5 ms·

I like how the article starts with "the nightmare letter is clearly a troll attempt we need to deal with" and closes with "actually, those are are all valid an

by zwaps 8y ago

I like how the article starts with "the nightmare letter is clearly a troll attempt we need to deal with" and closes with "actually, those are are all valid and reasonable questions that you should have answers to if you were not breaking the law in the last five years. Answering them automatically should be easy If you, no matter what company size, are not dependent on illegally and immorally profiting from personal data, then GDPR may even be good for you." hehehehehehehe

jacquesm 8y ago
The letter is clearly a troll attempt because it is engineered to inflict maximum damage even if the claimant has no use for a lot of the information they are requesting. Even so, in isolation and moderation the questions make good sense and answering them properly using an automated system and an updated privacy policy should not be a huge burden.
- GiuseppaAcciaio 8y ago
  I've been involved in the GDPR-proofing of the company that employs me in the UK, and find that the questions are the same that our consultants put to us when identifying where we stood. Based on my experience (medium sized manufacturing company) I think that the letter really becomes a nightmare when the company receiving it has not looked into it at all, or when their business model relies on being able to ignore consent from users for their processing; in other cases, and especially for any company that sells to businesses rather than individuals, GDPR compliance is really not that bad IMO.
- gnode 8y ago
  I don't agree that this is trolling, even if it is a fishing expedition. The primary purpose appears to be to probe for GDPR compliance, which is a valid expectation of customers and prospective customers (Europeans at least).
  - jacquesm 8y ago
    You can probe for GDPR compliance without inflicting a large amount of work on the counterparty, assuming that you are on friendly terms. For instance, if you wish to know if they are GDPR compliant you could ask them something along the lines of "Hello there dear valued business relationship, I would like to know if you are aware of the changes in legislation re. privacy and if so whether or not you are at present compliant with that law and if not if you have a time-table when you will be'. To ask for the maximum under threat of reporting a party to the regulator is not aligned with 'probing for GDPR compliance'.
    - fotbr 8y ago
      That request gets vague promises, with no proof that the entity is following through with them. Asking for the maximum shows you exactly how compliant an entity is.
      - jacquesm 8y ago
        No, that request should get you some fairly precise answers. If the answers are unsatisfactory then you always have the option to escalate, and it will actually help you if you do in the end decide to lodge a complaint with the regulators. As it stands it's clearly an attempt at causing the wheels to grind to a halt, the title of the request and the context in which it has been presented are evidence of that as is the faux concern laced through the letter. This is not a request made in good faith.
    - mlthoughts2018 8y ago
      In some cases, like having received email communication from a business I’ve never used, never provided my email to, and never consented to receive promotional emails from, the situation starts out unfriendly from the very beginning. It that case, I want to know about all the data that company has regarding me, and how they got it. Most likely I also want them to delete it too. Given that their first communication with me is totally unsolicited email marketing, it seems reasonable that if I can reach for a legalese template for a GDPR request, and that raises the chances they’ll take me seriously, then it would be a good thing, almost the precise opposite of trolling (which is more or less what the company was doing by attempting to get data about me in the first place). And I truly don’t have sympathy for companies like this if they find that answering GDPR requests takes up a lot of their time and they lose money as a result. That is literally the only way they will care about data privacy. I agree that this template could be used for trolling, but there are so many valid, positive outcomes that could be made easier by such a template that I think it’s unimportant to focus on possible trolling until it becomes a material problem. In fact, this just gives companies a way to disingenuously whine about GDPR to legislators. “Look how many troll requests are clogging our system!” When really, many templated requests aren’t troll requests.
- wlll 8y ago
  > even if the claimant has no use for a lot of the information they are requesting. It's not about wether the information is useful or not, it's about seeing what a company has. If I get some unsolicited comms from a company then I'm going to want to get information about all the data they hold on me, preferably including where they got it from and where they sent it to.
  - jacquesm 8y ago
    Then you ask that without resorting to threats of reporting someone to the regulators unless that is your whole goal. Keep in mind that the writer of the letter claims he/she is a 'customer of the company', so a friendly relationship, not a hostile one like the one that you are describing. Those are totally different situations and different strategies apply.
    - wlll 8y ago
