4 ms·

You only have to prove "innocence" if your users doubt your statements about PII handling, are so annoyed about your doing that they inform the supervisory auth

You only have to prove "innocence" if your users doubt your statements about PII handling, are so annoyed about your doing that they inform the supervisory authority and that authority has sufficient doubt that they open an investigation. It must be a tricky/dirty/spammy business you're in if you really fear that your users will call the authorities in droves about your procedures. Even for user requests the law states that the user must show that he has a valid reason to act, repeated requests just for the fun of it don't need to be honored and the user can charged for thus a behaviour. And to be honest: Blocking access casts more doubt than being open and ask for consent.

RobertRoberts 8y ago
You are utterly and completely wrong. All it takes is court papers and a lawsuit for _any_ reason at all, and you are done. You seem to be claiming the GDPR dictates who is allowed to sue and what evidence they must provide, and it simply does not. Go look it up, it's a "guilty until proven innocent" system, which guarantees loss to the accused, guilty or not.
- hadrien01 8y ago
  You obviously don't know how the EU works. If a Data Protection Agency comes to know your wrongdoings, they'll first try to resolve peacefully the matter, by telling you what you're doing wrong. Only if you persist multiple times you'll be in danger of being brought to court.
  - dogma1138 8y ago
    That’s not true at least in the UK and Germany fines are issued essentially on the stop for every violation even questionable ones.
    - detaro 8y ago
      Source? From what I know, the German DPAs (they are organized on state level) hand out like 2 fines per month each, generally way below the maxima (under old German law, the max was 300000 €), and concluding the majority of cases without a fine. E.g. from the Bavarian DPA (german doc: https://www.lda.bayern.de/media/baylda_report_07.pdf https://www.lda.bayern.de/media/baylda_report_07.pdf, page 151): in the years 2015-2016 they had 173 proceedings that could involved potential fines. 52 of those resulted in fines. 34 of those fines were <1k€, 13 were <10k€.
  - RobertRoberts 8y ago
    You are so wrong, Google and Facebook are already being sued, the FIRST day the law has been in effect.
    - y4mi 8y ago
      No, they aren't. There have been user complaints about them. These complaints can ultimately result in a investigation and finally a court case. That is still far off, however
      - RobertRoberts 8y ago
        Yes, they are. http://money.cnn.com/2018/05/25/technology/gdpr-compliance-facebook-google/index.html http://money.cnn.com/2018/05/25/technology/gdpr-compliance-f... >"The suit against Google alleges that users of the company's Android software are forced to turn over personal data to use an Android-powered mobile device. The lawsuit alleges this "forced consent" amounts to a violation of GDPR, which guarantees individuals the right to consent when companies want to collect and process their personal data."
        y4mi 8y ago
        this just shows how lacking cnns quality is nowadays. It most likely will become a lawsuit in the next days/weeks, yes. But just because an investigation got started doesnt necessarily mean that it'll end in an lawsuit. This is exactly was the original post was talking about. The investigator will contact the company, look at how the company processes the data and finally - if they're willfully ignoring gdpr - open an actual case. more likely however is that the company already tried to comply and will just get a few reports of things they have to change/improve. as google probably doesn't have interest in actually upholding gdpr, the investigators will probably soon-ish open an actual suit.
        RobertRoberts 8y ago
        >this just shows how lacking cnns quality is nowadays. Do I _really_ need to link to all the other news companies saying the same thing? There are lawsuits started already.
- DanBC 8y ago
  > You seem to be claiming the GDPR dictates who is allowed to sue Yes, it literally does do this. Please can you point to the bit that allows anyone to sue? > Go look it up, it's a "guilty until proven innocent" system, which guarantees loss to the accused, guilty or not. Completely untrue. That would be incompatible with human rights and European law. You're scared about stuff that isn't in GDPR or that cannot happen under EU law.
  - dogma1138 8y ago
    Having dealt with 2 DPAs (UK and DE) it is guilty until proven innocent I think you may be thinking of the rights of seeking damages under the GDPR which is utterly irrelevant to the core enforcement of it. I think have way too of a rosy outlook on how laws are enforced in the EU much of the enforcement is contradictory to the ideals you hold in such high regard. Charities are one of the most common targets of data protection enforcement in the EU even before the GDPR, in the UK they are collectively the sector that gets hit the most by the ICO and the picture isn’t much different on the continent and one of the main reasons for that is that they are easy targets (this does not mean they didnt do anything wrong but they are easy targets nonetheless).

