Ask HN: Why are law documents (GDPR) so difficult to understand?

Look at any profession -- accounting for instance -- and they have all sorts of stuff like this. As an example, there's a concept in accounting of "materiality" - basically, something that's big enough to matter. Materiality is what lets fortune 500 companies present their financial statements rounded to the nearest thousand dollars. When you're talking about tens/hundreds of millions, individual dollars just don't matter.

Whether or not something is "material" is a matter of professional judgment, to be made in the context of a large body of professional knowledge, history, prevailing industry standards, economic/cost considerations, etc, basically that thing called "experience" that we so often toss under the bus in SV.

Perhaps the biggest difference between law and code, which are in many ways quite similar, is that law is highly reliant on context. For a court to determine whether "appropriate security" and "appropriate technical measures" are followed, they would solicit testimony from experts in the field (people like us) to determine whether they felt whether someone took "appropriate security". So ultimately it's a matter of opinion, but one made with context and expertise.

It works surprisingly well.

EDIT: For really complicated stuff, implementation is often delegated to an agency, such as the FCC, to create specific guidelines like you want. But this is the job of executive action, which is easy to change, not statute (on-the-books laws), which is much harder to modify once passed.

https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...

In general I think legislatures putting out goals/guidelines instead of detailed specifications is a feature not a bug. Tech moves faster than they can possibly keep up with and to call out things down to the patchnote level just isn't feasible.

Try to think of it more like: "jury of your peers". If a dozen fellow sysadmins / devops / programmers would consider what you're doing to be reasonable then you're probably ok.

One big caveat to that with GDPR is that the legislature is very purposefully pushing for what many would consider fairly innocuous "personal data" to be treated more how many developers today would treat something like credit card numbers or banking info including pins and passwords.

If the format/style of the article feels familiar to you, it's probably because you read "AWS in Plain English" which I also wrote and which periodically blows up on HN.

The answer is simple: the law will stand for a long time, and legislators know their limits. Unlike many engineers, unfortunately.

Having courts interpret laws, with help from experts, is not a bug, but a feature!

Treat every paragraph like a great big chain of boolean logic. The confusing parts of law are normally due to long paragraphs of 'and' and 'or', all mingled together. Parsing those in legal documents isn't any different than parsing them in code. But we normally don't have to think that way when reading, so it feels more confusing than it really is.

Try re-reading it specifically looking for the ands/ors, and envision how they really operate on the words of the paragraph, and legal reading will suddenly become far more clear.

1.) Make sure your software has all vendor-supplied patches.

2.) When personal data is being processed, keep it in RAM.

3.) When personal data is at rest, ensure that it's on a locked-down system and safe. Encryption at rest is called out in GDPR, but it's not required. (The definition of "locked-down" can fill a couple paragraphs, but consider it like SOX - only give access to employees that need it as part of their job title. Block off all access for everyone else - network, physical, logins).

4.) Make sure that all systems that store/receive/transmit personal data are audited and logged, and do not give out access to people unless they absolutely require it. (Anonymize data for BI, developers, business reports when able)

comes in to play here. GDPR, at its core, is about legally requiring businesses to care for customer data. It gives customers increased control over how their data is used, and how it should be protected.

In answer to OP's question "how do I know it is appropriate," as a first pass, how would you feel if your most important personal data were being treated that way? As a developer, if that makes you uncomfortable, that's probably a warning sign.

Also, most comments will say this is just how it has to be because the law cannot be very specific on highly technical matters. I believe that part is true, but it is not just how it has to be. The other option is the absence of the law and alternative measures to tackle this problem (e.g. education/awareness, encouragement of alternatives, public equivalents or assistance w/ caveats, etc, etc).

So, you should expect the "appropriate" part to mean the current state of the art to keep something secure.

An "appropriate" hashing algorithm today would be bcrypt, scrypt, or potentially still a salted SHA512 with many rounds.

An "appropriate" protection against unauthorised access would probably be a strict permissions setup in your AWS rules, proper firewalling, and potentially at-rest encryption.

An "appropriate" encryption would be AES 256 GCM.

"Appropriate" always just refers to the current state of the art for what is considered secure.

