[overlude]

A few queries, Omniscient.

(btw, can't use full text editor so formatting my may suck, sorry if it makes this harder to read, error: Fatal error: Cannot redeclare custom_permission_check() in /home/hfaccount/domains/hackforums.net/public_html/inc/functions_custom.php on line 150)

------

First query:

Using your quote from the GDPR, you said: "This is in a nutshell why we're not going to just delete accounts. We have a legal obligation to retain data. There is also archival purpose and freedom of expression."

Which part of that quote are you using as justification? For archival purposes, you'd retain a right to keep posts (which you did anyway), but for other information stored (email addresses, IPs, names, addresses from payment details) the freedom of expression doesn't apply. Your quote lists all the valid reasons for processing data (beyond consent), which one is being used to continue processing this personal data (without consent)?

For clarification, you can say retaining IPs (of banned users) under the "legitimate business interests" clause is valid to enforce your one account policy. I'm just clarifying which reason for processing is used for email addresses and billing information.

-------

Second set of queries stem from your privacy policy: (hackforums.net/misc.php?action=help&hid=12) (presuming this is still the active privacy policy). -- (I cannot link to this policy, possible to allow inter-site linking for users with < 50 posts?)

1. Do you still store billing data (names, addresses) from when you processed PayPal payments, or still request this info for Bitcoin payments? It isn't mentioned there, hence I ask.

2. From your policy: "Anyone reversing payments to HF are subject to a closed account and their payment details and account information placed directly into their signature for public viewing. If you want to reverse a payment to HF then go for it but we will make sure you are named and shamed and the data will not be removed. Your payment and account details will be made public and searchable at Google. You are warned."

I'm not particularly active here (as you can tell) so I don't know if you use this name and shame policy much. This is certainly a violation of the GDPR and, in general, a bit concerning from a privacy perspective. Chargebacks suck, but this is a very dangerous policy, and often those charging back may not be using their own personal details, so the details of some person have been leaked to a community notorious for various illegal acts to persons.

Do you plan to wipe all this stuff from your privacy policy and create a GDPR compliant privacy policy in its place? Additionally, do you plan to (optionally) offer these same GDPR rights to all users across the world, not just those resident in the EU (as a show of your dedication to protecting users' privacy).

-------

This site's members have been known to be toxic towards each other in the past, specifically by doxing, swatting, etc. Of course, I don't suggest you support any of these actions, but naturally your site (as the largest hacking forum) attracts these types. Due to this, I hope you'll try your best to always ensure the highest standards of privacy. You can't babysit users, but you can hopefully set an example by showing a great level of respect for individual user privacy (as I'm sure you already do).

Thanks!

[Omniscient]

I'm just clarifying which reason for processing is used for email addresses and billing information.

We don't process billing information since moving to cryptos. Anyone can do an export to see their PII we have. It's very minimal.

Second set of queries stem from your privacy policy:

The privacy policy has to be rewritten still. Realize this is a LOT of work and indeed it's constantly changing as we realize new things and how they apply to HF.

1. Do you still store billing data (names, addresses) from when you processed PayPal payments, or still request this info for Bitcoin payments? It isn't mentioned there, hence I ask.

Yes, that data we have currently saved in archive format but is not part of the HF database. I think under GDRP that type of data doesn't necessarily have to be deleted if there is a legitimate purpose in keeping it, which we have. Note that before GDPR it was standard practice to just save data constantly, persistently, and forever. Now of course adjustments have to be made for compliance to GDPR.

I'm not particularly active here (as you can tell) so I don't know if you use this name and shame policy much.

No longer needed or used since we moved to crypto. But I'm not so sure it's against GDPR to have it anyways since it's a legal issue where I have been scammed. In any case, we no longer even require valid billing address in payments. With cryptos we process payments very differently and even more securely and privately for members with no risk to either party.

Do you plan to wipe all this stuff from your privacy policy and create a GDPR compliant privacy policy in its place?

Yes, I plan on rewriting policy to be GDPR compliant.

do you plan to (optionally) offer these same GDPR rights to all users across the world, not just those resident in the EU (as a show of your dedication to protecting users' privacy).

I intend to make one policy but some protections and options that the GDPR requires of me may not be applied to non-EU citizens.

