4 ms·

I'm not sure what GDPR is protecting me against that wasn't already covered by PCI-DSS and existing cybersecurity standards. Not being financially defrauded is

I'm not sure what GDPR is protecting me against that wasn't already covered by PCI-DSS and existing cybersecurity standards. Not being financially defrauded is the only thing i care about. For everything else is easy to avoid sharing personally identifiable data if it's really a concern.

briandear 9y ago
A point of fact though — PCI isn’t a law, it’s a voluntary standard.
- rorykoehler 9y ago
  Yes however i can choose to not interact with non compliant service. The ignorant need to be educated rather than the informed punished.
  - blub 9y ago
    There are almost no companies that respect the customer's privacy because of the lack of regulation so you can't in fact choose anything. Companies have failed to regulate themselves since the dawn of time, this is how the world works.
    - rorykoehler 9y ago
      You won't get PCI-DSS accredited without an audit.
      - jimktrains2 9y ago
        Only Level 1 compliance requires an audit. Below that a remote scan of public IPs and a self-assessment is sufficient.
e12e 9y ago
Do you prosecute your friend and aqaintances for uploading pictures of you to Instagram/fb etc? Block all tracking script/pixels on the Web? Avoid using the phone in order to not generate meta-data? I'm not sure how it's "easy to avoid sharing identifiable data"?
- rorykoehler 9y ago
  For the most part no (i block ads because I'm not interested in them not for privacy concerns) but I'm also not irrationally paranoid about such things. I've lived in a world where I'm photographed hundreds of times a day by cctv etc for most of my life. Im not really sure what difference a few photos on social media will make
  - e12e 9y ago
    The difference is the size of the aggregated dataset on you and those you are associated with, and how it might be sold, augmented etc. Granted, some places it might be legal to sell cctv footage too - but it will also fall under the GDPR (not the GDPR alone, there are surveillance bills and "ant-terror" provisions... But there's one remedy for government overreach (throw the government, through elections or protest) another for private overreach: government regulation/laws).
    - rorykoehler 9y ago
      I understand the risk of aggregate data etc and do think we need to hold companies accountable however I disagree with the fundamentals of how GDPR tries to achieve this. It’s the wrong abstraction. I also value what free services, indie apps, small scrappy startups and general maker world productions provide society and life in general way more than I value absolute privacy.
GordonS 9y ago
PCI-DSS is essentially about credit/debit card data. GDPR is about personal information is general, such that you need to let your users know what you are collecting, what you will do with it, and how long you will hold it.
IanCal 9y ago
One of they key things to me is increased fines that are available. I've likely had my data and families data lost through a variety of terribly insecure services having breaches. TalkTalk lost 150k peoples information (including bank account numbers, sort codes, dates of birth, etc - people who later then received scam phone calls with people who knew their details) due to extremely basic security failings. They were fined £400k (a record fine). They then did it again and paid £100k. Properly securing the site and the data over many years could easily cost more than that, added to the chance you'll not get hacked or fined and it is perhaps even a financially sensible position to not put the effort in.
- rorykoehler 9y ago
  I think being responsible for negligence in security practices and GDPR are not the same. GDPR is overreach. There is a saner middle ground, for example in Australia new laws coming in mean executives can go to prison for the negligence in your example. That makes more sense as it doesn't invalidate 90% of standard tools processes in technical marketing for example.
  - IanCal 9y ago
    I think it's interesting you find a fine to be overreach but imprisonment not. > That makes more sense as it doesn't invalidate 90% of standard tools processes in technical marketing for example. Can you explain in more detail?
    - rorykoehler 9y ago
      I'm not talking about the fine/prison. The overreach is that they dictate how you have to handle data. In Australia you are only obligied not to get hacked and are trusted to figure it out for yourself. In Europe they have all this right to be forgotten BS and reams of compulsory opt ins etc etc
      - IanCal 9y ago
        I don't really have a problem with requiring consent to work with personal data. Right to be forgotten is restricted and I can't think of obvious cases within the restrictions here: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/guide-to-the-general-da... that I disagree with. Stronger restrictions on what data you can hold without good reason or consent means that inevitable breaches become less important.

