27 ms·

For those of you understandably intimidated by the GDPR regulations themselves, here's a good summary in plain English: https://blog.varonis.com/gdpr-requiremen

For those of you understandably intimidated by the GDPR regulations themselves, here's a good summary in plain English: https://blog.varonis.com/gdpr-requirements-list-in-plain-english/ https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... The UK's ICO also has a good structured summary: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-the-general-da... In general I agree with the sentiments in this article. I've probably spent a total of three to four days reading around the GDPR and I don't really see what's special about this law other than it's imposing decent standards on what was in effect a wildly unregulated industry in people's personal data. If you have a broad distrust of any government activity then I suppose any new laws with "fines up to €X" might feel like "I run a small site on a Digital Ocean droplet and I'm at risk of a €2m fine out of the blue." But that doesn't make it true.

cbg0 8y ago
That Varonis link gets posted quite a bit, but it drastically over simplifies things and even tries to poke fun at some aspects of the legislation. The ICO site is a much better read for this.
- Sverigevader 8y ago
  Pardon me but, what does ICO site mean in this context?
  - tonfa 8y ago
    The link to ico.org.uk in the comment above.
  - matthewmacleod 8y ago
    The Information Comissioner’s Office site, as linked in the grandparent post.
  - tomw2005 8y ago
    Information Commissioner's Office: https://ico.org.uk/about-the-ico/ https://ico.org.uk/about-the-ico/
- frereubu 8y ago
  Fair point - my intent was to point out that some sources which are less intimidating than others. If all you read was the Varonis link you'd be in trouble, but if someone's the kind of person who thinks that they can read one blog post and understand the GDPR I'm not sure they're the kind of person that can be helped anyway...
  - hobofan 8y ago
    I would even go as far as saying that that article is straight up wrong/misinterpreting at least some of the articles. I randomly checked Article 14, as I am wondering how I am expected to communicate to users that I don't collect any PII([0]), and it turns out Article 14 is not about "You need to tell people what you’re doing even if you’re not collecting personal data." but about "Information to be provided where personal data have not been obtained from the data subject" = "You have collected personal data about the data subject, just not directly from them, but via some other source" [0]: Even though I'm not sure if that's even easily possible for any company that has a website, now that IPs can fall under PII.
AnabeeKnox 8y ago
Reminder: you have to legally comply with every letter of the GDPR, not just the TLDR version. Saying "but we implemented the TLDR version" is not a legal defence.
- tialaramex 8y ago
  This concern applies to all laws though. Not murdering people doesn't require you to spend ages examining the exact text of a statutory definition of murder. The tl;dr version is enough for me to grasp that kicking somebody in the head until they stop breathing isn't allowed.
- Arnt 8y ago
  Saying "we got the major stuff right, missed some of the details, sorry about that" will keep the fine small. And... de minimis non curat lex.
dantheman 8y ago
The amount of discretion and lack of clarity in the penalties is part of the problem. It opens you up to risk based on the whims of politics and the regulators and increases uncertainty. Laws should be clear, limited, and understandable - this is not.
- frereubu 8y ago
  In an ideal world, yes. But that leads you down a Kafkaesque hole of bureaucracy - at some point you have to stop adding detail and leave things open to interpretation. There are plenty of laws out there with fines "up to €X" and, from my limited experience, I don't think the GDPR is especially ambiguous compared to others.
  - kingofhdds 8y ago
    Well, lots of ends open to interpretation, and $20 mln fine - so obviously nothing to care about! Hysteria!
    - DanBC 8y ago
      Maximum possible fine for repeated worst possible violation after ignoring previous attempts at regulation and not making changes after previous smaller fines. It's not a minimum.
      - frereubu 8y ago
        I think this is a common misinterpretation though because of the lanauge - that the maximum fine is actually the minimum, because the figures that are talked about are "€20m or 4% of global turnover, whichever is the greatest." It's the emphasis on "the greatest" that has an undercurrent of "we're going to fine you the maximum of these two numbers."
        StavrosK 8y ago
        I'm not sure what you mean by "actually the minimum". They will find you the maximum of those two numbers, at most, if you flagrantly disregard the law.
dspillett 8y ago
> I don't really see what's special about this law The key change is the fairly explicit punishments and apparent intent to hand them out for non-compliance. A lot of older regulations get considered by companies but the issues relegated, officially or otherwise, to "yeah, we'll apologise and fix that when someone notices" which might not be a good way to manage the risk management after next Friday. > ... might feel like "I run a small site on a Digital Ocean droplet and I'm at risk of a €2m fine out of the blue." But that doesn't make it true. Exactly. A lot of the unhelpful hysteria is being drummed up by consulting companies trying to sell there services to help others assess and/or manage their GDPR compliance: they are stoking the fears to improve sales. The rest is coming from people who don't want to lose control of some of what they consider to be _their_ data. From a business perspective this is usually "I've collected it or pad for it, I should be able to keep it / sell it / use it, this is unfair, wa waa waaaaaa" and from a technical perspective many of us data people have flinch reactions to any idea of hard-delete or un-rollback-able update operations (they are not really impossible to rollback of course, anyone sensible is building considerations for backup retention policies into their procedures, but rolling back is less likely to be simple and can only be done during that retention window).
- ciguy 8y ago
  The consulting companies use exactly the same MO that Y2K consultants used. Cherry picking case studies and data sets to make executives think the sky is falling when in reality it's not all that hard to be compliant with GDPR and it really is comprehensible by an average person spending a day or 2 reading up on it.