Note that basically anyone making very serious requirements of me because of GDPR I will require them to prove their identity to me and EU citizenship. This the GDPR allows. So if you're not willing to send me your passport or national identitifation card you can forget even asking for GDPR protections.

Due to this, I hope you'll try your best to always ensure the highest standards of privacy.

It's always been a policy on HF that you were not suppose to post private member data. Exception was Deal Disputes in screenshot format only. Even that I believe is GDPR compliant consider the legal nature and public interest in knowing who a scammer is.

Overall members shouldn't worry about HF and what we do with your info. Because really we do nothing with it. It's useful to catch scammers and ban evaders and provide site safety for members. If you're a criminal and want your history erased to remove evidence then you shouldn't be asking for protections from a law, that would be ironic.

[Black Hat]

We don't process billing information since moving to cryptos.  Anyone can do an export to see their PII we have. It's very minimal.  


The privacy policy has to be rewritten still.  Realize this is a LOT of work and indeed it's constantly changing as we realize new things and how they apply to HF.


Yes, that data we have currently saved in archive format but is not part of the HF database.  I think under GDRP that type of data doesn't necessarily have to be deleted if there is a legitimate purpose in keeping it, which we have.  Note that before GDPR it was standard practice to just save data constantly, persistently, and forever.  Now of course adjustments have to be made for compliance to GDPR.  


No longer needed or used since we moved to crypto.  But I'm not so sure it's against GDPR to have it anyways since it's a legal issue where I have been scammed. In any case, we no longer even require valid billing address in payments.  With cryptos we process payments very differently and even more securely and privately for members with no risk to either party.


Yes, I plan on rewriting policy to be GDPR compliant.


I intend to make one policy but some protections and options that the GDPR requires of me may not be applied to non-EU citizens.

Note that basically anyone making very serious requirements of me because of GDPR I will require them to prove their identity to me and EU citizenship. This the GDPR allows.  So if you're not willing to send me your passport or national identitifation card you can forget even asking for GDPR protections.


It's always been a policy on HF that you were not suppose to post private member data.  Exception was Deal Disputes in screenshot format only.  Even that I believe is GDPR compliant consider the legal nature and public interest in knowing who a scammer is.  

Overall members shouldn't worry about HF and what we do with your info.  Because really we do nothing with it.  It's useful to catch scammers and ban evaders and provide site safety for members.  If you're a criminal and want your history erased to remove evidence then you shouldn't be asking for protections from a law, that would be ironic.

Just curious as to what the possible implications for HF could be if you weren't operating in compliance with the GDPR? I'm guessing HF would be blacklisted by EU internet service providers, payment/data processors or something along these lines?

[Omniscient]

Just curious as to what the possible implications for HF could be if you weren't operating in compliance with the GDPR?

Good question. One that I have no answer for.

[Silver Fang]

GDPR seems really stupid. Seems like the EU is trying to change the internet (but failing) like the US did with the creation of the DMCA.

Why exactly is GDPR stupid/failing?
Isn't it good for the users to know what information they are gathering about them?

[Omniscient]

Isn't it good for the users to know what information they are gathering about them

Yes, and it's good to know how it's used. Unsure though if it's good to be deleted if you already approved of the processing. The GDPR gives people a few rights which are way beyond normal.

[Silver Fang]

Yes, and it's good to know how it's used. Unsure though if it's good to be deleted if you already approved of the processing. The GDPR gives people a few rights which are way beyond normal.

Well 'normal' isn't always the correct path or choice.
Change could be better, in my mind i don't see any setback from my perspective as a user.

[Omniscient]

in my mind i don't see any setback from my perspective as a user

Exactly why this law sucks. Written by end-users who don't run internet sites. The full-burden of this law is entirely on website operators and realistically well beyond that. Any places that holds PII are under this law that includes places like hospitals or your local electric company not just websites. GDPR is about the processing of personal data.

So let's say you're a hospital in the USA. You have an EU citizen visiting America and while here gets injured or sick. When you go to a hospital they begin to get your data. They now fall under the GDPR. When an EU citizen now travels any hotel or resort they stay at falls under GDPR. Do you realize the burden that is for business who are not in EU? Heck, I'm sure EU businesses feel like this is a burden too.

So yeah, from user perspective it's no big deal. But are you unable to see the other side?

