4 ms·

About the GDPR, can anyone recommend a company in the UK they have dealt with, that brought them up to compliance?

jacquesm 9y ago
If you aim to do this before May 15th you will find that anybody that is capable is fully booked for the remainder of 2018.
- no1youknowz 9y ago
  > you will find that anybody that is capable Define capable. Look at this thread as an example. Many answers contradict each other. There are so many ways to interpret the guidelines, which in many cases have not been thought through. I have engaged in discussions with 5 companies located in the UK. All gave differing answers on specific questions relating to data for marketing, finance, and fraud.
  - jacquesm 9y ago
    That was my point. You need to know the law inside out to be able to tell someone exactly what to do in their situation. We - our little band of friends - have been reading up on this subject since the previous privacy law was enacted and all I can tell you is that it is much easier to spot things that are in conflict with the law(s) as written than to come up with a single workable solution that does not leave things open to interpretation. Even so, these laws are good, they will force people to wake up to the underlying issues and to begin to think about their responsibilities when before the mantra seems to have been that any effort spent on privacy and security is better spent on growing the business because otherwise the other guy that doesn't care about those things will eat your lunch.
    - no1youknowz 9y ago
      > That was my point. Was it? Let me be blunt for a second. When someone asks for recommendations. If you are able to help that person, then please do so. It helps them and it may help others in the HN community. What you should not be doing, is your previous reply. In no way was it warranted, nor was it solicited. If you wish to make such statements known. Feel free to post your own comment or replying elsewhere. I cannot believe some elements of HN behave in this manner.
      - jacquesm 9y ago
        > When someone asks for recommendations. If you are able to help that person, then please do so. No. Recommending commercial entities to others is not what HN is for. If you want such a thing you are more than welcome to contact me or others out-of-band. > It helps them and it may help others in the HN community. Yes, or it may steer them in the wrong direction entirely. I don't think this sort of advice is best dispensed through a public forum, reputations of companies are at stake and without enough context it is impossible to make a good advice to begin with. It is closely related to people dispensing legal advice in forums, better yet if they're not lawyers. The line that comes to mind is 'advice is worth what you pay for it'. > What you should not be doing, is your previous reply. In no way was it warranted, nor was it solicited. That's your opinion, mine is a different one. I get regularly asked to recommend services or companies (by those companies and by their prospective customers) and as a rule I will only do this if I familiar with both parties and consider them a good fit. That's a thing borne from experience, which again you may disagree with but this has served me well over the years. > I cannot believe some elements of HN behave in this manner. And I can not believe that you feel that you are doing any better with this comment.
  - outsideoflife 9y ago
    General compliance advice 1) Act in good faith. DPA fines seem to have been to people who had a blatant disregard for data protection and their customers, not those who tried hard but committed some technical breach. 2) Whenever new rules come out there is a long period of interpretation. Unless you are in a very high risk category I wouldn't 'throw the baby out with the bath-water' in the interim. 3) Documentation wins court cases. 4) Personally I was already trying not to have my data stolen, so I am not overly concerned by GDPR. I am updating some policies, employee handbooks and terms. I will watch how other companies deal with it before I act too rashly.
    - jacquesm 9y ago
      The most important bit that you can do that is actionable and that will not be open to interpretation is to have someone competent write a clause into employment contracts regarding data confidentiality, to put in place a protocol on how to deal with various levels of breaches and to review your sites privacy policy to ensure that it is still applicable (this is something you should be doing regularly anyway). On the whole I think your approach is a very balanced and reasonable one, especially the 'act in good faith' bit. What surprises me is that plenty of companies explicitly do not act in good faith and try to interpret the directive creatively so that they can continue to do what they were already doing without modification. That's asking for trouble in my opinion, some companies in that bracket will find themselves in the un-enviable position of being used to educate the rest. Especially in adtech and marketing there will be a lot of tension between business goals and the law as written and the finer you want to ride that line the more important it becomes to have competent guidance.

If you aim to do this before May 15th you will find that anybody that is capable is fully booked for the remainder of 2018.

no1youknowz 9y ago
> you will find that anybody that is capable Define capable. Look at this thread as an example. Many answers contradict each other. There are so many ways to interpret the guidelines, which in many cases have not been thought through. I have engaged in discussions with 5 companies located in the UK. All gave differing answers on specific questions relating to data for marketing, finance, and fraud.
- jacquesm 9y ago
  That was my point. You need to know the law inside out to be able to tell someone exactly what to do in their situation. We - our little band of friends - have been reading up on this subject since the previous privacy law was enacted and all I can tell you is that it is much easier to spot things that are in conflict with the law(s) as written than to come up with a single workable solution that does not leave things open to interpretation. Even so, these laws are good, they will force people to wake up to the underlying issues and to begin to think about their responsibilities when before the mantra seems to have been that any effort spent on privacy and security is better spent on growing the business because otherwise the other guy that doesn't care about those things will eat your lunch.
  - no1youknowz 9y ago
    > That was my point. Was it? Let me be blunt for a second. When someone asks for recommendations. If you are able to help that person, then please do so. It helps them and it may help others in the HN community. What you should not be doing, is your previous reply. In no way was it warranted, nor was it solicited. If you wish to make such statements known. Feel free to post your own comment or replying elsewhere. I cannot believe some elements of HN behave in this manner.
    - jacquesm 9y ago
      > When someone asks for recommendations. If you are able to help that person, then please do so. No. Recommending commercial entities to others is not what HN is for. If you want such a thing you are more than welcome to contact me or others out-of-band. > It helps them and it may help others in the HN community. Yes, or it may steer them in the wrong direction entirely. I don't think this sort of advice is best dispensed through a public forum, reputations of companies are at stake and without enough context it is impossible to make a good advice to begin with. It is closely related to people dispensing legal advice in forums, better yet if they're not lawyers. The line that comes to mind is 'advice is worth what you pay for it'. > What you should not be doing, is your previous reply. In no way was it warranted, nor was it solicited. That's your opinion, mine is a different one. I get regularly asked to recommend services or companies (by those companies and by their prospective customers) and as a rule I will only do this if I familiar with both parties and consider them a good fit. That's a thing borne from experience, which again you may disagree with but this has served me well over the years. > I cannot believe some elements of HN behave in this manner. And I can not believe that you feel that you are doing any better with this comment.
- outsideoflife 9y ago
  General compliance advice 1) Act in good faith. DPA fines seem to have been to people who had a blatant disregard for data protection and their customers, not those who tried hard but committed some technical breach. 2) Whenever new rules come out there is a long period of interpretation. Unless you are in a very high risk category I wouldn't 'throw the baby out with the bath-water' in the interim. 3) Documentation wins court cases. 4) Personally I was already trying not to have my data stolen, so I am not overly concerned by GDPR. I am updating some policies, employee handbooks and terms. I will watch how other companies deal with it before I act too rashly.
  - jacquesm 9y ago
    The most important bit that you can do that is actionable and that will not be open to interpretation is to have someone competent write a clause into employment contracts regarding data confidentiality, to put in place a protocol on how to deal with various levels of breaches and to review your sites privacy policy to ensure that it is still applicable (this is something you should be doing regularly anyway). On the whole I think your approach is a very balanced and reasonable one, especially the 'act in good faith' bit. What surprises me is that plenty of companies explicitly do not act in good faith and try to interpret the directive creatively so that they can continue to do what they were already doing without modification. That's asking for trouble in my opinion, some companies in that bracket will find themselves in the un-enviable position of being used to educate the rest. Especially in adtech and marketing there will be a lot of tension between business goals and the law as written and the finer you want to ride that line the more important it becomes to have competent guidance.