[Enronitis]

I think it's about the principle, the law is something that the world is looking at, the world will probably want it after they see the quality it brings but companies are skeptical because of the work it forces you to do and to what cost. As you maybe noticed people are skeptical because they think it doesn't bring "that" much to the table so why bother. Or at least i guess.

---

Even if it is like you say "No one is techically fully compliant" which maybe is true to a degree but the main part is that people should reach/strive for the quality.

I think for the most part, businesses and business owners ARE-
But the issue is some of the items are very vague to the extent we don't know if we are actually compliant or if we are moments away from receiving a crippling penalty.

[overlude]

You have full control by not joining.  I stopped using my Facebook accounts a very long time ago.  I am careful about sites I join and if I am worried about abuse of the information I give them then I don't join.

That's exactly what the GDPR addresses. As you understand, a lot of your (active) userbase involves kids. A lot are adults, but an alarming number will be < 18 I imagine, a majority < 21. This is a young age. The GDPR classes < 18s as vulnerable individuals, and they are. They have no clue what they're consenting to, or the importance of their data. I'm not sure I can say I did, and you perhaps can't say so either (ofc I can't comment on your behalf).

The people charging back on you may well be 13-17 years old. They don't know what they're doing, they perhaps don't see it as scamming, and in general they sure don't know what can happen to people on this site that "piss off" certain types. A policy of putting addresses in signatures puts them at risk. That, in my opinion, would be the most concerning policy of yours. They'll have other digital footprints anyway, any motivated individual can find them if they want, but my point is that these kids aren't always competent enough to engage on this site.

Even as adults, it's hard to know what you're getting into. A key aim of the GDPR is to make privacy polices more verbose, so individuals signing up better know what they're getting into, and can not sign up if some of this info concerns them.

Even then, they can mess up and I don't think it's fair to have that looming over their heads forever. The previous data protection acts already had (rather absolute) rights to erasure if processing caused "significant duress". Generally speaking, I don't think a data controller should be processing information they have no reason to process other than for the sake of it.

You, yourself, realise now you don't want your data on Facebook (and you're in a rather unique position to care more about your privacy, I'd guess), others may take longer to realise that, perhaps not until after they've consented to processing. Also, sometimes we can't control who we have to give our data to. We may strictly speaking have the right to not use a service, but we're effectively blackmailed into using such service. An example is centralised application services for universities. We may not want them to process our data, but if an individual wants to get into X university they're effectively forced into it. Same goes for CRAs etc...

I assume you don't own a business or at least one that has to comply with GDPR.

I reside in Europe, and do run a business that needs to comply with the GDPR, processing more personal information than Hack Forums (based off what you've said). I also freelance for businesses processing sensitive information. My opinions of the GDPR are more following my personal opinions on individual rights to privacy.

The GDPR is stretched out of context. The rights offered are not absolute rights, and delving deeper into the legislation shows that. Before the GDPR, I've adhered to providing the same protections to users I would expect myself (and I expect a fair bit), so the main changes for me personally were mainly privacy policy changes to be more transparent. Complying with the GDPR is not a burden. If you look at headlines like "right to erasure" it may sound like it, but delving deeper you realise the GDPR is not there to make your life harder, it's there to make it harder for businesses that couldn't care less about personal (and perhaps sensitive) information about their users. That's wrong, with or without GDPR.

I have no problem with the additional burdens though. I went out of my way to do a fair bit of it regardless, and to me my customers having sufficient faith in my respect for their privacy is more important than some additional hours I 'waste' into ensuring those protections. I don't think any of them care tbh., but I would in their shoes so it's worth my time for me. I'm aware not all business owners feel this, though. None of my freelance clients share the same view and all of them viewed it as a burden. Some possess very sensitive information, so I find it very concerning that they don't view the GDPR as an opportunity. Perhaps I'm just the naive one here, though, since clearly nobody else views it in the ways I do.

There is a number of things written into GDPR which requires a lot of work on the part of businesses. Just trying to understand the full scope of this huge law and how it applies to your business is a vast undertaking. I am easily 50+ hours into my own research and implementation trying to be compliant.  And I bet another 20-50 hours gets logged before this is done. I'm one small site, so imagine your a multinational corporation with thousands of employees.  They not only have to comply but if they don't they do risk facing the $20 million fine for each violation.  

It's an easy law to understand but a difficult one to implement, admittedly. It's clear in the rights it wants to give and its purpose, as if it were a manifesto, but it isn't concrete in how businesses should reasonably implement these rights. That's the same for most EU legislation tbh, future legislation looks worse.

It's actually easier for the multinational corps imo, they have access to large consultancy firms that have interpreted the hell out of this for years. For places like Google they just had to deploy new privacy policies. Their operations haven't changed much from what I can tell. They (presumably) just found better ways to process data and have used the entire 2 year transition window for this.

Even then, even the data protection authorities aren't fully sure on the GDPR. There are inconsistencies in enforcement across the EU. The UK DPA says one thing, the Finnish one says another, and it's the DPAs that do enforcement in the first instance. The EU made this regulation up and forced it down on the member states to enforce, so it's not really the most centralised piece of legislation. The issue is that a complaint can be filed in any EU member state, so I'm not sure how jurisdiction works here when they themselves aren't 100% here.

