5 ms·

Why? The GDPR is made to protect people from scrupleless companies and practices. Not all companies are good citizen (Cambridge Analytics comes to mind), and

Why? The GDPR is made to protect people from scrupleless companies and practices. Not all companies are good citizen (Cambridge Analytics comes to mind), and as a european I say "Good riddance". For normal companies doing normal things with their data, the effort is mostly documentation and good-willed "try to abide the rules". If you followed the spirit of the pre-GDPR rules, you would almost certainly be compliant without much work even for the GDPR - at least here in Denmark. But if you business is exploiting data, you collected with questionable methods - then yes, you are going to have a problem... I would also like to see the graveyard site, mostly because I would then have something to point to when showing that the GDPR works as intented...

lwansbrough 8y ago
> The GDPR is made to protect people from scrupleless companies and practices. This ignores the vast amount of legislation that creates an enormous legal burden for small companies. > Not all companies are good citizen (Cambridge Analytics comes to mind), and as a european I say "Good riddance". Not all companies in violation of GDPR are bad or negligent. > For normal companies doing normal things with their data, the effort is mostly documentation and good-willed "try to abide the rules". > If you followed the spirit of the pre-GDPR rules, you would almost certainly be compliant without much work even for the GDPR - at least here in Denmark. Until someone sues you and you have to prove that. > But if you business is exploiting data, you collected with questionable methods - then yes, you are going to have a problem... Quite often, data can be both in the "public interest" (not the definition legally defined by GDPR, just that there's no reasonable expectation of privacy by the data creator) and "expoiting" -- such as data derived from pseudonymous sources but could be argued as PII, even though practically speaking, it isn't really. > I would also like to see the graveyard site, mostly because I would then have something to point to when showing that the GDPR works as intented... Most of the sites I've seen that are dead-by-GDPR are small businesses that weren't doing anything any reasonable person would be against, but a single takedown request could be over-burdening for them to respond to as it may have merits by the letter of the law.
- svennek 8y ago
  If you are an European company, most of this stuff has been the law for decades! Running a project/company means taking on risk. Financially and otherwise. Why is data-care risk so much worse? And sueing is only going to happen in the US. In Europe getting sued is extremely rare. I expect most DPA (gov bodies handling this) starts out with a kindly worded letter. You comply, nothing happened.. (Most other legislation works this way in Europe already). Fines are mostly for repeat-offenders or clearly black sheep. In the US, who knows... Most europeans are baffled by the courts and cases in the US. But I think US companies have to be handled by an EU DPA anyways, so we are back to the letter again.. I run a small company (two employees) and I am not concerned. I know a lot of small companies, they are mostly not concerned. I know a few larger companies, they are not concerned (unless they have data handling as their main business). My own work in this has been somewhere in the neighbourhood of a workweek. Not any worse than complying with tax-law... There is also no "automatic 20M euro fine". Most matters are likely handled by a kindly- or sternly worded letter, or a small fine (in the 5-20k EUR range for small companies, which sucks but shouldn't kill you....
  - hvidgaard 8y ago
    I work at a company that stores highly confidential PII. Statements from doctors and the like are just some of the documents our system handle. We're not that concerned. The general consensus is be responsible with the data, make it possible to actually delete something, and show reasonable effort to implement the directives or have a reasonable plan on how and when to implement it reasonably. It's not a big deal as this is how it should have been done in the first place. Only not it's formalized into law.
