6 ms·

Exactly. People try to explain to me how it is impossible to comply and usually it turns out that it would be easy. I think the problem most of time that people

Exactly. People try to explain to me how it is impossible to comply and usually it turns out that it would be easy. I think the problem most of time that people misunderstanding the requirements or not reading GDPR (not even TLDR versions).

merinowool 8y ago
It is easy if they believe particular person's interpretation. But that doesn't mean they are right. People have huge problems with interpreting written word if it is not written without a room for interpretation and if you add to the mix bureaucrats that have targets to meet you'll see it will not be easy at all.
- dtf 8y ago
  What targets? Where have you heard something about targets?
  - merinowool 8y ago
    Every institutions have targets to prove their existence is of benefit to the tax payer.
    - desas 8y ago
      That doesn't have to be in money raised, that would be rather unlikely in this case. It could be percentage of problems "fixed" whether that be by sharply worded letter or by court proceedings (the former is far easier and cheaper for the authority), or by the time it takes the authority to investigate a problem.
      - merinowool 8y ago
        You don't know that, depending how mad is the person in charge. Take into account that it might be good for a couple of years but the power it gives might be tempting to shut down sites that are against EU agenda.
- bengale 8y ago
  I think the biggest complaint I've heard so far is that there is too much room for interepration at the moment, we currently lack any case law.
- willvarfar 8y ago
  Am in EU, am involved in some compliance stuff and have talked to plenty others at other companies, and it really does seem to be a nothing-to-see-here for all companies except the sleezy ones.
  - hvidgaard 8y ago
    In all of my research, talking to lawyers, and seminars on GDPR, it is about: 1. Ask permission for collecting data 2. Keep sensitive data safe 3. Restrict access to said data 4. Keep a log of what happens with the data 5. Delete it upon request 6. Have all of the above documented and adhere to the protocol. It's such a none issue unless you're relying on the very thing GDPR is designed to combat. If you not collecting and selling peoples data, and you don't do the above already, see this as a good opportunity to do what you should have been doing all along. There is such an awareness now, that it's the easiest it has ever been to know how to handle sensitive data properly.
    - willvarfar 8y ago
      Completely agree with everything you list, and would add that 6. you can't force a user to give up privacy in order to get some other benefit, e.g. you can't offer to unlock some feature in return for more tracking
      - merinowool 8y ago
        Example: How do you ask user for a permission to log access logs (which contain IP address) in the server, so that you can detect spam, ddos and other attacks? How do you store that consent information and what do you do if user doesn't consent? What do you do if user connecting from given IP address wants you to send him data you have collected about him. If people share IP addresses how do you know which log data is about which person?
        willvarfar 8y ago
        Some entity runs a webserver. This entity has a legitimate business purpose in retaining access logs for e.g. 3 months for e.g. spam and security reasons. This entity just has to document that. This entity can allow a 3rd party service to access these logs so that 3rd party can do whatever needs to be done if it is within the reasons the entity gave for having the data. What neither can do is go use that data for anything other than the said purposes. And if the given reasons are gratuitous and somehow the regulators notice, expect to get a nastygram and have to comply or face fines. Basically what you can't do is collect data for longer than you have a legitimate need for, or cash-in and sell data you've collected. Basically, all said and done, just don't be sleezy and you'll be ok.
- windowsworkstoo 8y ago
  The only person who’s opinion you should worry about is your internal legal counsel’s. The nerds who try to carry on like this is a technical problem with a technical solution are so far off. It’s about beig able to argue and justify your interpretation - not how much you have gold plated your tech stack
- deleted 8y ago
  [deleted]
- DanBC 8y ago
  All law has room for interpretation, that's what the courts are for. There are no targets for bureaucrats.
AnabeeKnox 8y ago
There is no "TLDR" of the GDPR. It has to all be read, understood and complied with. This is basic legal compliance, and is not at all easy for a small business.
- gcthomas 8y ago
  Yes, and it is not that hard a read. The only problems people seem to be having are in trying to finesse the rules to avoid looking after data with due diligence. If you really want to look after data, then you just need to do that, and you will be compliant.
- orwin 8y ago
  And if you are a small/medium business, don't comply and somehow are reported, you will receive an email from the regalutory instance of the country the person who reported you come from. They will tell you what is wrong and point you to some articles who can give you advices on how to comply. If you have difficulty to do so, you can contact them and ask specific advices, they will respond (probably a bit late) and as long as you comply with the RGPD within a month after that, you're good. Audit can take some time and have a real impact on your business though, so i'm not saying everything is perfect. But to me, audit is the only thing you have to be really afraid of, not fines.
- bausshf 8y ago
  It's especially hard for a small sized business where all your clients are either departments of the government or leasing companies.
- deleted 8y ago
  [deleted]
- StreamBright 8y ago
  There is TLDR version, it is called the checklist. Here is one: https://ico.org.uk/for-organisations/resources-and-support/data-protection-self-assessment/controllers-checklist/ https://ico.org.uk/for-organisations/resources-and-support/d... It captures the compliance with a checklist which is shorter than the original 88 page law.

