4 ms·

I think there's also a sizable number of companies that basically were already compliant... but aren't sure. It's not like you can submit your processes to the

by eli 8y ago

I think there's also a sizable number of companies that basically were already compliant... but aren't sure. It's not like you can submit your processes to the EU for approval. You don't actually know if what you're doing is OK unless, some day, a regulator decides it isn't.

HelloNurse 8y ago
This kind of problem is what lawyers are for. Unless, of course, one is shortsighted enough to compromise business in order to avoid being bothered with law compliance, a rather common attitude among the aggressive startup-minded audience of Hacker News. I look forward to GDPR-like laws in the USA.
- Silhouette 8y ago
  The trouble with the GDPR is that there is so much ambiguity in even quite basic areas of the regulations and the official guidance so far that any formal opinion you get from lawyers, consultants, regulators and the like is riddled with vague terms like "reasonable", "legitimate", "proportionate" and "balanced". It's advice that doesn't actually answer any of the important questions like "Am I compliant?" or "What specific actions can I take to become compliant?".
  - setquk 8y ago
    I think that's intentional as it massively increases the risk of doing something negative for the end user and leaves loopholes uncertain and prone to interpretation. It will forces businesses to stay well clear of the line or pack up and go home. And that's not a bad thing. Also it stops a whole legal and compliance industry appearing in the grey zone as no one wants to abstract liability.
    - Silhouette 8y ago
      It will forces businesses to stay well clear of the line or pack up and go home. And that's not a bad thing. I'm not so sure. No-one knows where the line is, so many organisations can only be sure they're staying well clear by stopping all kinds of legitimate, reasonable data processing, which is throwing the baby out with the bathwater. An alternative, which I've seen quite a few small organisations and individuals adopting and now a few larger ones as well, is to just cut the EU off entirely if they're based outside and thus put themselves outside the scope of the GDPR for practical purposes, and then carry on as before under more liberal regimes like the US. Both of these strategies are harmful without really helping anyone.
      - HelloNurse 8y ago
        Legitimate and reasonable data processing is just that: it's obviously compliant. If there is any doubt, it's excessive and careless data processing, even if not illegal and without malicious intent. So there is no valuable baby that could be thrown out with the bathwater, and a well-behaved company has little or no bathwater to begin with.
        Silhouette 8y ago
        Legitimate and reasonable data processing is just that: it's obviously compliant. If there is any doubt, it's excessive and careless data processing, even if not illegal and without malicious intent. No, it isn't. Sorry, you can't just hand-wave the whole issue away that easily. If this were all so obvious, we wouldn't keep having these conversations, where even people who have been looking into this for months and taken real legal advice are still in doubt about what specific actions they can or must take to be compliant.
        HelloNurse 8y ago
        I should have been more explicit about my point: GDPR compliance is easy and inexpensive for restrained good companies that care about privacy, troublesome and expensive only for companies that behave inappropriately, and an existential threat only for true scum. You are simply being forced to behave like you should have been behaving from the beginning of your online presence.
        manigandham 8y ago
        That is absolutely meaningless and opens up every business to constant unrelenting litigation. Your definition of obvious is not the same as someone else.
  - jdietrich 8y ago
    >riddled with vague terms like "reasonable", "legitimate", "proportionate" and "balanced" You could be describing a very large proportion of laws. To pick a random example, I'll go with the Road Traffic Act 1991 (England and Wales). It is an offence under this act to drive a mechanically propelled vehicle dangerously on a public road. The definition of dangerous driving is: a) the way he drives falls far below what would be expected of a competent and careful driver, and b) it would be obvious to a competent and careful driver that driving in that way would be dangerous. That's it. Are you driving like an absolute dick? Is it obvious that you're driving like an absolute dick? If so, you're committing an offence. We have lots of other, more specific motoring laws, but you can be convicted and sentenced based on those two subjective factors. We have lots of case law and guidelines, but the matter of whether your driving definitively is or isn't dangerous can only be decided in court. https://www.legislation.gov.uk/ukpga/1991/40/part/I/crossheading/driving-offences https://www.legislation.gov.uk/ukpga/1991/40/part/I/crosshea... The broad nature of GDPR is a feature, not a bug. Nothing about the way it is worded is particularly new or unusual. Large sections are cribbed from the Data Protection Directive, which came into force in 1995. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A31995L0046 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...
    - Silhouette 8y ago
      I respectfully disagree with your example. We have very specific standards required for competent and safe driving, and in addition to the laws, there is well-established official practical guidance available in the form of the Highway Code. We have a regime of qualified instructors and examiners to guide and assess newcomers, and everyone has to pass a test to demonstrate their competence and understanding before being allowed out on the road independently. And then we're talking about criminal law, which means the burden of proof is heavily on the prosecution, you're going to be in court, and for more serious cases there is going to be a jury involved. And even then you have to fall far below the expected standard in a way that is obvious to someone who doesn't. None of those things applies in the context of GDPR.
    - deleted 8y ago
      [deleted]
- nathanaldensr 8y ago
  I promise: we're not all like that. In fact, I suspect there is a significant minority of people--including myself--that think just like you. I look forward to the end of all these data and privacy abuses.

by eli 8y ago

HelloNurse 8y ago

This kind of problem is what lawyers are for. Unless, of course, one is shortsighted enough to compromise business in order to avoid being bothered with law compliance, a rather common attitude among the aggressive startup-minded audience of Hacker News. I look forward to GDPR-like laws in the USA.

