Hey y'all,
The question that I can't answer and wish I could, is this;
As I (as do most other BBSes do) collect certain data from users, such as IP
addresses, email addresses, names, phone numbers, etc etc (assuming that real
info is given), does this fall under some GDPR regulation of which we as sysops need to put notices upon login to say something about?
My very limited understanding of GDPR is that companies and organisations need to make sure they handle data appropriately, and allow the persons whom
give personal data the rights set out in said regulation, however a BBS for almost all of them, are just hobbies, without any business use or intent.
Does a personal website fall under the same category if you capture the IP addresses of visitors, etc.
It's an interesting thought, and one that I am sure someone in here will be qualified to answer, so I'm asking it here because ... well y'all run BBSes so it _could_ affect y'all too.
Thanks in advance to your responses, I can't wait to hear y'alls thoughts on
this and to get a definite qualified answer to this question.
The question that I can't answer and wish I could, is this;
As I (as do most other BBSes do) collect certain data from users, such as IP addresses, email addresses, names, phone numbers, etc etc (assuming that rea info is given), does this fall under some GDPR regulation of which we as sysops need to put notices upon login to say something about?
Honestly, I could see it going either way.
One section seems to say you must be engaged in "economic activity". So that would be a no, unless you run a commercial BBS, or so I would think.
However, another part shows that it applies if you are engaged in offering "goods and services" regardless of a payment being required. Which a BBS co be seen as doing, with message bases, door games and file areas.
While personally, I wouldn't see it being applicable, it's a hobby, and full contact information isn't regularly required to join a BBS anymore in my experience. I'm certain some scumbag lawyer could make the case for it thoug
TL;DR: Hobbie services are impossible in Europe unless you ignore the
law.
On 06 Oct 2020, Arelor said the following...
TL;DR: Hobbie services are impossible in Europe unless you ignore
the law.
An interesting observation.
Does this mean that we sysops _should_ have disclaimers stating this and that?
1. The ability to completely delete my account with all my data (and thatit gets automatically purged after some time of inactivity,
like 6 to 24 month).
I dont think the files do - but what if in the ZIP archive there was a file_id.diz that had your details in it?
When you connect to a remote BBS, what is "your" data? (Apart from your name / address, etc) IE: Do the files you upload, the messages you post (both a local message bases and networked ones) count as "your" data?
I dont think the files do - but what if in the ZIP archive there was a file_id.diz that had your details in it?
If a Sysop posted a message along the lines of "we dont follow the GDPR,
so if you dont want your personal information stored here, dont register"
- would it be valid?
When you connect to a remote BBS, what is "your" data? (Apart from your name address, etc) IE: Do the files you upload, the messages you post (both a loc message bases and networked ones) count as "your" data?
I dont think the files do - but what if in the ZIP archive there was a file_id.diz that had your details in it?
If a Sysop posted a message along the lines of "we dont follow the GDPR, so you dont want your personal information stored here, dont register" - would be valid?
As I (as do most other BBSes do) collect certain data from users, such as IP addresses, email addresses, names, phone numbers, etc etc (assuming that rea info is given), does this fall under some GDPR regulation of which we as sysops need to put notices upon login to say something about?
I think all this just comes to show what a frigging mess these laws are.
I think all this just comes to show what a frigging mess these laws are
I like the GDPR for a site of any size, mostly because I'd really rather never have tailored ads or tracking that surveils me across the internet.
simpler with walled gardens like facebook or web forums. At least you would need some informed consent that it's impossible to get back control of posted messages. IMHO FTNsIf a Sysop posted a message along the lines of "we dont follow the GDPR,
so if you dont want your personal information stored here, dont register"
- would it be valid?
I don't think so. You cannot opt out of the GDPR.
I still don't know how the GDPR can be applied to federated systems. It's
1. The ability to completely delete my account with all my data (and
that it gets automatically purged after some time of inactivity, like 6
to 24 month).
2. The information/disclaimer that messages I post in Fidonet or some other FTN are public on the web, archived forever by unknown people and cannot be deleted from the internet.
A BBS is a non-commercial enterprise so the various provisions of the
GDPR do not apply. You likely do not employ hundreds of people nor do
you have an IT department, a "privacy officer" or data controller as set forth in the GDPR.
