3 ms·
The GDPR is perfectly straightforward to interpret and apply. It's remarkably similar to the existing Data Protection Directive. If you are using data in a spec
by jdietrich 9y ago
The GDPR is perfectly straightforward to interpret and apply. It's remarkably similar to the existing Data Protection Directive. If you are using data in a specific, explicit and legitimate way, you have nothing to fear from the GDPR. It only seems radical because tech companies have operated with relative impunity in the past, hoovering up data en masse with no regard to the privacy or security of their users.
Article 83 clearly states that penalties must be proportionate to the scale of the breach, the impact on users, the intentional or negligent character of the breach and the degree of co-operation with the supervisory authority. A supervisory authority can't just bankrupt your company out of spite.
https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/
Your bio says that you're a founder of a company that processes healthcare data. The maximum civil penalty for HIPAA violation is a fine of $50,000 per violation and there have been several multimillion dollar penalties. The maximum criminal penalty is 10 years imprisonment. If you're worried about GDPR, you should be absolutely terrified of HIPAA.
- pg_bot 9y agoI'm not worried about it for my company, just putting into perspective why other people might be.
- coldcode 9y agoWhy, I used to be a HIPPA architect and basically the government (and even more this one) ignored all evidence of HIPPA violations. Our compliance was a complete joke, covered by some fancy "audit" which failed to ask a single question. Laws don't matter unless they enforced.
- raverbashing 9y ago> Your bio says that you're a founder of a company that processes healthcare data. The maximum civil penalty for HIPAA violation is a fine of $50,000 per violation and there have been several multimillion dollar penalties. The maximum criminal penalty is 10 years imprisonment. If you're worried about GDPR, you should be absolutely terrified of HIPAA. Yes, I also find this hilarious, people love to spread FUD about the GDPR, but HIPPA is more serious (though limited in scope).
- crazypyro 9y agoI think the scope differences between HIPPA and GDPR, as well as the specificity of some of the language used, are key factors in why someone might disagree with GDPR, but not HIPPA.
- scarface74 9y agoThe GDPR is perfectly straightforward to interpret and apply. How can anything with 11 chapters and 99 sections be "straightforward to interpret and apply"? https://gdpr-info.eu/ https://gdpr-info.eu/
- jdietrich 9y agoThose chapters and sections are logical and clearly written. It's very easy to figure out which provisions apply to your business and what action you need to take. The ICO have provided extensive guidance and a toolkit for assessing your GDPR compliance. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-the-general-da... If you're making a hardware product for the US market, you need to comply with FCC Title 47 Part 15. If you've never been involved in this process, I'd encourage you to read it. The rules governing a bluetooth speaker are at least as complex as the rules governing Facebook and Google's hoard of personal information. https://www.ecfr.gov/cgi-bin/text-idx?SID=91a501119ab6978f8713a63ea25d10a1&mc=true&tpl=/ecfrbrowse/Title47/47cfr15_main_02.tpl https://www.ecfr.gov/cgi-bin/text-idx?SID=91a501119ab6978f87...