3 ms·

Depends. If you happen to be both a lawyer that is well versed in the laws of all 28 EU countries, who can divine how each country will interpret and enforce t

Depends. If you happen to be both a lawyer that is well versed in the laws of all 28 EU countries, who can divine how each country will interpret and enforce the law, and also a coder with lots of time on your hands to implement in code what you hope is the correct interpretation of these laws, you may be able to do it for free. Most companies don't have a person like this though, and need to rely on outside experts for one or both of these.

user5994461 9y ago
The interpretation of laws and specific contexts are usually relatively straightforward for people who are trained in legal speak, not engineers. There should be hardly any change needed as long as the service only gathers data that is required for it and users are willingly using the service. The problem if for companies that do heavy identification of users against their will like in adtech or companies that gather and resell personal information.
gerdesj 9y ago
Bollocks! First off: GDPR will be harmonised across all 28 member states (not countries) - that's the point of it. For example in the UK, the current Data Protection Act of 1998 will be superseded by GDPR (https://www.itgovernance.co.uk/data-protection https://www.itgovernance.co.uk/data-protection) You do not need to be a lawyer to understand GDPR, you merely need the ability to read, and have a few hours to devote to research. Implementing a policy that is compatible with GDPR is not hard. It does require some thought and some time and will need some training across your organisation. If you do not have a market in the EU then it need not worry you at all. Funnily enough, if you bin (or neuter) those social icons and a few .js thingies from your website you'll be well on the way. Now think about how you would like to be treated, personally ... yep - you'll be fine. No lawyers needed and certainly not seven figure sums for handwaving. You really can use research and common sense and some time, to do the job in house effectively. I might politely suggest that it is a pretty good standard to work to anyway: it is designed to protect the privacy of individual people. I consider myself an individual and perhaps you do too.
- downandout 9y ago
  You do not need to be a lawyer to understand GDPR And yet billions are being spent on exactly that - because it's an incredibly complex law that can indeed be subject to different interpretations in each country. I have been briefed on this point specific by lawyers in the EU for to whom we paid a fortune, only to decide that it was too risky to allow EU traffic. It's not just a matter of taking away "a few .js thingies" as you put it.
  - gerdesj 9y ago
    I am a director of a UK based IT company (MD) I am also the ISO9001 senior worrier and an ISO27001 sponsor. Just in case you are concerned that I might be a PHB (I do not have enough hair anyway): I run Arch Linux on all my PCs and am personally CREST accredited. The purpose of GDPR is protect individual's right to privacy - I doubt you can fault that. You and I are both individuals ... Have you actually sat down with a copy of the GDPR a clear mind, and some really good coffee and bothered to read it? If you are arguing the toss with me based on something that someone else has told you then go away. GDPR is designed to protect people - you and I if you like. I'm a fan of it.
    - downandout 9y ago
      I have read it, as have our lawyers, which is why we have no choice but to block all EU traffic from our services. All fans of the law think it will only be used to go after "bad" guys. But that just isn't how laws like this are used in practice. They are designed to be easy to violate for a reason - that reason being to generate massive revenue from fines. You should take a look at this well reasoned blog post about why someone stopped selling their products in the EU - https://www.brentozar.com/archive/2017/12/gdpr-stopped-selling-stuff-europe/ https://www.brentozar.com/archive/2017/12/gdpr-stopped-selli... There are just far more issues here than you're acknowledging.
      - codingdave 9y ago
        All legal questions can be answered with "It Depends." The lack of clarity form the courts is to be expected, but isn't that different than any other legal grey area. And yes, there are concerns. And yes, if a company wants to skip out of the EU and wait for the dust to settle, that is a valid business choice. But people are arguing with you because you are all over this thread acting like it is the only business choice. Or that we all need to spend millions to make that choice. In truth, it is a risk management decision, not a legal one, because the legal answers are unknowns. You clearly are drawing this into the quadrant of both high likelihood and high consequences... which is fine, for you. But different organizations may have different answers, putting GDPR compliance into a different risk quadrant, and those are their own decisions to make.

user5994461 9y ago

The interpretation of laws and specific contexts are usually relatively straightforward for people who are trained in legal speak, not engineers. There should be hardly any change needed as long as the service only gathers data that is required for it and users are willingly using the service. The problem if for companies that do heavy identification of users against their will like in adtech or companies that gather and resell personal information.

gerdesj 9y ago

Bollocks! First off: GDPR will be harmonised across all 28 member states (not countries) - that's the point of it. For example in the UK, the current Data Protection Act of 1998 will be superseded by GDPR (https://www.itgovernance.co.uk/data-protection https://www.itgovernance.co.uk/data-protection) You do not need to be a lawyer to understand GDPR, you merely need the ability to read, and have a few hours to devote to research. Implementing a policy that is compatible with GDPR is not hard. It does require some thought and some time and will need some training across your organisation. If you do not have a market in the EU then it need not worry you at all. Funnily enough, if you bin (or neuter) those social icons and a few .js thingies from your website you'll be well on the way. Now think about how you would like to be treated, personally ... yep - you'll be fine. No lawyers needed and certainly not seven figure sums for handwaving. You really can use research and common sense and some time, to do the job in house effectively. I might politely suggest that it is a pretty good standard to work to anyway: it is designed to protect the privacy of individual people. I consider myself an individual and perhaps you do too.

downandout 9y ago
You do not need to be a lawyer to understand GDPR And yet billions are being spent on exactly that - because it's an incredibly complex law that can indeed be subject to different interpretations in each country. I have been briefed on this point specific by lawyers in the EU for to whom we paid a fortune, only to decide that it was too risky to allow EU traffic. It's not just a matter of taking away "a few .js thingies" as you put it.
- gerdesj 9y ago
  I am a director of a UK based IT company (MD) I am also the ISO9001 senior worrier and an ISO27001 sponsor. Just in case you are concerned that I might be a PHB (I do not have enough hair anyway): I run Arch Linux on all my PCs and am personally CREST accredited. The purpose of GDPR is protect individual's right to privacy - I doubt you can fault that. You and I are both individuals ... Have you actually sat down with a copy of the GDPR a clear mind, and some really good coffee and bothered to read it? If you are arguing the toss with me based on something that someone else has told you then go away. GDPR is designed to protect people - you and I if you like. I'm a fan of it.
  - downandout 9y ago
    I have read it, as have our lawyers, which is why we have no choice but to block all EU traffic from our services. All fans of the law think it will only be used to go after "bad" guys. But that just isn't how laws like this are used in practice. They are designed to be easy to violate for a reason - that reason being to generate massive revenue from fines. You should take a look at this well reasoned blog post about why someone stopped selling their products in the EU - https://www.brentozar.com/archive/2017/12/gdpr-stopped-selling-stuff-europe/ https://www.brentozar.com/archive/2017/12/gdpr-stopped-selli... There are just far more issues here than you're acknowledging.
    - codingdave 9y ago
      All legal questions can be answered with "It Depends." The lack of clarity form the courts is to be expected, but isn't that different than any other legal grey area. And yes, there are concerns. And yes, if a company wants to skip out of the EU and wait for the dust to settle, that is a valid business choice. But people are arguing with you because you are all over this thread acting like it is the only business choice. Or that we all need to spend millions to make that choice. In truth, it is a risk management decision, not a legal one, because the legal answers are unknowns. You clearly are drawing this into the quadrant of both high likelihood and high consequences... which is fine, for you. But different organizations may have different answers, putting GDPR compliance into a different risk quadrant, and those are their own decisions to make.