Someone who calls a BBS and creates an account does so knowing that
these are amateur systems ran on someone's computer. The contents of a
BBS are in most cases not searchable by the Internet so privacy really comes down to the account itself. Many BBS callers don't give their real info... I don't.
Likewise for an FTN. An FTN is not a commercial network. A Sysop makes
the decision to join and be listed in an FTN otherwise you would not be
in a nodelist that in some cases is Internet-searchable. So a great majority of the GDPR does not apply in that case either.
No I don't employ anyone to run my BBS or do anything with it, lol.. but what
I have been reading on government websites about GDPR, it looks like
even
personal websites have to think about GDPR, so from what I read a BBS
being a
non-commercial enterprise or not, would still be required by law to
abide by
certain GDPR regulations?
So I just had a new user log into my BBS, and left me some really interesting feedback, of which I actually think is awesome.
I'm still looking for the "right" answer, if that even exists. I
might have a chat with someone from my work who would deal with
such a thing, to see if they can offer any clarity to this.
I don't really follow the current events, but I thought the UK left the EU? Or is that still to happen?
what was his feedback to you regarding GDPR?
Let us know what he says. I am afraid you would need a lawyer to get the right answers and one of those answers could be. you can't run a BBS legally nowadays.
Just look at the signup process. it is not encrypted. But thats one importand thing with the GDPR. You would have to create a temporary login and ask the user to come back with SSH for data encryption. BBSs are just from a different time in technology and law. But i think there is no exception for "old" systems in the GDPR.
1. The ability to completely delete my account with all my data (and
that it gets automatically purged after some time of inactivity,
like 6 to 24 month).
I have that on mine.
I'm still looking for the "right" answer, if that even exists. I might have chat with someone from my work who would deal with such a thing, to see if they can offer any clarity to this.
OK so I have had an answer from the guy at work who deals
with this daily, and I explain exactly why I am asking,
what I do etc, and this is his reply;
"The material scope Art 2 (C) may be a weak argument in
this case. Albeit you may be able to state this pursuit
is purely personal. However, you are processing PII
information and a lot of GDPR is about risk. E.G. is
there a risk to the rights and freedoms of the data
subjects on a large scale.
If anyone asks what happens to their data you need to be
transparent and we usually do this by having a privacy
statement. What these look like are outlined in Art 13/14
of GDPR.
These are simple measures your can take to cover yourself
in case anyone tries to get cute with you."
What are your thoughts to this new piece of information?
"GDPR is a regulation that requires businesses to protect the personal data and privacy of EU citizens for transactions that occur within EU member states. And non-compliance could cost companies dearly."
Ogg wrote to MeaTLoTioN <=-
What are your thoughts to this new piece of information?
There you have it. This is an interesting topic. But I think
for BBSes there is panic for no reason.
"The new account process was a bit much, things like sex, birth date, location, e-mail address etc. should really not be necessary to create an account. In fact in light of GDPR you might not even want to collect any of such information as it increases your liability should the data for whatever reasons become compromised."
I responded with this;
"I appreciate this feedback, the reasons I have kept that in is so that I ca find out, for example;
If BBSes would fall under GDPR regulations, then why don't
regular people who store and record CID (Caller ID) on their
phones?
Ogg wrote to MeaTLoTioN <=-
What are your thoughts to this new piece of information?
There you have it. This is an interesting topic. But I think
for BBSes there is panic for no reason.
Panic? LOL
I don't think so. I could not give a rat's ass about this GDPR,
nor could nearly anyone else in the USA. Let the Euro-commies
fret about it all they want. We don't care.
... Post may contain information unsuitable for overly sensitive persons.
"The new account process was a bit much, things like sex, birth date, location, e-mail address etc. should really not be necessary to create an
* ratio between men and woman using my BBS
* the birthdate is useful to know the age of someone so you can tellwhether
they're new to the scene or an old hat revisiting and remembering times of old
* the location is nice to know because we can see where everyone is fromand
how far and wide the BBS scene is reaching, who is visiting your BBS and from where
I do care, not for anything underhanded but because I want to get to knoweach
person who joins and connects. I respond to every feedback I get, andsometimes
if they call back I can get to know that person better.
As for GDPR; this is a BBS, not an organisation, or company so I am notsure
that it qualifies to be required to follow said regulation.
