Europe’s Public Institutions Are Quietly Ditching US Cloud Providers
European public institutions are quietly migrating away from American cloud providers and office software, driven less by policy ambitions in Brussels than by the mundane legal reality that GDPR-mandated risk assessments keep flagging the US CLOUD Act as an unacceptable threat to citizen data.

Austria’s Federal Ministry for Economy, Energ … ⌘ Read more

“TCF” cookie consent popups violate GDPR; OSNews wants to stop using cookie popups too once we get enough Patreons
You may not have heard of the “Transparency & Consent Framework”, but you’ve most likely interacted with it, probably on a daily basis. The TCF is used by 80% of the internet to obtain “consent” from users to collect their data and share it among advertisers – you know, the cookie popups. In a landmark EU ru … ⌘ Read more

Self-hosting my emails again: A few weeks in
A few weeks ago, I moved back to self-hosting my mail server after using Purelymail for three years. The decision wasn’t about cost – it’s actually more expensive to rent a VPS – but about control, security, and data locality. My mails are now hosted in Europe, giving me more confidence in their privacy, and I can configure everything exactly as I want while ensuring compliance with GDPR. ⌘ Read more

Self-hosting my emails again
After three years with Purelymail, I’m back at self-hosting my mail server. Not because it’s cheaper (it’s actually much pricier to pay for a VPS), but because my mails are now hosted in Europe (who knows what happens next in the USA), I have more control to configure things how I want, and I can comply with GDPR. ⌘ Read more

83(4) GDPR sets forth fines of up to 10 million euros, or, in the case of an undertaking, up to 2% of its entire global turnover of the preceding fiscal year, whichever is higher.

Though I suppose it has to be the greater of the two. But I don’t even have one euro to start with.

@falsifian@www.falsifian.org The GDPR does not apply to the processing of data for a purely personal or household activity that is not connected to a professional or commercial activity.

@prologic@twtxt.net I have no specifics, only hopes. (I have seen some articles explaining the GDPR doesn’t apply to a “purely personal or household activity” but I don’t really know what that means.)

I don’t know if it’s worth giving much thought to the issue unless either you expect to get big enough for the GDPR to matter a lot (I imagine making money is a prerequisite) or someone specifically brings it up. Unless you enjoy thinking through this sort of thing, of course.

@prologic@twtxt.net Do you have a link to some past discussion?

Would the GDPR would apply to a one-person client like jenny? I seriously hope not. If someone asks me to delete an email they sent me, I don’t think I have to honour that request, no matter how European they are.

I am really bothered by the idea that someone could force me to delete my private, personal record of my interactions with them. Would I have to delete my journal entries about them too if they asked?

Maybe a public-facing client like yarnd needs to consider this, but that also bothers me. I was actually thinking about making an Internet Archive style twtxt archiver, letting you explore past twts, including long-dead feeds, see edit histories, deleted twts, etc.

RT by @mind_booster: ❗Breaking: Meta Tracking Tools unlawful
In a groundbreaking decision in one of noybs 101 complaints, the Austrian Data Protection Authority decided that the use of Facebook’s tracking pixel directly violates the GDPR: https://noyb.eu/en/austrian-dsb-meta-tracking-tools-illegal?mtc=tw
❗Breaking: Meta Tracking Tools unlawful

In a groundbreaking decision in one of noybs 101 complaints, the Austrian Data Protection Authority decided that the use of Facebook’s tracking pixel directly violates th … ⌘ Read more

When you submit a GDPR request to American Express (Germany), you get an “Encrypted Mail” (for which you have to log in again somewhere and set a password), which then contains two PDFs, one of which is full of screenshots of mainframe terminals. ⌘ Read more

Suggestion for the next #GDPR iteration: No landing pages allowed. Content must be served on the first request.

The easiest path to GDPR compliance: switch to a completely static website with no javascript, CGI, or CSS, and rotate the logs daily.

GDPR Hysteria · Jacques Mattheij https://jacquesmattheij.com/gdpr-hysteria

Doc Searls Weblog · GDPR will pop the adtech bubble https://blogs.harvard.edu/doc/2018/05/12/gdpr/