6 ms·
> The GDPR says when you collect data, you have to tell the user what you intend to use it for. Then that part is worthless, just another click-through "agreem
by msla 9y ago
> The GDPR says when you collect data, you have to tell the user what you intend to use it for.
Then that part is worthless, just another click-through "agreement" practically nobody reads.
That part won't change anything.
> So if your business purpose is to mail something to the customer, full physical address is OK to collect. If your business purpose is to help them find a nearby store location, you may be expected to collect something less granular like ZIP code or metro area, depending on how many locations you have.
I always wonder one thing: Is the penalty going to be high enough to justify not breaking this law?
All business decisions are cost-benefit. If the costs of doing something outweigh the benefit, you don't do that. This includes following the law: If you can reliably get more money by breaking the law, you break the law, and pay the penalty if you get caught. Unless you're very unlucky, you're still right-side-up after you pay the penalty, so your behavior was, on the whole, justified.
- lmkg 9y ago> Then that part is worthless GDPR requires that the use cases be itemized, and the user can opt out of each one individually. So if the user opts out of receiving a mailing but not the store locator, you have to manage how much data you collect about that person. I agree that for the most part this will just be another click-through like the cookie law was, but companies will be required to accommodate those minority that do care. > Is the penalty going to be high enough to justify not breaking this law? The penalty is up to 4% of annual global revenue. Global revenue.
- robin_reala 9y agoAlmost, it requires the users to actively opt in rather than opt-out.
- Someone 9y agoUp to 4% or €20 million, whichever is greater.
- deleted 9y ago[deleted]
- mamon 9y agoLet me get it straight: if your global revenue is €10 million, you won't pay 4%(€400k) penalty, you'll pay €20 million, because it's greater of the two? It seems like this will be especially harmful to small companies.
- Someone 9y agoUp to $20 million, depending on the severity of the infringement. I think the reason that floor is there is to handle cases where an organization doesn’t have much revenue, either through accounting shenanigans or because it is a non-profit (made up example: a free PDF to text converter that claims to be stateless but mines passwords and information to blackmail people with)
- ec109685 9y agoNot every little thing needs to be opted into individually. If you have a legitimate use of data for the user’s benefit, you can collect that data after a general consent as long as you provide a way for the user to see that data and delete it. If you use that data for your own benefits (like building an advertising profile), that needs to be opted into separately.
- PeterisP 9y agoThe fines are up to €20 million, or 4% annual global turnover – whichever is higher. Of course, paying the fine doesn't mean that you can continue with the action - it'd also likely involve imposing a temporary or permanent ban on data processing and ordering the rectification, restriction or erasure of data gathered unlawfully.