As a rule of thumb you don't want to host information that is not needed for your service to function.
Honestly, as far as I know, most users are being offered a ToS box with
a big "I accept the ToS and cookies of this site", which they click.
Then they get all the tailored ads and data collection just the same way they used to do before cookie laws and GDPR.
"The new account process was a bit much, things like sex, birth date, location, e-mail address etc. should really not be necessary to create an account. In fact in light of GDPR you might not even want to collect any of such information as it increases your liability should the data for whatever reasons become compromised."
There's a mod for Mystic available on Agency called dm-suicidev3.zip that allows a user to delete their own account.
If BBSes would fall under GDPR regulations, then why don't
regular people who store and record CID (Caller ID) on
their phones?
According to Spanish law, your contact addressbook is an
archive of personal identifying information for all
effects.
Welcome to Spain.
Sorry, I think it is spelled S-Pain nowadays.
Please, drag me out of this rotting place.
Panic? LOL
I don't think so. I could not give a rat's ass about this
GDPR, nor could nearly anyone else in the USA. Let the
Euro-commies fret about it all they want. We don't care.
I am as far from an Euro-commie as it can get, but if you
don't at least *pretend* you care for cookie laws and
similar rubbish, you'll be tattooing a target in your ass
for the real Euro-commies to kick.
As for GDPR; this is a BBS, not an organisation, or
company so I am not sure that it qualifies to be
required to follow said regulation.
I doubt if there's much to worry about. If a BBS operator
is ever officially challenged on this point, it's unlikely
to begin with a big-money lawsuit or a steep fine. You're
much more likely to receive a warning and a strongly-
worded letter. (Especially for those of us outside the
EU.)
It might be better to create an optional survey that users can fill out, decoupled from registration,
Arelor wrote to Gamgee <=-
There you have it. This is an interesting topic. But I think
for BBSes there is panic for no reason.
Panic? LOL
I don't think so. I could not give a rat's ass about this GDPR,
nor could nearly anyone else in the USA. Let the Euro-commies
fret about it all they want. We don't care.
I am as far from an Euro-commie as it can get, but if you don't
at least *pretend* you care for cookie laws and similar rubbish,
you'll be tattooing a target in your ass for the real
Euro-commies to kick.
Yeah, I think that was where I was going.
So if there was a message at registration that said something along the lines of "your data is shared within the FTN network to an unlimited
number of unknown systems and cannot be redacted - so you sign up
accepting that your data cannot be removed at your request to be 'forgotten'".
That would work right?
Its a curious law with good intention but in some respects impracticle implementation it seems. When I google search (or any search engine for that matter) and find my name (eg a nodelist), who is responsible for it being removed - google/search engine(s) and/or "x" number of systems that have the nodelist publicly available (that the "y" search engines
indexed).
Where would you go?
I am as far from an Euro-commie as it can get, but if you don't
at least *pretend* you care for cookie laws and similar rubbish,
you'll be tattooing a target in your ass for the real
Euro-commies to kick.
Understood, and that's gotta suck. Perhaps you should become a
(legal) immigrant to the USA. ;-)
Ogg wrote to MeaTLoTioN <=-
What are your thoughts to this new piece of information?
There you have it. This is an interesting topic. But I think
for BBSes there is panic for no reason.
Panic? LOL
I don't think so. I could not give a rat's ass about this GDPR,
nor could nearly anyone else in the USA. Let the Euro-commies
fret about it all they want. We don't care.
Hello Arelor!
** On Thursday 08.10.20 - 10:14, Arelor wrote to Ogg:
If BBSes would fall under GDPR regulations, then why don't
regular people who store and record CID (Caller ID) on
their phones?
According to Spanish law, your contact addressbook is an
archive of personal identifying information for all
effects.
That's incredible. Since when does a gov't suggest that your
address book is their address book?
There is nothing illegal about being stupid. You could
stupidly delete the address book by accident if bullied. ;)
It would seem to me that if one were to be forced to disclose
said contents of such address book, then the very nature of
disclosing would be in contradiction to the very regulations
that insist that it should be "protected".
Welcome to Spain.
Sorry, I think it is spelled S-Pain nowadays.
:)
Please, drag me out of this rotting place.
Where would you go?
