GDPR has been known for 3-4 years and was finalised in 2016. They should have had 2-3 years to go through their systems. Was it posted in their local planning

GDPR has been known for 3-4 years and was finalised in 2016. They should have had 2-3 years to go through their systems. Was it posted in their local planning department in Alpha Centauri as well? Because to most people running microbusinesses -- which is most businesses, remember -- it might as well have been. If a business can't do that, it indicates that they don't have control of the information in the first place. Not at all. It's quite possible that an organisation has been reasonable and responsible about handling personal data and its staff know exactly what it's doing and why, but that the formal documentation and automated processes referred to throughout today's discussion aren't in place because they have never been necessary before. Why should I lose control of my personal information just because it costs money to process it responsibly? The trouble is that different people will have different interpretations of "responsibly". For example, I'm not sure it's irresponsible to have been storing and processing data for legitimate purposes and entirely with the subject's informed consent for years, and also to be concerned about the cost of updating or replacing all of those systems because the subject is now being given a retrospective right to withdraw that consent that they didn't have before. While this might be considered desirable in terms of reining in data hoarders like Facebook or Google, it also imposes burdens on organisations with different models and lower risks to data subjects. Some sort of balance is needed between these competing priorities. At some point a regulation has to be implemented and some companies will unfortunately be impacted even if their intentions were good. Right, but this is exactly why both unambiguous rules and proportionality are important.