5 ms·

I largely agree with you. I'm happy that GDPR is meant to protect consumers and frankly, it's about damn time something was done about protecting our personal d

I largely agree with you. I'm happy that GDPR is meant to protect consumers and frankly, it's about damn time something was done about protecting our personal data. What I challenge, though, is the assertion that it's easy to comply with if you're not doing "shady" things with data. The law is so broad and sometimes subtle/ambiguous that it COULD turn out to be a nightmare for just about any company. The safety here really is in not being on the short shit list of regulators. And one might end up on that list for any number of reasons unrelated to data protection (eg. size, market position, media coverage/populism).

svennek 8y ago
All laws are broad. The current practice is either written in more specific (easilier modifiable documents) from the agencies or defined by "current best practice". In (western) european law there is a "bonus pater" consideration, which means did you expend a reasonable effort to know and be compliant. The same goes for all other legislation. I for one am awaiting a visit by the work-safety agency within the next month (the have notified me, that they drop in unannonced with the next 1 to 3 months) two months ago. That too is neboulus legislation, but I am confident that I have offered my best effort to make the workplace safe, and I am likely to not have any greater reactions that a verbal instruction to be better on certain points (if I have overlooked something).
- svennek 8y ago
  Obviously the preparation considered "resonable" differs for a three person and a thousand-person company...
DanBC 8y ago
> The safety here really is in not being on the short shit list of regulators. And one might end up on that list for any number of reasons unrelated to data protection (eg. size, market position, media coverage/populism). You might find reassurance if you look at how the regulators already work. They've never sought the maximum fines, and they only apply fines in the worst cases. The vast majority of infringements are dealt with by sending letters asking the company to come back into compliance and explaining how that might happen.

svennek 8y ago

All laws are broad. The current practice is either written in more specific (easilier modifiable documents) from the agencies or defined by "current best practice". In (western) european law there is a "bonus pater" consideration, which means did you expend a reasonable effort to know and be compliant. The same goes for all other legislation. I for one am awaiting a visit by the work-safety agency within the next month (the have notified me, that they drop in unannonced with the next 1 to 3 months) two months ago. That too is neboulus legislation, but I am confident that I have offered my best effort to make the workplace safe, and I am likely to not have any greater reactions that a verbal instruction to be better on certain points (if I have overlooked something).

svennek 8y ago
Obviously the preparation considered "resonable" differs for a three person and a thousand-person company...

DanBC 8y ago

> The safety here really is in not being on the short shit list of regulators. And one might end up on that list for any number of reasons unrelated to data protection (eg. size, market position, media coverage/populism). You might find reassurance if you look at how the regulators already work. They've never sought the maximum fines, and they only apply fines in the worst cases. The vast majority of infringements are dealt with by sending letters asking the company to come back into compliance and explaining how that might happen.