5 ms·

The letters are FUD. Take a look at the process: https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-role-edpb_en.pdf https://

The letters are FUD. Take a look at the process: https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-role-edpb_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d...

jacquesm 8y ago
Please stop spreading incorrect (and identical) advice all over this thread. https://news.ycombinator.com/item?id=17178562 https://news.ycombinator.com/item?id=17178562
- ainiriand 8y ago
  I only want to help users and creators. They should not be afraid of the GDPR. There is a lot of FUD around this topic and I guess that most of the people didn't even read the law. But I'm gonna take your advice anyways. There is plenty of information already for anyone concerned.
  - JumpCrisscross 8y ago
    You’re spreading patently false information. After being corrected in one thread, you repeat it in another. I’ve read the law, myself and with a lawyer. This is complicated stuff. Ignoring letters is a bad idea.
dnomad 8y ago
The letters aren't even smart FUD. This sort of stuff gets made up by dumb people to validate the fears of other dumb people. It's a kind of self-propaganda. The idea that rando customers can ask for arbitrary information like backup policies and safe-guards or the location of your servers is just silly. The SARs have clear, well-defined limits [1] and the response can and should be automated (once identity has been verified). [1] https://ico.org.uk/media/for-organisations/documents/2014223.. https://ico.org.uk/media/for-organisations/documents/2014223....
- czardoz 8y ago
  > The idea that rando customers can ask for arbitrary information like backup policies and safe-guards or the location of your servers is just silly. Why is this silly? Does the law explicitly forbid people from asking stuff like this?
  - JumpCrisscross 8y ago
    > Does the law explicitly forbid people from asking stuff like this? No. The expectation is each of the EU’s twenty-eight national data regulators will be nice and reasonable into perpetuity.
  - TheCoelacanth 8y ago
    Anyone is allowed for ask for anything. In context, they are clearly talking about which requests you are required to answer.
- jacquesm 8y ago
  In a legitimate - not trolling - exchange I could see a situation where asking about back-up policies is valid. For instance, a company could have had a breach where backups were involved. But the letter has been carefully worded as a DSAR, a Data Subject Access Request and throws in some cover in terms of concerns the user might legitimately have. So you can't just ignore this letter. The safe guards question would be valid in that context as well but not right of the bat in a first exchange, but if a previous answer left something specific unsaid. The location of the servers is a valid request depending on the context, for instance when the data is sufficiently critical to be legally mandated that it stays within the EU (yes, there is such data). Agreed on the automated response, that's the best way to handle this. Again, this is a troll letter, but even so it still requires a response otherwise you give the claimant grounds for forwarding their complaint to the regulators (who likely will ignore it but I'd play it safe).
rostigerpudel 8y ago
Would you kindly elaborate on which part of that link is relevant to this kind of letter? The PDF there only relates to what a citizen can do when you don't answer the letter. How does that make the letter irrelevant? Responding to the letter rather seems to be the first countermeasure against the authorities' involvement...

jacquesm 8y ago

Please stop spreading incorrect (and identical) advice all over this thread. https://news.ycombinator.com/item?id=17178562 https://news.ycombinator.com/item?id=17178562

ainiriand 8y ago
I only want to help users and creators. They should not be afraid of the GDPR. There is a lot of FUD around this topic and I guess that most of the people didn't even read the law. But I'm gonna take your advice anyways. There is plenty of information already for anyone concerned.
- JumpCrisscross 8y ago
  You’re spreading patently false information. After being corrected in one thread, you repeat it in another. I’ve read the law, myself and with a lawyer. This is complicated stuff. Ignoring letters is a bad idea.

dnomad 8y ago

The letters aren't even smart FUD. This sort of stuff gets made up by dumb people to validate the fears of other dumb people. It's a kind of self-propaganda. The idea that rando customers can ask for arbitrary information like backup policies and safe-guards or the location of your servers is just silly. The SARs have clear, well-defined limits [1] and the response can and should be automated (once identity has been verified). [1] https://ico.org.uk/media/for-organisations/documents/2014223.. https://ico.org.uk/media/for-organisations/documents/2014223....

czardoz 8y ago
> The idea that rando customers can ask for arbitrary information like backup policies and safe-guards or the location of your servers is just silly. Why is this silly? Does the law explicitly forbid people from asking stuff like this?
- JumpCrisscross 8y ago
  > Does the law explicitly forbid people from asking stuff like this? No. The expectation is each of the EU’s twenty-eight national data regulators will be nice and reasonable into perpetuity.
- TheCoelacanth 8y ago
  Anyone is allowed for ask for anything. In context, they are clearly talking about which requests you are required to answer.
jacquesm 8y ago
In a legitimate - not trolling - exchange I could see a situation where asking about back-up policies is valid. For instance, a company could have had a breach where backups were involved. But the letter has been carefully worded as a DSAR, a Data Subject Access Request and throws in some cover in terms of concerns the user might legitimately have. So you can't just ignore this letter. The safe guards question would be valid in that context as well but not right of the bat in a first exchange, but if a previous answer left something specific unsaid. The location of the servers is a valid request depending on the context, for instance when the data is sufficiently critical to be legally mandated that it stays within the EU (yes, there is such data). Agreed on the automated response, that's the best way to handle this. Again, this is a troll letter, but even so it still requires a response otherwise you give the claimant grounds for forwarding their complaint to the regulators (who likely will ignore it but I'd play it safe).

rostigerpudel 8y ago

Would you kindly elaborate on which part of that link is relevant to this kind of letter? The PDF there only relates to what a citizen can do when you don't answer the letter. How does that make the letter irrelevant? Responding to the letter rather seems to be the first countermeasure against the authorities' involvement...