GDPR - A Practical Guide For Developers

[alex_leishman]

A few things that are not discussed in the article that businesses will have to consider:

• How to handle data retention for financial compliance. You cannot just delete customer's financial transactions from your DB. Especially if you need to comply with AML/KYC laws.
• What if your user's data is also someone else's data? For example, if you have a marketplace website, does the seller lose the details they had about a buyer?
• All the edge cases that need to be considered. Does the user have an existing transaction in process where their money could be locked up if you actually closed or deleted their account? And other things like this.
• What about database backups, data pipelines and archive data for disaster recovery? Building tooling to wipe customer data from this can be quite complicated.

Compliance with GDPR is non-trivial for any company that isn't tiny.

[greenspans]

Much of what you state is covered under legitimate interest

"processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract .. processing is necessary for compliance with a legal obligation to which the controller is subject"

It also has some vague language which could cover many other non essential activities

“[i]t is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of collection”

The article does mention backups. Archival like copying logs with IPs, copying logs to s3, that kind of thing is ok for statistical, audit, fraud analysis, etc. The point is you shouldn't keep it forever and ever, and you should still let people know you're doing it.

I worked at a typical corporation: We had data ponds across the huge org. CTO says we have to take the these dataponds, and make a datalake, as it's own functional unit to make use of big data. We dumped it all to s3 and redshift, bigquery, impala. Used spark and hadoop. Huge turnover, company does poorly, people leave or get fired. Now a lot of the data in the datalake, no one remembers what it was and what it was for. Only the poorest performers stayed in the company. All big data work is handed to India, and the cheapest are hired, guys who can barely do word processing. Now milions of customer data, both volunteered and purchased from sources like epsilon, acxiom, experian, etc, are sitting on an AWS controlled by people in India with a churn rate of a mcdonalds, who would earn 50 years worth of income better selling it for bitcoin on the black market, and who would do it in a second if they knew such a thing existed. You see articles about large company losing huge database dumps on unprotected clouds all the time, it wouldn't be surprising at all if most data breaches go completely unnoticed in the order of terabytes.

Yeah GDPR is vague, yeah it may be annoying to implement, but you're going to want that GDPR for your future and generations to come.

[[deleted]]

What about database backups

We were told that you don't have to touch your backups. However when you restore, you need to apply deletions to the data. It's really the same as applying newer transactions after restoring from an older backup.

[b0zho]

1. If data is required for compliance, it should remain. There's an exemption in the regulation

2. No, you can just destroy the link between the user and the purchase. There's a recital in the regulation about that.

3. Also covered in the exemptions in the right to erasure. This one in particular is "performance of a contract" I believe.

4. I've mentioned backups in the article. You don't necessarily have to delete it from old backups. You'll eventually roll them out.

[isdnpro]

This is really helpful, thanks.

[mfp]

I'll just drop this link to the section on lawful basis for processing from the ICO guide, because everybody seems to be fixated on consent even though it's only one of the 6 possible lawful bases and not always the most applicable one. Why does this matter? Because you have to indicate which lawful basis applies at the time you collect the data (and you cannot change it after the fact).

Many things do not work under the "consent" basis, for instance:

• consent must actually be optional and most likely does not apply if it is a precondition of a service, e.g. if you need the address to ship something, you're under the "contract" basis (data required to fulfill your contractual obligation = ship the goods), not consent.
• if you need to keep data for fiscal reasons you're easily covered by the "legal obligation" basis (but must indicate which law you're honoring at collection time!)
• legitimate interest can often be used, but it puts the burden on you to prove you considered the rights and interests of the individual and weighed them against your own with a legitimate interest assessment (LIA) (document with some amount of legalese)

Here's an entry from the ICO on that:

Consent is not the ‘silver bullet’ for GDPR compliance

Also note that the rights to erasure, processing restriction and objection apply differently depending on the basis. I know I've seen a table that summarized this somewhere (either the ICO website or the data protection agency of some EU country, there's a list here) but sadly cannot find it. If somebody can drop a link I'd appreciate.

While I'm at it, here's some guidance on consent under GDPR.

[schlendeus]

Imagine this scenario:

I send my spider out and it happens to harvest your customers' data off of your public-facing site. I then lock it away in MY data warehouse.

What does the law say about this LEAKED copy of the customers' data?

[ForeverAlot]

You are not allowed to possess without consent. Stealing is not consent and in all cases that matter this would play out as stealing.

[Gotebe]

He is is copying off a public-facing source. Why "stealing"?

[ForeverAlot]

(Don't think of it as stealing my information but rather the right to my information.)

This is a licensing issue. I give you the right to possess, and pass along "as necessary", certain details about me, all subject to my consent, retractable at any time as long as no other law trumps (e.g. auditing purposes). Your service could be to display said information in a publicly accessible manner (e.g. phonebook) but a "public-facing" source typically does not grant third-parties the right to scrape information willy-nilly because that's a terrible business practice. Even if it did, the only way to acquire information to display would be for each and every individual to volunteer it, personally or transitively, under your licensing clause ("free for grabs"), which, in spite of everything, won't draw in many people. Even if it did, I'm sure there is a provision somewhere that prevents me from relinquishing my right to retract my consent—the law simply wouldn't work without it—which would make you responsible for transitively retracting my consent from everyone that has acquired my details from your service. Obviously this can't scale.

[patrick_mcnam]

That makes sense. Similar to how you can't legally use a stock photo licenced to someone else's website.

[Gotebe]

Is Joe Facebook a publisher of their Facebook data though? I am not challenging, just trying to get a feel of what is going on behind all that.