      The only thing that could be called a "threat" that I saw (and I may have missed some instances) was: > I would like you to be aware at the outset, that I anticipate reply to my request within one month as required under Article 12, failing which I will be forwarding my inquiry with a letter of complaint to the <appropriate data protection authority>. and I don't really see that as a threat, more of a "directing of the proceedings". I mean, it's fact. If some company doesn't respond in the way I think they should to then that's exactly what I will be doing. This isn't a love letter, I don't see any harm in stating fact about this. I can totally see how it could be taken either way though. I also agree the letter is going after everything, and everything is going to be painful for companies, but for me personally the pain is going to be a byproduct of wanting to know everything. To be clear, companies that have made efforts to comply with GDPR that I've directly engaged with I'm not interested in and am going to leave alone, but the next unsolicited email from a recruiter I get will start a cascade of access then deletion requests up to the point where my information entered the system, painful or not.
      - jacquesm 8y ago
        If you have a relationship with a company that is otherwise in good standing this is a fishing expedition based on false concern, and clearly a trolling attempt. If you have an actual reason based on some evidence that something is not ok then yes, by all means go for it. But if that's not the case all this letter does is to try to get the company to waste time and resources on it, effectively devaluating the GDPR.
- newsbinator 8y ago
  If you're allowed to use the smartest engineers and the cleverest algorithms to process as much data about me as possible to create perfect ads, and if that's not trolling... then neither is it trolling to ask what you've been up to.
  - jacquesm 8y ago
    That depends on what your motivations are. If you are just interested then that's all fine and good, if you have a legitimate issue with a company then too you are in the clear. But if all you want to do is cause work 'just because you can' then you're on a fishing expedition without an actual cause. The claimant in the letter is clearly aware of that and how it would make them look in the eyes of the regulators if they were to forward a complaint hence the 'set up' at the beginning of the letter indicating some kind of faux concern in spite of being a 'customer'. The dissonance there is pretty strong, if I'm a customer of a company in good standing this is not how I would address them.
  - cm2012 8y ago
    Facebook and Google can be expected to answer this letter. 99.99% of other companies do not have the smartest engineers et al.
    - mlthoughts2018 8y ago
      But they all told me they only hire the smartest engineers, and that’s why I had to derive 256-ary Judy tree implementations on the whiteboard. Someone is lying!
    - newsbinator 8y ago
      I know it's not black and white at all. But it feels to me that if I'm processing personal data about my users, then it's reasonable for them to ask what it is and where it is. There are overheads that come with doing business. GDPR is going to shake out some of the companies that are competent at using personal data but incompetent at telling people what it is and where it's stored.
- mikekchar 8y ago
  I saw this letter quite a while ago (maybe a month ago) in the context of "When you are preparing for GDPR, you should be able to answer these questions". In other words, it was a self test to help you determine whether or not you were fooling yourself about being ready for GDPR. If people are actually using them as data requests, it's very unfortunate.
  - rejschaap 8y ago
    Yes, it is linked in the article and it was discussed here as well: https://news.ycombinator.com/item?id=16606629 https://news.ycombinator.com/item?id=16606629
- eadmund 8y ago
  The law was engineered to inflict maximum damage. Look, we all know that you think the GDPR is a great idea, but a law which can't be used to its full extent is IMHO not a great law. I agree with the goals of the GDPR: they're laudable. But its details & its implementation are, quite simply, wrong. You don't install a self-destruct mechanism which can be triggered by just pushing a single un-guarded button. Likewise, you don't pass a law which can inflict grave economic harm just by sending a letter.
  - tremon 8y ago
    The law was engineered to inflict maximum damage for abuse of personal data. This letter is designed to inflict maximum administrative paperwork without first establishing whether abuse has taken place. Also, "grave economic harm" cannot be dealt with such a simple letter. The maximum fine cannot be levied by individuals, only regulators, and they will not do so for individual cases.
  - salvar 8y ago
    How long has GDPR been in effect for? Do you generally think that's a long enough time to make the judgments you're making here?
  - blub 8y ago
    Given the involved scale, corporate lobbying and stated goals, this was the best that could be done. It's probably not even possible to create a great law. The industry that can't even agree on something as simple as coding guidelines is suddenly screaming that the law isn't good (enough).
deleted 8y ago
[deleted]

by zwaps 8y ago

jacquesm 8y ago

The letter is clearly a troll attempt because it is engineered to inflict maximum damage even if the claimant has no use for a lot of the information they are requesting. Even so, in isolation and moderation the questions make good sense and answering them properly using an automated system and an updated privacy policy should not be a huge burden.

