3 ms·

With one minor exception, you have just described GDPR. The exception being: there is no minimum for fines. So a small company could be fined absolutely nothin

With one minor exception, you have just described GDPR. The exception being: there is no minimum for fines. So a small company could be fined absolutely nothing for an infringement if it was representative of the harm caused or they fixed the issue. Also. Security representatives--actually called data protection officers--are only necessary at large scale or highly sensitive operations. The law is being applied gradually. It is already in effect and has been for two years. The approaching deadline is when the penalty clauses will come into effect. How it will be applied remains to be seen, but has no bearing on the validity of the legislation itself.

aquadrop 8y ago
Not exactly, I specifically left out 'right to be forgotten' part. Also, I didn't see anything specific about tiers for companies and data (I didn't read the whole law, only its explanations) - when you clearly know what applies to you. With GDPR as you said small company could be fined nothing, but it also could be fined a lot - that's the problem, you don't know for sure and that's a risk which streetlend.com was afraid of. If they could just look at GDPR and say "ok, we're a small company and we don't hold any highly sensitive data, so according to the law we just need to provide users with clear ways to stop using our service; ok, keep going" it would be much easier. One of main problems of GDPR is uncertainty around it. Also with gradually I meant geography - only within EU for its companies, because frankly I don't like idea of countries deciding to apply their rules in the internet worldwide - it can get messy pretty quickly.
- BlackFly 8y ago
  In my mind, the right to be forgotten is implied by your bullet point "Let users clear way to tell company that they want to stop using their account (and related data gathering)" By the definition of data processing, streetlend has to delete all my data to stop processing it. It is pretty clear what streetlend needs to do to be GDPR compliant: if the user data is actually being sent to the third parties (the ad networks) then users need to explicitly be told this. If the data is not being sent to third parties then users already consent to their data being stored by entering the data (the data is necessary for the performance of the service operated). Next to that: allow users to delete their data when they close their account (this should be as easy as setting cascade on foreign key constraints). As for the geography: if your interaction with European citizens is incidental and not purposeful, you cannot be charged under the GDPR. It is only if you are actively trying to target your goods or services to the European market that they will enforce against you. This is obviously the case since they will have no power to enforce the law otherwise, but it is also covered by the three paragraphs of Article 3.
  - aquadrop 8y ago
    I didn't say about data processing, but data gathering. What I meant about stop using account is that they won't send you any new notifications, won't show you as a possible friend for other registering people etc. By data gathering I meant that they won't track you anymore, like if you exit facebook, they should still adding info about you through all the like buttons etc. > Next to that: allow users to delete their data when they close their account (this should be as easy as setting cascade on foreign key constraints). That is definitely not easy and doesn't work like that. That's why it's common practice in any serious system to have 'deleted' flag instead of actual deleting. > It is only if you are actively trying to target your goods or services to the European market that they will enforce against you. Yes, and if you target whole world like most sites in the internet do, you're targeting Europe?

aquadrop 8y ago

Not exactly, I specifically left out 'right to be forgotten' part. Also, I didn't see anything specific about tiers for companies and data (I didn't read the whole law, only its explanations) - when you clearly know what applies to you. With GDPR as you said small company could be fined nothing, but it also could be fined a lot - that's the problem, you don't know for sure and that's a risk which streetlend.com was afraid of. If they could just look at GDPR and say "ok, we're a small company and we don't hold any highly sensitive data, so according to the law we just need to provide users with clear ways to stop using our service; ok, keep going" it would be much easier. One of main problems of GDPR is uncertainty around it. Also with gradually I meant geography - only within EU for its companies, because frankly I don't like idea of countries deciding to apply their rules in the internet worldwide - it can get messy pretty quickly.

BlackFly 8y ago
In my mind, the right to be forgotten is implied by your bullet point "Let users clear way to tell company that they want to stop using their account (and related data gathering)" By the definition of data processing, streetlend has to delete all my data to stop processing it. It is pretty clear what streetlend needs to do to be GDPR compliant: if the user data is actually being sent to the third parties (the ad networks) then users need to explicitly be told this. If the data is not being sent to third parties then users already consent to their data being stored by entering the data (the data is necessary for the performance of the service operated). Next to that: allow users to delete their data when they close their account (this should be as easy as setting cascade on foreign key constraints). As for the geography: if your interaction with European citizens is incidental and not purposeful, you cannot be charged under the GDPR. It is only if you are actively trying to target your goods or services to the European market that they will enforce against you. This is obviously the case since they will have no power to enforce the law otherwise, but it is also covered by the three paragraphs of Article 3.
- aquadrop 8y ago
  I didn't say about data processing, but data gathering. What I meant about stop using account is that they won't send you any new notifications, won't show you as a possible friend for other registering people etc. By data gathering I meant that they won't track you anymore, like if you exit facebook, they should still adding info about you through all the like buttons etc. > Next to that: allow users to delete their data when they close their account (this should be as easy as setting cascade on foreign key constraints). That is definitely not easy and doesn't work like that. That's why it's common practice in any serious system to have 'deleted' flag instead of actual deleting. > It is only if you are actively trying to target your goods or services to the European market that they will enforce against you. Yes, and if you target whole world like most sites in the internet do, you're targeting Europe?