Just read this:
https://hospitalitytech.com/hospitality-unprepared-gdpr

[overlude]

Yes, and it's good to know how it's used. Unsure though if it's good to be deleted if you already approved of the processing. The GDPR gives people a few rights which are way beyond normal.

I think it gives necessary rights. People should retain control over the processing of their data to the extent it is necessary. The previous data protection legislation (in the EU) is from 1998, clearly a lot has changed since then, notably our digital footprint on the Internet. I don't think it gives rights beyond the ordinary or is detrimental to businesses. There are methods of consent to allow you to use data reasonably even if the subject doesn't want you to, where they couldn't reasonably expect the processing of their data. e.g. the right to erasure is really just a right to withdraw consent, data processed under other reasons can still be processed. Of course, a business can make wild interpretations of the GDPR to give it a broad range of rights but (if reported) it won't hold.

I suppose you'll just have to interpret the act as best you can and apply it in your way. I probably don't agree with some of the things in your reply to me, but whether they're violations of the GDPR is anyone's guess, it's not exactly written perfectly in a way that you can be confident you're applying it right. Perhaps worth seeing a lawyer/consultancy firm regardless if you intend to keep data like addresses (I would at least), but emails and IPs are somewhat trivial.

[Silver Fang]

Exactly why this law sucks. Written by end-users who don't run internet sites. The full-burden of this law is entirely on website operators and realistically well beyond that.  Any places that holds PII are under this law that includes places like hospitals or your local electric company not just websites.  GDPR is about the processing of personal data.

But as a user wouldn't you ensure that your private information are stored secured and to know the details of what they are gathering about you?
Also the quality of the cyber security will increase overall which is also really good for new developers in the future so they can grow with this.
When companies are GDPR compliant they will be able to operate with entire EU without worrying about laws.
As a user you can feel safer with the GDPR implementation at least from a personal perspective.

As a developer i see the hard work that has to be done.

The one thing that worries me is that if people can't choose to stay anonymous in the future, what i mean by this is the principle about taking microsteps into wrong direction as many countries have and it has affected the net neutrality along with the right of being anonymous.

As people will more and more decide to walk away from sites that are not GDPR compliant, this is included with all the other microsteps such as ISPS being threatened by governments to send out Data and IP belongings.
There should be laws to prohibit from overstepping where it actually causes damage for the 'free internet'

So let's say you're a hospital in the USA. You have an EU citizen visiting America and while here gets injured or sick. When you go to a hospital they begin to get your data. They now fall under the GDPR. When an EU citizen now travels any hotel or resort they stay at falls under GDPR. Do you realize the burden that is for business who are not in EU? Heck, I'm sure EU businesses feel like this is a burden too.

I see the work that has to be made, but could it be for the better? I believe so.
Exactly as we have laws today, they were made at some point and where considered to be bad or risky or alike but further in the time we understood it was needed.

About your example, i didn't know US companies have to change also. I thought this was forced to within EU to begin with..
Are you forced to use GDPR or to offer it if you are an US company at this time?

[Omniscient]

People should retain control over the processing of their data to the extent it is necessary.

You have full control by not joining. I stopped using my Facebook accounts a very long time ago. I am careful about sites I join and if I am worried about abuse of the information I give them then I don't join.

I don't think it gives rights beyond the ordinary or is detrimental to businesses

I assume you don't own a business or at least one that has to comply with GDPR.

There are methods of consent to allow you to use data reasonably even if the subject doesn't want you to

There is a number of things written into GDPR which requires a lot of work on the part of businesses. Just trying to understand the full scope of this huge law and how it applies to your business is a vast undertaking. I am easily 50+ hours into my own research and implementation trying to be compliant. And I bet another 20-50 hours gets logged before this is done. I'm one small site, so imagine your a multinational corporation with thousands of employees. They not only have to comply but if they don't they do risk facing the $20 million fine for each violation.

I suppose you'll just have to interpret the act as best you can and apply it in your way.

I am listening to feedback and doing my absolute best to quote the actual law when I do interpret. I don't want to quote articles about the law or posts from the web. I prefer to read the law myself and use the words in it to justify my own policy. That's the only way imho we can be compliant.

The current agreement will likely be changed and updated and definitely the Help Doc will get completely rewritten too. Oh, we'll also be adding that little cookie popup thing soon too. More annoying crap.