GiuseppaAcciaio 8y ago
I've been involved in the GDPR-proofing of the company that employs me in the UK, and find that the questions are the same that our consultants put to us when identifying where we stood. Based on my experience (medium sized manufacturing company) I think that the letter really becomes a nightmare when the company receiving it has not looked into it at all, or when their business model relies on being able to ignore consent from users for their processing; in other cases, and especially for any company that sells to businesses rather than individuals, GDPR compliance is really not that bad IMO.
gnode 8y ago
I don't agree that this is trolling, even if it is a fishing expedition. The primary purpose appears to be to probe for GDPR compliance, which is a valid expectation of customers and prospective customers (Europeans at least).
- jacquesm 8y ago
  You can probe for GDPR compliance without inflicting a large amount of work on the counterparty, assuming that you are on friendly terms. For instance, if you wish to know if they are GDPR compliant you could ask them something along the lines of "Hello there dear valued business relationship, I would like to know if you are aware of the changes in legislation re. privacy and if so whether or not you are at present compliant with that law and if not if you have a time-table when you will be'. To ask for the maximum under threat of reporting a party to the regulator is not aligned with 'probing for GDPR compliance'.
  - fotbr 8y ago
    That request gets vague promises, with no proof that the entity is following through with them. Asking for the maximum shows you exactly how compliant an entity is.
    - jacquesm 8y ago
      No, that request should get you some fairly precise answers. If the answers are unsatisfactory then you always have the option to escalate, and it will actually help you if you do in the end decide to lodge a complaint with the regulators. As it stands it's clearly an attempt at causing the wheels to grind to a halt, the title of the request and the context in which it has been presented are evidence of that as is the faux concern laced through the letter. This is not a request made in good faith.
  - mlthoughts2018 8y ago
    In some cases, like having received email communication from a business I’ve never used, never provided my email to, and never consented to receive promotional emails from, the situation starts out unfriendly from the very beginning. It that case, I want to know about all the data that company has regarding me, and how they got it. Most likely I also want them to delete it too. Given that their first communication with me is totally unsolicited email marketing, it seems reasonable that if I can reach for a legalese template for a GDPR request, and that raises the chances they’ll take me seriously, then it would be a good thing, almost the precise opposite of trolling (which is more or less what the company was doing by attempting to get data about me in the first place). And I truly don’t have sympathy for companies like this if they find that answering GDPR requests takes up a lot of their time and they lose money as a result. That is literally the only way they will care about data privacy. I agree that this template could be used for trolling, but there are so many valid, positive outcomes that could be made easier by such a template that I think it’s unimportant to focus on possible trolling until it becomes a material problem. In fact, this just gives companies a way to disingenuously whine about GDPR to legislators. “Look how many troll requests are clogging our system!” When really, many templated requests aren’t troll requests.
wlll 8y ago
> even if the claimant has no use for a lot of the information they are requesting. It's not about wether the information is useful or not, it's about seeing what a company has. If I get some unsolicited comms from a company then I'm going to want to get information about all the data they hold on me, preferably including where they got it from and where they sent it to.
- jacquesm 8y ago
  Then you ask that without resorting to threats of reporting someone to the regulators unless that is your whole goal. Keep in mind that the writer of the letter claims he/she is a 'customer of the company', so a friendly relationship, not a hostile one like the one that you are describing. Those are totally different situations and different strategies apply.
  - wlll 8y ago