It's not. You are wrong.

What if this law will be abused as a tactic to attack business competitions?

Why would that happen?

How do you understand this "security appropriateness" of the above text? How can you be sure your understanding is correct?

You use your knowledge or regulation to read and make decisions. If you don't have the required experience, you hire a consultant or a lawyer. Just like you do when complying with any other piece of legislation.

More general, it's difficult to understand because it's in legalese, which is aimed at people that studied it for years - it's the English programming language. And like code, there's lots of holes in it that it doesn't cover, despite lots of manyears of effort.

They have explained GDPR in reasonably everyday language, with checklists and examples. That site should be your first choice.

If you are a developer, you should check https://github.com/gdprhq/GdprHq.Io.ClientSdk - you can find interfaces and default implementations. For example, to implement the right to erasure (to be forgotten) in your app, you'll need to erase personal data and to inform an individual that you've done so. Even though actual erasure might be tricky, at least you know what you need to implement to be compliant. However, note that having the app GDPR compliant isn't the same as having the business compliant; primarily, GDPR is a set of rules and processes that apply to organizations.

"In a manner" means that you're absolutely free to use whichever means (i.e. technologies, systems, ...) you want to do your data processing with, as long as you make sure you keep the data secure.

"Appropriate security" is indeed a very vague term, but it is vague on purpose: As you probably know firsthand, technologies change rapidly these days, and what's considered "state of the art" today might be a "legacy system" in five years. Therefore, laws often do leave the interpretation of terms like the "appropriateness" above open to interpretation by the executive branch. In case of the GDPR, this means that at the highest level it will be the European Court that will decide if a given measure/technology was appropriate or not. In practice we can't (and do not want to) fight out each definition in court of course, so in addition to that last instance the member countries try to release guidelines that should help companies to judge what measures are appropriate. Unfortunately, there's not always consensus between individual countries here so you will have to find a compromise or look at the guidelines of the country you're based in (as that's where complaints about your company will be handled in the first instance). For Germany, the BSI (Bundesamt für die Sicherheit in der Informationstechnik) would be the relevant instance to look for guidance when it comes to IT security best practices, and the standard that they define will (usually) be followed by the federral data protection agencies.

As a final remark, what helped me a lot in understanding the intent behind the law is to read the "motivations" section, which is where the lawmakers write down the actual intent they had when creating a given law. These are used by courts to interpret laws in case of ambiguity and can (in my opinion) greatly help to gain a better understanding of some of the more cryptic articles. Here's the link:

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A...

If you have any specific questions about appropriate measures or the GDPR please feel free to reach out to me (contact info in my profile), I'm always eager to learn about your problems and will be glad to give you free advice wherever I can.

There's a very simple way around that problem - don't ask for your user's data.

The GDPR is about making sure you do your best to protect what they share with you. If they don't need to share anything then there is no burden on you to protect anything. In my opinion this is the ideal outcome. If you gather their data then there really should be a burden on you and your business to do the necessary work to make sure you've done at least the minimum to protect what they've shared, especially if you're profiting from that data.

https://techblog.bozho.net/gdpr-practical-guide-developers/

Then, according to your interests/knowledge/SOW, you can act as a security consultant who gives proactive advice, or as a contractor that develops a solution from a set of specs.

Chesterson’s Fence.

Having said that, I am a tax lawyer and I view the output of the Federal government as astonishingly bad. Poorly-written laws cause millions or billions of dollars of friction to taxpayers.

There are many reasons for why laws are written so poorly:

- the people are stupid or malicious or lazy (appealing but this conclusion reveals more about its holder than its object)

- the task of writing the law is impossible

- the people writing the law are technically deficient in this style of writing

I’m sure you can think of others.

There is another factor. After you have been a lawyer for a long time, you see the folly of believing it is possible to write binary yes/no rules to govern human behavior. Politicians believe this. An economist would call this a belief in a static economic model.

