3 ms·

> I suspect [...] probably [...] This kind of subjective enforcement annoys me. In the meantime, in my risk assessment I have to weigh the largest possible ris

> I suspect [...] probably [...] This kind of subjective enforcement annoys me. In the meantime, in my risk assessment I have to weigh the largest possible risk. It is quite strange how often many EU laws are defended because of enforcement and not the letter of the law. If they are only going after the most flagrant, codify it. If they are not going to put SMB's out of business with a maximum fine, codify it. This article is a "trust us" which I abhor in lieu of more specific punishment rules. The rest of us running SMBs and not needing more customers in the EU are just not going to gamble with what side of the bed the punishers wake up on.

geocar 9y ago
The ICO (for example) has excellent English-language guidance on the GDPR. https://ico.org.uk/for-organisations/business/ https://ico.org.uk/for-organisations/business/ > codify it It is very difficult in my experience to make lawmakers and lawyers experts in digital marketing, telesales, medical processing, machine learning, banking and anti-money laundering and so on, so a lot of our regulation is just “do your best” and “don’t be a dick” anyway. This works remarkably well- CEOs of billion dollar companies are asking if their IT/IS systems are actually secure which is a massive improvement over what I used to see: “are we compliant” Well Equifax was probably compliant. I much prefer companies seek more than sheer profit, and to have restraint when it comes to putting peoples lives and livelihoods at risk. > (we) are just not going to gamble with what side of the bed the punishers wake up on. With all due respect, unless you go to war (which has different risks), or you ask everyone if they’re European when they reach your website (ie before you’ve given them a cookie or logged their data in your access logs; or telephone and so on) you’re going to have to. The GDPR is already law. The good news is that European law is rather fair, and if you’re not dealing with personal data as a product you probably aren’t going to be affected at all.

geocar 9y ago

The ICO (for example) has excellent English-language guidance on the GDPR. https://ico.org.uk/for-organisations/business/ https://ico.org.uk/for-organisations/business/ > codify it It is very difficult in my experience to make lawmakers and lawyers experts in digital marketing, telesales, medical processing, machine learning, banking and anti-money laundering and so on, so a lot of our regulation is just “do your best” and “don’t be a dick” anyway. This works remarkably well- CEOs of billion dollar companies are asking if their IT/IS systems are actually secure which is a massive improvement over what I used to see: “are we compliant” Well Equifax was probably compliant. I much prefer companies seek more than sheer profit, and to have restraint when it comes to putting peoples lives and livelihoods at risk. > (we) are just not going to gamble with what side of the bed the punishers wake up on. With all due respect, unless you go to war (which has different risks), or you ask everyone if they’re European when they reach your website (ie before you’ve given them a cookie or logged their data in your access logs; or telephone and so on) you’re going to have to. The GDPR is already law. The good news is that European law is rather fair, and if you’re not dealing with personal data as a product you probably aren’t going to be affected at all.