Perhaps worth seeing a lawyer/consultancy firm regardless if you intend to keep data like addresses

I probably have read more about this law then a US lawyer. Also, I don't intend to keep addresses. I may have to go into some archive folders and just delete all my very old backups. I still have site files from 10 years ago, which I'm willing to bet most webmasters do that. You run backups, drop into folder, and forget it. No one puts an expiration date on files to self-delete.

But as a user wouldn't you ensure that your private information are stored secured and to know the details of what they are gathering about you?

100% agreed that this is a good thing. I love the data portability part of the law.

Also the quality of the cyber security will increase overall which is also really good for new developers in the future so they can grow with this.

I don't think that's true we'll see an increase in better security. If anything because GDPR requires that any data breaches get reported within 72 hours I think we'll hear more about breaches which previously might not have been reported at all. I'm sure sites are penetrated all the time and no one is informed. Sometimes it was a whistleblower who told everyone or even the hackers.

The one thing that worries me is that if people can't choose to stay anonymous in the future

That doesn't bother me too much because HF has always wanted members to maintain their privacy as best as possible.

[Kraith]

Omni, I don't understand how a European law is messing with your site. I understand that there are many EU users on the site. But why does it apply to a site you run out of the US? Since when do other country's laws even effect us? I know pirating sites that constantly get cease and desists that aren't affected because they aren't hosted in America.. Shouldn't the same idea be present here, considering the site isn't run or hosted within that country so the only laws that apply should be native?

[Silver Fang]

I don't think that's true we'll see an increase in better security.  If anything because GDPR requires that any data breaches get reported within 72 hours I think we'll hear more about breaches which previously might not have been reported at all.  I'm sure sites are penetrated all the time and no one is informed. Sometimes it was a whistleblower who told everyone or even the hackers.

You haven't taken into account that developers will have easier to receives big fines if they don't protect the data according to standards and if they don't report it?
By the nature developers will prioritize the data safety especially the userdata due to this law and by that the quality of security will improve in a sense of smaller business sites for example.

add: About who's notifying about the breaches in the first places of course comes probably later, however i do think people will be more efficient with security updates.

This law in a sense will force people to maintain the user data much more safer and by nature by knowing the fee's or penalty for not protecting the data that is within the sense of law will be there to keep everyone in line.
After all, as a user my personal information should be considered a privilege to have and with that comes the responsibility to have it. Ethic and morals have maintained my personal details before now i know the law will also step up as a reminder of it.
I believe there will updates with this law in the future though!

Note: Is i said i am worried about how GDPR will be used in the future, if it will "help" companies to force people to leave their details to use important services that people need.
Also i am worried that companies will want more information about personal details so that they can "Believe the data to be GDPR eligible", or else they wont protect it or alike.

I agree with the hard work that has to be done and the cost overall that could come with it for that i would like to thank everyone who goes with the GDPR law.

[Enronitis]

I have been working with my employer to figure all of this out as it screws with a number of our international businesses, and as stated, it's a shit show to say the least.
We have a law-firm working full time on bringing us fully up to date.

@Omniscient, I'd be happy to discuss some of this with you, and even pass any specific queries you have to our retained firm.

Regardless, whether it ends up being good for the end user or not, its certainly screwing a lot of businesses and as mentioned, almost no one is technically fully "compliant" with many opting to jump ship completely.
Gotta love the law sometimes 🤝

[Silver Fang]

Omni, I don't understand how a European law is messing with your site. I understand that there are many EU users on the site. But why does it apply to a site you run out of the US? Since when do other country's laws even effect us? I know pirating sites that constantly get cease and desists that aren't affected because they aren't hosted in America.. Shouldn't the same idea be present here, considering the site isn't run or hosted within that country so the only laws that apply should be native?

I think it's about the principle, the law is something that the world is looking at, the world will probably want it after they see the quality it brings but companies are skeptical because of the work it forces you to do and to what cost. As you maybe noticed people are skeptical because they think it doesn't bring "that" much to the table so why bother. Or at least i guess.

---

Regardless, whether it ends up being good for the end user or not, its certainly screwing a lot of businesses and as mentioned, almost no one is technically fully "compliant" with many opting to jump ship completely.
Gotta love the law sometimes 🤝

Even if it is like you say "No one is techically fully compliant" which maybe is true to a degree but the main part is that people should reach/strive for the quality.