---

I am listening to feedback and doing my absolute best to quote the actual law when I do interpret.  I don't want to quote articles about the law or posts from the web.  I prefer to read the law myself and use the words in it to justify my own policy.  That's the only way imho we can be compliant.

The current agreement will likely be changed and updated and definitely the Help Doc will get completely rewritten too.  Oh, we'll also be adding that little cookie popup thing soon too.  More annoying crap.

I probably have read more about this law then a US lawyer.  Also, I don't intend to keep addresses.  I may have to go into some archive folders and just delete all my very old backups.  I still have site files from 10 years ago, which I'm willing to bet most webmasters do that.  You run backups, drop into folder, and forget it.  No one puts an expiration date on files to self-delete.

Agreed. You're the best person to understand your operations. It's hard to explain tech sites to traditional lawyers/firms (in my experience anyway). It's more just a case of checking your interpretations are valid and justifiable. At the end of the day, the people that would review violations think similar to the traditional firms providing consultancy. The EU is clearly out of the loop in tech, as evident by their copyright regulations they're cooking up. Some interpretations you find valid may not be is all, I ran my logic by someone as well and found some flaws, helps to have someone "experienced" check (although, they tend to hint that they're uncertain).

BTW, you may be able to keep those backups. The GDPR (and previous data protection acts) apply to sortable data. If you can run a search, or if data is categorised (either physically in a file and filing cabinet, or in a database) it falls under the GDPR. If it's stored in various backups over a long period I do not believe the GDPR reasonably requires you to delete or modify data from them all.

See: gdpr-info.eu/art-2-gdpr/

This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

Of course this is ironic, because you can retain all the data you want in backups and if you really want some data you can fish it out of them. Recommendations here: acronis.com/en-us/blog/posts/backups-and-gdpr-right-be-forgotten-recommendations

Seems to me like they would expect you to categorise individual data separately in backups so it's easily, widely, erasable but for prior backups they won't expect you to sort through and delete data. IANAL so YMMV.

[Silver Fang]

I think for the most part, businesses and business owners ARE-
But the issue is some of the items are very vague to the extent we don't know if we are actually compliant or if we are moments away from receiving a crippling penalty.

Ah yeah, at this point i don't think anyone would be fined. As i said earlier i think the law will be more specified with the time as it's needed to see what can be done and what should be done.

I don't think you have to worry that much at this point if you have done your best according to what the law actually states.
I'm pretty sure there is law-consultants for European companies that help to clarify the ongoing process for people.

What i also would like to know is how companies like Faceit / ESEA that have services which basically sniffing out a lot of information on what you are doing with your system how they are going to maintain their services if the GDPR law states that users are within their rights to know what information is gathered about you.
It's a direct conflict with Anti-cheats, Anti-Virus as they are there to protect you and to hide their detection strategies etc.

[overlude]

What i also would like to know is how companies like Faceit / ESEA that have services which basically sniffing out a lot of information on what you are doing with your system how they are going to maintain their services if the GDPR law states that users are within their rights to know what information is gathered about you.
It's a direct conflict with Anti-cheats, Anti-Virus as they are there to protect you and to hide their detection strategies etc.

ESEA has already seen the consequence of disobeying EU regulations despite being in the US. If you haven't noticed, they finally charge EU customers VAT now, they wrote about it on their blog a year ago. I have no doubt that they intend to fully comply with the GDPR if they haven't already. FACEIT is a UK corporation anyway, so they're under direct EU authority.

They are allowed to process data with consent or for "legitimate business interests" btw. Both reasons fit processing data for the purposes of anti-cheat behaviour. I presume they use "legitimate business interests" though, since this allows you to keep processing even if the user withdraws consent. Key note on this condition, such business interests must not override the legitimate privacy interests of the data subject.

FACEIT:

We also collect Personal Information to investigate complaints of cheating or behavior that we believe may be contrary to our T&C, including the Code of Conduct. This may include screenshots of players’ computer desktops or footage of in-game play.

ESEA:

Anti-cheat functionality in the ESEA Client. Certain information regarding your computer and software it contains is required for effective operation of our anti-cheat services. By using the ESEA Client, you consent to the collection and analysis of information from your computer that ESEA deems reasonably necessary to identify and prevent the use of cheat software, files used to gain an unfair advantage, and to enforce bans. This information collection is not strictly limited to when you are logged in to the ESEA Client. Information analyzed or collected by the ESEA Client may include hardware, network and software identifiers; running programs; system configuration information; files or data suspected of being used to cheat or gain an unfair advantage; or screenshots while you are logged in and playing a game through the ESEA Client.

This is a vague interpretation, I haven't bothered read the full policy but I presume this falls under the legitimate business interests stuff. I'd say it counts. The GDPR doesn't stop you processing data, just means you have to be more transparent about it, and only process it if you need to, or if the user allows you to (amongst some other reasons that may be more applicable for some contexts).

