5 ms·
I respect his right to do whatever he would like with his own hobby, but we should be clear that the guy is stating he doesn’t have the resources, based on a s
by Angostura 9y ago
I respect his right to do whatever he would like with his own hobby, but we should be clear that the guy is stating he doesn’t have the resources, based on a series of misunderstandings.
So, for example, he says he is required to appoint a DPO.
The U.K. Information Commissioner has this to say:
>Do we need to appoint a Data Protection Officer?
A> Under the GDPR, you must appoint a DPO if:
> you are a public authority (except for courts acting in their judicial capacity);
> your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking);
> * or your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences.
- aembleton 9y agoThat's the UK's interpretation of GDPR. What about France or Poland, or any of the other countries? I suppose it depends where in Europe he would like to visit
- poizan42 9y agoI'm not seeing any interpretation being done here, but judge for yourself. Here is what the GDPR actually says (Art. 37 Designation of the data protection officer): > (1) The controller and the processor shall designate a data protection officer in any case where: > a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; > b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or > c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10.
- raverbashing 9y agoThere's no "UK Interpretation", this is the whole point of the EU. The rules apply across the block.
- jashmatthews 9y agoEU law doesn't work like that. Each country has to pass their own local law to enforce the GDPR. For the UK that was the Data Protection Bill 2017.
- YeGoblynQueenne 9y agoFrom wikipedia: The GDPR replaces the 1995 Data Protection Directive.[4] Because the GDPR is a regulation, not a directive, it does not require national governments to pass any enabling legislation and is directly binding and applicable.[5] So, no local laws. It's a regulation.
- jotaen 9y agoOnly for the sake of correctness/completeness: GDPR does allow member states to adjust certain details to bring them in line with local regulations (see Chapter 9). These are explicit opening clauses though that must not basically weaken or augment GDPR.
- jashmatthews 9y agoIt's more complex than that. Different countries might pass different laws about interpretation, and both are valid until there's an ECJ decision.
- jashmatthews 9y agoIt's an EU Regulation, which under EU law the local courts have a duty to enforce. Local courts and laws will be dealing with all the details unless a case is appealed to ECJ. To say that local courts and laws will have no influence is complete rubbish.
- deleted 9y ago[deleted]
- jashmatthews 8y agoI'm not sure why people are downvoting this so hard: https://webcache.googleusercontent.com/search?q=cache:eMV5_lnMODMJ:https://www.lexology.com/library/detail.aspx%3Fg%3D3b3d8d1f-66ad-4c24-a19c-4d99183f160e+&cd=1&hl=en&ct=clnk&gl=de&client=firefox-b https://webcache.googleusercontent.com/search?q=cache:eMV5_l...
- Angostura 9y agoThat's the UK's straight-forward unequivocal explanation of the rules. Where there is room for interpretation or uncertainty, the ICO is very good at pointing this out. It doesn't here. As poisan42 points out - it echoes the words in the actual article, directly. Bottom line, he doesn't need a DPO.
- kingofhdds 9y agoAnd "large scale" means how many records in DB? How many users? Or records per day?
- pgeorgi 9y agoMonal is an XMPP client running on user's iOS devices. Is that person even running an XMPP server for those users?
- peteretep 9y agoThese are excellent questions that you will have to have shown you've considered if you get audited. If there's disagreement with the regulator, you'll come together to resolve it, and then may need to appoint one.
- kingofhdds 9y agoWell, so it's undefined, at least until practice of legal application establishes. Undefined means risk, and stopping serving EU is a meaningful mitigation, if your profits don't compensate you for all the hassle. Where's "overreaction“ then?
- scotty79 9y agoI guess if you have to ask that question you are not a large scale.
- kingofhdds 9y agoI don't think an argument of such kind would stand in your communication with regulators, or (especially) in courts.
- scotty79 8y agoThis is "what will you do if the lightning strikes you" thinking. Only about less probable things.
- e12e 9y agoPerhaps more important, dpo is just another hat - if he's ceo,cfo,cto - he can be dpo too?
- krfsm 9y agoThere are limitations, namely: "There must not be a conflict of interest between the duties of the individual as a DPO and her other duties, if any." Specifically they recommend against also being the data controller. I.e. you shouldn't be responsible both for handling personal data and verifying compliance of said handling.
- johnchristopher 9y agoNo, because you wouldn't be independent enough. A CFO or a CTO would tell its board things are okay because it isn't in its interest to do otherwise. That's why some independent DPO jobs are appearing. But the DPO is a small cog in the machine. Updating the processes is the most time and resource consuming regarding the GDPR.
- caffeine5150 8y agoYou are correct as to a DPO, but if he is, say in the US, and subject to GDPR, he must have an EU Representative, who by all indications would be liable for his violations. That's a significant burden if not a practical impossibility for most in his position. Also, if he's transferring personal data from the EU to the US directly from individuals, his only practical way of making that transfer compliant is likely to be privacy shield certified which is not cost free (although he could maybe rely on consent as a derogation, but relying on that has risk). I can think of many things like this that have, if not a hard cost, then a definite cost in time and resources to comply including keeping up with compliance. Could easily be not worth the effort for a single individual.