5 ms·

So what you're saying is there's lots of complexity and nuances in how you do this with some commonly done things illegal and others not ... and you should prob

So what you're saying is there's lots of complexity and nuances in how you do this with some commonly done things illegal and others not ... and you should probably consult a lawyer to make sure. Correct ?

hennsen 8y ago
Which is exactly my point put a bit shorter :)
zaarn 8y ago
You don't have to get it all right on the first try. If you get something wrong, the regulatory body will contact you (via letter or email) and tell you what they feel like is not correct (that is the official guidance on how to handle GDPR violations). As long as you do your best to implement the GDPR and interact with the regulatory agency in a friendly and helpful manner then there won't be much need for a lawyer (but do consider that the GDPR being written as it is is also the result of being written in the EU where law is written a bit differently)
- jeremyt 8y ago
  Your comment sounds so Orwellian I can’t help but cringe.
  - zaarn 8y ago
    It's not orwellian to be friendly towards authority, especially when you're a business and it's about the privacy of the users, protecting the very data that orwellian governments seek to collect and abuse. Otherwise, I would love to hear which part of my comment was orwellian in nature?
    - tripletao 8y ago
      I'd guess he's referring to your (likely correct) implication that the regulators will give more weight to your "friendly and helpful" behavior than to how the text of the law applies to the facts of your case. The concept of the rule of law was invented primarily in countries that now belong to the EU. Is there no one left there who still thinks it's important? It's not even that people argue "the GDPR couldn't be less vague without loopholes, and this is important enough that it's worth the cost". The idea that a powerful human's best attempt to objectively apply stable, published rules is generally better than a powerful human's unrestrained discretion just seems foreign to most commenters here. If you ran an organization publicly associated with George Soros in Hungary (whose prime minister has described him as an "enemy of the state"), then would you still feel good relying on your friendly relationship with the government? What steps would you take to comply with the GDPR as it's currently written, if you couldn't rely on the goodwill of the people interpreting it? With a sufficiently corrupt government, there's nothing you can do; but the point where a judge will accept an obvious lie tends to come long after the point where a regulator lets politics disambiguate a vague standard.
      - zaarn 8y ago
        The GDPR is a regulation and not a law, thusly the implications are different. If you produce a device that accidentally violates FCC guidelines, would you rather be immediately punished to the extend of the regulation or rather work with the FCC to rectify the issue and how to fix it for affected customers? The other reason is that yes the GDPR is vague. It must be because in the past corporations have abused loopholes and the only way to prevent people abusing loopholes without punishing people who don't abuse them is to make it vague and then decide on their behaviour. And again, these are corporations, legal persons. They don't even have the remotely same rights as a natural person.
        tripletao 8y ago
        At least in the USA, a regulation has the force of law. To say "regulation" instead of "law" just means the rule gets its legal power indirectly from some statute (which probably also limits the scope of the rules), instead of directly from the legislative process. I'd thought the EU was similar. Is it not? If I ship a device that fails to comply with FCC rules, then I would prefer that the maximum penalty provided by law is also a fair and reasonable one. I understand that most regulated fields are complex enough that if we don't give regulators some discretion, then the law will be filled with loopholes and impossibly complex; but I would like to give them the minimum discretion they need to do their job. I think the GDPR fails that test spectacularly. Do you really think they need the statutory authority to fine someone 20M EUR for their semi-commercial side project that made $1k lifetime total? If not, then why give it to them? The GDPR applies to natural persons too. Imagine if it didn't! Facebook could just contract all the creepy stuff to a sole proprietorship operated by Mark Zuckerberg... ETA: From https://ec.europa.eu/info/law/law-making-process/types-eu-law_en https://ec.europa.eu/info/law/law-making-process/types-eu-la... > Regulations are legal acts that apply automatically and uniformly to all EU countries as soon as they enter into force, without needing to be transposed into national law. They are binding in their entirety on all EU countries. So not quite the same as the US, though maybe some analogy in that the regulation is still "secondary law", subordinate to the EU treaty? But I don't see how you can describe a set of rules "binding in its entirety" as anything but law.