Your own personal phone records in your phone is *NOT* subject to GDPR regulations since you are a private person. GDPR was designed to protect individuals from having their identity and personal information misused by corporations for fraud or other kinds of attempts to use it for their own personal benefit (hello Facebook, Google, et al).
For fucks sake - read up on this stuff. It's not hard.
It can be argued that a BBS can be view upon as a private club and as sucha BBS is exempt from GDPR since you are allowed to store
any of the information listed above without consent from the user/member.
For fucks sake - read up on this stuff. It's not hard.
Arelor wrote to Gamgee <=-
Re: Re: GDPR and BBSes
By: Gamgee to Arelor on Thu Oct 08 2020 06:36 pm
I am as far from an Euro-commie as it can get, but if you don't
at least *pretend* you care for cookie laws and similar rubbish,
you'll be tattooing a target in your ass for the real
Euro-commies to kick.
Understood, and that's gotta suck. Perhaps you should become a
(legal) immigrant to the USA. ;-)
I am still banging my head against a wall because I rejected a
job offer from a 'murican company back in the day.
Maybe I could get a green card since I have contracts with Linux
News Media and (soon) other American publishers, but taking my
horse there would be sorta troublesome.
Keep in mind something... what would happen if you didn't give a shit.
Keep in mind something... what would happen if you didn't give a shit.
I will keep that in mind for any rules (policies) in fidonet. why should anyone give a shit about anything?
Maybe I could get a green card since I have contracts with Linux
News Media and (soon) other American publishers, but taking my
horse there would be sorta troublesome.
Probably a little troublesome, but do-able.
Getting the greencard, or moving with the horses? :-P
One of them seems to be an Arabian cross. I bet the TSA would not let her in without a throughful background check and many questions.
"So, are you an spy for the arabs?"
Getting the greencard, or moving with the horses? :-P
Isn't that the same thing? :)
One of them seems to be an Arabian cross. I bet the TSA would not let her
in without a throughful background check and many questions.
"So, are you an spy for the arabs?"
Or, "Is that horse a Musi extremist?"
One of them seems to be an Arabian cross. I bet the TSA
would not let her in without a throughful background check
and many questions.
"So, are you an spy for the arabs?"
Arelor wrote to Gamgee <=-
Re: Re: GDPR and BBSes
By: Gamgee to Arelor on Fri Oct 09 2020 07:59 am
Maybe I could get a green card since I have contracts with Linux
News Media and (soon) other American publishers, but taking my
horse there would be sorta troublesome.
Probably a little troublesome, but do-able.
Getting the greencard, or moving with the horses? :-P
One of them seems to be an Arabian cross. I bet the TSA would not
let her in without a throughful background check and many
questions.
"So, are you an spy for the arabs?"
"So, are you an spy for the arabs?"
Or, "Is that horse a Musi extremist?"
Spec
Keep in mind something... what would happen if you didn't give a shit.
Sorry, I think it is spelled S-Pain nowadays.
Please, drag me out of this rotting place.
Adept wrote to Arelor <=-
Sorry, I think it is spelled S-Pain nowadays.
Please, drag me out of this rotting place.
I wonder if it's just a common thing for people to think that
about their own countries.
But I'm getting questions about why I'd choose to live in
Germany, especially a random smaller city.
But I'm getting questions about why I'd choose to live in Germany, especially a random smaller city.
But I'm getting questions about why I'd choose to live in Germany, especiall a random smaller city.
Nobody has seen her eat bacon, so that casts reasonable suspicion
Please, drag me out of this rotting place.Nobody I know thinks that about our country (USA). I'd have to
guess that holds true for nearly all US citizens.
As I recall, you recently moved there from the USA... Don't you
think it would be rather normal for folks to ask why you wanted to
do that? I think it's a perfectly natural thing to ask. <SHRUG>
But I'm getting questions about why I'd choose to live in Germany, especially a random smaller city.
I would love to live there as well. My only question is do you have a large enough trunk to let me ride in for the trip? ;)
Oh, yeah, that aspect is totally normal -- I was trying to get at the aspect
that they're asking it in a, "That makes no sense to me" context, especially
since I'm not in a fancy international city like, oh, Munich or Berlin.
