5 ms·
If you think you can understand the GDPR by reading it, that's merely proof you haven't read it. Questions without answers in the GDPR: * how to carry out a l
by x0x0 9y ago
If you think you can understand the GDPR by reading it, that's merely proof you haven't read it.
Questions without answers in the GDPR:
* how to carry out a legitimate interest balancing test
* who is your lead regulator (do you have a lead regulator?)
* When do you need a DPO (large scale is left undefined, as is systematic)
* How reasonable will any particular regulator be towards inadvertent violations
* what precisely counts as the required technical and organizational measures in art24
* how do you define what is one purpose and what is two purposes?
- SaltySolomon 9y agoDPO turns almost always into always in the EU because you got more than 10 people that work in HR or Work with Customers.
- pbowyer 9y agoThat's the nature of law. It's a set of principles, it's not black and white in the way techies want the world to be. Painful when needing to implement? Absolutely (not my favourite either, I want definite answers). The way it is? Yes.
- aeorgnoieang 9y ago> That's the nature of law. Not all laws, nor all legal systems, are equally vague. It would be really helpful if the regulations had been accompanied with a large set of 'example applications' demonstrating how EU members should be expected (or required) to implement the law in specific scenarios. Uncertainty is a real cost too.
- zerostar07 9y agowhat happens if someone enters identifying information that you did not ask for, e.g. users who use their real name instead of (pseudonymous) username
- x0x0 9y agooff the top of my head, I see no provision in the GDPR for unrequested personal data being treated more laxly than requested...