3 ms·

You do not need to be a lawyer to understand GDPR And yet billions are being spent on exactly that - because it's an incredibly complex law that can indeed be

You do not need to be a lawyer to understand GDPR And yet billions are being spent on exactly that - because it's an incredibly complex law that can indeed be subject to different interpretations in each country. I have been briefed on this point specific by lawyers in the EU for to whom we paid a fortune, only to decide that it was too risky to allow EU traffic. It's not just a matter of taking away "a few .js thingies" as you put it.

gerdesj 9y ago
I am a director of a UK based IT company (MD) I am also the ISO9001 senior worrier and an ISO27001 sponsor. Just in case you are concerned that I might be a PHB (I do not have enough hair anyway): I run Arch Linux on all my PCs and am personally CREST accredited. The purpose of GDPR is protect individual's right to privacy - I doubt you can fault that. You and I are both individuals ... Have you actually sat down with a copy of the GDPR a clear mind, and some really good coffee and bothered to read it? If you are arguing the toss with me based on something that someone else has told you then go away. GDPR is designed to protect people - you and I if you like. I'm a fan of it.
- downandout 9y ago
  I have read it, as have our lawyers, which is why we have no choice but to block all EU traffic from our services. All fans of the law think it will only be used to go after "bad" guys. But that just isn't how laws like this are used in practice. They are designed to be easy to violate for a reason - that reason being to generate massive revenue from fines. You should take a look at this well reasoned blog post about why someone stopped selling their products in the EU - https://www.brentozar.com/archive/2017/12/gdpr-stopped-selling-stuff-europe/ https://www.brentozar.com/archive/2017/12/gdpr-stopped-selli... There are just far more issues here than you're acknowledging.
  - codingdave 9y ago
    All legal questions can be answered with "It Depends." The lack of clarity form the courts is to be expected, but isn't that different than any other legal grey area. And yes, there are concerns. And yes, if a company wants to skip out of the EU and wait for the dust to settle, that is a valid business choice. But people are arguing with you because you are all over this thread acting like it is the only business choice. Or that we all need to spend millions to make that choice. In truth, it is a risk management decision, not a legal one, because the legal answers are unknowns. You clearly are drawing this into the quadrant of both high likelihood and high consequences... which is fine, for you. But different organizations may have different answers, putting GDPR compliance into a different risk quadrant, and those are their own decisions to make.
- fiddlerwoaroof 9y ago
  As someone who has had to try to figure out how to implement GDPR, my takeaway so far is that it might eventually be ok, once the courts have clarified what it actually requires. But, that process will be quite profitable for European governments.

gerdesj 9y ago

I am a director of a UK based IT company (MD) I am also the ISO9001 senior worrier and an ISO27001 sponsor. Just in case you are concerned that I might be a PHB (I do not have enough hair anyway): I run Arch Linux on all my PCs and am personally CREST accredited. The purpose of GDPR is protect individual's right to privacy - I doubt you can fault that. You and I are both individuals ... Have you actually sat down with a copy of the GDPR a clear mind, and some really good coffee and bothered to read it? If you are arguing the toss with me based on something that someone else has told you then go away. GDPR is designed to protect people - you and I if you like. I'm a fan of it.

downandout 9y ago
I have read it, as have our lawyers, which is why we have no choice but to block all EU traffic from our services. All fans of the law think it will only be used to go after "bad" guys. But that just isn't how laws like this are used in practice. They are designed to be easy to violate for a reason - that reason being to generate massive revenue from fines. You should take a look at this well reasoned blog post about why someone stopped selling their products in the EU - https://www.brentozar.com/archive/2017/12/gdpr-stopped-selling-stuff-europe/ https://www.brentozar.com/archive/2017/12/gdpr-stopped-selli... There are just far more issues here than you're acknowledging.
- codingdave 9y ago
  All legal questions can be answered with "It Depends." The lack of clarity form the courts is to be expected, but isn't that different than any other legal grey area. And yes, there are concerns. And yes, if a company wants to skip out of the EU and wait for the dust to settle, that is a valid business choice. But people are arguing with you because you are all over this thread acting like it is the only business choice. Or that we all need to spend millions to make that choice. In truth, it is a risk management decision, not a legal one, because the legal answers are unknowns. You clearly are drawing this into the quadrant of both high likelihood and high consequences... which is fine, for you. But different organizations may have different answers, putting GDPR compliance into a different risk quadrant, and those are their own decisions to make.
fiddlerwoaroof 9y ago
As someone who has had to try to figure out how to implement GDPR, my takeaway so far is that it might eventually be ok, once the courts have clarified what it actually requires. But, that process will be quite profitable for European governments.