5 ms·

> ...they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). > What's the minimum amount

by lmkg 9y ago

> ...they list "Minimize the amount of collected data" as as an item (supposedly to be achieved to be in compliance with the law). > What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! The GDPR says when you collect data, you have to tell the user what you intend to use it for. "Minimization" applies within the context of those stated uses. So if your business purpose is to mail something to the customer, full physical address is OK to collect. If your business purpose is to help them find a nearby store location, you may be expected to collect something less granular like ZIP code or metro area, depending on how many locations you have. As a corollary, if you can't link a piece of data to a business use, you shouldn't be collecting it. This was a good idea before, but GDPR makes it more relevant. Note that this is similar to the ethical guidelines for medical research. "Harm Minimization" is a central pillar of ethical research. Harm, and risk of harm, is acceptable, but there is an affirmative duty to seek the least-harmful means of achieving your goal from those available. > That's a really unsettling description of a law. That's how HIPAA works, actually. I have a professor who argues this model of legislation is more effective than traditional sector-specific regulation, because it puts the onus of subject-matter expertise onto the people who are actually subject-matter experts, and because it allows for creative and adaptive solutions.

msla 9y ago
> The GDPR says when you collect data, you have to tell the user what you intend to use it for. Then that part is worthless, just another click-through "agreement" practically nobody reads. That part won't change anything. > So if your business purpose is to mail something to the customer, full physical address is OK to collect. If your business purpose is to help them find a nearby store location, you may be expected to collect something less granular like ZIP code or metro area, depending on how many locations you have. I always wonder one thing: Is the penalty going to be high enough to justify not breaking this law? All business decisions are cost-benefit. If the costs of doing something outweigh the benefit, you don't do that. This includes following the law: If you can reliably get more money by breaking the law, you break the law, and pay the penalty if you get caught. Unless you're very unlucky, you're still right-side-up after you pay the penalty, so your behavior was, on the whole, justified.
- lmkg 9y ago
  > Then that part is worthless GDPR requires that the use cases be itemized, and the user can opt out of each one individually. So if the user opts out of receiving a mailing but not the store locator, you have to manage how much data you collect about that person. I agree that for the most part this will just be another click-through like the cookie law was, but companies will be required to accommodate those minority that do care. > Is the penalty going to be high enough to justify not breaking this law? The penalty is up to 4% of annual global revenue. Global revenue.
  - robin_reala 9y ago
    Almost, it requires the users to actively opt in rather than opt-out.
  - Someone 9y ago
    Up to 4% or €20 million, whichever is greater.
    - deleted 9y ago
      [deleted]
    - mamon 9y ago
      Let me get it straight: if your global revenue is €10 million, you won't pay 4%(€400k) penalty, you'll pay €20 million, because it's greater of the two? It seems like this will be especially harmful to small companies.
      - Someone 9y ago
        Up to $20 million, depending on the severity of the infringement. I think the reason that floor is there is to handle cases where an organization doesn’t have much revenue, either through accounting shenanigans or because it is a non-profit (made up example: a free PDF to text converter that claims to be stateless but mines passwords and information to blackmail people with)
  - 9y ago
dominotw 9y ago
my company seems to be going on a encrypt everything spree. I am not sure how GDPR requires encryption. Can you be GDPR complaint ( in theory) with zero encryption?
- grabeh 9y ago
  The GDPR, as with existing EU data protection law requires technical & organisational measures in place to protect data. The GDPR specifically calls out (Article 32 if you're interested) encryption as one measure that entities should consider in determining whether their technical & organisational measures are fit for purpose. Generally speaking, encryption is an obvious choice when it comes to measures designed to protect user data.
- Radim 9y ago
  Of course—if you don't store personal data (trivially). In fact, encryption (security) is mostly orthogonal to how you track and handle personal and sensitive data (privacy protection). You could encrypt everything and still be wildly GDPR non-compliant, if the encrypted information you're storing lacks clear purpose and explicit consent.
  - wglb 9y ago
    To further emphasize your point You could encrypt everything and still be wildly GDPR non-compliant, we need to be able to respond to a request by each and every individual user to delete the information that they no longer wish us to carry.
    - gnud 9y ago
      ... unless you actually need that data (billing for past services, keeping records as required by law, etc).
  - bostik 9y ago
    Indeed. We store data encrypted because it A) leaves no room for misunderstanding with different regulators or their respective auditors, and B) provides a computationally infeasible barrier against accidental personal information disclosure even if the storage system was improperly decommissioned Point B in particular can be explained to auditors without problems. They understand both the intent and the technical measures put in place. But how we store data is only tangentially relevant to how we handle data. Let alone what we need to collect in the first place. (The KYC/AML/SOW requirements in gambling are quite demanding; they impose significant data collection and retention needs.)
MayeulC 9y ago
> So if your business purpose is to mail something to the customer, full physical address is OK to collect. If your business purpose is to help them find a nearby store location, you may be expected to collect something less granular like ZIP code or metro area, depending on how many locations you have. I would also like to stress out that, from my understanding, this data would rather be deleted immediately after use. That is, not saved at all after the query, or the delivery, unless the user explicitly opted-in to give you such data for advertising, etc...

