8 ms·

This doesn't consider some factors that dictate how strong any company will experience their firehose of GDPR requests to be: - how incentivised people are to

• AnabeeKnox 8y ago
  I agree, and there seems to be a lack of conversation around this! Next week could be ground-zero for all sorts of unintended consequences. Especially, a flashmob of GDPR requests could sink a company.
  • Marazan 8y ago
    If it is difficult and time consuming for you to answer a GDPR request then your data handling practices are bad and you should feel bad.
  • cbg0 8y ago
    It is highly unlikely that a lot of requests will "sink" your company. As per the GDPR, you have a month to respond to requests and you can extend this period by two more months by telling the user that you need more time to process their request. (See article 12 for reference)
    • AnabeeKnox 8y ago
      If 10% of the members of my website request a GDPR, then my website will no longer exist. The processing time for that would be a decade.
      • AstralStorm 8y ago
        You mean request to be forgotten? Are you seriously lacking an automated removal process if you have more than a thousand users and also can't keep it in a three month deadline? Oor is it collecting so much data that you cannot just send it all to the requestee? If it would take a decade, then it is a broken business that should cease to exist as it is doing something illegal with the collected data. What kind of business is it?
      • cbg0 8y ago
        If this is such a serious concern, you should automate this process as much as possible. You don't necessarily need to respond manually to these requests if you put in place the required features on your website which will allow your EU data subjects to benefit from their rights. Realistically, how hard is it to automatically grab some data from a database and export it as JSON, as well as remove data from your database pertaining to a user? With a relational database, this would be a cinch. I mention the right to access the erasure right, as I estimate these will be the most frequently called upon.
        • desas 8y ago
          Depends on your system. We have an automated process that produces a PDF, which a human will then go through and redact so we're not leaking through the non-relevent PII of other people if one of our users isnt using the system quite properly.
      • acqq 8y ago
        If you have a lot of “members” you obviously provide the services by the automated process. Obviously the request processing could also be mostly automatic.
      • 8y ago
  • bkor 8y ago
    Enabling people to force a company into bankruptcy using the GDPR is not the intention. From https://gdpr-info.eu/art-12-gdpr/ https://gdpr-info.eu/art-12-gdpr/: "Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: " The quoted bit is about one person, not multiple so not directly applicable. I assume if someone organizes a coordinated flood of requests from multiple persons you can still argue that it is excessive. I agree that the amount of requests is very uncertain. Within my company I'm planning to make one request (data regarding me as an employee). This to see if they're prepared.
  • pheleven 8y ago
    I was thinking a solid new business plan is to register gdpr.me (or whatever) and offer a service. $40, fill out a form, and I will send a GDPR request to every company in the world on your behalf. The data coming back is then offered back to you with the ability to create further requests (deletion for example) selectively or in full. This seem explicitly allowed for in the law.
    • jacquesm 8y ago
      (1) the service is not explicitly allowed for because data subjects (and not data processors acting on their behalf) would be the ones to file such requests. (2) you would be filing a lot of requests to companies that have no data in the first place and which you could reasonably have known about had you queried the data subject. I see such a service as acting in bad faith and would file a complaint against you and your service if such a frivolous request would land in my inbox. Better hold on to the $40, you might need to spend them on a lawyer. But kudos for trying to see the GDPR as an opportunity, now try to do so in a more constructive way. And - funny - you would be mailing yourself since you would be sure to hold PII on the party making the request in order to be able to authenticate the request as being a genuine one, which in turn would make you required to be in compliance.
      • shabble 8y ago
        You could maybe provide your users with a pre-filled request form for various companies they indicate they're a customer of, and have them send them directly. IIRC there are services along those lines for various 'contact your $REPRESENTATIVE' political and activism lines. I vaguely recall something about how the US has specific laws allowing certain requests to be ignored (or maybe even criminalising the sending of) generated or form-letters, due apparently to this sort of abuse. Can't remember what the exact context was that I saw it, but it might have been FOI or something data- related
        • jacquesm 8y ago
          That sounds like a much better idea. > I vaguely recall something about how the US has specific laws allowing certain requests to be ignored (or maybe even criminalising the sending of) generated or form-letters, due apparently to this sort of abuse. Exactly, and it is abuse. There are so called 'mass letter writers' here in NL that keep on sending FOI requests and other letters to local government effectively DDOSing the services and they too can be - and have been - slapped down.
