May, 25th 2018 - EU General Data Protection Regulation - does it affect you? - Page 1
Forum section: electronics / general

author: Bicurico
author_rank: Super Contributor
timestamp: May 05, 2018, 11:03:01 am
content: Hi,This will affect only EU citizens. Please read:https://www.eugdpr.org/QuoteWhile this may sound like a great thing, more privacy for EU citizens, it seems that it will mainly cause havoc on all the private and hobby websites, blogs, forums, Youtube channels, etc.My blog (https://vma-satellite.blogspot.pt/) will be affected the same way:- I am no lawyer nor can I afford one (well, I could, but there is no point in spending this kind of money for a hobby project)- I have no time nor knowledge to read and understand the whole lot of pages that compose the GDPR- It seems that lawyers are not fully understanding the law and its consequences, either- There are many obligations, even for private hobby providers of said internet presences- Germany is infamous for "Abmahnwelle", where lawyers send notification to those who apparently are in infrengement and asking them to correct the problem and billing them for the notification- Fines in GDPR are very heavy (up to 20 MILLLION €, if I read that correctly)All this (and more) leave me in a state of mind, where the easiest fix is to just close down my blog. Also, I have been distributing my VMA Simple Spectrum Analyser Software (for SMA/NWT devices, Siglent SSA3000X and Rohde&Schwarz CMU200/CRTU). It uses a licensing mechanism, basically to keep me under control of who uses the software. Everyone can use the software for free for limited periods of times (renewable as often as desired) or receive a permanent activation for a small donation. This requires me to keep the email of whose who made a donation... Thus I am suddenly in obligation to fulfill a lot of burocratic crap, I have no idea about. As a result I will probably stop licensing my software altogether. I could just release it for free, but I am not up to that.So here stops my rant and begins the discussion:Am I the only EU user of EEVblog who started to think about the consequences of this new EU law?Do you guy's have forums, blogs, Youtube channels, etc., too?What are you going to do about it?Thanks,Vitor

author: Vtile
author_rank: Super Contributor
timestamp: May 05, 2018, 11:42:29 am
content: That is interesting law. The Finnish general media (and representatives of the republic) have once again failed miserably to inform the citizens about EU based legislation. I heard it like 2 weeks ago in the work when it were lifted up that we are ready for it.

author: Bicurico
author_rank: Super Contributor
timestamp: May 05, 2018, 12:06:54 pm
content: I knew about this for some few months, but I was thinking in terms of our company and me as the end user that now gets further rights on how companies use my data.I did not associate this with my own blog!Yesterday I started reading in German sites about this subject and it was then that I realized this will be a HUGE issue for private/hobby internet presences or one man show companies.Being able to fully operate within this new law is complex.Example: from what I understood, I would now have to email every single user of my software (independantly if they did a donation or not) and ask them if they allow me to keep their e-mail or if they want me to delete it. This is WORK. It is not a hobby anymore. But I don't get paid for this work. Most users probably don't care, are not EU residents, but I don't know that. In doubt, I need to delete all data. But that is not so easy: the ones that did a small donation through PayPal left a record on my PayPal account. How should I handle that? I have no idea!It gets even weirded: my blog is a hobby blog where I post my findings regarding spectrum analysis & co. But the blog has a few followers! What does that mean to me? I did not ask them to be followers! Also, the blog is hosted at Blogspot. It uses Javascript and Google Analytics. I have no idea what it logs and which data it keeps. But I know that the EU considers the IP as private data! I don't have access to any of what those Javascripts and Google Analytics do, how can I control it and prevent breaking the law?Too many questions...Regards,Vitor

author: Bicurico
author_rank: Super Contributor
timestamp: May 05, 2018, 01:50:25 pm
content: It was hurting me to consider shuting down my blog, so I removed AdSense, chenged to HTTPS and added a "Disclaimer and Privacy Information" link on the left side panel.I would be interested to know fellow members opinion on how acceptable this is in view of the GDPR.Regards,Vitor

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 05, 2018, 02:06:04 pm
content: I have been looking at this from a business side, and the major points are:* Don't keep personal data if you don't need it. So being asked you have to have a valid reason to keep it.* Do not send unsolicited email. If you send out email regularly ask for permission before the 25th and keep a record of the permissions.* Everyone has the right to ask you what information you keep about them, and you have to reply in a timely manner.I don't see that you have to worry about what for instance google stores, that is their problem, not yours.If anyone googles for my companies name and then clicks on the result, it is not our problem.