Thus, politicians think “we will impose this tax and collect a lot of money”. Then they are shocked because people change their behavior and avoid paying the tax. I do not mean maliciously. I mean like a toll-road. Imposing a toll for driving on a road will affect the traffic patterns and fewer people will drive on the road. Less money will be collected. Economists think that way. Politicians are not as . . . astute. (That statement reveals more about me than it reveals about politicians as a group). :-)

Back to why laws are so badly written. There is a second reason and it is mentioned in another comment. Lawyers and judges are comfortable with ambiguity. In tax law, we often ask for penalties to be waived for “reasonable cause”. WTF is that? Yet it (more or less) works. At the margin, some people get away with stuff that “should” be penalized. And some people are penalized “unjustly”.

This discovery in law is the result of centuries of evolution. It works. So if you see ambiguity, understand that it is a feature, not a bug.

But for tax law, quite often I think of the rules as a broken set of algebra rules written by teenage sociology majors while drunk, for bribes. Over decades. Again, this reveals more about me than the United States Code and the Treasury Department.

AINAL, I am a security/privacy consultant. I have a strictly technical/security background but didn't find the GDPR that hard to understand at all. Actually, I was pleasantly surprised that the text itself was quite easy to read, even though really understanding the consequences requires a bit of background research. A year ago, I got CIPP-E certified in a month just by self-study.

> I found it is very difficult to translate from the regulation text to code, to actual implementation

Well yeah, I'm with you on that one. I think it is not because the text is too vague, but rather because it was written in a way that allows companies to implement it in a way that fits their size and the sensitivity of data. Art. 32 is the most important one for security/technical protection. It allows you to implement security controls the way you see fit, as long as you can demonstrate that you made an appropriate decision based on the risk of the data. I think that is the strength of it, not its weakness: A small company doesn't need formal authorization processes if they can show that the user administrator knows all personnel personally and issued the correct authorization profiles for the roles. Telephone numbers from contacts don't need to be protected in the same way you need to protect medical data.

The advantage of the wording is that the controls just need to be "good enough". The disadvantage is that there is no checklist of security controls to take, and hence, you never know for sure whether good is really good enough until you had a visit from the data protection authorities. That remains a problem, but I think if you can explain your reasoning, they might disagree, but if the reasoning is solid enough they won't fine you for it because you can demonstrate you acted in good faith. Therefore it is important to document the reasoning behind your decisions.

> I found this regulation put too much burden on small businesses.

For a small company, setting up the "records of processing activities", doing a basic risk assessment and setting up processing agreements can be done in a couple of days. I don't think that's too much a burden. For many of my clients it helped them to identify weak spots in their security, which is a win-win for both the company and their customers.

If the rule applies to people who do x, and you encounter a requirement that is clearly burdensome, then you should reevaluate whether or not your really want to do x.

ie... The new liquor regulation is 10^100 pages long, but page 1 says we dont have to read the rest if we just serve wine and beer.

1. is email address considered personal information?

2. is cookie, in a form of random hash code, be considered personal information?

Ignorance isn't an excuse.

It is a burden. It's supposed to be a burden. It's supposed to make it harder for companies to amass toxic dumps of sensitive data, that go onto get hacked. And to stop the Facebooks of the world weaponising every anecdote they can link to you.

It's a good set of measures. It's just going to be a cock to comply with some times. I get that. I'm going to have to comply with it. But I'm happy that companies I deal with will also have to deal with it, for my sake, as a consumer.

I guess the difference is that the law doesn't have to implement code. Code has to implement the law.

If something goes wrong, Facebook can easily hire an army of lawyers and "prove" that they "processed [data] in a manner that ensures appropriate security".

But a small player can't do that. This has the follow advantages for big corps and governments:

1. Big companies can use the laws to destroy small companies (they just need to push the enforcers of regulations in the right direction, maybe with a little gift or something wink wink) 2. People don't even try to create a small company, because it's too risky, so big companies don't have to face any competition at all 3. Governments and other institutions can use the laws to stop people who spread informations or products that go against their interest. In fact the main reason for GDPR is stopping the spreading of true informations about the current political situation in Europe (what they techinically call "fake news"). It's much easier to control the web if you only have Facebook, Youtube and other channel you can easily manipulate. Good luck instead controlling hundreds of thousands of small blogs, mailing lists, chat rooms, etc