  - Mirioron 8y ago
    You're very naive about this situation. Just because the possibility legally exists already means that you're taking this into account when calculating risk. Also, EU tax-law is one of the reasons that small digital businesses have suffered in recent years. The VAT fiasco was very poorly handled and it's still ongoing.
    - 8y ago
SyneRyder 8y ago
> If you followed the spirit of the pre-GDPR rules, you would almost certainly be compliant without much work even for the GDPR.... Have you deleted all of your blog's comments and/or asked everyone who previously commented on your blog for new GDPR compliant consent? Because that's one of the GDPR Graveyard events I'm seeing - people deleting their personal blogs and disabling comments as the easiest way to remain compliant.
- svennek 8y ago
  Why? Article 2c (excemptions): "by a natural person in the course of a purely personal or household activity"
  - SyneRyder 8y ago
    Some of his blog also discusses his technical work, so it can be debated whether it is or is not "purely personal or household". Either way, it's vaguely worded enough that for someone who doesn't want to deal with compliance and laws and doesn't want to pay a lawyer just to know if they can keep writing a blog, the path of least resistance is just to delete everything.
    - svennek 8y ago
      That is crystal clear personal activity to me. Also which protection worthy data does the comments contain? Most likely none.
      - SyneRyder 8y ago
        Email addresses, account user names (especially if they commented by logging in via Twitter account). Personal website URLs if they included it. Maybe IP addresses on the server end but hopefully not. All of those are personally identifiable user data.
        DanBC 8y ago
smueller1234 8y ago
I largely agree with you. I'm happy that GDPR is meant to protect consumers and frankly, it's about damn time something was done about protecting our personal data. What I challenge, though, is the assertion that it's easy to comply with if you're not doing "shady" things with data. The law is so broad and sometimes subtle/ambiguous that it COULD turn out to be a nightmare for just about any company. The safety here really is in not being on the short shit list of regulators. And one might end up on that list for any number of reasons unrelated to data protection (eg. size, market position, media coverage/populism).
- svennek 8y ago
  All laws are broad. The current practice is either written in more specific (easilier modifiable documents) from the agencies or defined by "current best practice". In (western) european law there is a "bonus pater" consideration, which means did you expend a reasonable effort to know and be compliant. The same goes for all other legislation. I for one am awaiting a visit by the work-safety agency within the next month (the have notified me, that they drop in unannonced with the next 1 to 3 months) two months ago. That too is neboulus legislation, but I am confident that I have offered my best effort to make the workplace safe, and I am likely to not have any greater reactions that a verbal instruction to be better on certain points (if I have overlooked something).
  - svennek 8y ago
    Obviously the preparation considered "resonable" differs for a three person and a thousand-person company...
- DanBC 8y ago
  > The safety here really is in not being on the short shit list of regulators. And one might end up on that list for any number of reasons unrelated to data protection (eg. size, market position, media coverage/populism). You might find reassurance if you look at how the regulators already work. They've never sought the maximum fines, and they only apply fines in the worst cases. The vast majority of infringements are dealt with by sending letters asking the company to come back into compliance and explaining how that might happen.
deleted 8y ago
[deleted]

