5 ms·

I’m surprised nobody has mentioned that being forced to provide personal data on request does not in any way reduce the risk of personal data being misused. Wh

by fogzen 9y ago

I’m surprised nobody has mentioned that being forced to provide personal data on request does not in any way reduce the risk of personal data being misused. What’s the damage consumers are being protected from, exactly?

wsxcde 9y ago
Being forced to comply with GPDR forces companies to keep track of data, limit usage, add data expiration policies -- all of this makes compliance easier and definitely improves security. A well-known researcher once joked to me that programmers are associated with a company for a few few years, programs live only for a few more years, but data lives forever.
- fogzen 9y ago
  > and definitely improves security. How? What procedure improves security? Right now, people I don't know at various companies have access to databases with my personal information. Those same people will still have the same access and opportunity to misuse my personal information, but under GDPR I can know what personal information is stored. I could also demand it be deleted, but that doesn't apply to data that's already been shared or under control of other parties.
  - lagadu 9y ago
    GDPR is far wider than that; you're just looking at it from the end user perspective because GDPR isn't just allowing the user to enquire about their data. For a company to be GDPR compliant they also have to satisfy the regulators and that includes limiting access to data to only those that need it, knowing who those people are and putting measures in place in case of a breach.
kbenson 9y ago
Accurate knowledge of risk exposure allows consumers to adjust practices and plan accordingly. It may also incentive companies to play more carefully with the data, since they have to explain what that have done with it.
- fogzen 9y ago
  I don't see how GDPR changes the knowledge of risk exposure. Before GDPR I know that when I give companies my personal information it is at risk. After GDPR the situation is the same.
  - kbenson 9y ago
    This assumes you know all the personal data they have about you beforehand. Also, you seem to be implying that there is no benefit to knowing how risky companies are being with the data they do have. If your data is stores in certain jurisdictions that have difference laws than you expected, that could increase the risk your data bight be accessed in ways you assumed illegal (different countries have different rules). For a very simple example, LiveJournal is now owned and operated entirely out of Russia. It didn't start that way. a GDPR request would presumably let you know that your data was in servers in Russia, or that the company in question did not feel the need to answer your request, in which case at lest you would know that your local laws did not apply towards it. In my eyes, both are very useful information that provides additional information about the risk of that data being accessed in a way you thought it would not beyond what you might assume of an EU company that you gave personal information.
    - deleted 9y ago
      [deleted]
    - fogzen 9y ago
      Knowing where my data is stored is hardly a consumer protection. Whether data is hosted in Russia or the EU it’s at risk of being stolen, exposed, and misused and the liability companies have for that has not changed (there is no liability)
      - kbenson 9y ago
        > Whether data is hosted in Russia or the EU it’s at risk of being stolen, exposed, and misused and the liability companies have for that has not changed (there is no liability) So your contention is that the same risk exists no matter the storage location? Bad things can happen anywhere. I submit that certain locations are more prone to certain situations. Knowing your information is being stored in a certain location at a minimum gives you the opportunity to deny additional information from yourself (stop using the service). Since this discussion has regressed to the point where you're essentially arguing that additional information has no utility, and I fundamentally disagree with that point, I'm not sure the point of continuing. We're just repeating our points with different examples.

by fogzen 9y ago

wsxcde 9y ago

Being forced to comply with GPDR forces companies to keep track of data, limit usage, add data expiration policies -- all of this makes compliance easier and definitely improves security. A well-known researcher once joked to me that programmers are associated with a company for a few few years, programs live only for a few more years, but data lives forever.

fogzen 9y ago
> and definitely improves security. How? What procedure improves security? Right now, people I don't know at various companies have access to databases with my personal information. Those same people will still have the same access and opportunity to misuse my personal information, but under GDPR I can know what personal information is stored. I could also demand it be deleted, but that doesn't apply to data that's already been shared or under control of other parties.
- lagadu 9y ago
  GDPR is far wider than that; you're just looking at it from the end user perspective because GDPR isn't just allowing the user to enquire about their data. For a company to be GDPR compliant they also have to satisfy the regulators and that includes limiting access to data to only those that need it, knowing who those people are and putting measures in place in case of a breach.

kbenson 9y ago

Accurate knowledge of risk exposure allows consumers to adjust practices and plan accordingly. It may also incentive companies to play more carefully with the data, since they have to explain what that have done with it.

fogzen 9y ago
I don't see how GDPR changes the knowledge of risk exposure. Before GDPR I know that when I give companies my personal information it is at risk. After GDPR the situation is the same.
- kbenson 9y ago
  This assumes you know all the personal data they have about you beforehand. Also, you seem to be implying that there is no benefit to knowing how risky companies are being with the data they do have. If your data is stores in certain jurisdictions that have difference laws than you expected, that could increase the risk your data bight be accessed in ways you assumed illegal (different countries have different rules). For a very simple example, LiveJournal is now owned and operated entirely out of Russia. It didn't start that way. a GDPR request would presumably let you know that your data was in servers in Russia, or that the company in question did not feel the need to answer your request, in which case at lest you would know that your local laws did not apply towards it. In my eyes, both are very useful information that provides additional information about the risk of that data being accessed in a way you thought it would not beyond what you might assume of an EU company that you gave personal information.
  - deleted 9y ago
    [deleted]
  - fogzen 9y ago
    Knowing where my data is stored is hardly a consumer protection. Whether data is hosted in Russia or the EU it’s at risk of being stolen, exposed, and misused and the liability companies have for that has not changed (there is no liability)
    - kbenson 9y ago
      > Whether data is hosted in Russia or the EU it’s at risk of being stolen, exposed, and misused and the liability companies have for that has not changed (there is no liability) So your contention is that the same risk exists no matter the storage location? Bad things can happen anywhere. I submit that certain locations are more prone to certain situations. Knowing your information is being stored in a certain location at a minimum gives you the opportunity to deny additional information from yourself (stop using the service). Since this discussion has regressed to the point where you're essentially arguing that additional information has no utility, and I fundamentally disagree with that point, I'm not sure the point of continuing. We're just repeating our points with different examples.