4 ms·

> 95% Such as? Everything. Even if you process just an IP you need to document your procedures, change privacy policies. If at any point you ask for anything y

> 95% Such as? Everything. Even if you process just an IP you need to document your procedures, change privacy policies. If at any point you ask for anything you need to implement opt ins, a way for (unauthenticated) users to request their data (even if it's just 1 IP) etc. My point is that having negligible private data is not less of a compliance burden than having a lot of private data. > You've had two full years You mean i ve had 2 years to attempt to interpret a vaguely written law. Actionable information is just now coming out, and even that is contradictory (cue this topic). Even the EU parliament's website does not comply yet. > you likely were already riding a very fine line with respect to the DPD First, that is a directive, not a law and compliance can vary widely. Second, gdpr requires new procedures which means it requires amendments anyway > Such as? I have posted another comment

jacquesm 8y ago
> Even if you hold just an IP you need to document your procedures, change privacy policies. So don't hold IPs if you can't be bothered to know where the might end up and if you don't want to update your privacy policy. Why would you? > My point is that having negligible private data is no less compliance burden than having a lot of private data. And no data means no compliance burden. Note that holding data already has costs associated with it no matter what you do: you need to secure that data, you need to back it up, you need to process it and eventually you will need to get rid of it. All of those cost money and effort. > You mean i ve had 2 years to attempt to interpret a vaguely written law. As laws come the GDPR is surprisingly clear. I was quite skeptical until I actually got a copy of the draft and I was positively surprised. They actually got it mostly right, there are some minor things that I would have liked to see different but on the whole I am not complaining. > Actionable information is just now coming out, and even that is contradictory (cue this topic). The hysteria is ridiculous. Anybody that has spent even so much as a couple of hours on this subject - and from a somewhat serious point of view rather than the ridiculous fear mongering - knows enough to not have written a silly blog post like the one on display here. > Even the EU parliament's website does not comply yet. That article was not exactly enlightened to put it mildly. > First, that is a directive, not a law and compliance can vary widely. Yes, but if you did take it serious then you are well underway. > Second, gdpr requires new procedures which means it requires amendments anyway Yes, there is some overhead. But this is mostly to ensure that the law will not be ignored like what happened with the DPD. As you say 'it was a directive' which many companies interpreted as 'can be ignored'. What they failed to realize is that if you don't self regulate after a directive is issued that there will be a version of the directive with teeth that has the strength of law. Congratulations, we are there.
DanBC 8y ago
> you need to implement opt ins, No. This is the myth that "consent is always required". There are several justifications for processing personal data, and consent is just one of them. There are others. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
- zerostar07 8y ago
  First, notice how things like legitimate interests are not narrowly defined and left up to the DPA to judge. Which makes it hard to know whether you even need consent or not. Second, this is ICO, the British regulator. There are 28 of them one in each country and they won't always agree, so the application of GDPR policies can vary.
  - DanBC 8y ago
    But, again, if you're not compliant they'll just write a letter telling you this and asking you to come into compliance. At that point you can check your understanding of the law and what you're doing and write back letting them know why you think you're in compliance; or you can change your process; or you can take it to court.
    - zerostar07 8y ago
      What happens when that is not possible though? E.g. in the case there is a breach and it is found out because of it that you were not compliant. Do they still write you a letter? Also , is this procedure common for all DPAs or just for the UK?
  - mikekchar 8y ago
    Legitimate interest definition is almost exactly the same as the existing laws on handling private information. If you want to complain about it, don't complain about the GDPR. If you've been handling private information for EU customers and have been complying with the law, then there is practically nothing for you to do.

jacquesm 8y ago

> Even if you hold just an IP you need to document your procedures, change privacy policies. So don't hold IPs if you can't be bothered to know where the might end up and if you don't want to update your privacy policy. Why would you? > My point is that having negligible private data is no less compliance burden than having a lot of private data. And no data means no compliance burden. Note that holding data already has costs associated with it no matter what you do: you need to secure that data, you need to back it up, you need to process it and eventually you will need to get rid of it. All of those cost money and effort. > You mean i ve had 2 years to attempt to interpret a vaguely written law. As laws come the GDPR is surprisingly clear. I was quite skeptical until I actually got a copy of the draft and I was positively surprised. They actually got it mostly right, there are some minor things that I would have liked to see different but on the whole I am not complaining. > Actionable information is just now coming out, and even that is contradictory (cue this topic). The hysteria is ridiculous. Anybody that has spent even so much as a couple of hours on this subject - and from a somewhat serious point of view rather than the ridiculous fear mongering - knows enough to not have written a silly blog post like the one on display here. > Even the EU parliament's website does not comply yet. That article was not exactly enlightened to put it mildly. > First, that is a directive, not a law and compliance can vary widely. Yes, but if you did take it serious then you are well underway. > Second, gdpr requires new procedures which means it requires amendments anyway Yes, there is some overhead. But this is mostly to ensure that the law will not be ignored like what happened with the DPD. As you say 'it was a directive' which many companies interpreted as 'can be ignored'. What they failed to realize is that if you don't self regulate after a directive is issued that there will be a version of the directive with teeth that has the strength of law. Congratulations, we are there.

DanBC 8y ago

> you need to implement opt ins, No. This is the myth that "consent is always required". There are several justifications for processing personal data, and consent is just one of them. There are others. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-the-general-da...

zerostar07 8y ago
First, notice how things like legitimate interests are not narrowly defined and left up to the DPA to judge. Which makes it hard to know whether you even need consent or not. Second, this is ICO, the British regulator. There are 28 of them one in each country and they won't always agree, so the application of GDPR policies can vary.
- DanBC 8y ago
  But, again, if you're not compliant they'll just write a letter telling you this and asking you to come into compliance. At that point you can check your understanding of the law and what you're doing and write back letting them know why you think you're in compliance; or you can change your process; or you can take it to court.
  - zerostar07 8y ago
    What happens when that is not possible though? E.g. in the case there is a breach and it is found out because of it that you were not compliant. Do they still write you a letter? Also , is this procedure common for all DPAs or just for the UK?
- mikekchar 8y ago
  Legitimate interest definition is almost exactly the same as the existing laws on handling private information. If you want to complain about it, don't complain about the GDPR. If you've been handling private information for EU customers and have been complying with the law, then there is practically nothing for you to do.