4 ms·

I'd feel better if there were a definition of 'large scale' somewhere but the official documents are just too ambiguous. Are 1 million IPs in my logs 'large sc

I'd feel better if there were a definition of 'large scale' somewhere but the official documents are just too ambiguous. Are 1 million IPs in my logs 'large scale'?

djsumdog 8y ago
It really should be defined by company size or revenue. If I my site goes viral and a small web app suddenly has 2M lines of logs, but my revenue is small/non-existent, then there's no reason to comply. If that pushes my revenue over 1M euros a year, you now get pushed into a zone where you should be compliant, and you have enough revenue to afford it as well.
- gervase 8y ago
  Another comment in this thread indicated that "large scale" was any business in which 5 employees or more had access to the data in the course of normal business operations. Not exactly an ironclad source, but better than nothing, hopefully.
theclaw 8y ago
Possibly but they are not "sensitive data" (aka "special categories of personal data"). Article 9 of the GDPR outlines what these special categories are: "personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, [...] genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation"
- jwdunne 8y ago
  Oddly, GDPR gives 3 reasons why you would need a DPO: 1. you're a public authority (NHS practices are an example) 2. Large scale processing 3. Large scale processing of sensitive data They don't specify what large scale means. They also haven't specified how sensitive data qualifies the third statement. One can assume the threshold is lower but the GDPR doesn't specify any thresholds with regards to this.
jwdunne 8y ago
It's not defined. It was left intentionally ambiguous in the GDPR so member states have some flexibility in definition. I've got a call with a lawyer on Monday to clarify some bits of the GDPR. Number one Q for me is "how far can you take legitimate interests?". Some lawyers are advising that marketing data and usage falls under legitimate interest, in a way that these higes drives for consent seem unnecessary. If anyone else has any questions, I can ask and feedback. I'm sure I'll have those questions too.
- DanBC 8y ago
  > Some lawyers are advising that marketing data and usage falls under legitimate interest, Even ICO says legitimate interests might be okay for some marketing. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/#marketing_activities https://ico.org.uk/for-organisations/guide-to-the-general-da...

I'd feel better if there were a definition of 'large scale' somewhere but the official documents are just too ambiguous. Are 1 million IPs in my logs 'large scale'?

djsumdog 8y ago

It really should be defined by company size or revenue. If I my site goes viral and a small web app suddenly has 2M lines of logs, but my revenue is small/non-existent, then there's no reason to comply. If that pushes my revenue over 1M euros a year, you now get pushed into a zone where you should be compliant, and you have enough revenue to afford it as well.

gervase 8y ago
Another comment in this thread indicated that "large scale" was any business in which 5 employees or more had access to the data in the course of normal business operations. Not exactly an ironclad source, but better than nothing, hopefully.

theclaw 8y ago

Possibly but they are not "sensitive data" (aka "special categories of personal data"). Article 9 of the GDPR outlines what these special categories are: "personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, [...] genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation"

jwdunne 8y ago
Oddly, GDPR gives 3 reasons why you would need a DPO: 1. you're a public authority (NHS practices are an example) 2. Large scale processing 3. Large scale processing of sensitive data They don't specify what large scale means. They also haven't specified how sensitive data qualifies the third statement. One can assume the threshold is lower but the GDPR doesn't specify any thresholds with regards to this.

jwdunne 8y ago

It's not defined. It was left intentionally ambiguous in the GDPR so member states have some flexibility in definition. I've got a call with a lawyer on Monday to clarify some bits of the GDPR. Number one Q for me is "how far can you take legitimate interests?". Some lawyers are advising that marketing data and usage falls under legitimate interest, in a way that these higes drives for consent seem unnecessary. If anyone else has any questions, I can ask and feedback. I'm sure I'll have those questions too.

DanBC 8y ago
> Some lawyers are advising that marketing data and usage falls under legitimate interest, Even ICO says legitimate interests might be okay for some marketing. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/#marketing_activities https://ico.org.uk/for-organisations/guide-to-the-general-da...