  - sdoering 8y ago
    Exactly that. Working as a data analyst for my agency's clients I had more work in making sure my clients do not panic after having other consultants claiming, that the world will end and what not. It is possible to comply with GDPR in most cases with not too much of an effort (I know some processual stuff is just boring and ugly, but doable). It is possible to not have a cookie wall of horror, if you "just" want to do tracking (analytics) or first party onsite marketing. It will get more complicated with personalized recommendations, profiling and stuff. I have to admit this - especially with third party vendors and such - will be a little bit more fun/challenging.
SagelyGuru 8y ago
I am concerned that the effect of this legislation on the private individual is the opposite of the stated intention. People are being forced to sign agreements which jeopardise the natural rights to their data which they would otherwise have. One example: a friend who has a very pretty daughter was asked by her school to give them the right to film her and to use any and all such recordings as they see fit for 50 years even after she leaves the school. This feels very wrong on just about all the conceivable levels.
- Jubok 8y ago
  What ? It's the opposite, it allow you to access and delete the data, even if you gave consent one time. And your image concern a lot of other old laws, even if you sell it you can get it back later.
  - SagelyGuru 8y ago
    I have difficulty in understanding your language and in following your logic. Surely, signing away the rights to your records for over 50 years can not be better for you than not signing them?
    - Jubok 8y ago
      English may not be my mother tongue but I can logically follow an argument. Your friend' daughter was not obligated to sign such contract and GDPR reinforce previous laws protecting her image ;)
    - p49k 8y ago
      This law has nothing to do with signing away the rights of your image to be used for publicity, though. GDPR does not come into play at all in the scenario with your friend’s daughter; the school is likely abusing laws in their request and should be investigated, but those laws aren’t related to GDPR and the existence of GDPR does not somehow cause the daughter’s position to be weaker here.
    - sdoering 8y ago
downandout 8y ago
There is nothing - and I do mean nothing - written into the GDPR that requires any warnings of any kind, or places any limits on fines, except for $10/$20 million or 4% of revenue, whichever is greater. Period. A multimillion-dollar fine without warning for a first, minor violation is perfectly lawful under GDPR. The idea that "yes it says that but we can trust EU regulators to not assess large fines against foreign companies, even though they would benefit handsomely from them" rings hollow to me.
- laumars 8y ago
  In principle I might agree with you, however the EU has a long history of striking a fair balance between consumer rights and commercial interests. There is no point, in history, of the EU doing anything remotely like you've described. Which actually gives me more faith in the GDPR than legislation in a corrupt ecosystem as corrupt individuals will find a way to warp legislation in their favor anyway. So yes, I do trust the EU and their history has proven that the aforementioned idea isn't a hollow one.
  - deleted 8y ago
    [deleted]
  - ajeet_dhaliwal 8y ago
    Related to this, there is a difference in culture that may had add to the fear for people running SMEs outside of Europe. I am talking about a difference in the culture of fines, at least at the local level of government based on my personal experience. When I lived in Canada (and the US briefly) it was common for me to get fined for various trivial offences. I used to joke I should have a fine budget, or at least fine schedule for attending court. The local authorities set speed traps, fine for crossing the road at the wrong place, not shoveling snow quickly etc. My parents in-law and everyone on their whole street got fined for parking their cars on the street by a by-law officer instead of their driveways when the houses were new builds still getting constructed and new drive ways were clearly in the process of being constructed and could not be entered. There was someone in the news who got arrested for not mowing their lawn. I'm not making this up, just do a search, in fact it seems dozens of people have been sent to jail for not paying fines for not keeping up with landscaping in the US. Now since being back in the UK for six years I've not received a single fine, had any interaction with the police or courts. There is a big difference in how fines are applied in Europe and I agree with your comment that I do trust the EU more in this regard, based on the way they operate historically.
doktrin 8y ago
> I've probably spent a total of three to four days reading around the GDPR and I don't really see what's special about this law other than it's imposing decent standards on what was in effect a wildly unregulated industry in people's personal data We are still waiting for the first court battles that will help determine how GDPR is actually enforced in practice. Until then being in compliance with GDPR is gonna be like herding invisible cats, and it's likely well intentioned people will get burned and OP ends up with major egg on his face within a years time. I want to drink the EU koolaid as much as the next person, but that's just naive.
- cesarb 8y ago
  > We are still waiting for the first court battles that will help determine how GDPR is actually enforced in practice. I'm wondering if this is yet another point where cultural differences are muddling the discussion. In particular, the difference between common law systems (like the USA) and civil law systems (like nearly all of the EU).
  - kazen44 8y ago
    this is a major difference indeed. In Civil law systems, the judge his interpretation matters much less then in common law systems. Mainly because everything is already codified into law.
dominotw 8y ago
> people's personal data. I remember back in the day there was no such concept on the internet. Your identity didn't translate to anything in real world. At somepoint people started to treat it as 'real world but on the computer' instead of thinking about it totally radically new way about 'self'/'identity' ect. People thought of their internet profiles as their own self. Intenet age was killed even before it started. Endless promise of internet to free human beings was thwarted by paranoia, censorship, laws ect.

