I guess the biggest advantage of this project is removing access to the PII by means of joins and such and automatically enforcing access to PII using a restricted API. I guess a premade API makes it much easier to ensure nobody ends up violating that access and integrate PII too closely with the application.
Project demo is back to life. Project demo is available at:
User account: Phone: 4444 Code: 4444
Admin access token: DEMO
Many more info is available at:
The companies I work for are just going to re-implement this (poorly) in their own language and framework. They generally can't just pick up a single turn-key solution, because they already have 50 custom internal systems with records they need to manage.
If there were open source libraries that followed a standard for GDPR record management, they could pick up those libraries and plug the pieces they need together, according to the standard. That would remove a lot bugs from trying to write all the code themselves, and make it easier to integrate different systems.
> Let say I use some service, then I violate policies of that company, then I exercise my "right to forget", and after they delete my data I sign up again and repeat the entire thing?
In this case a business (or 'data controller' in GDPR lingo) can use 'legitimate interest' as a lawful basis for processing the users information. Of course the data you kept would have to be proportional to what you're doing. For example, it would be hard to argue that you needed to keep the users billing address history if your services used a simple email black list (this is the 'data minimisation' principle).
> how does that work in regards to book keeping and tax policies, where you are required to have data about your clients?
As a rule of thumb, if you're using some personal data to comply with another piece of law then that usage is generally exempt from GDPR.
Source: https://ico.org.uk/for-organisations/guide-to-data-protectio...
1. Nothing user has is truly hash-able, (email can be replaced, there are people with the same name/dob/place of birth, address is not permanent attribute...)
2. Hash key can have duplicates - so those collisions would block different users (probably not for small companies but for FB with 2 billion users something worth considering.)
A user-token – if consistent and mappable – would, for instance, be "personal data" at least for the service provider for a storage solution such as this.
Also, like other "self-sovereign identity" and data hubs, services such as this should be very clear that the only privacy-guarantee it can practically make to its users is regarding authorization of first-party access to data. Outside of that, no technical guarantees can be made (whether we're talking caching for legitimate reasons, or sharing/selling data to partners).
Text on the site is often incorrect. ‘pseudonymization as a valid solution to store customer data as defined by GDPR.’ This is simple not true. Gdpr measurements are based on defined risks that differ per use case.
Governments should be refunding solicitor costs to anyone needing GDPR advice. Otherwise this is just another way to add barriers. If you are on modest income you can forget about setting up a website in the EU.
Personally I think pretty much everything in GDPR is just sensible guidelines for how to handle personal data, and if you're not willing to do those things then you probably shouldn't be handling personal data in the first place. Being ignorant of good data practice is not an excuse.
> If you are on modest income you can forget about setting up a website in the EU.
This is just rubbish. GDPR only applies to personal info for a start so if you don't store personal info then you have nothing to worry about. Even if you do store personal info the vast majority of use cases are really straightforward and require a very minimal understanding of the law to be compliant.
And yet it doesn't say "don't give it to me if you don't want me to have it."
> GDPR only applies to personal info for a start so if you don't store personal info then you have nothing to worry about.
So logging IPs is fine?
