3 ms·

This is a great resource because it is from the EU, provides clear examples, cites the actual legislation and Article 29 Working Party Guidelines (which is the

This is a great resource because it is from the EU, provides clear examples, cites the actual legislation and Article 29 Working Party Guidelines (which is the group that is tasked with preparing official opinions on GDPR). I think that if you want to really comprehend something, you should go to the primary source. The GDPR legislation is far more approachable than it seems (as an official 261 page PDF). When the preamble and the mechanical bits about how the GDPR will be governed are removed, the parts that important to companies are only 34 pages long. You can use this to guide your reading: https://www.enterpriseready.io/gdpr/how-to-read-gdpr/ https://www.enterpriseready.io/gdpr/how-to-read-gdpr/

Silhouette 8y ago
I respectfully disagree. This is a terrible resource, which frequently says things that are either mostly vacuous or just plain wrong. For example, here's their page on the right to erasure: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/dealing-citizens/do-we-always-have-delete-personal-data-if-person-asks_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Its opening paragraph reads as if data subjects have an automatic right to have their data deleted unless one of the three exceptions applies. In fact, Article 17 of the GDPR itself grants that right only under a list of specific circumstances, and the exceptions are just that, which is an entirely different situation that will lead to the opposite decision on whether data must be erased in many normal situations. Even the list of exceptions shown isn't complete. For another example, here's their page on demonstrating compliance: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/how-can-i-demonstrate-my-organisation-compliant-gdpr_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... There is literally nothing on that page that would help any business I'm dealing with to demonstrate compliance, unless you count the references to the primary sources at the end. There are a couple of ideas about codes of conduct or certifications that contain no substantial details, and even the vague hints about other things you might have to do don't go into any detail about who does or doesn't, leaving the entire page almost entirely content-free unless you happen to be in an industry where the kind of scheme they mention exists. This sort of "guidance" is everything that is wrong with how the GDPR is being handled. It is verbose, ambiguous, sometimes seriously misleading, and almost entirely non-actionable. I'm actually worse off than I was before I read it, because I know nothing useful now that I didn't know before, I would have been misled by several of the pages such as the one I mentioned above if I hadn't already known better, and that's still half an hour of my life wasted.
- grantlmiller 8y ago
  Well, you're clearly thinking deeply about this and you seem to care. Which is great. I've been digging in deep on this the last few months so I have some thoughts. Respectfully (srsly), I think you might be misinterpreting the legislation (this resource is provides more concrete examples of how you should interpret it). For example, Article 17(1) lays out the MANY grounds upon which a Data Subject can request erasure. If ONE of the mentioned criteria is met including the very broad Right to Object (Article 21) then it must be erased. 17(2) states you must fwd this request on to other online orgs. 17(3) provides the exceptions for which a Controller can object to the erasure. It is important to note that the spirit of GDPR is one where Data Subjects rights (to their data, to object) are the default. Sort of like innocent until proven guilty. This is a big shift for most companies who would contend that they own the data & data exhaust from use of their application. As for compliance demonstration... yes, this is still a mess. My only suggestion there is that if you're working with software companies, try to study what the leaders are doing and take some inspiration. https://www.enterpriseready.io/gdpr/preparing-for-gdpr/ https://www.enterpriseready.io/gdpr/preparing-for-gdpr/ Happy to hear your thoughts. Genuinely interested in other people's perspectives on this.
  - Silhouette 8y ago
    For example, Article 17(1) lays out the MANY grounds upon which a Data Subject can request erasure. If ONE of the mentioned criteria is met including the very broad Right to Object (Article 21) then it must be erased. Yes, but crucially, if the data is still relevant and you're processing it on a proper basis, the data subject doesn't necessarily have a right to have it erased. If your only legal basis for processing is consent, subjects get most of the rights under the GDPR automatically and you have very little choice about complying. One of the big changes in the new regime is that consent can be withdrawn retrospectively. If your basis is legitimate interests, things are more complicated. Subject rights are stronger in this situation than with some of the other legal bases, because they can object to processing. However, the right to object is itself subject to balancing tests that aren't clearly defined, except in the specific case of direct marketing. For the stronger bases, such as performance of a contract or compliance with legal obligations, subject rights are still quite limited even under the GDPR. For example, under EU VAT rules, we are required by law to keep evidence of where our customers are located for quite a long time, and customers can't require us to delete that evidence prematurely. There are some other important details to be considered, for example if you're processing data about children, but that seems to be the basic situation.

