3 ms·

I get what you’re saying, but I’m not sure it’s fair to compare PII management to the medical industry. Personally I think the new regulations are rather ham fi

I get what you’re saying, but I’m not sure it’s fair to compare PII management to the medical industry. Personally I think the new regulations are rather ham fisted, with so many edge cases that it looks more like a denial of reality than an attempt to regulate it. I also think it’s going to be pretty harmful to startups, and that we’ll see more businesses just trying to avoid Europe at all costs. Regulation like this can either be easy to comply with, or they can be effective, you can’t really have both at the same time. Even then it just boils down to the old tension between security and compliance. I work with a lot of PCI orgs, all of them have AoCs, very few of them are actually what I would view as compliant. They all managed to satisfy the box checkers, but the DSS doesn’t do much to protect the consumers in most situations. The reality is that the DSS is just a mechanism of shifting accountability around, which is what I see the GDPR as. A bunch of politicians using poorly written regulations to shift accountability on to the market.

guitarbill 9y ago
The medical industry is a decent analogy though. Highly regulated, high barrier to entry. Which is bad. Overall though, probably better than a free-for-all (e.g. Theranos), as we've learned from several millennia of humans being awful or incompetent. God forbid we try and apply some of those ethics to IT. (Europe is big on privacy, again a somewhat hard-learned lesson.)
- AmericanChopper 9y ago
  Except that approach ignores the nature of risk. The impact of getting a drug wrong is catastrophic, the impact of disclosing some PII is far less. This impact also decreases proportional to the size of the organisation, unlike the regulatory burden. To compare PII to medicine is trying to invoke an emotional reaction, not a reasoned one. I don’t think this regulation is well designed at all, I don’t even think it’s going to achieve half of what it’s trying to do. But it will achieve increases compliance costs to pretty much every company, costs that will put startups at a serious disadvantage to established companies. Europe thinks they’ll have some protection by claiming every company in the world must comply, but only time will tell how that will work out for them.
  - guitarbill 9y ago
    First, European law works differently, and the way we write laws is different. You can't interpret them in the context of the US law system, where everything must be ultra-explicit and overworked. Also, only regulators can levy the fines/sanctions, they don't result from law suits from individuals. Second, Europeans take privacy serious, and it's a right for us, similar to free speech in America. Also, while not as bad as some medical risks, identity theft is not fun. But, yeah, the risks are different, and the GDPR is pretty mild compared to medical laws, no? I mean in Europe, you can't advertise prescription drugs. Third, Europe is not claiming every company in the world must comply. But if you're mad at governments overreaching, maybe you could sort out the requirements FATCA/US tax law puts on foreign banks, or the US attempting to extradite "cyber criminals" before you get to the GDPR?
    - AmericanChopper 9y ago
      I am not personally the federal government of the US, so I’m not sure why you’re directing that whataboutism at me. However, comparing identity theft to death or permanent disability is not equivalent no matter which way you look at it. In any case, none of that responds to any of the points I made. The EU does think this regulation applies to every company in the world (unless you can somehow prove you don’t handle any EU data subjects data - which almost no company could do). One of the reasons being that they don’t want to only hamstring European company’s with it, as that would be a very poor strategic move for their markets. How enforceable this ends up being is entirely unknown at this point, and you can bet there’ll be a lot of legal challenges ahead regarding this.
      - guitarbill 9y ago
        I'm making the point government "overreach" or whatever you feel it is happens daily, and IMO, GDPR is the least inappropriate of those. I would imagine it's incredibly easy for many US companies, like e.g. a restaurant or a tire-repair shop to prove they don't explicitly go after EU subjects. Since I was elaborating on how the EU and EU nationals feel like the GDPR is appropriate in addressing the risk of privacy violations - which part of that did you feel like didn't address your comment of "Except that approach ignores the nature of risk"?

guitarbill 9y ago

The medical industry is a decent analogy though. Highly regulated, high barrier to entry. Which is bad. Overall though, probably better than a free-for-all (e.g. Theranos), as we've learned from several millennia of humans being awful or incompetent. God forbid we try and apply some of those ethics to IT. (Europe is big on privacy, again a somewhat hard-learned lesson.)

AmericanChopper 9y ago
Except that approach ignores the nature of risk. The impact of getting a drug wrong is catastrophic, the impact of disclosing some PII is far less. This impact also decreases proportional to the size of the organisation, unlike the regulatory burden. To compare PII to medicine is trying to invoke an emotional reaction, not a reasoned one. I don’t think this regulation is well designed at all, I don’t even think it’s going to achieve half of what it’s trying to do. But it will achieve increases compliance costs to pretty much every company, costs that will put startups at a serious disadvantage to established companies. Europe thinks they’ll have some protection by claiming every company in the world must comply, but only time will tell how that will work out for them.
- guitarbill 9y ago
  First, European law works differently, and the way we write laws is different. You can't interpret them in the context of the US law system, where everything must be ultra-explicit and overworked. Also, only regulators can levy the fines/sanctions, they don't result from law suits from individuals. Second, Europeans take privacy serious, and it's a right for us, similar to free speech in America. Also, while not as bad as some medical risks, identity theft is not fun. But, yeah, the risks are different, and the GDPR is pretty mild compared to medical laws, no? I mean in Europe, you can't advertise prescription drugs. Third, Europe is not claiming every company in the world must comply. But if you're mad at governments overreaching, maybe you could sort out the requirements FATCA/US tax law puts on foreign banks, or the US attempting to extradite "cyber criminals" before you get to the GDPR?
  - AmericanChopper 9y ago
    I am not personally the federal government of the US, so I’m not sure why you’re directing that whataboutism at me. However, comparing identity theft to death or permanent disability is not equivalent no matter which way you look at it. In any case, none of that responds to any of the points I made. The EU does think this regulation applies to every company in the world (unless you can somehow prove you don’t handle any EU data subjects data - which almost no company could do). One of the reasons being that they don’t want to only hamstring European company’s with it, as that would be a very poor strategic move for their markets. How enforceable this ends up being is entirely unknown at this point, and you can bet there’ll be a lot of legal challenges ahead regarding this.
    - guitarbill 9y ago
      I'm making the point government "overreach" or whatever you feel it is happens daily, and IMO, GDPR is the least inappropriate of those. I would imagine it's incredibly easy for many US companies, like e.g. a restaurant or a tire-repair shop to prove they don't explicitly go after EU subjects. Since I was elaborating on how the EU and EU nationals feel like the GDPR is appropriate in addressing the risk of privacy violations - which part of that did you feel like didn't address your comment of "Except that approach ignores the nature of risk"?