5 ms·

Tough luck. Really, it's no excuse not to handle PII properly.

by hvidgaard 8y ago

Arnt 8y ago
Oh, I agree with that. But the phase-in could have been gentler on the unknown legacy software people do run.
- svennek 8y ago
  The regulation has been known for years. BigCorps, I work with, have been working on this for years... If you start now, then you have a problem. Also, I expect there will be quite some years before the book is thrown on companies, that do not willfully disobey the law.. As most new major legislation, there is a long process of dialing it in (for the lack of better terms), and in most north- and western european contries (at least, I don't know that much about eastern and southern european) most regulatory handling is dialogue-based and not fine-based unless you are a black sheep..
  - speedplane 8y ago
    I suspect that there are many contours of the law that European regulators are not entirely decided on. The next few years will be a learning process for them as well as the tech industry (and their lawyers).
    - svennek 8y ago
      Sure, that is what I meant by dialing in. But that is a process without fines (unless the companies are entirely unreasonable)... At least here in Denmark, the DPA is really reasonable and willing to work with the companies to get compliance...
      - hvidgaard 8y ago
        The source is eluding me, but I'm pretty sure that Datatilsynet (DPA in Denmark) have stated that as long as you have a reasonable plan for implementing GDPR in a reasonable timeframe, you're in the clear. I'd expect as much as they have only recently released their standard documents for Data Processor Agreements for instance.
- DanBC 8y ago
  We've had data protection law for 20 years. And GDPR has been in place for 2 years already. It just comes into effect now. Businesses have had about 5 years to get ready for GDPR.
- hvidgaard 8y ago
  As others have stated, the GDPR have been a talking point in mainstream tech for 1 year, every one in the business with tabs on the current state have known this for at least 2 years when it was adopted. It was proposed 5 years ago, and before that we had DPD [1] from 1995 which more or less states the same, but without ability for the EU courts to do anything about companies not honoring it. It was up to the member states DPA to do this. Companies that cannot handle GDPR was breaking EU law in the first place and probably have since "The Internet" was a thing. If GDPR puts your business down, then good riddance. You'd gambled with the law and now pay the price. [1] https://en.wikipedia.org/wiki/Data_Protection_Directive https://en.wikipedia.org/wiki/Data_Protection_Directive

Tough luck. Really, it's no excuse not to handle PII properly.

Arnt 8y ago

Oh, I agree with that. But the phase-in could have been gentler on the unknown legacy software people do run.

svennek 8y ago
The regulation has been known for years. BigCorps, I work with, have been working on this for years... If you start now, then you have a problem. Also, I expect there will be quite some years before the book is thrown on companies, that do not willfully disobey the law.. As most new major legislation, there is a long process of dialing it in (for the lack of better terms), and in most north- and western european contries (at least, I don't know that much about eastern and southern european) most regulatory handling is dialogue-based and not fine-based unless you are a black sheep..
- speedplane 8y ago
  I suspect that there are many contours of the law that European regulators are not entirely decided on. The next few years will be a learning process for them as well as the tech industry (and their lawyers).
  - svennek 8y ago
    Sure, that is what I meant by dialing in. But that is a process without fines (unless the companies are entirely unreasonable)... At least here in Denmark, the DPA is really reasonable and willing to work with the companies to get compliance...
    - hvidgaard 8y ago
      The source is eluding me, but I'm pretty sure that Datatilsynet (DPA in Denmark) have stated that as long as you have a reasonable plan for implementing GDPR in a reasonable timeframe, you're in the clear. I'd expect as much as they have only recently released their standard documents for Data Processor Agreements for instance.
DanBC 8y ago
We've had data protection law for 20 years. And GDPR has been in place for 2 years already. It just comes into effect now. Businesses have had about 5 years to get ready for GDPR.
hvidgaard 8y ago
As others have stated, the GDPR have been a talking point in mainstream tech for 1 year, every one in the business with tabs on the current state have known this for at least 2 years when it was adopted. It was proposed 5 years ago, and before that we had DPD [1] from 1995 which more or less states the same, but without ability for the EU courts to do anything about companies not honoring it. It was up to the member states DPA to do this. Companies that cannot handle GDPR was breaking EU law in the first place and probably have since "The Internet" was a thing. If GDPR puts your business down, then good riddance. You'd gambled with the law and now pay the price. [1] https://en.wikipedia.org/wiki/Data_Protection_Directive https://en.wikipedia.org/wiki/Data_Protection_Directive