5 ms·

Good. Perhaps there will be fewer reckless start-ups who sell on my personal details without permission.

• jl6 9y ago
  Your insurance will cost more because implementing GDPR is costing insurance companies a lot of money.
  • geocar 9y ago
    I hope so. If they were putting my data at risk because they didn't have enough money, then this was required, right?
    • jenscow 9y ago
      Yes, exactly. "Unfortunately we have to increase prices, because we now have be careful with your personal data"
  • peteretep 9y ago
    I am comfortable with this.
    • janemanos 9y ago
      Well, the cost for GDPR won't be that high, if the EU would have thought this through. Talked to a few of the GDPR "Consultants" and as soon as people have some more in-depth questions how A or B can be handled, you just get a surprised look. I'm all for better protecting my information but if you introduce these regulations you, as the regulator, also have to have answers to basic questions.
      • jimnotgym 9y ago
        > Talked to a few of the GDPR "Consultants" and as soon as people have some more in-depth questions how A or B can be handled, you just get a surprised look. I'm all for better protecting my information but if you introduce these regulations you, as the regulator, also have to have answers to basic questions. Talk to better consultants. Consultants are not the regulator. The regulation itself is in plain language. What do you consider is not thought through?
        • amarkov 9y ago
          I must delete personal data "without undue delay". This opens up a few questions, which as far as I can tell the text of the regulation provides no guidance for. * I (like most companies) have a variety of unstructured and/or immutable logs. I can't just DROP FROM table WHERE. Is it acceptable to delete this data by waiting a few days for a retention period to expire, or do I have to retrofit deletion functionality in? * What if the retention period is a week, or a month? What if I've been advised to establish those longer retention periods for other reasons? * If a bug is found in the data deletion workflow, is it an undue delay to say we'll tackle it next sprint? Do we need to drop everything and make it a priority now? * Once we've resolved a personal data deletion bug, is it an undue delay to roll it out slowly over a week? Does it matter if this is our standard rollout process, or if there's a risky hotfix process we're deliberately choosing not to use?
          • vidarh 9y ago
            For logs, I'll suggest you aim to avoid personal data in the logs, and if necessary only log an anonymous id and separately keep a mapping to a user for the bare minimum amount of time needed, and in a way that let you explicitly delete it easily. A lot of the "problems" of the GDPR goes away if you minimize the amount of personal data you process and retain, which incidentally generally will be good for your security as well.
            • amarkov 9y ago
              A lot of the problems of the GDPR do indeed go away if you're building your systems from scratch, using data privacy standards significantly beyond what GDPR mandates. Surely you see why this doesn't weaken the claim that it's hard for existing companies to understand what must be done to comply.
              • vidarh 9y ago
                No, I don't, because the point is that my applying principles that are good to follow anyway, you reduce your exposure to a point where you don't really need to worry about what needs to be done to comply. At the same time you're improving security etc. as well (including internal security; e.g. I've deployed approaches like that at clients whose original intent was to prevent employees from accessing data they shouldn't, and where simplifying following data protection regulation was simply gravy)
      • peteretep 9y ago
        I am currently elbow deep in a complicated GDPR project, and I disagree with your take on it.
  • analog31 9y ago
    Did my insurance costs go down when companies started gathering and storing my personal information? I figure, if this stuff starts costing them more than a token amount, they can direct their IT manager to systematically erase the personal information that isn't utterly vital to their immediate business needs.
    • jl6 9y ago
      One example of the increased costs due to GDPR are that data subject access requests are now free to make. In the UK they used to cost £10. A small amount which never really covered the cost of fulfilling the request, but enough to deter frivolous mass use. Now that such requests are free, there is no deterrent and companies must introduce a scalable process for dealing with them (or risk being swamped and unable to meet the 30 day deadline). This will actually be easier for companies like Google and Facebook to comply with, as they are digital natives. Financial services is an industry struggling with a burden of legacy systems, and even paper-based processes still. This one GDPR provision alone is causing much expense and heartache.
      • lagadu 9y ago
        > Financial services is an industry struggling with a burden of legacy systems, and even paper-based processes still. This one GDPR provision alone is causing much expense and heartache. That's a good thing. If it's causing much expense and heartache it means that our private data wasn't being handled with the necessary care and attention to value that it needed to be.