3 ms·

I admit that my view is somewhat US-centric but also has roots in Europe. I would challenge / I am asking: what is the real difference in the EU, that you could

I admit that my view is somewhat US-centric but also has roots in Europe. I would challenge / I am asking: what is the real difference in the EU, that you could fall back on if sued because of these letters? You have to prepare for that if you want to be responsible, right? Is it because this is not law, but rather, regulation which is only selectively enforced and suits cannot be brought by individuals but rather by central regulators that will never keep up with the avalanche? Does the EU never enforce law by the letter, so the letters are unreliable and really more like a guideline? (If so, why bother with law? Lack of EU sovereignty over member states means it won't get enforced if it's really an inconvenience anyway? Something else?

jacquesm 8y ago
> what is the real difference in the EU, that you could fall back on if sued because of these letters? This is the first part where your view of how things would likely play out and reality diverge. Under the GDPR a Data Subject whose request is not answered satisfactorily or timely could sue but that will likely go nowhere because they should direct their complaints towards the regulators, not towards the courts. > You have to prepare for that if you want to be responsible, right? No, to prepare you have to be 'in compliance', which is a different thing. Essentially you should read the law, decide which part of your operation is 'in scope' and adapt your business to reflect your understanding of the law. In case of a complaint to a regulator they may (but not necessarily) investigate and if they find transgressions they will issue some guidance on how you should achieve compliance. If upon re-testing it appears that you have not followed the guidance you will most likely be hit with a fine. If the original investigation was because of a data breach or other serious issue they may decide to fine you immediately as well. > Does the EU never enforce law by the letter, so the letters are unreliable and really more like a guideline? (If so, why bother with law? The EU tries to achieve a certain effect with the law: to make it harder for companies to wipe breaches under the carpet, to give Data Subjects more control over their data and to stop the worst excesses in the world of data brokering. So if you cross any of those you can expect enforcement. > Lack of EU sovereignty over member states means it won't get enforced if it's really an inconvenience anyway? All member states have automatically adopted the law when it went in force (April 2016). > Something else? That's up to you :)
- sailfast 8y ago
  Thank you for the thoughtful responses! As someone with experience in regulation in the United States it makes sense to me that it is at the regulator's discretion to enforce these rules so there will (necessarily) be enforcement of intent, at least for the current regime. (might change in the next one) All that said, it likely can and will be mis-used, and citizens will likely sue and cite the regulation if the regulator refuses to enforce the regulation so if I were Europe, I would try my best to prepare for such an eventuality as part of the law to reduce burden. I don't think it's alarmist to suggest this. I also don't think it is alarmist to suggest that regulators will not always be rational actors, and there are politics at play. It will be interesting to see if any blatant cases of prosecution result from crossing an EU government or leader. Fingers crossed that never happens.

jacquesm 8y ago

> what is the real difference in the EU, that you could fall back on if sued because of these letters? This is the first part where your view of how things would likely play out and reality diverge. Under the GDPR a Data Subject whose request is not answered satisfactorily or timely could sue but that will likely go nowhere because they should direct their complaints towards the regulators, not towards the courts. > You have to prepare for that if you want to be responsible, right? No, to prepare you have to be 'in compliance', which is a different thing. Essentially you should read the law, decide which part of your operation is 'in scope' and adapt your business to reflect your understanding of the law. In case of a complaint to a regulator they may (but not necessarily) investigate and if they find transgressions they will issue some guidance on how you should achieve compliance. If upon re-testing it appears that you have not followed the guidance you will most likely be hit with a fine. If the original investigation was because of a data breach or other serious issue they may decide to fine you immediately as well. > Does the EU never enforce law by the letter, so the letters are unreliable and really more like a guideline? (If so, why bother with law? The EU tries to achieve a certain effect with the law: to make it harder for companies to wipe breaches under the carpet, to give Data Subjects more control over their data and to stop the worst excesses in the world of data brokering. So if you cross any of those you can expect enforcement. > Lack of EU sovereignty over member states means it won't get enforced if it's really an inconvenience anyway? All member states have automatically adopted the law when it went in force (April 2016). > Something else? That's up to you :)

sailfast 8y ago
Thank you for the thoughtful responses! As someone with experience in regulation in the United States it makes sense to me that it is at the regulator's discretion to enforce these rules so there will (necessarily) be enforcement of intent, at least for the current regime. (might change in the next one) All that said, it likely can and will be mis-used, and citizens will likely sue and cite the regulation if the regulator refuses to enforce the regulation so if I were Europe, I would try my best to prepare for such an eventuality as part of the law to reduce burden. I don't think it's alarmist to suggest this. I also don't think it is alarmist to suggest that regulators will not always be rational actors, and there are politics at play. It will be interesting to see if any blatant cases of prosecution result from crossing an EU government or leader. Fingers crossed that never happens.