Silhouette 8y ago

I respectfully disagree. This is a terrible resource, which frequently says things that are either mostly vacuous or just plain wrong. For example, here's their page on the right to erasure: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/dealing-citizens/do-we-always-have-delete-personal-data-if-person-asks_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Its opening paragraph reads as if data subjects have an automatic right to have their data deleted unless one of the three exceptions applies. In fact, Article 17 of the GDPR itself grants that right only under a list of specific circumstances, and the exceptions are just that, which is an entirely different situation that will lead to the opposite decision on whether data must be erased in many normal situations. Even the list of exceptions shown isn't complete. For another example, here's their page on demonstrating compliance: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/how-can-i-demonstrate-my-organisation-compliant-gdpr_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... There is literally nothing on that page that would help any business I'm dealing with to demonstrate compliance, unless you count the references to the primary sources at the end. There are a couple of ideas about codes of conduct or certifications that contain no substantial details, and even the vague hints about other things you might have to do don't go into any detail about who does or doesn't, leaving the entire page almost entirely content-free unless you happen to be in an industry where the kind of scheme they mention exists. This sort of "guidance" is everything that is wrong with how the GDPR is being handled. It is verbose, ambiguous, sometimes seriously misleading, and almost entirely non-actionable. I'm actually worse off than I was before I read it, because I know nothing useful now that I didn't know before, I would have been misled by several of the pages such as the one I mentioned above if I hadn't already known better, and that's still half an hour of my life wasted.

grantlmiller 8y ago
Well, you're clearly thinking deeply about this and you seem to care. Which is great. I've been digging in deep on this the last few months so I have some thoughts. Respectfully (srsly), I think you might be misinterpreting the legislation (this resource is provides more concrete examples of how you should interpret it). For example, Article 17(1) lays out the MANY grounds upon which a Data Subject can request erasure. If ONE of the mentioned criteria is met including the very broad Right to Object (Article 21) then it must be erased. 17(2) states you must fwd this request on to other online orgs. 17(3) provides the exceptions for which a Controller can object to the erasure. It is important to note that the spirit of GDPR is one where Data Subjects rights (to their data, to object) are the default. Sort of like innocent until proven guilty. This is a big shift for most companies who would contend that they own the data & data exhaust from use of their application. As for compliance demonstration... yes, this is still a mess. My only suggestion there is that if you're working with software companies, try to study what the leaders are doing and take some inspiration. https://www.enterpriseready.io/gdpr/preparing-for-gdpr/ https://www.enterpriseready.io/gdpr/preparing-for-gdpr/ Happy to hear your thoughts. Genuinely interested in other people's perspectives on this.
- Silhouette 8y ago
  For example, Article 17(1) lays out the MANY grounds upon which a Data Subject can request erasure. If ONE of the mentioned criteria is met including the very broad Right to Object (Article 21) then it must be erased. Yes, but crucially, if the data is still relevant and you're processing it on a proper basis, the data subject doesn't necessarily have a right to have it erased. If your only legal basis for processing is consent, subjects get most of the rights under the GDPR automatically and you have very little choice about complying. One of the big changes in the new regime is that consent can be withdrawn retrospectively. If your basis is legitimate interests, things are more complicated. Subject rights are stronger in this situation than with some of the other legal bases, because they can object to processing. However, the right to object is itself subject to balancing tests that aren't clearly defined, except in the specific case of direct marketing. For the stronger bases, such as performance of a contract or compliance with legal obligations, subject rights are still quite limited even under the GDPR. For example, under EU VAT rules, we are required by law to keep evidence of where our customers are located for quite a long time, and customers can't require us to delete that evidence prematurely. There are some other important details to be considered, for example if you're processing data about children, but that seems to be the basic situation.