4 ms·

strengthened? this is already such a large undertaking with huge risk. it’s not 4% of EU revenue, it’s global revenue. i think many small businesses are going

strengthened? this is already such a large undertaking with huge risk. it’s not 4% of EU revenue, it’s global revenue. i think many small businesses are going to have to shut down EU operations because of GDPR

jacquesm 9y ago
Of course you could simply comply with the law. It's only made to look super difficult by those that would like to avoid compliance. But in practice it is actually fairly reasonable and if you were a conscientious operator you most likely already had 90% or so of the technical measures in place long ago.
- aquadrop 9y ago
  Maybe an unpopular opinion, but I think GDPR is not net good. It has its good parts, but overall it doesn't really improve security (think of all the big data breaches, GDPR wouldn't help there), but makes many things harder, especially for small companies and hence stifles innovation. Like the infamous "cookies law" but on larger scale. Governments pressure private companies with this, but in the same time are making it easier and easier for themselves (govmnts) to spy on people and infringe on people's privacy (in the name of fight against terrorism, or "for the children" etc)
  - rmc 9y ago
    GDPR can help advocates for privacy within an organisation. Rather than argue with nebulous harm from potential bad PR, you can say "If we don't do this, we risk a fine of $LOTS"
    - bonesss 9y ago
      GDPR puts legal teeth with $MegaFines onto a lot of internal IT political battles beyond security, too. Unified project processes, mandatory architectural reviews, IT-driven planning... if you're in a domain with lots of personal data the answer to why can't be cowboys and ignore IT 'just this one time' goes from "because we are trying to do IT right, dammit" to "because it's illegal" or "because the compliance costs are too high".
  - jacquesm 9y ago
    GDPR is already reducing the number of data breaches before it has even come into existence. Try booking a pentest from a company with a good rep in Europe right now and see what answers you get. Companies have finally woken up to the fact that security is no longer optional, that's a good thing in my book.
  - SahAssar 9y ago
    > think of all the big data breaches It actually mandates that you need to protect the data, and if it gets breached you need to notify the data subjects. So for example uber couldn't have a massive breach and just pay the hackers off and keep quiet. The GDPR is a massive good for users of online services. The basics of it aren't hard: build your systems to not store too much data you don't need, get permission for the data you store, make sure it's secure and make sure you can delete it when needed. I don't think that is too much to ask, do you? EDIT: > Governments pressure private companies with this, but in the same time are making it easier and easier for themselves (govmnts) to spy on people and infringe on people's privacy Looking at how prism and other programs worked/works it seems like what GDPR encourage (Don't store what you don't need) would have actually helped against that. With GDPR it will be harder to create a service that stores everything about you forever to be retrived by FISA or whoever, and simpler to create a service that just stores what it needs, and encrypts everything it can.
neuronic 9y ago
Good, take down all companies that violate GDPR. Good riddance.
- frockington 9y ago
  The counter to that is all you are left with is giant mega corps that can pay the associated costs. I'm not sure that this is a much better alternative
  - ionised 9y ago
    Or you'll end up with small business that don't make their money taking a garden rake across your personal data and bagging it up for the world to see.

jacquesm 9y ago

Of course you could simply comply with the law. It's only made to look super difficult by those that would like to avoid compliance. But in practice it is actually fairly reasonable and if you were a conscientious operator you most likely already had 90% or so of the technical measures in place long ago.

aquadrop 9y ago
Maybe an unpopular opinion, but I think GDPR is not net good. It has its good parts, but overall it doesn't really improve security (think of all the big data breaches, GDPR wouldn't help there), but makes many things harder, especially for small companies and hence stifles innovation. Like the infamous "cookies law" but on larger scale. Governments pressure private companies with this, but in the same time are making it easier and easier for themselves (govmnts) to spy on people and infringe on people's privacy (in the name of fight against terrorism, or "for the children" etc)
- rmc 9y ago
  GDPR can help advocates for privacy within an organisation. Rather than argue with nebulous harm from potential bad PR, you can say "If we don't do this, we risk a fine of $LOTS"
  - bonesss 9y ago
    GDPR puts legal teeth with $MegaFines onto a lot of internal IT political battles beyond security, too. Unified project processes, mandatory architectural reviews, IT-driven planning... if you're in a domain with lots of personal data the answer to why can't be cowboys and ignore IT 'just this one time' goes from "because we are trying to do IT right, dammit" to "because it's illegal" or "because the compliance costs are too high".
- jacquesm 9y ago
  GDPR is already reducing the number of data breaches before it has even come into existence. Try booking a pentest from a company with a good rep in Europe right now and see what answers you get. Companies have finally woken up to the fact that security is no longer optional, that's a good thing in my book.
- SahAssar 9y ago
  > think of all the big data breaches It actually mandates that you need to protect the data, and if it gets breached you need to notify the data subjects. So for example uber couldn't have a massive breach and just pay the hackers off and keep quiet. The GDPR is a massive good for users of online services. The basics of it aren't hard: build your systems to not store too much data you don't need, get permission for the data you store, make sure it's secure and make sure you can delete it when needed. I don't think that is too much to ask, do you? EDIT: > Governments pressure private companies with this, but in the same time are making it easier and easier for themselves (govmnts) to spy on people and infringe on people's privacy Looking at how prism and other programs worked/works it seems like what GDPR encourage (Don't store what you don't need) would have actually helped against that. With GDPR it will be harder to create a service that stores everything about you forever to be retrived by FISA or whoever, and simpler to create a service that just stores what it needs, and encrypts everything it can.

neuronic 9y ago

Good, take down all companies that violate GDPR. Good riddance.

frockington 9y ago
The counter to that is all you are left with is giant mega corps that can pay the associated costs. I'm not sure that this is a much better alternative
- ionised 9y ago
  Or you'll end up with small business that don't make their money taking a garden rake across your personal data and bagging it up for the world to see.