4 ms·

I already commented on the previous post feeling the author has no idea what he is talking about but this nails it: > What’s important with any law is - beside

by chx 8y ago

I already commented on the previous post feeling the author has no idea what he is talking about but this nails it: > What’s important with any law is - besides the letter of the law - what the spirit of the law is, the laws intent. This very conveniently forget the GDPR will not be interpreted by a single authority in Brussels but rather by the relevant authority in every single EU country. Whatever the lawmakers intended, who gives a hoot? I can pretty much guarantee the Hungarian NAIH will see this as a fantastic cash grab opportunity. (I am a dual Canadian-Hungarian citizen, I know my birth country all too well.) Despite all this "pah-pah, it'll all be fine" there is not even a guidance much less any law describing who shall be fined for how much. Spirit of the law protecting you from Hungarian bureaucracy , good luck Chuck. The courts will eventually curb this madness and set some best practices but meanwhile those who got fined excessively will stay bankrupt. Don't be the patsy. At this time, unless you are a big enough company to have a sizable legal department do not do business with the EU. This is not hysteria, this is just good business sense.

jacquesm 8y ago
Yes, I saw your previous comment. If you feel that you can discard a whole article because you find one line in it that confirms your prior belief then that's fine with me. But I've been in this business for long enough and have seen EU regulators at work often enough that there is no mystery to me about how this will play out. What will happen is that the small fry will be ignored unless they cross the lines in very visible ways. Larger companies and companies with more risky models will be more at risk of having the regulators take an active interest in them. Large companies because there is a large chance of complaints to the regulators, companies with more risky models because they will be acting against the spirit of the law even if they will do everything they can to comply with the letter. If you don't believe that's how it will work that's entirely fine with me but about 30 years of data confirm my point of view.
- chx 8y ago
  > If you feel that you can discard a whole article because you find one line in it that confirms your prior belief then that's fine with me. The entire spirit of these articles are completely misguided because the adverse reaction to GDPR is not hysteria. Here's the unique nature of this which makes it a recipe for disaster: 1. Every business interacting practically any way with European citizens is affected 2. The potential fees for breaching a very complex regulation are unprecedentedly high. 3. Determining the actual fees for each breach is in the hand of every EU country, including some which today wouldn't be admitted into the EU.
  - jacquesm 8y ago
    The oft bandied around 20 million euro fine is the reason for that particular choice of words. People shutting down their projects without having spent a minimum amount of time on the impact, bloggers worried about having to hire a DPO. I haven't seen this much bullshit since the Y2K days and even then with some work and planning it got taken care of. People were genuinely surprised when the world didn't end. This is going to be just like that. May 25th the world will continue to turn and none of these bogeyman stories will come to pass with anything approaching fidelity. Regulators will target the worst excesses to show they mean business and are severely limited in manpower anyway so the vast majority of interaction that has to do with the GDPR will amount to a change in mindset and some best practices. In edge cases things will get a bit more interesting (someone mentioned federated services and that's a really good question). FWIW I've been looking at companies from the GDPR angle for about a year and a half now, we slowly ratcheted up the push for compliance and it is interesting to see how (EU based) start-ups have adapted to the new legislation. We have also found some companies that were ill prepared but that's to be expected. The worst position to be in is a small (10...20FTE) company operating in the US running a SaaS that stores critical information. That's an expensive affair. For most other companies - including the really large ones - the impact will be mostly a one-time investment in software and inventory of data and processes. After that they will be in much better shape and that's a good thing. Companies that make a business of selling data are expected to be hit hard, and rightly so.
    - chx 8y ago
      > Regulators will target the worst excesses Your confidence scares me. What about this, I have the same amount of evidence you have: Some regulators will target the weakest. It's really easy to slap a few tens of thousand of euros fine on a small business. Sure, fining a big company for many tens, hundreds of millions makes news but a few ten thousands is a good income.
      - jacquesm 8y ago
        > Some regulators will target the weakest. Do you have any evidence for this? I have plenty of evidence for the opposite, if you want I will collect it. Here is one sample dataset, NL: https://www.computable.nl/artikel/nieuws/overheid/6345059/250449/privacywaakhond-ap-legde-geen-boetes-op-in-2017.html https://www.computable.nl/artikel/nieuws/overheid/6345059/25... No fines in all of 2017, in spite of 10,009 data leaks that were reported. In one case there was a settlement of 48K, but it is not quite clear what the circumstances were, probably to protect the guilty. "De AP stelt in een samenvatting van het jaarverslag 2017 dat het niet altijd direct een onderzoek start. Het gaat eerst in gesprek met partijen die een overtreding begaan en in veel gevallen leiden die zogenoemde alternatieve interventies niet tot een officieel onderzoek." Rough translation: "The Authority says in the summary of their annual report for 2017 that it does not always immediately starts an investigation. It first tries to talk to the parties that have violated the law and in many cases these so called alternative interventions do not lead to an official inquiry."

