7 ms·

If you get a letter like this, reply in plain language: Given that the "requests are complex or numerous", I will be responding within three months as recommen

by geocar 9y ago

If you get a letter like this, reply in plain language: Given that the "requests are complex or numerous", I will be responding within three months as recommended by the ICO[1]. Have a nice day. You now have plenty of time to deal with it properly. If you have a lot of data on someone, you can enumerate the categories (1) and then request they break it down (specifically request 1c; see Recital 63[2] of the GDPR for the exact language). Almost everything else should be in your privacy policy anyway. If you do not have a lot of data on someone, then three months should certainly be enough time to properly respond to this. Most businesses do not have any personal data on anyone beyond what you need for an invoice. If you have a dedicated CRM that contains leads of potential customers, or you use an online service like SalesForce, you can probably get their support in complying. [1]: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/ https://ico.org.uk/for-organisations/guide-to-the-general-da... [2]: http://www.privacy-regulation.eu/en/recital-63-GDPR.htm http://www.privacy-regulation.eu/en/recital-63-GDPR.htm

nopriorarrests 9y ago
Sorry, but ICO stands for "Information Commissioner Office", and they seem to be UK organization, having .uk domain and all that. How can they recommend anything with regard to EU-wide law? Or, stating differently, how their recommendation hold any value at all?
- Silhouette 9y ago
  The ICO is the government regulator responsible for data protection in the UK, and as such the people who are going to be enforcing the GDPR here.
- sharkdaysunrise 9y ago
  "The EU" doesn't enforce the GDPR, the Supervisory Authorities in each member state (like the ICO) enforce the GDPR. The member states have agreed to abide by the GDPR, but their own specific data protection laws are allowed have slight variations, e.g. the specific age limit defining minor vs. adult.
- kenbaylor 9y ago
  Each country will have a Data Protection Authority (DPA) which is the regulator in the country. The ICO is the one in the UK. The last letter of the GDPR is Regulation. A regulation is very different than than a Directive (the pre-GDPR law is based on a directive). There is very little wiggle-room with a Regulation, even between countries. The ICO also works with other DPAs currently as part of Working Party 29, which ensures the DPAs are working in Sync. So the ICO advice is worthy of close study, especially if your local DPA (assuming you have one) has not commented or given guidance on a certain matter.
  - barrkel 9y ago
    To add, the difference between directive and regulation is in Article 288 of the TFEU: To exercise the Union's competences, the institutions shall adopt regulations, directives, decisions, recommendations and opinions. A regulation shall have general application. It shall be binding in its entirety and directly applicable in all Member States. A directive shall be binding, as to the result to be achieved, upon each Member State to which it is addressed, but shall leave to the national authorities the choice of form and methods.
    - arrrg 9y ago
      Basically, a regulation is like a law. It’s directly binding as law. A directive is something member states have to implement themselves, probably also by passing a law using their own national process for doing so. As such there can be (greater) differences in the different national implementations of the directives.
- chasb 9y ago
  The ICO is seen as a leading voice, with some very good guidance, e.g.: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-the-general-da... They're widely respected, but you're right it remains to be seen whether UK and EU enforcement will diverge.
hedora 9y ago
Won’t adding round trips to the process (by sending letters indicating you’re delaying) just waste more of your lawyers’ billable hours? Anyway, the main target of this legislation are the hundreds of businesses you’ve never heard of brokering your personal information. I doubt they have salesforce leads for each person they track, and I think most people want to see that entire industry collapse. Similarly (in terms of regulatory burden, not consumer sentiment), most legit consumer businesses rely on razor thin transaction costs. Spending any additional per-customer human time could be the difference between profit and loss. To see the problem, consider what would happen if you walked into any store with affinity cards, and handed this letter to the manager.
- DanBC 9y ago
  > just waste more of your lawyers’ billable hours? Why are you using lawyers to respond to DPA / GDPR requests?
  - paulie_a 9y ago
    If anything that can be automated and it will waste their lawyers time. Sounds fun.
- geocar 9y ago
  > Won’t adding round trips to the process (by sending letters indicating you’re delaying) just waste more of your lawyers’ billable hours? There are only four requests in this letter, and they were written by a PWC consultant to appear as intimidating and confusing as possible, so a small business that does not have easy access to legal advice would not find it difficult to convince a regulator as such. That said, a lawyer can help you identify them and ignore the rest. For the cost-conscious, spending time on the ICO's website will also help you discover them so that when you talk to a lawyer you can be efficient with their time (and therefore your spending). > most legit consumer businesses... Most consumer businesses do not keep very much personal data, if the cost of understanding this letter within three months would cause a company to go into administration then they were going to fail anyway. > the main target of this legislation are the hundreds of businesses you’ve never heard of brokering your personal information. I doubt they have salesforce leads for each person they track I don't agree with this at all. Who do you think the "main target" of this legislation is?
ThePhysicist 9y ago
The GDPR gives you one month to reply to such requests by default, except if the nature of the request is so complex that you can believably justify why you'd need more time to reply to it. In general, I would recommend implementing automated procedures for answering such requests.
- geocar 9y ago
  How many of these requests do you expect? I imagine most companies might only deal with this once or perhaps twice ever, and if they do not keep very much personal data then automating it would not be very efficient use of their time. That's why in general I'd wait until you get such a request, ask your lawyer to explain it (will probably only cost a few hundred pounds), then decide what to do next. Only very large companies (or companies that deal with a lot of personal data) will benefit from up-front automation.
  - tobr 9y ago
    Since the content of the request is very generic and applies to almost any individual and business, it's not unthinkable that it will be automated on the other end, so anyone can push a button and send the request to hundreds of companies of their choosing. I certainly have several businesses in mind that I plan to send requests to once GDPR is in place. EDIT: Although I suppose small, non-EU businesses that mostly do not deal with personal data are unlikely to receive any requests. So you are probably right that "most companies" are unlikely receive GDPR requests.
    - kuschku 9y ago
      It’s already been automated. https://selbstauskunft.net/ https://selbstauskunft.net/ exists to allow you to send a BDSG §34 request (like GDPR request, but under the older German law for it) to basically any company. You select the company, sign it, and they automate all other steps. I’ve sent dozens just this week.
      - Jdam 9y ago
deleted 9y ago
[deleted]
foobarbazetc 9y ago
Honestly... none of the questions in this letter are that hard to answer. I really don’t see what the fuss is about if you run a semi-professional operation.
- x0x0 9y ago
  Then you haven't thought it through or don't understand the gdpr. Though this letter doesn't mention it, you not only have to provide all data in your systems -- every single db inside your company -- but also data from every 3rd party system. Your transactional emailer, your marketing emailer, your billing system, your logging system, your retargeting system, etc.
  - avianlyric 9y ago
    That’s not totally true. GDPR only applies if the data is stored in an “filing system”. Things like logs almost certainly don’t fall under that. (Unless you where feeding them into a data mining system, that would change things)
    - dominotw 9y ago
      Are you sure about logs? Kafka is in scope afaik.
      - Someone 9y ago
        I think so, too. Certainly, they should be in scope for the “data protection” part, or (extreme example) you would be allowed to log personal data to a publicly visible server.
        avianlyric 9y ago
        To be clear, when I say GDPR doesn’t apply. I’m taking about information requests (the topic of the linked article). The data protection part of GDPR of course applies to all PII regardless of how it’s stored. But that part is not new in GDPR, the EU has had strong data protection laws for a while. (Even if people didn’t talk about it)
chasb 9y ago
There are a lot of businesses that market and sell in the EU, or that recruit or hire contractors in the EU. GDPR affects not only your CRM, but your marketing and sales stack, your HR stack, and any other part of your business that might touch personal data. With a good system of record, you can track and manage all of the rest of the information and issues raised in the letter. That said, in a large company with a lot of legacy systems, it may be tough to extract the actual data itself (or even know if your system of record is complete).

