8 ms·

It seems to me that this letter is similar to a denial of service attack in the way that, although a valid request, it places an impossible burden on the recipi

It seems to me that this letter is similar to a denial of service attack in the way that, although a valid request, it places an impossible burden on the recipient. If so, the GDPR is similar to a broken protocol. Maybe the people who designed it assume that it will never be misused. Anyone with experience designing protocols could tell them how dangerously naive that is.

edent 9y ago
If you can't answer those questions in a few button clicks, then you probably can't be trusted with my personal data. We keep being told that "data is the new oil". It is. Not for money making opportunities, but because you have to handle it responsibly and if it leaks it will cost millions to clean up.
- Erlangolem 9y ago
  (Deleted)
  - mattzito 9y ago
    You know that the GDPR violation fines start at 10m or 2% of worldwide revenue, whichever is higher, right?
    - detaro 9y ago
      These are up to limits, not start at. The second class is 20 million/4%, but still up to. And given the long list of factors to consider for the fining authority, they can't just slap close-to-max amounts around without supporting evidence for why that's appropriate.
- montrose 9y ago
  Or you are an early-stage startup with just a couple founders trying to do everything.
  - setquk 9y ago
    Incidentally the minimum viable products that the early stage startups with two founders are kicking off are the ones that are most likely to put your data at risk. This is fair and just.
  - detaro 9y ago
    What exactly about being a startup makes this a lot harder? I'd expect a startup would in many cases have a fairly easy time answering requests like this, since it won't have built years worth of legacy systems, half-abandoned projects, weird cross-department data accesses etc that could catch a large company here. You'll likely have fairly centralized storage and a reasonable number of service providers you use for specific purposes. + the typical startup has more or less the same relationship with every customer, so it should be fairly easily repeatable once you've documented it once. For the few small companies I've worked for, this would have been a bit of work once (document the dataflows), and then a fairly easy set of queries to be repeated each time.
    - montrose 9y ago
      Having fewer people. The task may only be 1/100 as hard for a startup as for Google, but there are 1/10,000 as many people to perform it. If so, the burden on the startup is 100x greater than on Google.
    - gingerlime 9y ago
      It's not just about answering the questions. It's also about answering them in a legal-safe way that won't put you in more trouble than not answering them at all. And any small variation in the questions can require someone with legal experience just checking this, which costs money. To add to a sibling comment, Google can afford a big enough legal department for estimated 0.00000x% of their turnover that deals exclusively with these. For smaller organizations, this becomes more like 0.x% of turnover... Not to mention the distraction and plain overhead when you're juggling so many other things.
      - jopsen 9y ago
wffurr 9y ago
If you can't answer these questions promptly, preferably with a form letter referring to the self service features of your website, then you are setting yourself up for this.
dtech 9y ago
In the Netherlands we have a similar problems due to the "Wet Openbaarheid Bestuur" (Law of Open Administration) Basically, you can request any non-sensitive information from any government agency and they have to provide it within a reasonable term or pay a fine to the requester. This caused people to request all calibration reports of a speed camera if they got a ticket, because for quite some time the government would waive the ticket if you stopped the request. When it got abused too widely they automated the process and now it's not a problem. This is also how large coorporations should handle this problem.
- rdlecler1 9y ago
  Large corporation have the resources for this. Small startups that are built on an ecosystem of services do not.
  - Sylos 9y ago
    Nor do small startups have to fear request traffic that's in any way comparable to what a big company can expect.
  - sgift 9y ago
    Then they either shouldn't process private data or should only work with services that can provide such information. No one needs to process personal data - if you don't the answer is a matter of seconds.
    - Sevii 9y ago
      Then you have a government enforced monopoly for large companies in the personal data space.
      - roma1n 9y ago
        Not really. You have what already exists for handling investments, e.g. you pay Yomoni (a tiny startup) to make decisions for you but your money is handled by one of the big banks e.g. Crédit Agricole. Your point is somewhat valid, but also amounts to "there is a government-enforced monopoly for large companies in the airliner production space". Damn right there is. For the same safety reasons.
BjoernKW 9y ago
You don't even need experience with designing protocols to understand that. Real-life experience with how law is practised in some EU member countries is enough. There are law firms whose sole business model is targeting small companies for not complying with certain regulations like legal notice requirements or disclaimers on websites. Only time will tell if this will be the case with GDPR but there definitely is a risk that this new regulation will be abused by dubious players.
geocar 9y ago
The regulators aren't stupid and have thought of this. See: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/ https://ico.org.uk/for-organisations/guide-to-the-general-da... https://ico.org.uk/for-the-public/personal-information/ https://ico.org.uk/for-the-public/personal-information/ You can wait 3 months (not one). You can charge £10 if the request is complicated.
- tetromino_ 9y ago
  A £10 fee for a ridiculous fishing expedition which would likely require at least one person-day of work, with that person probably being a knowledgeable and key employee? A $1000 fee would seem a little bit more fair.
  - setquk 9y ago
    Legislation compliance should be built in as part of your product offering. If you don’t that day’s work is just technical debt you chose to take on immediately.
    - deleted 9y ago
      [deleted]
  - Khol 9y ago
    This might seem fair to the person incurring the direct cost of the response, but is markedly unfair to the person earning minimum wage who is concerned about the handling of their personal data. The law needs to be applicable to everyone, and imposing high costs is generally considered to do the opposite: http://www.bbc.co.uk/news/uk-40727400 http://www.bbc.co.uk/news/uk-40727400
    - tetromino_ 9y ago
      A person earning minimum wage may be concerned about all sorts of things, and the degree of his concern can be entirely unrelated to (1) the likelihood of the concern being legitimate, (2) the potential monetary harm to the person, (3) the cost to society of investigating and reporting on it, and (4) how fairly this cost is allocated. It is utterly unfair to compare subsidized access to an employment tribunal (potential harm: months of undeserved unemployment, loss of home and possessions; cost of investigation: spread across the entire nation's taxpayers) to almost-free access to your GDPR privacy report (potential harm: a little bit of mental discomfort; cost of investigation: borne by one organization, potentially ruinous for a small business or solo project).
raverbashing 9y ago
> it places an impossible burden on the recipient Which items do you feel are an impossible burden? From what I see most of the items pertain to one of two possibilities: 1 - General procedures or information about the company (keep this updated and it's the same for all requests) 2 - Information about the subject (export their data in an automated fashion) The thing about 'decisions based on their data' might be tricky, but I guess you can share what you concluded from it and the overall rationale (for example, Facebook's "Why am I seeing this" over an ad)
bogomipz 9y ago
>".. it places an impossible burden on the recipient."? Impossible? Why is it not possible?
tschellenbach 9y ago
Its looks especially damaging to the already frail EU startup ecosystem.

