lwyr

Joined 13 years ago

Karma

131

Submissions

Member since

Apr 10

View on Hacker News

Recent submissions

Private Inference (Confer Blog) confer.to

2 lwyr 10 months ago 0 comments

Comment · 7 years ago

Mobile ecosystem issues aside, IRMA looks excellent. Could IRMA's decentralization and selective disclosure features somehow be combined with OpenID? For example, could the IRMA application serve as a standalone OpenID provider, perhaps using OpenID Connect Federation to establish trust? [0]

[0] https://openid.net/specs/openid-connect-federation-1_0.html

Comment · 7 years ago

Warning: The privacy notice template on this site (https://gdpr.eu/privacy-notice/) omits basic mandatory elements (e.g. retention periods, right to lodge a complaint). The template's section on cookies is insufficient and misleading. Cookies are regulated by a different law (the ePrivacy Directive) and their explanation does not go into these rules at all.

As frereubu notes elsewhere in this thread, the UK regulator's GDPR guide is excellent, and is a much better starting point in my opinion: https://ico.org.uk/for-organisations/guide-to-data-protectio...

Comment · 8 years ago

At the time of writing the link to actual report in the blog post does not work. Here is the correct link: https://cdn.bitwarden.com/misc/Bitwarden%20Security%20Assess...

Comment · 8 years ago

The legitimate interest has been around for a while. It was also a legal basis to process personal data under the 1995 Data Protection Directive which the GDPR replaced. If you are interested in learning more about the notion of legitimate interest and balancing it against the interests of individuals, there is a 2014 opinion from the body of EU data protection regulators that explains the concept with a number of examples. [1]

> If a company sells something online they only really need your address & name for delivery + credit card details.

That would likely be "necessary for the performance of a contract" which is also a legal basis to process personal data. [2]

> I know of multiple companies where they prior to GDPR asked for explicit concent during signup for being allowed to send newsletters, but who post-GDPR dropped the concent and use 'Legitimate intrests' to justify it. Basically leaving the individual worse off.

That could be a violation of the ePrivacy Directive which provides that email marketing requires consent. [3]