[Enronitis]

Ah yeah, at this point i don't think anyone would be fined. As i said earlier i think the law will be more specified with the time as it's needed to see what can be done and what should be done.

I don't think you have to worry that much at this point if you have done your best according to what the law actually states.
I'm pretty sure there is law-consultants for European companies that help to clarify the ongoing process for people.

What i also would like to know is how companies like Faceit / ESEA that have services which basically sniffing out a lot of information on what you are doing with your system how they are going to maintain their services if the GDPR law states that users are within their rights to know what information is gathered about you.
It's a direct conflict with Anti-cheats, Anti-Virus as they are there to protect you and to hide their detection strategies etc.

My company looked into talking to European firms, and a couple of them were just as knowledgeable as most American firms, if not less so in some cases.
One firm we contacted basically shrugged their shoulders verbally saying "We are still working on that"-
That's scary.

ESEA/FACEIT/ETC will need to have extremely lengthy agreement policies, and take the appropriate measures to store all that data in a secure, and easily purged format. I imagine that they will be able to mask strategies to some extent as I can't imagine user movements are permanently stored, or would ever need to be. Temporary data like that can be auto-purged, so upon request there would be nothing there anyway.

[Cyber Coder]

i am curious , if some government agency asks about an account, are you willing to share a user sensitive data with them WITHOUT any warrant ?

[lolbott]

I just got a pop up about GDPR even I logged in couple weeks ago without being prompted about this and now I see that this thread is created back in 2018:

General Data Protection Regulation (GDPR) Compliance:

You agree that you're at least 16 years old if you are a resident or citizen of the European Union. Non-EU residents agree that they are a minimum age of 13.

You agree to use a pseudonym username that does not associate to your personal information. This includes, but is not limited to, association with social media accounts, websites you own or manage, ethnicity, location, school, workplace, emails accounts or your real name.

You agree that your posts will not contain information which may expose personally identifying information.

You agree that your profile signature, avatar, and other account editable data will not contain information that will identify you.

You agree that all data you submit to our website will not identify you and that we are not obligated to remove it based on personal privacy.

You agree that you will not post information which might identify another person. This includes but is not limited to emails, social media accounts, addresses, screenshots, or real names.

You agree that all posts and content posted meets the standard for "important public interests" or "journalism" and as such will not be required to be altered or deleted.

You agree that if you participate in using our website for deals, trades, sales, and other market activity that your personal information may be stored and even exposed for the purpose preventing, investigating, detecting, and prosecution of legal responsibility and liablility in both civil and criminal law.

You agree that our storage method of your data is within reason. Personal data is retained for a period up to 7 years and is stored in a database format accessible directly only by the administrators.

You consent that Staff group members may have access to the IP address of all posts, your registration IP, and your recently used IP.

You consent that Admin group members may have access to any IP address you've used on the site, your email address, and can have read access to your private message folders.

You agree that the exposure of your IP address to Staff and Admin group members is reasonable for site function.

You consent that site backups may be kept for up to a 6 month period and done on a daily basis. The stored information is only for site backup and recovery purposes and the data is not sold or shared and is kept securely according to internet standards on cloud datacenters.

You consent that data we have stored on your account may be downloaded only once per 30 day period. This will provide you the most accurate results of what we have stored. Data exports manually done more than once per 30 days will incur a $10 fee for processing.

You agree that your account may only be self-deleted if no posts are made.

You agree that in the event of a server change the data we store may be securely moved to a new location. We agree to inform you of a data move at least 3 days prior and provide you the option to close your account beforehand.

You agree that if you are not an EU citizen or resident that you do not fall under the GDPR (General Data Protection Regulation) law. Citizens and residents of the EU may be required to prove your citizenship or residency to provide you the legal protections and rights of that law.

You agree that for our service to function correctly your IP address and browser information may be shared with our vendors such as Cloudflare.

You agree that for our email service to function correctly your IP address and email information may be shared with our email vendor Elastic Email. We agree not to sell your email.

We are not interested to know who you are. You should not reveal your real identity to members. Your participation on our forum should be done from an anonymous and privacy perspective. We agree to not share or sell your data with 3rd parties. This webpage informs all visitors of current policies and is kept current. Only those who consent and agree to site policies will be allowed site access.

Was this prompt enforced back in 2018 or in past the few weeks?

[spiral]

I just got a pop up about GDPR even I logged in couple weeks ago without being prompted about this and now I see that this thread is created back in 2018:


Was this prompt enforced back in 2018 or in past the few weeks?

I remember it being enforced last year

[Omniscient]

I just got a pop up about GDPR even I logged in couple weeks ago without being prompted about this and now I see that this thread is created back in 2018:


Was this prompt enforced back in 2018 or in past the few weeks?

It's part of policy. If you haven't logged in since this was enacted then that's why it prompted you.

[lurking]

Thank you for your continued work and public disclosure of your assessment and implementation of GDPR on HF. You provide an example for other websites, smaller forums, less experienced webmasters/owners, etc to be able to compare to.

Something that is very appreciated.