RobertRoberts 8y ago

You are utterly and completely wrong. All it takes is court papers and a lawsuit for _any_ reason at all, and you are done. You seem to be claiming the GDPR dictates who is allowed to sue and what evidence they must provide, and it simply does not. Go look it up, it's a "guilty until proven innocent" system, which guarantees loss to the accused, guilty or not.

hadrien01 8y ago
You obviously don't know how the EU works. If a Data Protection Agency comes to know your wrongdoings, they'll first try to resolve peacefully the matter, by telling you what you're doing wrong. Only if you persist multiple times you'll be in danger of being brought to court.
- dogma1138 8y ago
  That’s not true at least in the UK and Germany fines are issued essentially on the stop for every violation even questionable ones.
  - detaro 8y ago
    Source? From what I know, the German DPAs (they are organized on state level) hand out like 2 fines per month each, generally way below the maxima (under old German law, the max was 300000 €), and concluding the majority of cases without a fine. E.g. from the Bavarian DPA (german doc: https://www.lda.bayern.de/media/baylda_report_07.pdf https://www.lda.bayern.de/media/baylda_report_07.pdf, page 151): in the years 2015-2016 they had 173 proceedings that could involved potential fines. 52 of those resulted in fines. 34 of those fines were <1k€, 13 were <10k€.
- RobertRoberts 8y ago
  You are so wrong, Google and Facebook are already being sued, the FIRST day the law has been in effect.
  - y4mi 8y ago
    No, they aren't. There have been user complaints about them. These complaints can ultimately result in a investigation and finally a court case. That is still far off, however
    - RobertRoberts 8y ago
      Yes, they are. http://money.cnn.com/2018/05/25/technology/gdpr-compliance-facebook-google/index.html http://money.cnn.com/2018/05/25/technology/gdpr-compliance-f... >"The suit against Google alleges that users of the company's Android software are forced to turn over personal data to use an Android-powered mobile device. The lawsuit alleges this "forced consent" amounts to a violation of GDPR, which guarantees individuals the right to consent when companies want to collect and process their personal data."
      - y4mi 8y ago
        this just shows how lacking cnns quality is nowadays. It most likely will become a lawsuit in the next days/weeks, yes. But just because an investigation got started doesnt necessarily mean that it'll end in an lawsuit. This is exactly was the original post was talking about. The investigator will contact the company, look at how the company processes the data and finally - if they're willfully ignoring gdpr - open an actual case. more likely however is that the company already tried to comply and will just get a few reports of things they have to change/improve. as google probably doesn't have interest in actually upholding gdpr, the investigators will probably soon-ish open an actual suit.
        RobertRoberts 8y ago
        >this just shows how lacking cnns quality is nowadays. Do I _really_ need to link to all the other news companies saying the same thing? There are lawsuits started already.
DanBC 8y ago
> You seem to be claiming the GDPR dictates who is allowed to sue Yes, it literally does do this. Please can you point to the bit that allows anyone to sue? > Go look it up, it's a "guilty until proven innocent" system, which guarantees loss to the accused, guilty or not. Completely untrue. That would be incompatible with human rights and European law. You're scared about stuff that isn't in GDPR or that cannot happen under EU law.
- dogma1138 8y ago
  Having dealt with 2 DPAs (UK and DE) it is guilty until proven innocent I think you may be thinking of the rights of seeking damages under the GDPR which is utterly irrelevant to the core enforcement of it. I think have way too of a rosy outlook on how laws are enforced in the EU much of the enforcement is contradictory to the ideals you hold in such high regard. Charities are one of the most common targets of data protection enforcement in the EU even before the GDPR, in the UK they are collectively the sector that gets hit the most by the ICO and the picture isn’t much different on the continent and one of the main reasons for that is that they are easy targets (this does not mean they didnt do anything wrong but they are easy targets nonetheless).