lwansbrough 8y ago

> The GDPR is made to protect people from scrupleless companies and practices. This ignores the vast amount of legislation that creates an enormous legal burden for small companies. > Not all companies are good citizen (Cambridge Analytics comes to mind), and as a european I say "Good riddance". Not all companies in violation of GDPR are bad or negligent. > For normal companies doing normal things with their data, the effort is mostly documentation and good-willed "try to abide the rules". > If you followed the spirit of the pre-GDPR rules, you would almost certainly be compliant without much work even for the GDPR - at least here in Denmark. Until someone sues you and you have to prove that. > But if you business is exploiting data, you collected with questionable methods - then yes, you are going to have a problem... Quite often, data can be both in the "public interest" (not the definition legally defined by GDPR, just that there's no reasonable expectation of privacy by the data creator) and "expoiting" -- such as data derived from pseudonymous sources but could be argued as PII, even though practically speaking, it isn't really. > I would also like to see the graveyard site, mostly because I would then have something to point to when showing that the GDPR works as intented... Most of the sites I've seen that are dead-by-GDPR are small businesses that weren't doing anything any reasonable person would be against, but a single takedown request could be over-burdening for them to respond to as it may have merits by the letter of the law.

svennek 8y ago
If you are an European company, most of this stuff has been the law for decades! Running a project/company means taking on risk. Financially and otherwise. Why is data-care risk so much worse? And sueing is only going to happen in the US. In Europe getting sued is extremely rare. I expect most DPA (gov bodies handling this) starts out with a kindly worded letter. You comply, nothing happened.. (Most other legislation works this way in Europe already). Fines are mostly for repeat-offenders or clearly black sheep. In the US, who knows... Most europeans are baffled by the courts and cases in the US. But I think US companies have to be handled by an EU DPA anyways, so we are back to the letter again.. I run a small company (two employees) and I am not concerned. I know a lot of small companies, they are mostly not concerned. I know a few larger companies, they are not concerned (unless they have data handling as their main business). My own work in this has been somewhere in the neighbourhood of a workweek. Not any worse than complying with tax-law... There is also no "automatic 20M euro fine". Most matters are likely handled by a kindly- or sternly worded letter, or a small fine (in the 5-20k EUR range for small companies, which sucks but shouldn't kill you....
- hvidgaard 8y ago
  I work at a company that stores highly confidential PII. Statements from doctors and the like are just some of the documents our system handle. We're not that concerned. The general consensus is be responsible with the data, make it possible to actually delete something, and show reasonable effort to implement the directives or have a reasonable plan on how and when to implement it reasonably. It's not a big deal as this is how it should have been done in the first place. Only not it's formalized into law.
- Mirioron 8y ago
  You're very naive about this situation. Just because the possibility legally exists already means that you're taking this into account when calculating risk. Also, EU tax-law is one of the reasons that small digital businesses have suffered in recent years. The VAT fiasco was very poorly handled and it's still ongoing.
  - 8y ago

SyneRyder 8y ago

> If you followed the spirit of the pre-GDPR rules, you would almost certainly be compliant without much work even for the GDPR.... Have you deleted all of your blog's comments and/or asked everyone who previously commented on your blog for new GDPR compliant consent? Because that's one of the GDPR Graveyard events I'm seeing - people deleting their personal blogs and disabling comments as the easiest way to remain compliant.

svennek 8y ago
Why? Article 2c (excemptions): "by a natural person in the course of a purely personal or household activity"
- SyneRyder 8y ago
  Some of his blog also discusses his technical work, so it can be debated whether it is or is not "purely personal or household". Either way, it's vaguely worded enough that for someone who doesn't want to deal with compliance and laws and doesn't want to pay a lawyer just to know if they can keep writing a blog, the path of least resistance is just to delete everything.
  - svennek 8y ago
    That is crystal clear personal activity to me. Also which protection worthy data does the comments contain? Most likely none.
    - SyneRyder 8y ago
      Email addresses, account user names (especially if they commented by logging in via Twitter account). Personal website URLs if they included it. Maybe IP addresses on the server end but hopefully not. All of those are personally identifiable user data.
      - DanBC 8y ago

smueller1234 8y ago

I largely agree with you. I'm happy that GDPR is meant to protect consumers and frankly, it's about damn time something was done about protecting our personal data. What I challenge, though, is the assertion that it's easy to comply with if you're not doing "shady" things with data. The law is so broad and sometimes subtle/ambiguous that it COULD turn out to be a nightmare for just about any company. The safety here really is in not being on the short shit list of regulators. And one might end up on that list for any number of reasons unrelated to data protection (eg. size, market position, media coverage/populism).

svennek 8y ago
All laws are broad. The current practice is either written in more specific (easilier modifiable documents) from the agencies or defined by "current best practice". In (western) european law there is a "bonus pater" consideration, which means did you expend a reasonable effort to know and be compliant. The same goes for all other legislation. I for one am awaiting a visit by the work-safety agency within the next month (the have notified me, that they drop in unannonced with the next 1 to 3 months) two months ago. That too is neboulus legislation, but I am confident that I have offered my best effort to make the workplace safe, and I am likely to not have any greater reactions that a verbal instruction to be better on certain points (if I have overlooked something).
- svennek 8y ago
  Obviously the preparation considered "resonable" differs for a three person and a thousand-person company...
DanBC 8y ago
> The safety here really is in not being on the short shit list of regulators. And one might end up on that list for any number of reasons unrelated to data protection (eg. size, market position, media coverage/populism). You might find reassurance if you look at how the regulators already work. They've never sought the maximum fines, and they only apply fines in the worst cases. The vast majority of infringements are dealt with by sending letters asking the company to come back into compliance and explaining how that might happen.

deleted 8y ago

[deleted]