author: JPortici
author_rank: Super Contributor
timestamp: May 05, 2018, 03:46:46 pm
content: Quote from: Bicurico on May 05, 2018, 12:06:54 pmit does?shit.from what i understand, if you send an email to a wrong address (just how many info-at-something are there?) or you send an email with unrelated personal info (think forwarding an email, there may be the content of the whole conversation)you are liable. and the other party is obligated to report you otherwise you are both into troubleor at least this is what i understood.for the same reason at the office we have to put passwords on every device, every device has to lock if it's put to sleep or go to suspend. annoying as hell

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 05, 2018, 03:55:42 pm
content: According to our legal department the info@, sales@ etc. addresses are not a problem because they contain no personal info, it's the j.doe@ stuff that you need permission for.

author: Benta
author_rank: Super Contributor
timestamp: May 05, 2018, 09:11:26 pm
content: Stop whining.Personally, I find this a very good step towards privacy protection. The data collection from companies has gone way too far.If I buy something at a shop and pay cash, then that's it!If I order from an internet store,, all my data are stored infinitely, and on top I receive spam for the rest of my life, not only from said store, but from its friends and associates.The web shysters have only themselves to blame, having lost all ethics in the crave for dollars.

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 05, 2018, 09:17:16 pm
content: Quote from: Benta on May 05, 2018, 09:11:26 pmAnd who are you addressing, and who is whining here?

author: Howardlong
author_rank: Super Contributor
timestamp: May 05, 2018, 09:28:52 pm
content: If you’re sending out unsolicited emails, it seems to me you’re part of the problem, and a signcificant part of the reason why GDPR is being enacted.

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 05, 2018, 09:38:50 pm
content: Quote from: Howardlong on May 05, 2018, 09:28:52 pmI hate that and no, I'm not doing that. I just mentioned it because now you have to keep record of the given permission.

author: Bicurico
author_rank: Super Contributor
timestamp: May 05, 2018, 11:20:41 pm
content: Quote from: Benta on May 05, 2018, 09:11:26 pmI'm not sure you are referring to me... If so: I am not whining. Instead I am genuinly concerned about the consequences the new laws have for private users and very small companies.Of course it will be great to no longer have your data on all kind of databases, with most having obtained this data through dubious ways. And yes, I want certain companies to stop using or owning my private data.BUT: Where do you draw the line? What if the laws are so complicated and/or vague, that anyone risks to be sued, no matter how much care was put into fulfilling said laws?Example: You have a blog and this blog allows people to comment. When they comment, their user name is placed under their comment. Your blog now "owns" this data (user name), but you don't have a written consent to own it. Plus, this user may request that you provide him with all stored data. This includes the user name, but also the IP address, which might be in some log file of the blogger software/server/provider you are using. You need to give an answer within 30 days. What if you are away on holidays in that period? What if you don't know what data is actually stored, because you are just yourself a user of the blogger provider?The question is: where does it stop? Can you just redirect the claim to the service hosting your blog? Are you responsible?Again, I am not whining, I am trying to figure out how it works and what people think about it around different EU countries.If I read German blogs wondering about GDPR, it seems pretty serious and the best is to shut down the blog.If I search Portuguese blogs, it seems that they never heard about GDPR or otherwise just carry on, business as usual.The problem is that in this particular case, it is a EU regulation that HAS to be inforced through the whole of EU. I am not even sure if a lawyer from EU country A can sue a blog in EU country B for not having a propper privacy disclaimer!And what about forums and blogs, that are outside EU (like EEVblog), but are used by EU citizens? Do they need to be in acordance with GDPR? If they are accessible by EU citizens?Will there be an IP check to determine if users are from the EU and if so, will the forum/blog refuse to open? Sounds silly, right? But perhaps that CAN actually happen (not that I care for some of the "services" provided, but fact is, EU users won't have the choice to use them):https://adexchanger.com/mobile/verve-closes-european-business-thanks-to-gdpr/https://www.polygon.com/2018/4/28/17295498/super-monday-night-combat-shutting-down-gdprhttps://techcrunch.com/2018/05/05/unroll-me-to-close-to-eu-users-saying-it-cant-comply-with-gdpr/https://www.streetlend.com/https://themerkle.com/peer-to-peer-bitcoin-trading-platform-cointouch-shuts-down-over-gdpr-concerns/https://blog.dmbcllc.com/gdpr-killed-the-blog/<-- read this one and the comments...Further info:https://www.eugdpr.org/https://www.crackingretirement.com/gdpr-for-the-small-blogger/Regards,Vitor

author: DimitriP
author_rank: Super Contributor
timestamp: May 05, 2018, 11:54:53 pm
content: QuotePlease click here to unsubscribeand click here to delete your personal information from our records

author: Howardlong
author_rank: Super Contributor
timestamp: May 06, 2018, 09:08:46 am
content: Quote from: DimitriP on May 05, 2018, 11:54:53 pmThe unsubscribe thing is questionable, half the time the software behind the unsubscribe link doesn’t work. The rest of the time it asks you to key in your email address, like a lemming.