But I didn't especially move away from the US (though that played a part); I
wanted to live in a culture where the language was different, even if most of
the people look like me. And this is also where the opportunity was. Moving to a random smaller city in Germany is significantly more interesting than moving to a random smaller city in the US.
situation. The only cities I ever went to were Stutgartt and Nuremburg.
I was roughly half way between them. I much preferred the small towns
to them, which probably is strange, considering I have lived in one of
the largest cities in the US for most of my life.
just never got the courage to do it. My sister, she got the opportunity years later to go first as an exchange student, then later as part of an internship, then again while getting her law degree. Apparently, she's braver than I am, her specialty is in international business law, and
after time working in several countries, she's living and raising a
family in Hamburg.
ajust never got the courage to do it. My sister, she got the opportunity
years later to go first as an exchange student, then later as part of an
internship, then again while getting her law degree. Apparently, she's
braver than I am, her specialty is in international business law, and
I do find the bravery aspect kind of interesting -- I don't consider myself particularly brave, and this time moving was less frightening - I'm scared of a variety of different things, but they're largely known unknowns (e.g., when will my German fail me? Can I get up enough energy/will power to find
place to live, or deal with the variety of things I need to deal with?)rather
than something more amorphous, like, "Will Germany have the things I needin
daily life?", "Will I be able to handle basic interactions?", "How will Iget a
job?", and so on.
.after time working in several countries, she's living and raising a
family in Hamburg.
That seems pretty neat. And Hamburg is decently large. I keep thinking it's close to here, but it's not especially. But Germany isn't a huge country -- especially having lived in California, where I was entertained when someone asked me about Los Angeles and my response was, "I don't know -- I've never been there". 'cause things are not close, and visiting LA would've been like visiting Berlin for me, now.
Adept wrote to Gamgee <=-
Please, drag me out of this rotting place.
Nobody I know thinks that about our country (USA). I'd have to
guess that holds true for nearly all US citizens.
Huh. I know several people who are actively trying to figure out
how to leave the US, a couple who already have, and a fair amount
who'd consider it if it were an option.
But clearly we have different bubbles, and yours evidently thinks
more of the US than mine does.
As I recall, you recently moved there from the USA... Don't you
think it would be rather normal for folks to ask why you wanted to
do that? I think it's a perfectly natural thing to ask. <SHRUG>
Oh, yeah, that aspect is totally normal -- I was trying to get at
the aspect that they're asking it in a, "That makes no sense to
me" context, especially since I'm not in a fancy international
city like, oh, Munich or Berlin.
But I didn't especially move away from the US (though that played
a part); I wanted to live in a culture where the language was
different, even if most of the people look like me. And this is
also where the opportunity was. Moving to a random smaller city
in Germany is significantly more interesting than moving to a
random smaller city in the US.
But who knows what I'll want to consider in a couple of years?
Okay, so "several"... My statement above still holds. Nearly all
US citizens are not looking to leave the country.
But clearly we have different bubbles, and yours evidently thinks more of the US than mine does.Apparently, yes. Absolutely, even.
Yeah, who knows. Maybe you'll miss the USA by then.
Maybe I'll make a business trip to the US, and we can get you fitted for
a suitcase. You're paying whatever overweight fee there is, though, as I assume you're over 23kg.
Please, drag me out of this rotting place.
Nobody I know thinks that about our country (USA). I'd have to
guess that holds true for nearly all US citizens.
Huh. I know several people who are actively trying to figure out how to leave the US, a couple who already have, and a fair amount who'd
consider it if it were an option.
Maybe I'll make a business trip to the US, and we can get you fitted for a suitcase. You're paying whatever overweight fee there is, though, as I assume you're over 23kg.
I believe you may have forgotten at least 1 zero. ;D
- I'm scared of a variety of different things, but they're largely
known unknowns (e.g., when will my German fail me? Can I get up
enough energy/will power to find a place to live, or deal with the
variety of things I need to deal with?) rather than something
Does a personal website fall under the same category if you capture the
IP addresses of visitors, etc.
Ahhh you're one of those really lightweight little people... 0.23 Kg ;)though, as I assume you're over 23kg.I believe you may have forgotten at least 1 zero. ;D
Maybe I'll make a business trip to the US, and we can get you fitted a suitcase. You're paying whatever overweight fee there is, though, a assume you're over 23kg.
