Hacker News Reader

Comment by weaksauce | Hacker News Reader

Who can bring suit? Is it the customer or the government or both?

In the UK, a third party legal firm can bring a civil case on your behalf with nothing more than your signature and admission that the processing of your personal information for a particular purpose without your explicit consent has caused 'distress'.

That's what the full-time solicitor at my company said. It will be like PPI, only worse.

But as a general principle, you sue for actual damages here in England, and thus you would normally need to demonstrate the real harm that has been done in order to be awarded compensation accordingly. We also tend to have a loser-pays default when it comes to costs. So unless this all goes south and winds up being like our infamous defamation laws (see "libel tourism") it seems unlikely that the GDPR will create a lucrative hunting ground for ambulance-chasing lawyer types. After all, if you were being sensible about privacy and security anyway, one would hope that actual damage to anyone whose personal data you held would be little if anything, even if you're in breach of the technicalities and paperwork requirements under the GDPR.

The big punitive fines people are talking about are the ones available to the regulators via a separate mechanism. As far as I can see, they do potentially apply to technical breaches as well, but that's quite a different context legally speaking.

It's the data protection authority of the country that represents the customer, such as the ICO for the UK.

Thanks... another thing I wonder is if this has implications in electronic crime detection. If the data can be irretrievable soon after a deletion request has been made doesn’t that make crimes harder to investigate after the fact? I haven’t done any real research on this so maybe it’s been addressed in the law.

That is exactly why you're allowed and should retain data such as server logs. You don't have to answer to deletion or transfer requests on such data.

Most people seem to agree that under GDPR, IP addresses count as personal information and you either need to get rid of IP addresses, or encrypt the data at rest and respond to deletion/retrieval requests. What makes you sure that this is not the case?

Probably common sense.

Most people, especially non EU folk, seem to be misinformed.

You don't have to purge your system of all PII upon request. An IP address is only considered PII if it can be used with other data to identify a person. If you delete the user's account, you can keep your server logs with IP addresses as long as you have a compelling business reason.

That reason is "security and monitoring".

Really most of the GDPR is just best practices codified. You are only really in trouble if you are using customer data for purposes that you A) haven't received their consent for and B) aren't what the customer would expect given what they are using your service for.

You can't reasonable identify someone via an IP address alone without issuing a warrant to the ISP. GDPR is fine with storing such information.

If you are able to map the IP to a user then it becomes personally identifiable but the IP itself is not.

It's explained quite clearly in https://gdpr-info.eu/art-17-gdpr/

"a. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;"

Because the data is still necessary, you don't have to delete it.

Reply on news.ycombinator.com