    - candiodari 8y ago
      That's something that utterly amazes me about the EU, and your comment. A lot of the protections that exist for privacy in the US against authorities mostly don't exist in the EU. The EU lets every police force in the EU, or in Interpol request data interception. That is a LOT of organizations, and of course, they got caught doing abuse just the same. But, for instance, the default practice in the US is that you get told your phone is tapped (yes, really), unless the police explains to a judge why not (nearly always), BUT in that case you still get told afterwards. This does not exist in the EU. You will never be told you got tapped. Second, in the US, the provider looks at the order, verifies it with the proper authorities, and decides for itself on scope, reasonableness, ... etc. In the EU, nope. If an order is received the only actions that a provider can take must be technical in nature. In theory an employee that does the actual tapping of the phone can't even tell his manager he's tapping phones, and definitely he can't tell anyone which phones are to be tapped or why (nor is there any obligation on the part of the requesting force to tell him why, but it is a field on the form). In many countries, this can be done without judicial oversight, or in nearly all cases with only very, very light oversight. This, to me, is far more worrying than the situation in the US. If a local police officer in Latvia wants to tap the phone of anyone in the EU, he just has to fill out a form and fax it to interpol. This is even weirder given that Europe has actual experience with abuse of surveillance powers, everywhere from Germany Eastward, as well as during WWII. They KNOW what can go wrong, they just have to ask their parents or grandparents to find people who were actually exposed to this. And yet ... Next we find out that large-scale spying on the own population is done in, at least, UK, France, Germany, the Netherlands ... and not a peep. This was barely reported in the local media, in fact. We all know that most other countries are going to be worse than these, not better. And, of course, they cooperate with the NSA as well. Hell, the US has reporting on how much they spy on their own citizens (in fact, that's the source of most of the outrage). No such stats in the EU. Nobody, not even the police forces themselves, feels the need to have the most banal, basic level of transparency. Clearly when it comes to spying the EU is of the opinion, them, yes, perfectly allowed. Think of the children ! I mean, clearly these guys do not believe in privacy. So yes, it is very Orwellian when they just request that you work with them on the privacy of their citizens. Clearly the result they want is not actual privacy and protections for their citizens. If they believe in privacy protections, they have a lot of state agencies that they need to attack for not having any decent respect for privacy, as well as the fact that what few protections do exist only exist in a vast complex tangled web that errs on the side of violating people's privacy. And that's ignoring the fact that privacy protections have been systematically eroded further and further in Europe (e.g. recently in Germany).
  - Proziam 8y ago
    I find the use of "Orwellian" rather ironic in this context. I run a company based in the UK, but I myself am American and most of my business experience is in the US. Despite that, I honestly have had no issues adapting to the GDPR. Considering that the business I operate has systems specifically designed to store as much data on people as possible, I find it absurd other businesses are unable to handle user/client data responsibly. That said, I cared about privacy BEFORE GDPR and intended to act responsibly regardless of regulation.
  - GW150914 8y ago
    I’m increasingly convinced that a majority of people who use the term “Orwellian” haven’t actually read Orwell’s books.