    The only thing that could be called a "threat" that I saw (and I may have missed some instances) was: > I would like you to be aware at the outset, that I anticipate reply to my request within one month as required under Article 12, failing which I will be forwarding my inquiry with a letter of complaint to the <appropriate data protection authority>. and I don't really see that as a threat, more of a "directing of the proceedings". I mean, it's fact. If some company doesn't respond in the way I think they should to then that's exactly what I will be doing. This isn't a love letter, I don't see any harm in stating fact about this. I can totally see how it could be taken either way though. I also agree the letter is going after everything, and everything is going to be painful for companies, but for me personally the pain is going to be a byproduct of wanting to know everything. To be clear, companies that have made efforts to comply with GDPR that I've directly engaged with I'm not interested in and am going to leave alone, but the next unsolicited email from a recruiter I get will start a cascade of access then deletion requests up to the point where my information entered the system, painful or not.
    - jacquesm 8y ago
      If you have a relationship with a company that is otherwise in good standing this is a fishing expedition based on false concern, and clearly a trolling attempt. If you have an actual reason based on some evidence that something is not ok then yes, by all means go for it. But if that's not the case all this letter does is to try to get the company to waste time and resources on it, effectively devaluating the GDPR.
newsbinator 8y ago
If you're allowed to use the smartest engineers and the cleverest algorithms to process as much data about me as possible to create perfect ads, and if that's not trolling... then neither is it trolling to ask what you've been up to.
- jacquesm 8y ago
  That depends on what your motivations are. If you are just interested then that's all fine and good, if you have a legitimate issue with a company then too you are in the clear. But if all you want to do is cause work 'just because you can' then you're on a fishing expedition without an actual cause. The claimant in the letter is clearly aware of that and how it would make them look in the eyes of the regulators if they were to forward a complaint hence the 'set up' at the beginning of the letter indicating some kind of faux concern in spite of being a 'customer'. The dissonance there is pretty strong, if I'm a customer of a company in good standing this is not how I would address them.
- cm2012 8y ago
  Facebook and Google can be expected to answer this letter. 99.99% of other companies do not have the smartest engineers et al.
  - mlthoughts2018 8y ago
    But they all told me they only hire the smartest engineers, and that’s why I had to derive 256-ary Judy tree implementations on the whiteboard. Someone is lying!
  - newsbinator 8y ago
    I know it's not black and white at all. But it feels to me that if I'm processing personal data about my users, then it's reasonable for them to ask what it is and where it is. There are overheads that come with doing business. GDPR is going to shake out some of the companies that are competent at using personal data but incompetent at telling people what it is and where it's stored.
mikekchar 8y ago
I saw this letter quite a while ago (maybe a month ago) in the context of "When you are preparing for GDPR, you should be able to answer these questions". In other words, it was a self test to help you determine whether or not you were fooling yourself about being ready for GDPR. If people are actually using them as data requests, it's very unfortunate.
- rejschaap 8y ago
  Yes, it is linked in the article and it was discussed here as well: https://news.ycombinator.com/item?id=16606629 https://news.ycombinator.com/item?id=16606629
eadmund 8y ago
The law was engineered to inflict maximum damage. Look, we all know that you think the GDPR is a great idea, but a law which can't be used to its full extent is IMHO not a great law. I agree with the goals of the GDPR: they're laudable. But its details & its implementation are, quite simply, wrong. You don't install a self-destruct mechanism which can be triggered by just pushing a single un-guarded button. Likewise, you don't pass a law which can inflict grave economic harm just by sending a letter.
- tremon 8y ago
  The law was engineered to inflict maximum damage for abuse of personal data. This letter is designed to inflict maximum administrative paperwork without first establishing whether abuse has taken place. Also, "grave economic harm" cannot be dealt with such a simple letter. The maximum fine cannot be levied by individuals, only regulators, and they will not do so for individual cases.
- salvar 8y ago
  How long has GDPR been in effect for? Do you generally think that's a long enough time to make the judgments you're making here?
- blub 8y ago
  Given the involved scale, corporate lobbying and stated goals, this was the best that could be done. It's probably not even possible to create a great law. The industry that can't even agree on something as simple as coding guidelines is suddenly screaming that the law isn't good (enough).

deleted 8y ago

[deleted]