4 ms·

It seems like a lot of the comments are about one issue: - do you believe generally, even for an “upstanding” company you’ve done business with for a while, th

by mlthoughts2018 8y ago

It seems like a lot of the comments are about one issue: - do you believe generally, even for an “upstanding” company you’ve done business with for a while, that commercial entities can be trusted with your data? If yes, you’ll see the template as overbearing and needlessly aggressive outside the context of some specific incident when a company proved to be untrustworthy. Especially if you operate a side project or business of your own, and believe you personally would not abuse consumer data collection, you’ll see it as rude in the best case, trollish resource wasting in the worst case. If you’re a consumer with a general mistrust of all commercial entities, even “upstanding” ones, when it comes to data practices, or if you just happen to believe that the potential risks for data abuse or harm are too high to be offset by anyone’s good intentions or past good behavior, then you’ll see this as a reasonable template, perhaps needing a few modifications for differing contexts, and that jumping straight away to legalese boilerplate just has to be assumed necessary when dealing with self-interested commercial entities.

jacquesm 8y ago
Sending boilerplate almost guarantees that a regulator will put your request at the bottom of the pile if you decide to take it to the next level unless the company responds in a way that shows their contempt for the law.
- mlthoughts2018 8y ago
  I think that will depend on how seriously GDPR non-compliance is treated. I’m hopeful some big corps will be heavily fined to set precedent and to ease concerns that GDPR is a mild form of regulatory capture intended to be misused (regardless of its wording) to asymmetrically inhibit new entrants and small firms.
  - ggg9990 8y ago
    But that’s what the big corps want. They’d gladly each cough up a billion for a permanent state where market entry is harder. Especially the easy to disrupt consumer services like Facebook and Snapchat.
- evancox100 8y ago
  What? That doesn't make any sense. The regulator would only care that you sent a valid request.
  - jacquesm 8y ago
    Boilerplate says that you don't care to even bother write a specific letter with your specific questions. Going on the assumption that the regulators will receive a large volume of complaints they will do what every overwhelmed institution does: Triage. - which requests can we get rid of immediately? - which requests are definitely legitimate? - which requests are borderline? but will need work? The boilerplate letters will - unless the boilerplate contains major errors - fall in the third category. It is my expectation that most enforcement in the first period will come from the second category, and in those cases where enough people each individually expended some effort on their complaint to the regulator.
    - mlthoughts2018 8y ago
      That might be true, or you might feel that your request is entirely general in nature -- you are generally concerned about how your data is used, collected, or sold by a given company, even though, at this moment, you have no specific complaint. Maybe you heard about how a similar company in the same industry did something bad, and you just want to be cautious and check. Yes, you might modify the tone of the template for the context of that situation. But you might still use a template because you believe it gives you the best way to be sure that the request uses adequate language to constitute a properly formatted and comprehensive request (short of taking your draft request to your personal attorney and paying them for advice). Your point is not wrong, but there still might be cases when someone satisfies both (a) not basing their GDPR inquiry on a specific incident or mistreatment that they know of, only on general skepticism or due diligence to get a comprehensive understanding of how the data is used. (b) still wants to use a template to have reasonable confidence it is a well-formed and comprehensive request without needing to pay an attorney to draft it or advise them on their own draft.

jacquesm 8y ago

Sending boilerplate almost guarantees that a regulator will put your request at the bottom of the pile if you decide to take it to the next level unless the company responds in a way that shows their contempt for the law.

mlthoughts2018 8y ago
I think that will depend on how seriously GDPR non-compliance is treated. I’m hopeful some big corps will be heavily fined to set precedent and to ease concerns that GDPR is a mild form of regulatory capture intended to be misused (regardless of its wording) to asymmetrically inhibit new entrants and small firms.
- ggg9990 8y ago
  But that’s what the big corps want. They’d gladly each cough up a billion for a permanent state where market entry is harder. Especially the easy to disrupt consumer services like Facebook and Snapchat.
evancox100 8y ago
What? That doesn't make any sense. The regulator would only care that you sent a valid request.
- jacquesm 8y ago
  Boilerplate says that you don't care to even bother write a specific letter with your specific questions. Going on the assumption that the regulators will receive a large volume of complaints they will do what every overwhelmed institution does: Triage. - which requests can we get rid of immediately? - which requests are definitely legitimate? - which requests are borderline? but will need work? The boilerplate letters will - unless the boilerplate contains major errors - fall in the third category. It is my expectation that most enforcement in the first period will come from the second category, and in those cases where enough people each individually expended some effort on their complaint to the regulator.
  - mlthoughts2018 8y ago
    That might be true, or you might feel that your request is entirely general in nature -- you are generally concerned about how your data is used, collected, or sold by a given company, even though, at this moment, you have no specific complaint. Maybe you heard about how a similar company in the same industry did something bad, and you just want to be cautious and check. Yes, you might modify the tone of the template for the context of that situation. But you might still use a template because you believe it gives you the best way to be sure that the request uses adequate language to constitute a properly formatted and comprehensive request (short of taking your draft request to your personal attorney and paying them for advice). Your point is not wrong, but there still might be cases when someone satisfies both (a) not basing their GDPR inquiry on a specific incident or mistreatment that they know of, only on general skepticism or due diligence to get a comprehensive understanding of how the data is used. (b) still wants to use a template to have reasonable confidence it is a well-formed and comprehensive request without needing to pay an attorney to draft it or advise them on their own draft.