I believe you may have forgotten at least 1 zero. ;D
Probably just the "current" case of the grass is always greener. In my mind probably one of the biggest drivers for immigration...
Those are the easy ones.... unless you're superfluent sprechen sie Deutsch, then you'd have to expect it to fail at some stage. The
question will be, what can I do to overcome it when it does. Most
Germans seem to speak some level of english anyways... so you'd
probably get by with a mash.. Actually you're probably more likely to
get caught out in some kind of dialect thing, I would expect.
I believe you may have forgotten at least 1 zero. ;D
Ahhh you're one of those really lightweight little people... 0.23 Kg ;)
Though it's been odd, this time, as I was expecting more interactions where Germans just automatically switch to English after hearing me speak, and that
hasn't happened, other than when I talk about my German being terrible, or ask if they speak English.
And I don't know if it's more that my memory was incorrect, that it was different situations, or that my German is better. I don't particularly think
the last one is true (at least toward the end of my time here, last time), so
I'll assume it's a combination of the first two.
I learned fairly quickly that even attempting to speak German would general result in the conversation switching to English, or a mix of the two. But i there were the stereotype Americans around (How much is that in REAL MONEY) such luck.
It is funny, my mother speaks close to perfect German and no English whatsoever, and when she is to Germany, every German tries to switch to ENglish
with her.
That's funny. I did generally have most people switch to English with
me, likely so I would stop butchering their language. Although there was
I think my funniest personal experience was when I got back to Germanyafter my units deployment in Desert Storm. I'm in the army, obvious military hair cut. I was sitting in the outdoor area of a cafe enjoying the quiet and a beer or three. An
older American couple came and sat at a nearby table, the Husband loudlytelling his wife about his time near there back during and after WWII. no attempt at all to speak German, so the waitress was ignoring them. So they turn
speak English. So let it be written, So let it be done.
I did say, "when" for my German failing me.
I should've thought of that. I wonder how many holes they need in their box?
and I answered it will... which amounts to the same thing, in that I'm expecting it to fail, just not sure when. So expecting it to fail you
can think about what else you can do when it does in advance :)
figured out that they wanted me to put the entire basket on the
counter. And later realized that they said "ganz" something,
and "ganz" means "complete" or something along that line.
Hmm ich habe sehen ganz nur "ganz gut". Aber es ist „hnlich alles.
Re: Re: GDPR and BBSes
By: Joacim Melin to Ogg on Fri Oct 09 2020 12:04 pm
It can be argued that a BBS can be view upon as a private club and as such a BBS is exempt from GDPR since you are allowed to store
any of the information listed above without consent from the user/member.
Wow really? Private clubs can get and keep that info that way? Can
they use it for marketing purposes etc?
Wow really? Private clubs can get and keep that info that way? Can
they use it for marketing purposes etc?
My understanding is that yes: they can. Because you joined a private club out of your own free will you also have to agree to whatever rules or TOS they operate by. Should you leave said club they have to delete your information in a timely manner and also upon request show all, if any, records they have containing information about you.
Joacim wrote (2020-10-24):
Wow really? Private clubs can get and keep that info that way? Can
they use it for marketing purposes etc?
My understanding is that yes: they can. Because you joined a private club
out of your own free will you also have to agree to whatever rules or TOS
they operate by. Should you leave said club they have to delete your
information in a timely manner and also upon request show all, if any,
records they have containing information about you.
Fidonet or a BBS is neither a private club nor is there an exception
for private clubs in the GDPR (AFAIK). "GDPR does not apply to the processing of personal data by a natural person in the exercise of a
purely personal or household activity".
See: https://www.fff-legal.com/the-household-exemption-in-gdpr/
That's where each country may draw their own conclusions (as someone rightly pointed out earlier). Here in Sweden there is such a clause for private clubs and as a SysOP I can choose who I let into my BBS and who I don't so I would view a BBS as a private club. Fidonet or FSXNet is another matter.
| Sysop: | sneaky |
|---|---|
| Location: | Ashburton,NZ |
| Users: | 28 |
| Nodes: | 8 (0 / 8) |
| Uptime: | 35:22:04 |
| Calls: | 2,013 |
| Calls today: | 3 |
| Files: | 11,119 |
| Messages: | 944,259 |