5 ms·

Yeah, that's what I was talking about couple of weeks ago here. I was afraid that GDPR will stifle innovation and it's just a beginning. GDPR is highly vague o

Yeah, that's what I was talking about couple of weeks ago here. I was afraid that GDPR will stifle innovation and it's just a beginning. GDPR is highly vague omnipresent regulation with huge strict fines. It's like infamous cookie law times a million. They could make it into a good law, my opinion on what should have been done: Keep good parts, such as: - Appoint official 'security' representative who're responsible for breach disclosures, promoting security practices etc, that person can be personally held responsible for shifty company behavior (though nothing draconian) like non-disclosing a breach, so they would be motivated to be on user side in the company. - Let users ability to download their own data - Let users clear way to tell company that they want to stop using their account (and related data gathering) - Mandate more open disclosure of what is done with data gathered from users And also: - Mandate easier ways to review EULA and changes to EULA (like each change should be available separately, describe what changed and why) - Create system of centralized disclosure of security vulnerabilities by third parties, with record showing request and response publicly after some time. Maybe also create some system of grants for third party penetration testing for larger players in the internet. - Split available data into categories, like 'non-sensitive data', 'sensitive data', 'highly sensitive data'. Medical records, financial records etc is highly sensitive and higher standards are applied. Email and name is non-sensitive data (so you could run a simple forum, or any other simple free service, where you only want email from a user, without being afraid). - Split companies into tiers, under 50 employees or 100000 users nothing applies; 51-1000 employees higher standard applies; over 1000 - full power applies. This also should be tied with previous point - for example, smallest tier company should still be responsible for some rules if they deal with highly sensitive data, and if it's largest tier company they should be following some rules even if they only deal with non-sensitive data. - More sensible fines. For example 1% or $100k, whichever is smaller for the first time, 2% or $1m second time etc. Designated security officer can also be held responsible in the same manner (like, % of salary and later being forbidden to work as a security officer). It can also be tied to tiers of companies. - Start applying law gradually, beginning with just applying it only for european countries. I believe that would keep benefits for users and won't create giant problems for the industry as a whole.

BlackFly 8y ago
With one minor exception, you have just described GDPR. The exception being: there is no minimum for fines. So a small company could be fined absolutely nothing for an infringement if it was representative of the harm caused or they fixed the issue. Also. Security representatives--actually called data protection officers--are only necessary at large scale or highly sensitive operations. The law is being applied gradually. It is already in effect and has been for two years. The approaching deadline is when the penalty clauses will come into effect. How it will be applied remains to be seen, but has no bearing on the validity of the legislation itself.
- aquadrop 8y ago
  Not exactly, I specifically left out 'right to be forgotten' part. Also, I didn't see anything specific about tiers for companies and data (I didn't read the whole law, only its explanations) - when you clearly know what applies to you. With GDPR as you said small company could be fined nothing, but it also could be fined a lot - that's the problem, you don't know for sure and that's a risk which streetlend.com was afraid of. If they could just look at GDPR and say "ok, we're a small company and we don't hold any highly sensitive data, so according to the law we just need to provide users with clear ways to stop using our service; ok, keep going" it would be much easier. One of main problems of GDPR is uncertainty around it. Also with gradually I meant geography - only within EU for its companies, because frankly I don't like idea of countries deciding to apply their rules in the internet worldwide - it can get messy pretty quickly.
  - BlackFly 8y ago
    In my mind, the right to be forgotten is implied by your bullet point "Let users clear way to tell company that they want to stop using their account (and related data gathering)" By the definition of data processing, streetlend has to delete all my data to stop processing it. It is pretty clear what streetlend needs to do to be GDPR compliant: if the user data is actually being sent to the third parties (the ad networks) then users need to explicitly be told this. If the data is not being sent to third parties then users already consent to their data being stored by entering the data (the data is necessary for the performance of the service operated). Next to that: allow users to delete their data when they close their account (this should be as easy as setting cascade on foreign key constraints). As for the geography: if your interaction with European citizens is incidental and not purposeful, you cannot be charged under the GDPR. It is only if you are actively trying to target your goods or services to the European market that they will enforce against you. This is obviously the case since they will have no power to enforce the law otherwise, but it is also covered by the three paragraphs of Article 3.

BlackFly 8y ago

With one minor exception, you have just described GDPR. The exception being: there is no minimum for fines. So a small company could be fined absolutely nothing for an infringement if it was representative of the harm caused or they fixed the issue. Also. Security representatives--actually called data protection officers--are only necessary at large scale or highly sensitive operations. The law is being applied gradually. It is already in effect and has been for two years. The approaching deadline is when the penalty clauses will come into effect. How it will be applied remains to be seen, but has no bearing on the validity of the legislation itself.

aquadrop 8y ago
Not exactly, I specifically left out 'right to be forgotten' part. Also, I didn't see anything specific about tiers for companies and data (I didn't read the whole law, only its explanations) - when you clearly know what applies to you. With GDPR as you said small company could be fined nothing, but it also could be fined a lot - that's the problem, you don't know for sure and that's a risk which streetlend.com was afraid of. If they could just look at GDPR and say "ok, we're a small company and we don't hold any highly sensitive data, so according to the law we just need to provide users with clear ways to stop using our service; ok, keep going" it would be much easier. One of main problems of GDPR is uncertainty around it. Also with gradually I meant geography - only within EU for its companies, because frankly I don't like idea of countries deciding to apply their rules in the internet worldwide - it can get messy pretty quickly.
- BlackFly 8y ago
  In my mind, the right to be forgotten is implied by your bullet point "Let users clear way to tell company that they want to stop using their account (and related data gathering)" By the definition of data processing, streetlend has to delete all my data to stop processing it. It is pretty clear what streetlend needs to do to be GDPR compliant: if the user data is actually being sent to the third parties (the ad networks) then users need to explicitly be told this. If the data is not being sent to third parties then users already consent to their data being stored by entering the data (the data is necessary for the performance of the service operated). Next to that: allow users to delete their data when they close their account (this should be as easy as setting cascade on foreign key constraints). As for the geography: if your interaction with European citizens is incidental and not purposeful, you cannot be charged under the GDPR. It is only if you are actively trying to target your goods or services to the European market that they will enforce against you. This is obviously the case since they will have no power to enforce the law otherwise, but it is also covered by the three paragraphs of Article 3.