cbg0 8y ago

That Varonis link gets posted quite a bit, but it drastically over simplifies things and even tries to poke fun at some aspects of the legislation. The ICO site is a much better read for this.

Sverigevader 8y ago
Pardon me but, what does ICO site mean in this context?
- tonfa 8y ago
  The link to ico.org.uk in the comment above.
- matthewmacleod 8y ago
  The Information Comissioner’s Office site, as linked in the grandparent post.
- tomw2005 8y ago
  Information Commissioner's Office: https://ico.org.uk/about-the-ico/ https://ico.org.uk/about-the-ico/
frereubu 8y ago
Fair point - my intent was to point out that some sources which are less intimidating than others. If all you read was the Varonis link you'd be in trouble, but if someone's the kind of person who thinks that they can read one blog post and understand the GDPR I'm not sure they're the kind of person that can be helped anyway...
- hobofan 8y ago
  I would even go as far as saying that that article is straight up wrong/misinterpreting at least some of the articles. I randomly checked Article 14, as I am wondering how I am expected to communicate to users that I don't collect any PII([0]), and it turns out Article 14 is not about "You need to tell people what you’re doing even if you’re not collecting personal data." but about "Information to be provided where personal data have not been obtained from the data subject" = "You have collected personal data about the data subject, just not directly from them, but via some other source" [0]: Even though I'm not sure if that's even easily possible for any company that has a website, now that IPs can fall under PII.