hennsen 8y ago

Which is exactly my point put a bit shorter :)

zaarn 8y ago

You don't have to get it all right on the first try. If you get something wrong, the regulatory body will contact you (via letter or email) and tell you what they feel like is not correct (that is the official guidance on how to handle GDPR violations). As long as you do your best to implement the GDPR and interact with the regulatory agency in a friendly and helpful manner then there won't be much need for a lawyer (but do consider that the GDPR being written as it is is also the result of being written in the EU where law is written a bit differently)

jeremyt 8y ago
Your comment sounds so Orwellian I can’t help but cringe.
- zaarn 8y ago
  It's not orwellian to be friendly towards authority, especially when you're a business and it's about the privacy of the users, protecting the very data that orwellian governments seek to collect and abuse. Otherwise, I would love to hear which part of my comment was orwellian in nature?
  - tripletao 8y ago
    I'd guess he's referring to your (likely correct) implication that the regulators will give more weight to your "friendly and helpful" behavior than to how the text of the law applies to the facts of your case. The concept of the rule of law was invented primarily in countries that now belong to the EU. Is there no one left there who still thinks it's important? It's not even that people argue "the GDPR couldn't be less vague without loopholes, and this is important enough that it's worth the cost". The idea that a powerful human's best attempt to objectively apply stable, published rules is generally better than a powerful human's unrestrained discretion just seems foreign to most commenters here. If you ran an organization publicly associated with George Soros in Hungary (whose prime minister has described him as an "enemy of the state"), then would you still feel good relying on your friendly relationship with the government? What steps would you take to comply with the GDPR as it's currently written, if you couldn't rely on the goodwill of the people interpreting it? With a sufficiently corrupt government, there's nothing you can do; but the point where a judge will accept an obvious lie tends to come long after the point where a regulator lets politics disambiguate a vague standard.
    - zaarn 8y ago
      The GDPR is a regulation and not a law, thusly the implications are different. If you produce a device that accidentally violates FCC guidelines, would you rather be immediately punished to the extend of the regulation or rather work with the FCC to rectify the issue and how to fix it for affected customers? The other reason is that yes the GDPR is vague. It must be because in the past corporations have abused loopholes and the only way to prevent people abusing loopholes without punishing people who don't abuse them is to make it vague and then decide on their behaviour. And again, these are corporations, legal persons. They don't even have the remotely same rights as a natural person.
      - tripletao 8y ago
        At least in the USA, a regulation has the force of law. To say "regulation" instead of "law" just means the rule gets its legal power indirectly from some statute (which probably also limits the scope of the rules), instead of directly from the legislative process. I'd thought the EU was similar. Is it not? If I ship a device that fails to comply with FCC rules, then I would prefer that the maximum penalty provided by law is also a fair and reasonable one. I understand that most regulated fields are complex enough that if we don't give regulators some discretion, then the law will be filled with loopholes and impossibly complex; but I would like to give them the minimum discretion they need to do their job. I think the GDPR fails that test spectacularly. Do you really think they need the statutory authority to fine someone 20M EUR for their semi-commercial side project that made $1k lifetime total? If not, then why give it to them? The GDPR applies to natural persons too. Imagine if it didn't! Facebook could just contract all the creepy stuff to a sole proprietorship operated by Mark Zuckerberg... ETA: From https://ec.europa.eu/info/law/law-making-process/types-eu-law_en https://ec.europa.eu/info/law/law-making-process/types-eu-la... > Regulations are legal acts that apply automatically and uniformly to all EU countries as soon as they enter into force, without needing to be transposed into national law. They are binding in their entirety on all EU countries. So not quite the same as the US, though maybe some analogy in that the regulation is still "secondary law", subordinate to the EU treaty? But I don't see how you can describe a set of rules "binding in its entirety" as anything but law.
  - candiodari 8y ago
    That's something that utterly amazes me about the EU, and your comment. A lot of the protections that exist for privacy in the US against authorities mostly don't exist in the EU. The EU lets every police force in the EU, or in Interpol request data interception. That is a LOT of organizations, and of course, they got caught doing abuse just the same. But, for instance, the default practice in the US is that you get told your phone is tapped (yes, really), unless the police explains to a judge why not (nearly always), BUT in that case you still get told afterwards. This does not exist in the EU. You will never be told you got tapped. Second, in the US, the provider looks at the order, verifies it with the proper authorities, and decides for itself on scope, reasonableness, ... etc. In the EU, nope. If an order is received the only actions that a provider can take must be technical in nature. In theory an employee that does the actual tapping of the phone can't even tell his manager he's tapping phones, and definitely he can't tell anyone which phones are to be tapped or why (nor is there any obligation on the part of the requesting force to tell him why, but it is a field on the form). In many countries, this can be done without judicial oversight, or in nearly all cases with only very, very light oversight. This, to me, is far more worrying than the situation in the US. If a local police officer in Latvia wants to tap the phone of anyone in the EU, he just has to fill out a form and fax it to interpol. This is even weirder given that Europe has actual experience with abuse of surveillance powers, everywhere from Germany Eastward, as well as during WWII. They KNOW what can go wrong, they just have to ask their parents or grandparents to find people who were actually exposed to this. And yet ... Next we find out that large-scale spying on the own population is done in, at least, UK, France, Germany, the Netherlands ... and not a peep. This was barely reported in the local media, in fact. We all know that most other countries are going to be worse than these, not better. And, of course, they cooperate with the NSA as well. Hell, the US has reporting on how much they spy on their own citizens (in fact, that's the source of most of the outrage). No such stats in the EU. Nobody, not even the police forces themselves, feels the need to have the most banal, basic level of transparency. Clearly when it comes to spying the EU is of the opinion, them, yes, perfectly allowed. Think of the children ! I mean, clearly these guys do not believe in privacy. So yes, it is very Orwellian when they just request that you work with them on the privacy of their citizens. Clearly the result they want is not actual privacy and protections for their citizens. If they believe in privacy protections, they have a lot of state agencies that they need to attack for not having any decent respect for privacy, as well as the fact that what few protections do exist only exist in a vast complex tangled web that errs on the side of violating people's privacy. And that's ignoring the fact that privacy protections have been systematically eroded further and further in Europe (e.g. recently in Germany).
- Proziam 8y ago
  I find the use of "Orwellian" rather ironic in this context. I run a company based in the UK, but I myself am American and most of my business experience is in the US. Despite that, I honestly have had no issues adapting to the GDPR. Considering that the business I operate has systems specifically designed to store as much data on people as possible, I find it absurd other businesses are unable to handle user/client data responsibly. That said, I cared about privacy BEFORE GDPR and intended to act responsibly regardless of regulation.
- GW150914 8y ago
  I’m increasingly convinced that a majority of people who use the term “Orwellian” haven’t actually read Orwell’s books.