by lmkg 9y ago

msla 9y ago

> The GDPR says when you collect data, you have to tell the user what you intend to use it for. Then that part is worthless, just another click-through "agreement" practically nobody reads. That part won't change anything. > So if your business purpose is to mail something to the customer, full physical address is OK to collect. If your business purpose is to help them find a nearby store location, you may be expected to collect something less granular like ZIP code or metro area, depending on how many locations you have. I always wonder one thing: Is the penalty going to be high enough to justify not breaking this law? All business decisions are cost-benefit. If the costs of doing something outweigh the benefit, you don't do that. This includes following the law: If you can reliably get more money by breaking the law, you break the law, and pay the penalty if you get caught. Unless you're very unlucky, you're still right-side-up after you pay the penalty, so your behavior was, on the whole, justified.

lmkg 9y ago
> Then that part is worthless GDPR requires that the use cases be itemized, and the user can opt out of each one individually. So if the user opts out of receiving a mailing but not the store locator, you have to manage how much data you collect about that person. I agree that for the most part this will just be another click-through like the cookie law was, but companies will be required to accommodate those minority that do care. > Is the penalty going to be high enough to justify not breaking this law? The penalty is up to 4% of annual global revenue. Global revenue.
- robin_reala 9y ago
  Almost, it requires the users to actively opt in rather than opt-out.
- Someone 9y ago
  Up to 4% or €20 million, whichever is greater.
  - deleted 9y ago
    [deleted]
  - mamon 9y ago
    Let me get it straight: if your global revenue is €10 million, you won't pay 4%(€400k) penalty, you'll pay €20 million, because it's greater of the two? It seems like this will be especially harmful to small companies.
    - Someone 9y ago
      Up to $20 million, depending on the severity of the infringement. I think the reason that floor is there is to handle cases where an organization doesn’t have much revenue, either through accounting shenanigans or because it is a non-profit (made up example: a free PDF to text converter that claims to be stateless but mines passwords and information to blackmail people with)
- 9y ago

dominotw 9y ago

my company seems to be going on a encrypt everything spree. I am not sure how GDPR requires encryption. Can you be GDPR complaint ( in theory) with zero encryption?

grabeh 9y ago
The GDPR, as with existing EU data protection law requires technical & organisational measures in place to protect data. The GDPR specifically calls out (Article 32 if you're interested) encryption as one measure that entities should consider in determining whether their technical & organisational measures are fit for purpose. Generally speaking, encryption is an obvious choice when it comes to measures designed to protect user data.
Radim 9y ago
Of course—if you don't store personal data (trivially). In fact, encryption (security) is mostly orthogonal to how you track and handle personal and sensitive data (privacy protection). You could encrypt everything and still be wildly GDPR non-compliant, if the encrypted information you're storing lacks clear purpose and explicit consent.
- wglb 9y ago
  To further emphasize your point You could encrypt everything and still be wildly GDPR non-compliant, we need to be able to respond to a request by each and every individual user to delete the information that they no longer wish us to carry.
  - gnud 9y ago
    ... unless you actually need that data (billing for past services, keeping records as required by law, etc).
- bostik 9y ago
  Indeed. We store data encrypted because it A) leaves no room for misunderstanding with different regulators or their respective auditors, and B) provides a computationally infeasible barrier against accidental personal information disclosure even if the storage system was improperly decommissioned Point B in particular can be explained to auditors without problems. They understand both the intent and the technical measures put in place. But how we store data is only tangentially relevant to how we handle data. Let alone what we need to collect in the first place. (The KYC/AML/SOW requirements in gambling are quite demanding; they impose significant data collection and retention needs.)

MayeulC 9y ago

> So if your business purpose is to mail something to the customer, full physical address is OK to collect. If your business purpose is to help them find a nearby store location, you may be expected to collect something less granular like ZIP code or metro area, depending on how many locations you have. I would also like to stress out that, from my understanding, this data would rather be deleted immediately after use. That is, not saved at all after the query, or the delivery, unless the user explicitly opted-in to give you such data for advertising, etc...