6 ms·
>this guy sees the law and runs off without even trying to become compliant This guy quite clearly states that he doesn't have resources to become compliant, w
by kingofhdds 8y ago
>this guy sees the law and runs off without even trying to become compliant
This guy quite clearly states that he doesn't have resources to become compliant, while it is too risky to make a mistake here.
There are fans of GDPR on this website, who prefer to ignore the fact that the compliance has its cost, and added to that still unknown risks of practical interpretation of legislation which also have their cost. But these are real life things.
- number6 8y agoGDPR compliance takes resources. I would say for a small business it takes about 1 or 2 days. Not hard work but tedious. In the end you will have around 5 documents that will show your processes, what you do to keep data save, a plan how you deal with questions from customers and regulators, that you trained your employees and that you choose your subs carefully. Essentially that's it. I am no lawyer but I am a CPO. Pro tip: Speak with the regulators they are on your side.
- kingofhdds 8y agoI guess you are EU-based, unlike the guy whose text we are debating here.
- number6 8y agoYes - I guess having an EU contact is something not easy to come by on the other hand there might soon be a service for it. I guess an XMPP Server could be considered a communication service an could be subject not to the GDPR but to regulations concerning ISPs and Phone companies.
- Angostura 8y agoI respect his right to do whatever he would like with his own hobby, but we should be clear that the guy is stating he doesn’t have the resources, based on a series of misunderstandings. So, for example, he says he is required to appoint a DPO. The U.K. Information Commissioner has this to say: >Do we need to appoint a Data Protection Officer? A> Under the GDPR, you must appoint a DPO if: > you are a public authority (except for courts acting in their judicial capacity); > your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking); > * or your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences.
- aembleton 8y agoThat's the UK's interpretation of GDPR. What about France or Poland, or any of the other countries? I suppose it depends where in Europe he would like to visit
- poizan42 8y agoI'm not seeing any interpretation being done here, but judge for yourself. Here is what the GDPR actually says (Art. 37 Designation of the data protection officer): > (1) The controller and the processor shall designate a data protection officer in any case where: > a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; > b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or > c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10.
- raverbashing 8y agoThere's no "UK Interpretation", this is the whole point of the EU. The rules apply across the block.
- jashmatthews 8y agoEU law doesn't work like that. Each country has to pass their own local law to enforce the GDPR. For the UK that was the Data Protection Bill 2017.
- YeGoblynQueenne 8y agoFrom wikipedia: The GDPR replaces the 1995 Data Protection Directive.[4] Because the GDPR is a regulation, not a directive, it does not require national governments to pass any enabling legislation and is directly binding and applicable.[5] So, no local laws. It's a regulation.
- wiz21c 8y agoWell many of us find it completely normal to spend days on having a good security, setting up HTTPS, encrypting content to protect privacy. I wonder why GDPR seems so different, it's just more of the same, just less technical.
- askmike 8y agoExactly. It will take a while before standards and best practices form, but they will.
- bryanrasmussen 8y agoI guess I am a fan of GDPR, certainly compliance to anything has a cost. I personally don't find the costs of GDPR compliance onerous unless you have already built up lots of non compliant systems that now need to be fixed, in which case the free ride is over. Anyway, this guy is pulling out of the EU but if he allows anyone from the EU to use his service from a non-EU location anyway he would be risking non-compliance.
- jiveturkey 8y agono. gdpr applies only to people in the eu. if you are an eu person in canada it does not apply to you.
- bryanrasmussen 8y agoyou're right, it seems a few people have been making the same mistake about eu citizens that I've made.