edent 9y ago

If you can't answer those questions in a few button clicks, then you probably can't be trusted with my personal data. We keep being told that "data is the new oil". It is. Not for money making opportunities, but because you have to handle it responsibly and if it leaks it will cost millions to clean up.

Erlangolem 9y ago
(Deleted)
- mattzito 9y ago
  You know that the GDPR violation fines start at 10m or 2% of worldwide revenue, whichever is higher, right?
  - detaro 9y ago
    These are up to limits, not start at. The second class is 20 million/4%, but still up to. And given the long list of factors to consider for the fining authority, they can't just slap close-to-max amounts around without supporting evidence for why that's appropriate.
montrose 9y ago
Or you are an early-stage startup with just a couple founders trying to do everything.
- setquk 9y ago
  Incidentally the minimum viable products that the early stage startups with two founders are kicking off are the ones that are most likely to put your data at risk. This is fair and just.
- detaro 9y ago
  What exactly about being a startup makes this a lot harder? I'd expect a startup would in many cases have a fairly easy time answering requests like this, since it won't have built years worth of legacy systems, half-abandoned projects, weird cross-department data accesses etc that could catch a large company here. You'll likely have fairly centralized storage and a reasonable number of service providers you use for specific purposes. + the typical startup has more or less the same relationship with every customer, so it should be fairly easily repeatable once you've documented it once. For the few small companies I've worked for, this would have been a bit of work once (document the dataflows), and then a fairly easy set of queries to be repeated each time.
  - montrose 9y ago
    Having fewer people. The task may only be 1/100 as hard for a startup as for Google, but there are 1/10,000 as many people to perform it. If so, the burden on the startup is 100x greater than on Google.
  - gingerlime 9y ago
    It's not just about answering the questions. It's also about answering them in a legal-safe way that won't put you in more trouble than not answering them at all. And any small variation in the questions can require someone with legal experience just checking this, which costs money. To add to a sibling comment, Google can afford a big enough legal department for estimated 0.00000x% of their turnover that deals exclusively with these. For smaller organizations, this becomes more like 0.x% of turnover... Not to mention the distraction and plain overhead when you're juggling so many other things.
    - jopsen 9y ago

wffurr 9y ago

If you can't answer these questions promptly, preferably with a form letter referring to the self service features of your website, then you are setting yourself up for this.

