4 ms·

I agree that the letter could be written in a less threatening manner, but the specific questions are required, in my opinion. If you ask someone whether they

by gnode 8y ago

I agree that the letter could be written in a less threatening manner, but the specific questions are required, in my opinion. If you ask someone whether they are complying with the law, you're likely to just get an inconsiderate "yes", with no indication they even understand the law (there is certainly plenty of misunderstanding that I have seen already, from companies large and small). Making specific questions about their business practises, such that they will have to plainly lie in order maintain a false claim of compliance is more rigorous.

jacquesm 8y ago
I would use that strategy only in a situation where the relationship is already adversarial or where some distrust is warranted. But different strokes for different folks, of course everybody is free to do what they want. But then you should be aware that a torrent of these requests are not going to help make matters better, they will just cause people to tune out and regulators to stop taking the complaints serious. It's like bringing a chainsaw to a surgery.
- delecti 8y ago
  > or where some distrust is warranted There have been enough data breaches that distrust is always warranted when a company has my data.
  - jacquesm 8y ago
    It saddens me to confirm that your viewpoint is backed up by my day to day experience looking at companies from the other side. But, and this is important, not every company sucks at this, I'd say it's about 70/30 at the moment (substantially improved from 3 years ago) when it comes to doing things right. That 30% is of course way too low but it was so much worse that that's already quite a step. This too depends very much on the company activity.
    - delecti 8y ago
      Even the companies that don't suck at it are still putting me at risk just by possessing my information. In the risk analysis, it's not that the chances of something happening are necessarily high, it's that the potential damage is high.
      - jacquesm 8y ago
        That's spot on. You can really see the difference between one company and another by asking a single question: do they treat the data they possess as a liability or as an asset?

by gnode 8y ago

jacquesm 8y ago

I would use that strategy only in a situation where the relationship is already adversarial or where some distrust is warranted. But different strokes for different folks, of course everybody is free to do what they want. But then you should be aware that a torrent of these requests are not going to help make matters better, they will just cause people to tune out and regulators to stop taking the complaints serious. It's like bringing a chainsaw to a surgery.

delecti 8y ago
> or where some distrust is warranted There have been enough data breaches that distrust is always warranted when a company has my data.
- jacquesm 8y ago
  It saddens me to confirm that your viewpoint is backed up by my day to day experience looking at companies from the other side. But, and this is important, not every company sucks at this, I'd say it's about 70/30 at the moment (substantially improved from 3 years ago) when it comes to doing things right. That 30% is of course way too low but it was so much worse that that's already quite a step. This too depends very much on the company activity.
  - delecti 8y ago
    Even the companies that don't suck at it are still putting me at risk just by possessing my information. In the risk analysis, it's not that the chances of something happening are necessarily high, it's that the potential damage is high.
    - jacquesm 8y ago
      That's spot on. You can really see the difference between one company and another by asking a single question: do they treat the data they possess as a liability or as an asset?