author: Benta
author_rank: Super Contributor
timestamp: May 06, 2018, 09:46:04 am
content: Funny is, that this was enacted two years ago, with a two year phase-in period (which should be plenty of time). But people and companies react 5 minutes before midnight. That's what I call poor planning and lack of responsibility.

author: Vtile
author_rank: Super Contributor
timestamp: May 06, 2018, 11:19:06 am
content: Quote from: Benta on May 06, 2018, 09:46:04 amI don't know how it goes in Germany, but at least up here the information about EU based anything is really poorly handled. I don't know if the younger generation who have had their schooling after the join to the union have better understanding of the Brussels mud ball, mine doesn't. In general it seems there is an information interruption and general lack of understanding in media the obvious importance to keep the news from Brussels in daily broadcast.The regulation is a good thing in general and forces the commercial spying meet the ground again.

author: Bicurico
author_rank: Super Contributor
timestamp: May 06, 2018, 01:08:05 pm
content: Look at the vague answer Google gives to their users who are bloggers:https://support.google.com/blogger/forum/AAAAY7oIW-whReLm9qQwwA/?hl=enI am still unsure on what the consequences will be...And why can't Google give a straight answer and provide a platform that is in accordance with this law?Regards,Vitor

author: German_EE
author_rank: Super Contributor
timestamp: May 07, 2018, 07:17:21 pm
content: OK, take a deep breath, relax, and breath outThe regulations only affect organizations that PROCESS LARGE amounts of data on individuals, think marketing companies, Google or the banks. In order to comply with the GDPR regulations you need to do the following:1) Somewhere on your blog state that you store personal information about people who use your software or products and inform the users that if they want a copy of this information then they should write to you.2) Store the minimum amount of data that you need, you can probably get away with name, email address and possibly physical address along with the details of what has been sold but that's it. Don't store Paypal information and NEVER store banking or credit card data.3) Keep your data safe, back it up, make sure that it's accurate and secure.4) NEVER EVER reveal data about an individual to a third party. This includes being careful about where your data is stored, for example, do you use a cloud based service that is outside of the EU?Unless you PROCESS data (generate mailing lists for example) and do this in LARGE amounts (thousands of customers) then most of these regulations are unlikely to affect you. Just follow some simple rules about data protection and you're done

author: Bicurico
author_rank: Super Contributor
timestamp: May 07, 2018, 08:26:31 pm
content: Thank you for your objective thoughts.I had already implemented exactly what you said!I am still not 100% sure, though, because I rely on Google/Blogger service to host my blog and they have not issued any GDPR compliance statement. I hope they will.Regarding the comments about having had 2 years to deal with this: today I was at a really huge customer (huge like the biggest European company of their kind) and the IT manager asked me if I had given GDPR a thought and obviously I started talking to him about this subject. Turns out that he started dealing with it 1.5 years ago and yet he is still not sure if he will meet all requirements! And he has a lawyer specialized in data protection working for him.The problem is that you need signed GDPR compliance manifests from all your service providers. If you use some cloud service, Office365, backup solution, CRM, web hosting, ... - you name it: you need to make sure all are in compliance. What if a provider does not hand out such signed statement? What if there is no alternative provider? Or swapping provider costs a lot of resources?Then there are the dubious issues: let's take this EEVblog forum. Dave is located in Australia. He couldn't care less about EU laws, right?The problem is that GDPR aims the data protection of ALL EU CITIZENS, no matter who the service provider is. And there is no doubt that EEVblog is a commercial venture.What does that mean? I don't know!Can Dave be sued if he sells user data of EU forum users to third party or if he simply does not follow 100% of the GDPR guidelines?If so, which court will be responsible?Could Dave decide, to be on the safe side, to lock out all EU users?To me, all of this does not make sense and/or makes me have a lot of questions.Regards,Vitor

author: DimitriP
author_rank: Super Contributor
timestamp: May 08, 2018, 05:05:37 am
content: It will be a sad day when EU residents can't type www..... and go wherever they want.Maybe it will look like this:Diese Website ist nicht konform. Der Zugang ist verboten!orCe site est non conforme ,. L'accès est interditor worse:该网站不符合规定。禁止访问。来迎接你！