by geocar 9y ago

nopriorarrests 9y ago

Sorry, but ICO stands for "Information Commissioner Office", and they seem to be UK organization, having .uk domain and all that. How can they recommend anything with regard to EU-wide law? Or, stating differently, how their recommendation hold any value at all?

Silhouette 9y ago
The ICO is the government regulator responsible for data protection in the UK, and as such the people who are going to be enforcing the GDPR here.
sharkdaysunrise 9y ago
"The EU" doesn't enforce the GDPR, the Supervisory Authorities in each member state (like the ICO) enforce the GDPR. The member states have agreed to abide by the GDPR, but their own specific data protection laws are allowed have slight variations, e.g. the specific age limit defining minor vs. adult.
kenbaylor 9y ago
Each country will have a Data Protection Authority (DPA) which is the regulator in the country. The ICO is the one in the UK. The last letter of the GDPR is Regulation. A regulation is very different than than a Directive (the pre-GDPR law is based on a directive). There is very little wiggle-room with a Regulation, even between countries. The ICO also works with other DPAs currently as part of Working Party 29, which ensures the DPAs are working in Sync. So the ICO advice is worthy of close study, especially if your local DPA (assuming you have one) has not commented or given guidance on a certain matter.
- barrkel 9y ago
  To add, the difference between directive and regulation is in Article 288 of the TFEU: To exercise the Union's competences, the institutions shall adopt regulations, directives, decisions, recommendations and opinions. A regulation shall have general application. It shall be binding in its entirety and directly applicable in all Member States. A directive shall be binding, as to the result to be achieved, upon each Member State to which it is addressed, but shall leave to the national authorities the choice of form and methods.
  - arrrg 9y ago
    Basically, a regulation is like a law. It’s directly binding as law. A directive is something member states have to implement themselves, probably also by passing a law using their own national process for doing so. As such there can be (greater) differences in the different national implementations of the directives.
chasb 9y ago
The ICO is seen as a leading voice, with some very good guidance, e.g.: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-the-general-da... They're widely respected, but you're right it remains to be seen whether UK and EU enforcement will diverge.

