5 ms·

In principle, yes. The intention behind and the principles outlined by the GDPR are good. However, the devil's in the details, specifically in how these princi

In principle, yes. The intention behind and the principles outlined by the GDPR are good. However, the devil's in the details, specifically in how these principles are supposed to be implemented. Some of these details are not quite clear yet. It's almost impossible to navigate these issues without getting at least some basic legal advice and investing a fair bit of time. Unfortunately, as often is the case with EU regulations these seem to be targeted mainly at larger companies or corporations, which can easily afford this because they have legal departments anyway. As a company that uses third-party services for data processing (which includes almost every piece of SaaS-type software) you have to sign a data processing agreement with each of those, which can mean considerable effort. Some suppliers unfortunately are not as well-prepared yet as they should be. Therefore now a company's processes continuing to run smoothly might depend on some third party getting their internal affairs in order. It's true they should've done this long before and one shouldn't continue to work with them if they fail to do so. Still, it's a problem you have to deal with. I agree that GDPR makes sense and it's a good idea to follow through with these measures. It won't be easy in each and every case though and it might be a bumpy ride at first, which is why I sincerely hope that in the beginning authorities will be lenient with parties that act in good faith.

jopsen 9y ago
OPs point is that if you act responsibly in good faith you'll probably avoid any issues, and likely be warned before they target you for maximum fines :)
- BjoernKW 9y ago
  I hope so. Unfortunately, that won't necessarily be the case. Small businesses have been specifically and routinely targeted by dubious law firms for not complying with certain regulations like legal notice requirements or disclaimers on websites. The EU and local as well as member state authorities also often are oblivious to problems smaller companies might have.
- x0x0 9y ago
  That's heavily dependent on the regulator in question, and there's 30-ish of them. Since American companies are very unlikely to have a lead regulator, you will need to comply with conflicting rulings from each. In half a dozen languages.
  - com 9y ago
    You will need to have a lead regulator (or I suppose a Privacy Shield listing while that is still legal) if you are doing significant business with EU data subjects’ personal data. See recital 80 and article 31 of the GDPR.
pbowyer 9y ago
> As a company that uses third-party services for data processing (which includes almost every piece of SaaS-type software) you have to sign a data processing agreement with each of those, which can mean considerable effort. At least for SaaS it's pretty clear-cut. For freelancers, contractors and consultants the situation is way more confused. AFAICT I need a data processing agreement with every client, even if I only log into their servers once a month to update WordPress and check their logs, because I am now deemed to be processing personal information. These details need talking about, and I've yet to see industry bodies doing so.
- PeterisP 9y ago
  IMHO it simply requires companies to make a clear choice. Either they have the organizational capacity to handle private information properly, or they should not do it at all. There's no reason for every company to get a data processing agreement with every SaaS they use as long as they're not putting private data of other people inside; and in most cases (except CRM and payment systems) they should not do so. There's no reason for every random company to get a data processing agreement with the contractor maintaining their WordPress site if that site doesn't contain any private information, and it probably should not. On the other hand, if it does, then giving full access to that data should be more difficult than simply giving the keys to a random contractor; the company is fully responsible for whatever you do ("Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject."), so that includes vetting you, being able to supervise what you've done, and probably some liability requirement. On the other hand, if that's a standard service you're providing, it all means that your standard agreement form just needs a few extra paragraphs to cover that data processing part. The log/IP address issue has technical solutions - you can use logrotate in combination with gnupg to ensure that logs are available if you need to analyze them, but are encrypted and not available to everyone logging on that server.
  - OrganicMSG 9y ago

jopsen 9y ago

OPs point is that if you act responsibly in good faith you'll probably avoid any issues, and likely be warned before they target you for maximum fines :)

BjoernKW 9y ago
I hope so. Unfortunately, that won't necessarily be the case. Small businesses have been specifically and routinely targeted by dubious law firms for not complying with certain regulations like legal notice requirements or disclaimers on websites. The EU and local as well as member state authorities also often are oblivious to problems smaller companies might have.
x0x0 9y ago
That's heavily dependent on the regulator in question, and there's 30-ish of them. Since American companies are very unlikely to have a lead regulator, you will need to comply with conflicting rulings from each. In half a dozen languages.
- com 9y ago
  You will need to have a lead regulator (or I suppose a Privacy Shield listing while that is still legal) if you are doing significant business with EU data subjects’ personal data. See recital 80 and article 31 of the GDPR.

pbowyer 9y ago

> As a company that uses third-party services for data processing (which includes almost every piece of SaaS-type software) you have to sign a data processing agreement with each of those, which can mean considerable effort. At least for SaaS it's pretty clear-cut. For freelancers, contractors and consultants the situation is way more confused. AFAICT I need a data processing agreement with every client, even if I only log into their servers once a month to update WordPress and check their logs, because I am now deemed to be processing personal information. These details need talking about, and I've yet to see industry bodies doing so.

PeterisP 9y ago
IMHO it simply requires companies to make a clear choice. Either they have the organizational capacity to handle private information properly, or they should not do it at all. There's no reason for every company to get a data processing agreement with every SaaS they use as long as they're not putting private data of other people inside; and in most cases (except CRM and payment systems) they should not do so. There's no reason for every random company to get a data processing agreement with the contractor maintaining their WordPress site if that site doesn't contain any private information, and it probably should not. On the other hand, if it does, then giving full access to that data should be more difficult than simply giving the keys to a random contractor; the company is fully responsible for whatever you do ("Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject."), so that includes vetting you, being able to supervise what you've done, and probably some liability requirement. On the other hand, if that's a standard service you're providing, it all means that your standard agreement form just needs a few extra paragraphs to cover that data processing part. The log/IP address issue has technical solutions - you can use logrotate in combination with gnupg to ensure that logs are available if you need to analyze them, but are encrypted and not available to everyone logging on that server.
- OrganicMSG 9y ago