briandear 9y ago

A point of fact though — PCI isn’t a law, it’s a voluntary standard.

rorykoehler 9y ago
Yes however i can choose to not interact with non compliant service. The ignorant need to be educated rather than the informed punished.
- blub 9y ago
  There are almost no companies that respect the customer's privacy because of the lack of regulation so you can't in fact choose anything. Companies have failed to regulate themselves since the dawn of time, this is how the world works.
  - rorykoehler 9y ago
    You won't get PCI-DSS accredited without an audit.
    - jimktrains2 9y ago
      Only Level 1 compliance requires an audit. Below that a remote scan of public IPs and a self-assessment is sufficient.

e12e 9y ago

Do you prosecute your friend and aqaintances for uploading pictures of you to Instagram/fb etc? Block all tracking script/pixels on the Web? Avoid using the phone in order to not generate meta-data? I'm not sure how it's "easy to avoid sharing identifiable data"?

rorykoehler 9y ago
For the most part no (i block ads because I'm not interested in them not for privacy concerns) but I'm also not irrationally paranoid about such things. I've lived in a world where I'm photographed hundreds of times a day by cctv etc for most of my life. Im not really sure what difference a few photos on social media will make
- e12e 9y ago
  The difference is the size of the aggregated dataset on you and those you are associated with, and how it might be sold, augmented etc. Granted, some places it might be legal to sell cctv footage too - but it will also fall under the GDPR (not the GDPR alone, there are surveillance bills and "ant-terror" provisions... But there's one remedy for government overreach (throw the government, through elections or protest) another for private overreach: government regulation/laws).
  - rorykoehler 9y ago
    I understand the risk of aggregate data etc and do think we need to hold companies accountable however I disagree with the fundamentals of how GDPR tries to achieve this. It’s the wrong abstraction. I also value what free services, indie apps, small scrappy startups and general maker world productions provide society and life in general way more than I value absolute privacy.

GordonS 9y ago

PCI-DSS is essentially about credit/debit card data. GDPR is about personal information is general, such that you need to let your users know what you are collecting, what you will do with it, and how long you will hold it.

IanCal 9y ago

One of they key things to me is increased fines that are available. I've likely had my data and families data lost through a variety of terribly insecure services having breaches. TalkTalk lost 150k peoples information (including bank account numbers, sort codes, dates of birth, etc - people who later then received scam phone calls with people who knew their details) due to extremely basic security failings. They were fined £400k (a record fine). They then did it again and paid £100k. Properly securing the site and the data over many years could easily cost more than that, added to the chance you'll not get hacked or fined and it is perhaps even a financially sensible position to not put the effort in.

rorykoehler 9y ago
I think being responsible for negligence in security practices and GDPR are not the same. GDPR is overreach. There is a saner middle ground, for example in Australia new laws coming in mean executives can go to prison for the negligence in your example. That makes more sense as it doesn't invalidate 90% of standard tools processes in technical marketing for example.
- IanCal 9y ago
  I think it's interesting you find a fine to be overreach but imprisonment not. > That makes more sense as it doesn't invalidate 90% of standard tools processes in technical marketing for example. Can you explain in more detail?
  - rorykoehler 9y ago
    I'm not talking about the fine/prison. The overreach is that they dictate how you have to handle data. In Australia you are only obligied not to get hacked and are trusted to figure it out for yourself. In Europe they have all this right to be forgotten BS and reams of compulsory opt ins etc etc
    - IanCal 9y ago
      I don't really have a problem with requiring consent to work with personal data. Right to be forgotten is restricted and I can't think of obvious cases within the restrictions here: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/guide-to-the-general-da... that I disagree with. Stronger restrictions on what data you can hold without good reason or consent means that inevitable breaches become less important.