hedora 9y ago

Won’t adding round trips to the process (by sending letters indicating you’re delaying) just waste more of your lawyers’ billable hours? Anyway, the main target of this legislation are the hundreds of businesses you’ve never heard of brokering your personal information. I doubt they have salesforce leads for each person they track, and I think most people want to see that entire industry collapse. Similarly (in terms of regulatory burden, not consumer sentiment), most legit consumer businesses rely on razor thin transaction costs. Spending any additional per-customer human time could be the difference between profit and loss. To see the problem, consider what would happen if you walked into any store with affinity cards, and handed this letter to the manager.

DanBC 9y ago
> just waste more of your lawyers’ billable hours? Why are you using lawyers to respond to DPA / GDPR requests?
- paulie_a 9y ago
  If anything that can be automated and it will waste their lawyers time. Sounds fun.
geocar 9y ago
> Won’t adding round trips to the process (by sending letters indicating you’re delaying) just waste more of your lawyers’ billable hours? There are only four requests in this letter, and they were written by a PWC consultant to appear as intimidating and confusing as possible, so a small business that does not have easy access to legal advice would not find it difficult to convince a regulator as such. That said, a lawyer can help you identify them and ignore the rest. For the cost-conscious, spending time on the ICO's website will also help you discover them so that when you talk to a lawyer you can be efficient with their time (and therefore your spending). > most legit consumer businesses... Most consumer businesses do not keep very much personal data, if the cost of understanding this letter within three months would cause a company to go into administration then they were going to fail anyway. > the main target of this legislation are the hundreds of businesses you’ve never heard of brokering your personal information. I doubt they have salesforce leads for each person they track I don't agree with this at all. Who do you think the "main target" of this legislation is?

ThePhysicist 9y ago

The GDPR gives you one month to reply to such requests by default, except if the nature of the request is so complex that you can believably justify why you'd need more time to reply to it. In general, I would recommend implementing automated procedures for answering such requests.

geocar 9y ago
How many of these requests do you expect? I imagine most companies might only deal with this once or perhaps twice ever, and if they do not keep very much personal data then automating it would not be very efficient use of their time. That's why in general I'd wait until you get such a request, ask your lawyer to explain it (will probably only cost a few hundred pounds), then decide what to do next. Only very large companies (or companies that deal with a lot of personal data) will benefit from up-front automation.
- tobr 9y ago
  Since the content of the request is very generic and applies to almost any individual and business, it's not unthinkable that it will be automated on the other end, so anyone can push a button and send the request to hundreds of companies of their choosing. I certainly have several businesses in mind that I plan to send requests to once GDPR is in place. EDIT: Although I suppose small, non-EU businesses that mostly do not deal with personal data are unlikely to receive any requests. So you are probably right that "most companies" are unlikely receive GDPR requests.
  - kuschku 9y ago
    It’s already been automated. https://selbstauskunft.net/ https://selbstauskunft.net/ exists to allow you to send a BDSG §34 request (like GDPR request, but under the older German law for it) to basically any company. You select the company, sign it, and they automate all other steps. I’ve sent dozens just this week.
    - Jdam 9y ago

deleted 9y ago

[deleted]

foobarbazetc 9y ago

Honestly... none of the questions in this letter are that hard to answer. I really don’t see what the fuss is about if you run a semi-professional operation.

x0x0 9y ago
Then you haven't thought it through or don't understand the gdpr. Though this letter doesn't mention it, you not only have to provide all data in your systems -- every single db inside your company -- but also data from every 3rd party system. Your transactional emailer, your marketing emailer, your billing system, your logging system, your retargeting system, etc.
- avianlyric 9y ago
  That’s not totally true. GDPR only applies if the data is stored in an “filing system”. Things like logs almost certainly don’t fall under that. (Unless you where feeding them into a data mining system, that would change things)
  - dominotw 9y ago
    Are you sure about logs? Kafka is in scope afaik.
    - Someone 9y ago
      I think so, too. Certainly, they should be in scope for the “data protection” part, or (extreme example) you would be allowed to log personal data to a publicly visible server.
      - avianlyric 9y ago
        To be clear, when I say GDPR doesn’t apply. I’m taking about information requests (the topic of the linked article). The data protection part of GDPR of course applies to all PII regardless of how it’s stored. But that part is not new in GDPR, the EU has had strong data protection laws for a while. (Even if people didn’t talk about it)

chasb 9y ago

There are a lot of businesses that market and sell in the EU, or that recruit or hire contractors in the EU. GDPR affects not only your CRM, but your marketing and sales stack, your HR stack, and any other part of your business that might touch personal data. With a good system of record, you can track and manage all of the rest of the information and issues raised in the letter. That said, in a large company with a lot of legacy systems, it may be tough to extract the actual data itself (or even know if your system of record is complete).