by chx 8y ago

jacquesm 8y ago

Yes, I saw your previous comment. If you feel that you can discard a whole article because you find one line in it that confirms your prior belief then that's fine with me. But I've been in this business for long enough and have seen EU regulators at work often enough that there is no mystery to me about how this will play out. What will happen is that the small fry will be ignored unless they cross the lines in very visible ways. Larger companies and companies with more risky models will be more at risk of having the regulators take an active interest in them. Large companies because there is a large chance of complaints to the regulators, companies with more risky models because they will be acting against the spirit of the law even if they will do everything they can to comply with the letter. If you don't believe that's how it will work that's entirely fine with me but about 30 years of data confirm my point of view.

chx 8y ago
> If you feel that you can discard a whole article because you find one line in it that confirms your prior belief then that's fine with me. The entire spirit of these articles are completely misguided because the adverse reaction to GDPR is not hysteria. Here's the unique nature of this which makes it a recipe for disaster: 1. Every business interacting practically any way with European citizens is affected 2. The potential fees for breaching a very complex regulation are unprecedentedly high. 3. Determining the actual fees for each breach is in the hand of every EU country, including some which today wouldn't be admitted into the EU.
- jacquesm 8y ago
  The oft bandied around 20 million euro fine is the reason for that particular choice of words. People shutting down their projects without having spent a minimum amount of time on the impact, bloggers worried about having to hire a DPO. I haven't seen this much bullshit since the Y2K days and even then with some work and planning it got taken care of. People were genuinely surprised when the world didn't end. This is going to be just like that. May 25th the world will continue to turn and none of these bogeyman stories will come to pass with anything approaching fidelity. Regulators will target the worst excesses to show they mean business and are severely limited in manpower anyway so the vast majority of interaction that has to do with the GDPR will amount to a change in mindset and some best practices. In edge cases things will get a bit more interesting (someone mentioned federated services and that's a really good question). FWIW I've been looking at companies from the GDPR angle for about a year and a half now, we slowly ratcheted up the push for compliance and it is interesting to see how (EU based) start-ups have adapted to the new legislation. We have also found some companies that were ill prepared but that's to be expected. The worst position to be in is a small (10...20FTE) company operating in the US running a SaaS that stores critical information. That's an expensive affair. For most other companies - including the really large ones - the impact will be mostly a one-time investment in software and inventory of data and processes. After that they will be in much better shape and that's a good thing. Companies that make a business of selling data are expected to be hit hard, and rightly so.
  - chx 8y ago
    > Regulators will target the worst excesses Your confidence scares me. What about this, I have the same amount of evidence you have: Some regulators will target the weakest. It's really easy to slap a few tens of thousand of euros fine on a small business. Sure, fining a big company for many tens, hundreds of millions makes news but a few ten thousands is a good income.
    - jacquesm 8y ago
      > Some regulators will target the weakest. Do you have any evidence for this? I have plenty of evidence for the opposite, if you want I will collect it. Here is one sample dataset, NL: https://www.computable.nl/artikel/nieuws/overheid/6345059/250449/privacywaakhond-ap-legde-geen-boetes-op-in-2017.html https://www.computable.nl/artikel/nieuws/overheid/6345059/25... No fines in all of 2017, in spite of 10,009 data leaks that were reported. In one case there was a settlement of 48K, but it is not quite clear what the circumstances were, probably to protect the guilty. "De AP stelt in een samenvatting van het jaarverslag 2017 dat het niet altijd direct een onderzoek start. Het gaat eerst in gesprek met partijen die een overtreding begaan en in veel gevallen leiden die zogenoemde alternatieve interventies niet tot een officieel onderzoek." Rough translation: "The Authority says in the summary of their annual report for 2017 that it does not always immediately starts an investigation. It first tries to talk to the parties that have violated the law and in many cases these so called alternative interventions do not lead to an official inquiry."