Silhouette 8y ago
The trouble with the GDPR is that there is so much ambiguity in even quite basic areas of the regulations and the official guidance so far that any formal opinion you get from lawyers, consultants, regulators and the like is riddled with vague terms like "reasonable", "legitimate", "proportionate" and "balanced". It's advice that doesn't actually answer any of the important questions like "Am I compliant?" or "What specific actions can I take to become compliant?".
- setquk 8y ago
  I think that's intentional as it massively increases the risk of doing something negative for the end user and leaves loopholes uncertain and prone to interpretation. It will forces businesses to stay well clear of the line or pack up and go home. And that's not a bad thing. Also it stops a whole legal and compliance industry appearing in the grey zone as no one wants to abstract liability.
  - Silhouette 8y ago
    It will forces businesses to stay well clear of the line or pack up and go home. And that's not a bad thing. I'm not so sure. No-one knows where the line is, so many organisations can only be sure they're staying well clear by stopping all kinds of legitimate, reasonable data processing, which is throwing the baby out with the bathwater. An alternative, which I've seen quite a few small organisations and individuals adopting and now a few larger ones as well, is to just cut the EU off entirely if they're based outside and thus put themselves outside the scope of the GDPR for practical purposes, and then carry on as before under more liberal regimes like the US. Both of these strategies are harmful without really helping anyone.
    - HelloNurse 8y ago
      Legitimate and reasonable data processing is just that: it's obviously compliant. If there is any doubt, it's excessive and careless data processing, even if not illegal and without malicious intent. So there is no valuable baby that could be thrown out with the bathwater, and a well-behaved company has little or no bathwater to begin with.
      - Silhouette 8y ago
        Legitimate and reasonable data processing is just that: it's obviously compliant. If there is any doubt, it's excessive and careless data processing, even if not illegal and without malicious intent. No, it isn't. Sorry, you can't just hand-wave the whole issue away that easily. If this were all so obvious, we wouldn't keep having these conversations, where even people who have been looking into this for months and taken real legal advice are still in doubt about what specific actions they can or must take to be compliant.
        HelloNurse 8y ago
        I should have been more explicit about my point: GDPR compliance is easy and inexpensive for restrained good companies that care about privacy, troublesome and expensive only for companies that behave inappropriately, and an existential threat only for true scum. You are simply being forced to behave like you should have been behaving from the beginning of your online presence.
      - manigandham 8y ago
        That is absolutely meaningless and opens up every business to constant unrelenting litigation. Your definition of obvious is not the same as someone else.
- jdietrich 8y ago
  >riddled with vague terms like "reasonable", "legitimate", "proportionate" and "balanced" You could be describing a very large proportion of laws. To pick a random example, I'll go with the Road Traffic Act 1991 (England and Wales). It is an offence under this act to drive a mechanically propelled vehicle dangerously on a public road. The definition of dangerous driving is: a) the way he drives falls far below what would be expected of a competent and careful driver, and b) it would be obvious to a competent and careful driver that driving in that way would be dangerous. That's it. Are you driving like an absolute dick? Is it obvious that you're driving like an absolute dick? If so, you're committing an offence. We have lots of other, more specific motoring laws, but you can be convicted and sentenced based on those two subjective factors. We have lots of case law and guidelines, but the matter of whether your driving definitively is or isn't dangerous can only be decided in court. https://www.legislation.gov.uk/ukpga/1991/40/part/I/crossheading/driving-offences https://www.legislation.gov.uk/ukpga/1991/40/part/I/crosshea... The broad nature of GDPR is a feature, not a bug. Nothing about the way it is worded is particularly new or unusual. Large sections are cribbed from the Data Protection Directive, which came into force in 1995. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A31995L0046 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...
  - Silhouette 8y ago
    I respectfully disagree with your example. We have very specific standards required for competent and safe driving, and in addition to the laws, there is well-established official practical guidance available in the form of the Highway Code. We have a regime of qualified instructors and examiners to guide and assess newcomers, and everyone has to pass a test to demonstrate their competence and understanding before being allowed out on the road independently. And then we're talking about criminal law, which means the burden of proof is heavily on the prosecution, you're going to be in court, and for more serious cases there is going to be a jury involved. And even then you have to fall far below the expected standard in a way that is obvious to someone who doesn't. None of those things applies in the context of GDPR.
  - deleted 8y ago
    [deleted]
nathanaldensr 8y ago
I promise: we're not all like that. In fact, I suspect there is a significant minority of people--including myself--that think just like you. I look forward to the end of all these data and privacy abuses.