• frereubu 8y ago
  This sounds like the arguments that organisations make against freedom of information laws. There is that risk, but what is the alternative? There doesn't seem to be a middle ground to me - either people can make subject access requests or they can't.
  • repolfx 8y ago
    FOI laws apply to governments, not corporations. And yes, civil servants did use those arguments to try and stop FOI. They lost because ultimately they pay themselves out of tax revenues, and when you force people to buy something the bar for denying them information about how that money is used is a lot higher. This doesn't apply in the case of companies and especially not job candidates.
    • frereubu 8y ago
      Fair point about it being public bodies. But my point stands in terms of abuse of the system - the deluge didn't happen.
      • repolfx 8y ago
        I have actually seen government agencies complain about being deluged by FOI requests, the cost of dealing with them etc. They mostly get ignored because on inspection the "deluge" of FOI requests tends to be from journalists digging for stories, and that's sort of what we want them to do. Also because the high cost of FOI responses tends to reflect messy and disorganised internal information systems rather than anything fundamental. That said, I don't think it's really comparable to the GDPR. For one FOI compliance is a joke, organisations get out of it all the time on the thinnest of pretexts. There's no real incentive for a government to police itself in this regard. But GDPR enforcement is incentivised by large sums of money, for an organisation that is technically bankrupt.
        • bkor 8y ago
          > But GDPR enforcement is incentivised by large sums of money, for an organisation that is technically bankrupt. What do you mean here? It seems to be about suggesting that GDPR is about getting the fine money? Elsewhere the law is quoted where it states the fine should be appropriate to be effective. So even if you don't trust this there's legal ground to back it up. Secondly, why is the EU technically bankrupt? Or is this a theoretical organization? Appreciate some clarification because currently the sentence I quoted is too open to interpretation.
• llukas 8y ago
  > The candidate gets back a formatted dump by email of all sorts of recruitment data, including interview notes, etc. Unless data is removed before end of the process and company keeps only final outcome. ;)
• _Codemonkeyism 8y ago
  If you don't have a talent pool, one should remove all candidate data after rejection. It's probably better to outsource talent pools.
  • abraae 8y ago
    Outsourcing your talent pools - literally the future of your company - would be an extreme step just to ensure GDPR compliance.
    • _Codemonkeyism 8y ago
      Talent pool as a Saas and the company needs to manage GDPR - you still have acces to your data. Still open how you monitor the company as required by GDPR, but at least you can redirect angry candidates.
      • abraae 8y ago
        In that scenario, you are the data controller and the GDPR obligations ride on you.
        • _Codemonkeyism 8y ago
          Yes, but the obligations are very different. (simplified) * You need to have a data processing agreement with the Saas company X. * You need to tell candidates in your privacy information that you send data to X * You need to make sure X is properly implementing the data processing agreement (currently not clear how you do this except using e.g. PwC to review X) If you have the data, you need to tell the candidate what you do to protect it, backup it, restrict access to it etc. (also if e.g. the talentpool feature is provided by LinkedIn based on LinkedIn data you're not responsible under the GDPR, only if you sent data to X or X collects data on your behalf e.g. in a web form)
• gcthomas 8y ago
  There is an exemption for vexacious or disproportionately costly requests, so once everything has settled down and it is clear how the regulators deal with complaints, then it should work out ok.
