3 ms·

You should note that lots of what that letter suggest it has rights to, are not rights granted under GDPR. Or at least would be subject to legal clarification.

You should note that lots of what that letter suggest it has rights to, are not rights granted under GDPR. Or at least would be subject to legal clarification. If you send that letter, expect to receive a standard response/report of data with a form response that politely & legally amounts to “piss off”. Large organizations have considerable resources set aside to make sure their “piss off” letter is legally defensible & GDPR compliant. That letter is likely only a problem when selectively used by a malicious actor against a small organization. Frankly not the kind of org that is systematically tracking personal data.

molf 9y ago
Not true; GDPR explicitly grants a large number of rights to the data subject. [1] These rights include: * the right to be informed about what data is processed * the right to access all data gathered about them * the right to rectification of incorrect data * the right to receive an export of the data in a common format * the right to object, to have all data removed, and to restrict processing until further notice GDPR also requires a data controller to respond within a month, and not charge any fee for this unless the requests are excessive (because they are repetitive). [2] [1] https://gdpr-info.eu/chapter-3/ https://gdpr-info.eu/chapter-3/ [2] https://gdpr-info.eu/art-12-gdpr/ https://gdpr-info.eu/art-12-gdpr/
- kasey_junk 9y ago
  The letter is a nice mix of asks that are specifically covered, rights that might be covered & things that are not covered at all. In that sense it’s a great way to rattle someone without specific GDPR guidance. But all things being equal, the large orgs that are capable of systematic data collection, are not at all troubled by it & certainly won’t be answering it with direct point by point answers.
  - molf 9y ago
    Which things that are mentioned do you believe are not covered?
    - kasey_junk 9y ago
      I’m not a GDPR lawyer or auditer, do nothing in this reply should be seen as advice. My general feel is that if he didn’t cite a specific article it was on purpose. He took implications or broad interpretations for anything not explicitly cited. A couple that jump out immediately are the requests for server locality information, retention periods & specifics about security policies are the ones that are likely to get a very polite “we conform to industry best practices piss off” replies.
      - molf 9y ago
        That's all neatly laid out in article 13. [1] I'm not a lawyer but having extensively studied all of GDPR recently I'm afraid the letter seems legit. If there's any error it will be a minor one. [1] https://gdpr-info.eu/art-13-gdpr/ https://gdpr-info.eu/art-13-gdpr/
        kasey_junk 9y ago
        Article 13, to my reading, provides no basis for requiring locality information or security policies. The retention declarations I’ve seen have been legal niceties that don’t answer the question in a way that makes it clear what the retention policy is. I’m not suggesting that the letter won’t get a response. I’m suggesting there isn’t anything in it that would cause a large organization to send any different a response than if they got a letter written in crayon that said “gives us the GDPR data”. In that way it’s not a “nightmare” letter. It’s the default thing you pay lawyers for.
dmix 9y ago
> That letter is likely only a problem when selectively used by a malicious actor against a small organization. Which is what is so annoying and economically destructive about regulations like these that are broadly applied to all companies, especially on the internet where single person companies are very popular. They are designed in a vindictive way against large companies like Facebook or major online retailers who burned customera due to minimal information security investment. But they so often ignore the reality of the burden it places on small firms who account for 90% of businesses and 50% of employment, who cant afford lawyers or the legal risks of a 'piss off' letter. The western economic environment countinually gets more and more structured favouring large firms, encouraging large scale merging, which usually generates the type of large oligopoly companies who most often does the things that cause regulations to get created, then imposed on smaller firms. If Japan's economy is any indication we do not want to state heavy economy where big companies are the only sanctioned winners and smaller companies are heavily disincentived by the state (whether indirectly, by side effect, or overtly). If not having these laws created isnt an option (seemingly impossible in an administrative heavy org like EU), I then hope someday these regulation start being structures like progressive income tax using size minimums or are contained to specific industries where it's clearly a problem (both of which would apply well to minimum wage laws for example). So laws are pinned directly to a specific problem area justifying the heavy-handed state intervention, not just blanket laws on everyone.
- molf 9y ago
  For most smaller businesses there is no real reason to do all that much as long as you can answer such questions on an ad-hoc basis. Although of course we still have to see how widespread it will become in practice. Basically you need to make sure you 100% know what data you collect (including any third parties) and make sure you have a good reason to collect it. Honestly most of GDPR should be considered "common sense". It's just that many corporations actively act against the interest of individuals they collect data on, and it's precisely these practices that GDPR tries to correct.
  - Silhouette 9y ago
    Unfortunately even if you're already handling personal data responsibly, the GDPR still also requires that you be able to provide various documented policies to your regulator on demand, still contains lots of ambiguity about how far subject rights can go in practice, still imposes obligations to include lots of extra detail in privacy policies or otherwise provide lots of information and active warnings to data subjects, etc.

