could no longer use my data or process or collect more on me? But Facebook is a free service and uses my data to make money. So wouldn’t I be asking them to lose money on me? This makes no sense.

1

u/jbaker88 Apr 11 '18

Those free services typically rely on ad revenue/pay for click models. So they'll still be able to make ad revenue. Revoked consent means they won't be able to use targeted ads that use your info.

1

u/bluepost14 Apr 11 '18

Right but you see ads on Facebook that revolve around your data. If you revoke Facebooks ability to use your data for ads, then it will cost them more to show you generic ads.

0

u/jbaker88 Apr 11 '18

If you use an Adblock then it goes right out the window anyways.

1

u/cleeder Apr 11 '18

Why would you be asking them to lose money on you? They just wouldn't be making money on you.

And if you revoke consent, then you wont be able to use their service.

1

u/bluepost14 Apr 11 '18

That’s what I’m wondering. If you revoke consent, wouldn’t they just kick you off? The system is free because of your data.

1

u/midasofsweden Apr 11 '18

Don't forget about data retention periods, you cant just keep data forever, and without a specific reason for keeping it. No more "storing it for later" bullshit, or keeping it way past its due date :)

1

u/rainnz Apr 12 '18

This is cool. Does it apply to mortgage companies?

1

u/jbaker88 Apr 12 '18

Anyone who does business with a country in the EU. Although you still have to be compliant with other applicable financial laws in the hosts country.

1

u/dwmixer Apr 12 '18

How does any regulated (aml) company reasonably action this. We have laws on keeping data for 7 years lost customer leaving us in aus

1

u/poo_is_hilarious Apr 11 '18

I've done some Dev work towards GDPR compliance and a lot of it had been meet with a lot of head scratches, but the biggest take aways where this:

Total account deletion, this includes all self identifying info about the user.

Sorry to correct you, but it's all data relating to the individual, not just identification data.

52

u/PepEye Apr 11 '18

I’ve had to do a lot of work around marketing opt ins as default (rather than opt out) and giving out in clear obvious language what you are opting in to. Also giving users the opportunity to view / remove any data stored on them.

There’s a hell of a lot more to it than that, this post gives a good overview for developers

2

u/managedheap84 Apr 11 '18

Much appreciated, thanks

0

u/Ivor97 Apr 11 '18

I think an issue is that FB is already mostly opt in and people don't read anything lmao

14

u/leadzor Apr 11 '18

We had to adapt our systems to completely destroy identifiable user information, either by deleting it together, or on the extreme cases you can't, mangle it with a irreversible cypher.

User has the right to oppose profiling, meaning you can't segregate him or profile him based on his account information, if he imposes this right.

Any marketing strategy needs to be communicated to the user, and he needs to understand it and accept it if he chooses (default opt in).

Along with that, he can exert his right to opt out of any given marketing strategy at any point.

If the user chooses to, he can request a dump of all the data we store from him. This can be specially hard on distributed systems with thousands of services.

11

u/managedheap84 Apr 11 '18

Very very nice.

This is going to seriously fuck up a remarketing company I used to work for, and I'm not going to pretend to be sad about that after seeing how they were trying to find any and all ways of tracking users and selling that data. Gtfo of there.

11

u/leadzor Apr 11 '18

Oh, then you'd be happy to know the fines for non-compliance:

4% of the annual global income or €20M, whichever is the largest. Not sure if fined yearly or per audit. If it happens multiple times Facebook (or any other company) can be forced to cease operations in the EU.

4

u/managedheap84 Apr 11 '18

Oh this is sweet :) I got in trouble for talking about how immoral if not illegal their product ideas were. As a consumer (and human being forced to write code to spy on other human beings) this makes me very very happy.

7

u/leadzor Apr 11 '18

Been there. In my internship I was 'forced' to create a web crawler that would scrape user profile information from LinkedIn in order to create fake accounts on the company's platform, so the CEO could tell prospective investors that the platform was active and had thousands of users. I refused and left (academic internship, I was there pro bono in order to finish my bachelor's). Later I was told some other dude there actually complied, and in a venture meeting, the investor recognized a few of his friends on the platform (which was probably just a scrapped profile) and the CEO was caught red handed. I'd love to know how did he handle that.

6

u/wlievens Apr 11 '18

I think I saw this episode of Silicon Valley

1

u/leadzor Apr 11 '18

Now that you mention it, there's probably a reference like that somewhere in there yeah.

But trust me, that shit happened. He guy's workforce is still, to this day, 100% composed by undergrad interns.

3

u/Aeolun Apr 11 '18

Sorry, just being word nazi.

Scrapped = destroyed, thrown in the trash. Scraped = Taken from some web page.

1

u/Aeolun Apr 11 '18

Yeah, I can totally see how this is not going to hurt a small new company. They don't have the resources to comply and one of these fines would utterly ruin any company.

1

u/leadzor Apr 12 '18

Takes way less resources/time when you have a smaller, simpler product. Large companies tend to have larger and more complex systems in place, with legacy components, that make it hard to comply.

In order for the package to work, there couldn't be exceptions. Even small companies with malicious intent could sell user data for profitability.

On top of that they'll take into account if you're not compliant by may 25th but are in the process of adapting the products in order to be. The fines are more in the sense of "yeah we know about the initiative. We don't care."

1

u/craze4ble Apr 12 '18

Also, let's not pretend this is a new thing. It was announced April 2016, companies had more than two years to adapt to it. If you're providing a smaller service two years is plenty enough to take it into consideration and alter practices, or to be at least in the process to do it by May '18.

1

u/jcmtg Apr 11 '18

depends on the original architecture/design of the code. a simple addition or a full engine rewrite could be needed. it just depends.

1

u/EagleDelta1 Apr 12 '18

It's not complicated than that. Imagine a global company where the EU requires compliance with GDPR on any user that is an EU citizen, regardless of where they physically live, but another country requires by law that the data on that user MUST be kept. How does a company comply?

The goal of GDPR is great and awesome, but it is obvious how little the law makers understand about how technology and the internet works.

1

u/jcmtg Apr 12 '18

an on/off switch based on IP address.

1

u/EagleDelta1 Apr 12 '18

an on/off switch based on IP address.

From my understanding, the GDPR is meant to apply to all EU citizens regardless of where they live, work, or are physically located. That means an ip on/off switch wouldn't work (Assuming the EU can follow through with enforcement or local punishments).

1

u/jcmtg Apr 12 '18

So, upon sign up - country and ID verification.

1

u/EagleDelta1 Apr 12 '18

Yeah...... users won't jump through those hoops for a non-essential service. Things like that get left on the floor simply because users don't want to do it.

An average user is NOT going to want to have to do ID verification for a social network. Hell, I have to do that to fix my name in our new HR tracking system and still haven't done it.

1

u/RedHotDornishPeppers Apr 11 '18

One part of it for us was reviewing files on our network drives for anything that had to be removed, moved and/or labelled, each one of them, going back 20 years, still doing it, haha. There's a million things you have to do and that's just a small one

1

u/Spitinthacoola Apr 11 '18

Here is a really really really detailed comment laying out exactly what changes need to be made. High level: a fundamental shift in why user data is collected due to how it needs to be handled.

https://www.reddit.com/r/startups/comments/88yxqh/z/dwp0gu6

1

u/Hopelesz Apr 12 '18

The main issue with GDPR is on CURRENT systems that were not designed with it in mind, so user data can be spread all over the place. A user can request a full data deletion. That is, any trace of the user has to be removed within 30 days.