• kartan 8y ago
  > and also to be curious about why they were not hired. A GDPR button lets them indulge their curiousity and start digging in to interview notes etc. If your company can not show the candidates why they were not hired, you are doing a very bad job. Are you discriminating against protected classes? Are you rude or offensive in your comments? Then, stop doing it. That will be a very good side-effect of this situation. Public scrutiny works. If a company needs to make public their interview notes, that notes are going to improve quality and abide to law. > how strong any company will experience their firehose of GDPR requests to be If you are big enough to have a big influx of GDPR, you need to automate it. > how easy it is for them to make requests It needs to be easy. The goal is not to let your company shield behind "sorry it is too complicated to give you the information". You need to give people easy access to their own data. > wildcard factors How is this difference of a Denial of service attack on the technical side? On the legal part, there are lawsuits that are going to be more effective than GDPR that starts with recommendations for improvement. > The candidate gets back a formatted dump by email of all sorts of recruitment data, including interview notes, etc. There are obvious ways to monetise a service like this, hence incentive for someone to do it. You only get the data about YOUR own interview. You can not hoard data this way. It works the other way around. The data protection is protecting you from the company monetizing this information without your consent. Companies are the ones hoarding YOUR personal data and creating a business around it without YOUR consent. Your concerns are the main reason GDPR was created.
  • grigjd3 8y ago
    Ok, why you aren't hired has nothing to do with internet privacy. It is also good practice not to tell people why because some will and do sue whether or not the potential employer did anything wrong.
  • mbesto 8y ago
    > If your company can not show the candidates why they were not hired, you are doing a very bad job. You sound like you've never had to deal with telling a candidate they weren't chosen for a position. There's a reason rejection letters are usually canned responses - it's not that HR teams are unanimously evil people, it's because any bit of information could open up the potential for a law suit, even if in good spirit. Someone gets a rejection letter saying "they aren't a good fit"...oh well it must be because I have different colored skin, right? It's a slippery slope from there.
• pjc50 8y ago
  You can do this already with the existing Data Protection Act. Businesses have not drowned in subject access requests. People seem to forget that data protection isn't new, it's just being beefed up a bit. https://ico.org.uk/for-organisations/guide-to-data-protection/principle-6-rights/subject-access-request/ https://ico.org.uk/for-organisations/guide-to-data-protectio... Another link from 2012 describing how to handle data protection in the 1998 framework: http://www.shoosmiths.co.uk/client-resources/legal-updates/Data-protection-during-recruitment-top-10-tips-for-managers-3006.aspx http://www.shoosmiths.co.uk/client-resources/legal-updates/D...
  • Macha 8y ago
    See "Europe vs Facebook" for another pre-GDPR example where people were obtaining data Facebook stored on them via existing data protection laws: http://www.europe-v-facebook.org/EN/en.html http://www.europe-v-facebook.org/EN/en.html
• A_No_Name_Mouse 8y ago
  > The candidate gets back a formatted dump by email of all sorts of recruitment data, including interview notes, etc. Interview notes would not have to be turned over to the candidate. They are personal opinion of the interviewer even if they mention the candidate. GDPR protects that data: you may not disclose it because it would violate the rights of the interviewer.
  • pjc50 8y ago
    Do you have a citation for that?
    • krageon 8y ago
      Read the actual law (it's in english, so you can). It mentions this fairly unambiguously.
      • pjc50 8y ago
        This level of detail relating to interview notes isn't in there, and all references to "opinion" refer to the decision-making by the regulatory body. Most people seem to interpret the directive to say that, because the interview notes constitute "any information relating to an identified or identifiable natural person", they are personal data of the person being interviewed?
  • M2Ys4U 8y ago
    That's not true. Under the existing Data Protection Directive these notes are subject to people making a Subject Access Request.
  • desas 8y ago
    I work in recruitment within the EU and you are completely wrong. Probably you can redact it so that it doesn't include the actual names of which interview panellist said what.
• dragonwriter 8y ago
  > For example, unsuccessful candidates applying for a job at a company could forward their rejection email to a bot. The bot parses the details and fires a GDPR access request in to the HR department. The candidate gets back a formatted dump by email of all sorts of recruitment data, including interview notes, etc. There are obvious ways to monetise a service like this, hence incentive for someone to do it. Recruitment at a large company means engaging with thousands of people and then rejecting them. It is natural for people to have bruised feelings, and also to be curious about why they were not hired. A GDPR button lets them indulge their curiousity and start digging in to interview notes etc. Huh. So, you’re saying a side effect of GDPR is a radical increase in recruitment/hiring transparency. As if that was a bad thing (clearly, it would be a shift in the capital/labor power assymetry in favor of labor, but I'm not seeing how that's bad.)