molf 9y ago

Not true; GDPR explicitly grants a large number of rights to the data subject. [1] These rights include: * the right to be informed about what data is processed * the right to access all data gathered about them * the right to rectification of incorrect data * the right to receive an export of the data in a common format * the right to object, to have all data removed, and to restrict processing until further notice GDPR also requires a data controller to respond within a month, and not charge any fee for this unless the requests are excessive (because they are repetitive). [2] [1] https://gdpr-info.eu/chapter-3/ https://gdpr-info.eu/chapter-3/ [2] https://gdpr-info.eu/art-12-gdpr/ https://gdpr-info.eu/art-12-gdpr/

kasey_junk 9y ago
The letter is a nice mix of asks that are specifically covered, rights that might be covered & things that are not covered at all. In that sense it’s a great way to rattle someone without specific GDPR guidance. But all things being equal, the large orgs that are capable of systematic data collection, are not at all troubled by it & certainly won’t be answering it with direct point by point answers.
- molf 9y ago
  Which things that are mentioned do you believe are not covered?
  - kasey_junk 9y ago
    I’m not a GDPR lawyer or auditer, do nothing in this reply should be seen as advice. My general feel is that if he didn’t cite a specific article it was on purpose. He took implications or broad interpretations for anything not explicitly cited. A couple that jump out immediately are the requests for server locality information, retention periods & specifics about security policies are the ones that are likely to get a very polite “we conform to industry best practices piss off” replies.
    - molf 9y ago
      That's all neatly laid out in article 13. [1] I'm not a lawyer but having extensively studied all of GDPR recently I'm afraid the letter seems legit. If there's any error it will be a minor one. [1] https://gdpr-info.eu/art-13-gdpr/ https://gdpr-info.eu/art-13-gdpr/
      - kasey_junk 9y ago
        Article 13, to my reading, provides no basis for requiring locality information or security policies. The retention declarations I’ve seen have been legal niceties that don’t answer the question in a way that makes it clear what the retention policy is. I’m not suggesting that the letter won’t get a response. I’m suggesting there isn’t anything in it that would cause a large organization to send any different a response than if they got a letter written in crayon that said “gives us the GDPR data”. In that way it’s not a “nightmare” letter. It’s the default thing you pay lawyers for.

dmix 9y ago

> That letter is likely only a problem when selectively used by a malicious actor against a small organization. Which is what is so annoying and economically destructive about regulations like these that are broadly applied to all companies, especially on the internet where single person companies are very popular. They are designed in a vindictive way against large companies like Facebook or major online retailers who burned customera due to minimal information security investment. But they so often ignore the reality of the burden it places on small firms who account for 90% of businesses and 50% of employment, who cant afford lawyers or the legal risks of a 'piss off' letter. The western economic environment countinually gets more and more structured favouring large firms, encouraging large scale merging, which usually generates the type of large oligopoly companies who most often does the things that cause regulations to get created, then imposed on smaller firms. If Japan's economy is any indication we do not want to state heavy economy where big companies are the only sanctioned winners and smaller companies are heavily disincentived by the state (whether indirectly, by side effect, or overtly). If not having these laws created isnt an option (seemingly impossible in an administrative heavy org like EU), I then hope someday these regulation start being structures like progressive income tax using size minimums or are contained to specific industries where it's clearly a problem (both of which would apply well to minimum wage laws for example). So laws are pinned directly to a specific problem area justifying the heavy-handed state intervention, not just blanket laws on everyone.

molf 9y ago
For most smaller businesses there is no real reason to do all that much as long as you can answer such questions on an ad-hoc basis. Although of course we still have to see how widespread it will become in practice. Basically you need to make sure you 100% know what data you collect (including any third parties) and make sure you have a good reason to collect it. Honestly most of GDPR should be considered "common sense". It's just that many corporations actively act against the interest of individuals they collect data on, and it's precisely these practices that GDPR tries to correct.
- Silhouette 9y ago
  Unfortunately even if you're already handling personal data responsibly, the GDPR still also requires that you be able to provide various documented policies to your regulator on demand, still contains lots of ambiguity about how far subject rights can go in practice, still imposes obligations to include lots of extra detail in privacy policies or otherwise provide lots of information and active warnings to data subjects, etc.