dtech 9y ago

In the Netherlands we have a similar problems due to the "Wet Openbaarheid Bestuur" (Law of Open Administration) Basically, you can request any non-sensitive information from any government agency and they have to provide it within a reasonable term or pay a fine to the requester. This caused people to request all calibration reports of a speed camera if they got a ticket, because for quite some time the government would waive the ticket if you stopped the request. When it got abused too widely they automated the process and now it's not a problem. This is also how large coorporations should handle this problem.

rdlecler1 9y ago
Large corporation have the resources for this. Small startups that are built on an ecosystem of services do not.
- Sylos 9y ago
  Nor do small startups have to fear request traffic that's in any way comparable to what a big company can expect.
- sgift 9y ago
  Then they either shouldn't process private data or should only work with services that can provide such information. No one needs to process personal data - if you don't the answer is a matter of seconds.
  - Sevii 9y ago
    Then you have a government enforced monopoly for large companies in the personal data space.
    - roma1n 9y ago
      Not really. You have what already exists for handling investments, e.g. you pay Yomoni (a tiny startup) to make decisions for you but your money is handled by one of the big banks e.g. Crédit Agricole. Your point is somewhat valid, but also amounts to "there is a government-enforced monopoly for large companies in the airliner production space". Damn right there is. For the same safety reasons.

BjoernKW 9y ago

You don't even need experience with designing protocols to understand that. Real-life experience with how law is practised in some EU member countries is enough. There are law firms whose sole business model is targeting small companies for not complying with certain regulations like legal notice requirements or disclaimers on websites. Only time will tell if this will be the case with GDPR but there definitely is a risk that this new regulation will be abused by dubious players.

geocar 9y ago

The regulators aren't stupid and have thought of this. See: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/ https://ico.org.uk/for-organisations/guide-to-the-general-da... https://ico.org.uk/for-the-public/personal-information/ https://ico.org.uk/for-the-public/personal-information/ You can wait 3 months (not one). You can charge £10 if the request is complicated.

tetromino_ 9y ago
A £10 fee for a ridiculous fishing expedition which would likely require at least one person-day of work, with that person probably being a knowledgeable and key employee? A $1000 fee would seem a little bit more fair.
- setquk 9y ago
  Legislation compliance should be built in as part of your product offering. If you don’t that day’s work is just technical debt you chose to take on immediately.
  - deleted 9y ago
    [deleted]
- Khol 9y ago
  This might seem fair to the person incurring the direct cost of the response, but is markedly unfair to the person earning minimum wage who is concerned about the handling of their personal data. The law needs to be applicable to everyone, and imposing high costs is generally considered to do the opposite: http://www.bbc.co.uk/news/uk-40727400 http://www.bbc.co.uk/news/uk-40727400
  - tetromino_ 9y ago
    A person earning minimum wage may be concerned about all sorts of things, and the degree of his concern can be entirely unrelated to (1) the likelihood of the concern being legitimate, (2) the potential monetary harm to the person, (3) the cost to society of investigating and reporting on it, and (4) how fairly this cost is allocated. It is utterly unfair to compare subsidized access to an employment tribunal (potential harm: months of undeserved unemployment, loss of home and possessions; cost of investigation: spread across the entire nation's taxpayers) to almost-free access to your GDPR privacy report (potential harm: a little bit of mental discomfort; cost of investigation: borne by one organization, potentially ruinous for a small business or solo project).

raverbashing 9y ago

> it places an impossible burden on the recipient Which items do you feel are an impossible burden? From what I see most of the items pertain to one of two possibilities: 1 - General procedures or information about the company (keep this updated and it's the same for all requests) 2 - Information about the subject (export their data in an automated fashion) The thing about 'decisions based on their data' might be tricky, but I guess you can share what you concluded from it and the overall rationale (for example, Facebook's "Why am I seeing this" over an ad)

bogomipz 9y ago

>".. it places an impossible burden on the recipient."? Impossible? Why is it not possible?

tschellenbach 9y ago

Its looks especially damaging to the already frail EU startup ecosystem.