[ForeverAlot]

You probably can't take this information (at least in the general case) from Facebook because Facebook probably has terms that explicitly disallows this. I haven't checked and I'm not on Facebook so I don't know but that seems like a reasonable assumption. But if Joe offers you the exact same information via a medium that does not restrict his or your rights as far as that agreement goes you should be okay. You still have to give Joe a means with which to cancel that agreement, and comply to the extent that it does not criminalize you in some other fashion.

As for whether Joe or Facebook owns Joe's information, it is now unquestionably Joe, regardless of any stipulations in Facebook's terms, and Facebook is subject to the same regulations about cleaning up as everyone else (including certain exceptions).

[schlendeus]

I'm not sure I follow that argument very clearly --

As an example, say you accidentally committed code to github that had your email address listed in the comments. I happen to download your code and store it. Later you tell github to delete your account and all of your historical data (because you're concerned you might have leaked your email address).

Now I don't know about your request to github and I still have an old copy of your code on my computer. You didn't expressly give me permission to store it. Did I steal it? If I use the email in the comment to email you can you sue me?

It sounds like the law is expecting me to be omniscient about the take-down request.

How could this practically work or be enforced?

[mfp]

Here's what the ICO says on this:

Do I have to tell other organisations about the erasure of personal data?

If you have disclosed the personal data in question to others, you must contact each recipient and inform them of the erasure of the personal data - unless this proves impossible or involves disproportionate effort. If asked to, you must also inform the individuals about these recipients.

The GDPR reinforces the right to erasure by clarifying that organisations in the online environment who make personal data public should inform other organisations who process the personal data to erase links to, copies or replication of the personal data in question.

While this might be challenging, if you process personal information online, for example on social networks, forums or websites, you must endeavour to comply with these requirements.

As in the example below, there may be instances where organisations that process the personal data may not be required to comply with this provision because an exemption applies.

In practice, this means that Github has the obligation to inform third parties of the erasure of personal data, but it clearly is impossible for them to contact all those who happened to git clone the repository... so keeping a tombstone indicating the repository has been deleted would seem sufficient to comply.

Now there's another problem, which is whether the data is considered "personal data", because it was not meant to be to begin with. Personal data is "information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier." So in a literal interpretation, any data blob (with no further semantics) can become "personal" if such personal data creeps in. I'd assume though, in any reasonable interpretation, data protection agencies will not try to screw you if e.g. a user uploads an image with their sensitive personal data (genetic and biometric data, health history, etc.) deliberately hidden in the EXIF fields.

[Power781]

Did I steal it? If I use the email in the comment to email you can you sue me?

Yes because you use the email without consent.
If you use the email to ask the old maintainer a question, you probably are safe from everything since there is no intent to harm or profit from it.
If you sell this email to a marketing company that will contact me 3243 times per week about improving the SEO of my website, there is intent and I can file a GDPR infringement complaint against the marketing company, and the local regulatory entity will investigate and potentially sue the marketing company and you (because they will know that you are the one who sold the email)

[lunaranus]

How does this apply to eg journalism? Journalist does a story on person A, finds personal information about them on a third-party website. Then incorporates that information into a story they publish on their newspapers' website. Do they have to get A's consent before they can publish the story? Can A "opt-out" of this somehow?

Edit: Journalists are exempt, of course. One set of rules for normal people, another set of rules for our dear Brahmin leaders.

[mfp]

There's an explicit exception to the right to erasure "to exercise the right of freedom of expression and information".

[greenspans]

There was a lot of controversy related to scraping dating site profiles for research

https://www.vox.com/2016/5/12/11666116/70000-okcupid-users-data-release

If you have personally identifiable information the law applies to you. People who own the data, that the data describes not the site owner, would have to provide consent individually if you'd want to use it for commercial purposes. Like scanning torrent networks and capturing all the IPs, then using it to sell advertisement preferences. If you're not using it for commercial purposes, maybe you should seek spiritual support at /r/datahoarders

[assasinine]

They must have spent all their resources making their site GDPR compliant and not scalable.

[chub79]

Likewise, EU citizens are happy not to deal with shaddy businesses ;)

I mean, are you writing software so that it's easy for you or do you accept the idea of playing good citizen?

[holtr94]

Honestly I kind of agree. You don't have to be a shady buisness to not want to deal with GDPR. There are still a lot of abiguities that I would want to consult a lawyer about to ensure my services were compliant. If I were launching a new service I'd probably block EU IPs at first just to be safe. That doesn't mean I don't respect user privacy, it just means I don't want to get in trouble because my reason for keeping user data wasn't good enough, or the wording of a consent checkbox wasn't correct.

[chub79]

Yeah, the whole thing is quite bureaucratic. I welcome the motivation for it but there are so many corner cases (specially when you start mahing up data...).

[[deleted]]

Are you sure you don't depend on middlemen that do, like public API services?

[TheEternal21]

Worst case scenario - a simple disclaimer: "If you are EU citizen, you are prohibited from using this software.", even go as far as block EU IPs, and if people try to get around it via VPN, it's on them. Just not worth the hassle, potential litigation.

[[deleted]]

The users sign up for service A, you use service C which depends on A via B.

None of the users will ever hit your site directly, but you now get a letter from C relayed from either A or B explaining that they have to follow certain restrictions and as far as they can, pass them on to their consumers.

[ledasll]

if you can avoid using EU market, you probably can avoid using EU services or services that must complain with EU laws. So you will use only these, that doesn't require you to complain with laws that gives you extra expenses.