AnabeeKnox 8y ago

Reminder: you have to legally comply with every letter of the GDPR, not just the TLDR version. Saying "but we implemented the TLDR version" is not a legal defence.

tialaramex 8y ago
This concern applies to all laws though. Not murdering people doesn't require you to spend ages examining the exact text of a statutory definition of murder. The tl;dr version is enough for me to grasp that kicking somebody in the head until they stop breathing isn't allowed.
Arnt 8y ago
Saying "we got the major stuff right, missed some of the details, sorry about that" will keep the fine small. And... de minimis non curat lex.

dantheman 8y ago

The amount of discretion and lack of clarity in the penalties is part of the problem. It opens you up to risk based on the whims of politics and the regulators and increases uncertainty. Laws should be clear, limited, and understandable - this is not.

frereubu 8y ago
In an ideal world, yes. But that leads you down a Kafkaesque hole of bureaucracy - at some point you have to stop adding detail and leave things open to interpretation. There are plenty of laws out there with fines "up to €X" and, from my limited experience, I don't think the GDPR is especially ambiguous compared to others.
- kingofhdds 8y ago
  Well, lots of ends open to interpretation, and $20 mln fine - so obviously nothing to care about! Hysteria!
  - DanBC 8y ago
    Maximum possible fine for repeated worst possible violation after ignoring previous attempts at regulation and not making changes after previous smaller fines. It's not a minimum.
    - frereubu 8y ago
      I think this is a common misinterpretation though because of the lanauge - that the maximum fine is actually the minimum, because the figures that are talked about are "€20m or 4% of global turnover, whichever is the greatest." It's the emphasis on "the greatest" that has an undercurrent of "we're going to fine you the maximum of these two numbers."
      - StavrosK 8y ago
        I'm not sure what you mean by "actually the minimum". They will find you the maximum of those two numbers, at most, if you flagrantly disregard the law.

dspillett 8y ago

> I don't really see what's special about this law The key change is the fairly explicit punishments and apparent intent to hand them out for non-compliance. A lot of older regulations get considered by companies but the issues relegated, officially or otherwise, to "yeah, we'll apologise and fix that when someone notices" which might not be a good way to manage the risk management after next Friday. > ... might feel like "I run a small site on a Digital Ocean droplet and I'm at risk of a €2m fine out of the blue." But that doesn't make it true. Exactly. A lot of the unhelpful hysteria is being drummed up by consulting companies trying to sell there services to help others assess and/or manage their GDPR compliance: they are stoking the fears to improve sales. The rest is coming from people who don't want to lose control of some of what they consider to be _their_ data. From a business perspective this is usually "I've collected it or pad for it, I should be able to keep it / sell it / use it, this is unfair, wa waa waaaaaa" and from a technical perspective many of us data people have flinch reactions to any idea of hard-delete or un-rollback-able update operations (they are not really impossible to rollback of course, anyone sensible is building considerations for backup retention policies into their procedures, but rolling back is less likely to be simple and can only be done during that retention window).

ciguy 8y ago
The consulting companies use exactly the same MO that Y2K consultants used. Cherry picking case studies and data sets to make executives think the sky is falling when in reality it's not all that hard to be compliant with GDPR and it really is comprehensible by an average person spending a day or 2 reading up on it.
- sdoering 8y ago
  Exactly that. Working as a data analyst for my agency's clients I had more work in making sure my clients do not panic after having other consultants claiming, that the world will end and what not. It is possible to comply with GDPR in most cases with not too much of an effort (I know some processual stuff is just boring and ugly, but doable). It is possible to not have a cookie wall of horror, if you "just" want to do tracking (analytics) or first party onsite marketing. It will get more complicated with personalized recommendations, profiling and stuff. I have to admit this - especially with third party vendors and such - will be a little bit more fun/challenging.

SagelyGuru 8y ago

I am concerned that the effect of this legislation on the private individual is the opposite of the stated intention. People are being forced to sign agreements which jeopardise the natural rights to their data which they would otherwise have. One example: a friend who has a very pretty daughter was asked by her school to give them the right to film her and to use any and all such recordings as they see fit for 50 years even after she leaves the school. This feels very wrong on just about all the conceivable levels.

