4 ms·

If you read up on the GDPR, the focus is on people 'deliberately doing something wrong'.. which could be not following proper security guidelines, not keeping p

If you read up on the GDPR, the focus is on people 'deliberately doing something wrong'.. which could be not following proper security guidelines, not keeping proper records, not notifying the users in a timely manner, and all sorts of things that are very cut and dry. It's perfectly possible to have a data breach and not get fined, and as long as you didn't do anything too careless that would allow a breach to happen you're probably in the clear. Everyone knows there's no perfect system.. but in regards to what we're talking about it's much better to have personal data be a liability rather than an asset, because it puts incentive on companies to only use what they need and make efforts to protect it appropriately.

joesb 9y ago
I don't think not following proper standard is deliberatelt doing something wrong. What if I'm just unaware of the standard or incompetent? Not all programmer who save password in plaintext starts by thinking "I'm going to intentionally doing this wrong so that it breaks all security guidelines".
- isostatic 9y ago
  And that's what the GDPR is aimed at stopping. People who work in food preperation who don't wash their hands after handling raw meat aren't thinking "I'm going to intentionally doing this wrong so that it it poisons everyone", but we still have regulations.
briandear 9y ago
> as long as you didn't do anything too careless Who determines how much careless is "too" careless? "slightly careless" but with huge consequences is more concerning than "incredibly careless" but with no consequences. Really the punishment should be matching the value of the breach. For example with HIPAA breaches, you can get fined $10k or so, PER RECORD -- obviously medical data is exceptionally more sensitive than most. Credit data should be covered under a HIPAA-like statute. Under HIPAA there's no such thing as "a little careless" -- you either f'ed up or you didn't. There's no gray area.

joesb 9y ago

I don't think not following proper standard is deliberatelt doing something wrong. What if I'm just unaware of the standard or incompetent? Not all programmer who save password in plaintext starts by thinking "I'm going to intentionally doing this wrong so that it breaks all security guidelines".

isostatic 9y ago
And that's what the GDPR is aimed at stopping. People who work in food preperation who don't wash their hands after handling raw meat aren't thinking "I'm going to intentionally doing this wrong so that it it poisons everyone", but we still have regulations.

briandear 9y ago

> as long as you didn't do anything too careless Who determines how much careless is "too" careless? "slightly careless" but with huge consequences is more concerning than "incredibly careless" but with no consequences. Really the punishment should be matching the value of the breach. For example with HIPAA breaches, you can get fined $10k or so, PER RECORD -- obviously medical data is exceptionally more sensitive than most. Credit data should be covered under a HIPAA-like statute. Under HIPAA there's no such thing as "a little careless" -- you either f'ed up or you didn't. There's no gray area.