GDPR – A Practical Guide for Developers (2017)
Few questions:<p>&quot;Forget me&quot; - What is personal information? Say I have a table with user_id and username, and an order table with user_id, order_id and other other stuff. If the user request a &#x27;forget me&#x27;, what do I delete? Blank the username? Delete the user_id row? Delete all orders belonging to the user (how would I report these gaps to tax agencies)? Delete the user from my trained ML model (is that even possible?).<p>&quot;Consent checkboxes&quot; - To what extent can users be forced to give consent or be denied from a service? Like the Cookie law, almost every website requires you to accept the fact that cookies are used, otherwise your experience is degraded (eg. you cannot watch news videos). Or say I want to order something from a webshop, and in order to place an order, I must consent with sharing my personal information with third parties for marketing purposes, else I cannot place the order. Do I have to call them out later? How is this law going to solve things if it prevents me from using things?<p>&quot;Export data&quot; &#x2F; &quot;See all my data&quot; - What is &#x27;all my data&#x27; here? Is in information I entered when I signed up for a service? Is it information derived from this data (eg. my google search suggestions&#x2F;ads profile)?<p>&quot;Don’t assume 3rd parties are compliant&quot; - if I, the data collector, gets fined because a 3rd party, data processor, is not compliant, can I retrieve part of the losses from the data processor? I mean, OpenID allows sharing a lot of personal information from data collectors like Facebook and Google with almost any random site. What can I expect here?<p>&quot;Consent checkboxes – “I accept the terms and conditions” would no longer be sufficient to claim that the user has given their consent for processing their data.&quot; - So if I, as a user, don&#x27;t give any explicit consent to any personal information sharing, and in May I receive a marketing email from a party I don&#x27;t have an account with (because they sold my personal information prior to this), I could say they broke the GDPR law?<p>&quot;Keeping data for no longer than necessary&quot; - My tax agency requires me to keep records of orders&#x2F;sales&#x2F;invoices up to 5 years ago. If a user requests deleting their personal information within that time period, what should I do?<p>&quot;Forget me&quot; - Say an employee leaves a company, and they request their personal information to be deleted. What information do I have to delete? Their Active Directory account? Their salary statements (I need those for tax agencies)? Their name in the git history? Their name from all minutes of all meetings they attended? Their name from documentation they wrote?<p>Some things might be doable to implement in just 8 weeks, if I had clear guidelines on how to do this, but as of now, I have so many situations where it is unclear what I should do, and no clear way to get answers, that I don&#x27;t know how I can comply  with this law within 8 weeks, as a small software company.