Jubok 8y ago
What ? It's the opposite, it allow you to access and delete the data, even if you gave consent one time. And your image concern a lot of other old laws, even if you sell it you can get it back later.
- SagelyGuru 8y ago
  I have difficulty in understanding your language and in following your logic. Surely, signing away the rights to your records for over 50 years can not be better for you than not signing them?
  - Jubok 8y ago
    English may not be my mother tongue but I can logically follow an argument. Your friend' daughter was not obligated to sign such contract and GDPR reinforce previous laws protecting her image ;)
  - p49k 8y ago
    This law has nothing to do with signing away the rights of your image to be used for publicity, though. GDPR does not come into play at all in the scenario with your friend’s daughter; the school is likely abusing laws in their request and should be investigated, but those laws aren’t related to GDPR and the existence of GDPR does not somehow cause the daughter’s position to be weaker here.
  - sdoering 8y ago

downandout 8y ago

There is nothing - and I do mean nothing - written into the GDPR that requires any warnings of any kind, or places any limits on fines, except for $10/$20 million or 4% of revenue, whichever is greater. Period. A multimillion-dollar fine without warning for a first, minor violation is perfectly lawful under GDPR. The idea that "yes it says that but we can trust EU regulators to not assess large fines against foreign companies, even though they would benefit handsomely from them" rings hollow to me.

laumars 8y ago
In principle I might agree with you, however the EU has a long history of striking a fair balance between consumer rights and commercial interests. There is no point, in history, of the EU doing anything remotely like you've described. Which actually gives me more faith in the GDPR than legislation in a corrupt ecosystem as corrupt individuals will find a way to warp legislation in their favor anyway. So yes, I do trust the EU and their history has proven that the aforementioned idea isn't a hollow one.
- deleted 8y ago
  [deleted]
- ajeet_dhaliwal 8y ago
  Related to this, there is a difference in culture that may had add to the fear for people running SMEs outside of Europe. I am talking about a difference in the culture of fines, at least at the local level of government based on my personal experience. When I lived in Canada (and the US briefly) it was common for me to get fined for various trivial offences. I used to joke I should have a fine budget, or at least fine schedule for attending court. The local authorities set speed traps, fine for crossing the road at the wrong place, not shoveling snow quickly etc. My parents in-law and everyone on their whole street got fined for parking their cars on the street by a by-law officer instead of their driveways when the houses were new builds still getting constructed and new drive ways were clearly in the process of being constructed and could not be entered. There was someone in the news who got arrested for not mowing their lawn. I'm not making this up, just do a search, in fact it seems dozens of people have been sent to jail for not paying fines for not keeping up with landscaping in the US. Now since being back in the UK for six years I've not received a single fine, had any interaction with the police or courts. There is a big difference in how fines are applied in Europe and I agree with your comment that I do trust the EU more in this regard, based on the way they operate historically.

doktrin 8y ago

> I've probably spent a total of three to four days reading around the GDPR and I don't really see what's special about this law other than it's imposing decent standards on what was in effect a wildly unregulated industry in people's personal data We are still waiting for the first court battles that will help determine how GDPR is actually enforced in practice. Until then being in compliance with GDPR is gonna be like herding invisible cats, and it's likely well intentioned people will get burned and OP ends up with major egg on his face within a years time. I want to drink the EU koolaid as much as the next person, but that's just naive.

cesarb 8y ago
> We are still waiting for the first court battles that will help determine how GDPR is actually enforced in practice. I'm wondering if this is yet another point where cultural differences are muddling the discussion. In particular, the difference between common law systems (like the USA) and civil law systems (like nearly all of the EU).
- kazen44 8y ago
  this is a major difference indeed. In Civil law systems, the judge his interpretation matters much less then in common law systems. Mainly because everything is already codified into law.

dominotw 8y ago

> people's personal data. I remember back in the day there was no such concept on the internet. Your identity didn't translate to anything in real world. At somepoint people started to treat it as 'real world but on the computer' instead of thinking about it totally radically new way about 'self'/'identity' ect. People thought of their internet profiles as their own self. Intenet age was killed even before it started. Endless promise of internet to free human beings was thwarted by paranoia, censorship, laws ect.