merinowool 8y ago

It is easy if they believe particular person's interpretation. But that doesn't mean they are right. People have huge problems with interpreting written word if it is not written without a room for interpretation and if you add to the mix bureaucrats that have targets to meet you'll see it will not be easy at all.

dtf 8y ago
What targets? Where have you heard something about targets?
- merinowool 8y ago
  Every institutions have targets to prove their existence is of benefit to the tax payer.
  - desas 8y ago
    That doesn't have to be in money raised, that would be rather unlikely in this case. It could be percentage of problems "fixed" whether that be by sharply worded letter or by court proceedings (the former is far easier and cheaper for the authority), or by the time it takes the authority to investigate a problem.
    - merinowool 8y ago
      You don't know that, depending how mad is the person in charge. Take into account that it might be good for a couple of years but the power it gives might be tempting to shut down sites that are against EU agenda.
bengale 8y ago
I think the biggest complaint I've heard so far is that there is too much room for interepration at the moment, we currently lack any case law.
willvarfar 8y ago
Am in EU, am involved in some compliance stuff and have talked to plenty others at other companies, and it really does seem to be a nothing-to-see-here for all companies except the sleezy ones.
- hvidgaard 8y ago
  In all of my research, talking to lawyers, and seminars on GDPR, it is about: 1. Ask permission for collecting data 2. Keep sensitive data safe 3. Restrict access to said data 4. Keep a log of what happens with the data 5. Delete it upon request 6. Have all of the above documented and adhere to the protocol. It's such a none issue unless you're relying on the very thing GDPR is designed to combat. If you not collecting and selling peoples data, and you don't do the above already, see this as a good opportunity to do what you should have been doing all along. There is such an awareness now, that it's the easiest it has ever been to know how to handle sensitive data properly.
  - willvarfar 8y ago
    Completely agree with everything you list, and would add that 6. you can't force a user to give up privacy in order to get some other benefit, e.g. you can't offer to unlock some feature in return for more tracking
    - merinowool 8y ago
      Example: How do you ask user for a permission to log access logs (which contain IP address) in the server, so that you can detect spam, ddos and other attacks? How do you store that consent information and what do you do if user doesn't consent? What do you do if user connecting from given IP address wants you to send him data you have collected about him. If people share IP addresses how do you know which log data is about which person?
      - willvarfar 8y ago
        Some entity runs a webserver. This entity has a legitimate business purpose in retaining access logs for e.g. 3 months for e.g. spam and security reasons. This entity just has to document that. This entity can allow a 3rd party service to access these logs so that 3rd party can do whatever needs to be done if it is within the reasons the entity gave for having the data. What neither can do is go use that data for anything other than the said purposes. And if the given reasons are gratuitous and somehow the regulators notice, expect to get a nastygram and have to comply or face fines. Basically what you can't do is collect data for longer than you have a legitimate need for, or cash-in and sell data you've collected. Basically, all said and done, just don't be sleezy and you'll be ok.
windowsworkstoo 8y ago
The only person who’s opinion you should worry about is your internal legal counsel’s. The nerds who try to carry on like this is a technical problem with a technical solution are so far off. It’s about beig able to argue and justify your interpretation - not how much you have gold plated your tech stack
deleted 8y ago
[deleted]
DanBC 8y ago
All law has room for interpretation, that's what the courts are for. There are no targets for bureaucrats.

AnabeeKnox 8y ago

There is no "TLDR" of the GDPR. It has to all be read, understood and complied with. This is basic legal compliance, and is not at all easy for a small business.

gcthomas 8y ago
Yes, and it is not that hard a read. The only problems people seem to be having are in trying to finesse the rules to avoid looking after data with due diligence. If you really want to look after data, then you just need to do that, and you will be compliant.
orwin 8y ago
And if you are a small/medium business, don't comply and somehow are reported, you will receive an email from the regalutory instance of the country the person who reported you come from. They will tell you what is wrong and point you to some articles who can give you advices on how to comply. If you have difficulty to do so, you can contact them and ask specific advices, they will respond (probably a bit late) and as long as you comply with the RGPD within a month after that, you're good. Audit can take some time and have a real impact on your business though, so i'm not saying everything is perfect. But to me, audit is the only thing you have to be really afraid of, not fines.
bausshf 8y ago
It's especially hard for a small sized business where all your clients are either departments of the government or leasing companies.
deleted 8y ago
[deleted]
StreamBright 8y ago
There is TLDR version, it is called the checklist. Here is one: https://ico.org.uk/for-organisations/resources-and-support/data-protection-self-assessment/controllers-checklist/ https://ico.org.uk/for-organisations/resources-and-support/d... It captures the compliance with a checklist which is shorter than the original 88 page law.