4 ms·

You only have to worry about penalties if you're deliberately doing something wrong. Auditing can be done internally, and if making sure you're not putting your

You only have to worry about penalties if you're deliberately doing something wrong. Auditing can be done internally, and if making sure you're not putting your customers at risk is too big of a task for a business, maybe the business needs to be re-thought.

macintux 9y ago
> You only have to worry about penalties if you're deliberately doing something wrong. I don't know how you define "deliberately doing something wrong" without either making it too broad or worthless. It's rare that any organization "deliberately" exposes their customer information. It's also effectively impossible for any organization to guarantee that the data is unbreachable.
- rando444 9y ago
  If you read up on the GDPR, the focus is on people 'deliberately doing something wrong'.. which could be not following proper security guidelines, not keeping proper records, not notifying the users in a timely manner, and all sorts of things that are very cut and dry. It's perfectly possible to have a data breach and not get fined, and as long as you didn't do anything too careless that would allow a breach to happen you're probably in the clear. Everyone knows there's no perfect system.. but in regards to what we're talking about it's much better to have personal data be a liability rather than an asset, because it puts incentive on companies to only use what they need and make efforts to protect it appropriately.
  - joesb 9y ago
    I don't think not following proper standard is deliberatelt doing something wrong. What if I'm just unaware of the standard or incompetent? Not all programmer who save password in plaintext starts by thinking "I'm going to intentionally doing this wrong so that it breaks all security guidelines".
    - isostatic 9y ago
      And that's what the GDPR is aimed at stopping. People who work in food preperation who don't wash their hands after handling raw meat aren't thinking "I'm going to intentionally doing this wrong so that it it poisons everyone", but we still have regulations.
  - briandear 9y ago
    > as long as you didn't do anything too careless Who determines how much careless is "too" careless? "slightly careless" but with huge consequences is more concerning than "incredibly careless" but with no consequences. Really the punishment should be matching the value of the breach. For example with HIPAA breaches, you can get fined $10k or so, PER RECORD -- obviously medical data is exceptionally more sensitive than most. Credit data should be covered under a HIPAA-like statute. Under HIPAA there's no such thing as "a little careless" -- you either f'ed up or you didn't. There's no gray area.
- bluGill 9y ago
  Not keeping up to date on security best practices is in itself deliberately doing something wrong. Lets not pretend we will get a perfect law the first time around. Closing a few gaps is already a good first effort. We just need to be willing to close a few more as we discover them. Note too that there are always unintended consequences - we also need to be quick for calling for the elimination of a well intended law where the unintended result is a negative, even if it does get some bad actors.

macintux 9y ago

> You only have to worry about penalties if you're deliberately doing something wrong. I don't know how you define "deliberately doing something wrong" without either making it too broad or worthless. It's rare that any organization "deliberately" exposes their customer information. It's also effectively impossible for any organization to guarantee that the data is unbreachable.

rando444 9y ago
If you read up on the GDPR, the focus is on people 'deliberately doing something wrong'.. which could be not following proper security guidelines, not keeping proper records, not notifying the users in a timely manner, and all sorts of things that are very cut and dry. It's perfectly possible to have a data breach and not get fined, and as long as you didn't do anything too careless that would allow a breach to happen you're probably in the clear. Everyone knows there's no perfect system.. but in regards to what we're talking about it's much better to have personal data be a liability rather than an asset, because it puts incentive on companies to only use what they need and make efforts to protect it appropriately.
- joesb 9y ago
  I don't think not following proper standard is deliberatelt doing something wrong. What if I'm just unaware of the standard or incompetent? Not all programmer who save password in plaintext starts by thinking "I'm going to intentionally doing this wrong so that it breaks all security guidelines".
  - isostatic 9y ago
    And that's what the GDPR is aimed at stopping. People who work in food preperation who don't wash their hands after handling raw meat aren't thinking "I'm going to intentionally doing this wrong so that it it poisons everyone", but we still have regulations.
- briandear 9y ago
  > as long as you didn't do anything too careless Who determines how much careless is "too" careless? "slightly careless" but with huge consequences is more concerning than "incredibly careless" but with no consequences. Really the punishment should be matching the value of the breach. For example with HIPAA breaches, you can get fined $10k or so, PER RECORD -- obviously medical data is exceptionally more sensitive than most. Credit data should be covered under a HIPAA-like statute. Under HIPAA there's no such thing as "a little careless" -- you either f'ed up or you didn't. There's no gray area.
bluGill 9y ago
Not keeping up to date on security best practices is in itself deliberately doing something wrong. Lets not pretend we will get a perfect law the first time around. Closing a few gaps is already a good first effort. We just need to be willing to close a few more as we discover them. Note too that there are always unintended consequences - we also need to be quick for calling for the elimination of a well intended law where the unintended result is a negative, even if it does get some bad actors.