3 ms·

> What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! Elizabeth Denham, UK's information commissioner in charge of da

by Radim 9y ago

> What's the minimum amount of data? Who decides that? Is it dependent on context? I'd hope so! Elizabeth Denham, UK's information commissioner in charge of data protection enforcement, had this to say: "Having larger fines is useful but I think fundamentally what I'm saying is it's scaremongering to suggest that we're going to be making early examples of organisations that breach the law or that fining a top whack is going to become the norm. Our office will be more lenient on companies that have shown awareness of the GDPR and tried to implement it, when compared to those that haven't made any effort." In other words, the compliance decision is not in your hands, but there's a promise of certain lenience. At least to start with. A practical trouble is that once a company reaches a certain size, they no longer even know what data they have, never mind why. Do we already store personal data? Where? Is it important data such as "names + credit cards", or some god-forgotten IP addresses in a log? Email archives and attachments? How about GoogleDrive and SharePoint? Then, do we redact it, or delete it? How? How do we answer Subject Access Requests? We've built a product to help companies take care of the most common "private data" cases (https://gdpr-tools.eu https://gdpr-tools.eu), but we're not fooling ourselves that we've solved "personal data". Or that the task is even solvable. That whole space is very much in turmoil and how hard the GDPR whip will get cracked remains to be seen. Funnily, one of the common fears that clients have is not about the general public. It comes from disgruntled employees ratting on the company. Employees know best where personal data is stored (and often no one else in the company does), so they can really do some surgical damage by reporting their employer to the "authorities".

jacquesm 9y ago
> A practical trouble is that once a company reaches a certain size, they no longer even know what data they have, never mind why. That's a very good reason to do a little inventory then. Not knowing what data you have is a real problem in my book.
- Radim 9y ago
  Indeed, and not only yours. The same issue crops up in B2B due diligence and risk management, irrespective of GDPR. The automated inventory analysis tools, like ours and others, are only just becoming useful thanks to ML. The previous generation was mostly regex-based and mired by constant false alarms.
x0x0 9y ago
Except that's precisely 1/28 of the regulators to which you are subject if you are an American company and, therefore, most likely don't have a lead regulator.

by Radim 9y ago

jacquesm 9y ago

> A practical trouble is that once a company reaches a certain size, they no longer even know what data they have, never mind why. That's a very good reason to do a little inventory then. Not knowing what data you have is a real problem in my book.

Radim 9y ago
Indeed, and not only yours. The same issue crops up in B2B due diligence and risk management, irrespective of GDPR. The automated inventory analysis tools, like ours and others, are only just becoming useful thanks to ML. The previous generation was mostly regex-based and mired by constant false alarms.

x0x0 9y ago

Except that's precisely 1/28 of the regulators to which you are subject if you are an American company and, therefore, most likely don't have a lead regulator.