3 ms·

>For example, one of the major burdens on small businesses is the cost of producing the data the company has on you -- but there is a simple way to fix that. Re

>For example, one of the major burdens on small businesses is the cost of producing the data the company has on you -- but there is a simple way to fix that. Require the requester to pay the cost of collecting the information, similar to FOIA requests in the US. Then the requirement is no longer an unfunded mandate and can't be used by griefers as a method of harassment. If you can't cheaply and quickly respond to a subject access request, then you're probably breaching several other parts of GDPR. How would you respond to a deletion request under Article 17, a restriction of processing request under Article 18, a portability request under Article 20 or an objection under Article 21? Compliance with all of those requirements necessitates clear documentation of how you're processing personal data. If you don't have that documentation, how can you comply with the stewardship and security requirements of Articles 24, 25 and 32? How will you comply with the record-keeping requirements of Article 30 and the impact assessment requirements of Article 35? If you have a data breach, how will you be able to properly fulfil your notification requirements under Articles 33 and 34? How can you be confident that you're abiding by the general principles laid out in Chapter 2? Processing personal data is a serious responsibility with potentially grave risks. If you have been taking that responsibility seriously (and been in compliance with the 1995 Data Protection Directive), then complying with the GDPR is relatively straightforward. If you just copy-pasted a privacy policy and gave no real thought to data protection while hoovering up tons of potentially sensitive personal data, then compliance will be a painful and expensive process. Being a small business doesn't give you the right to be negligent. Not under the GDPR and not under any of the other laws governing businesses. If you don't have the expertise to comply with data protection law, you need to delegate those tasks to someone who is suitably qualified. If the scale and complexity of your processing activities makes compliance impossible, then the EU would very much prefer that you find a different business model or stop doing business with their citizens.

AnthonyMouse 8y ago
> Being a small business doesn't give you the right to be negligent. I can't understand this attitude that it's negligence to not want to be bankrupted by poorly crafted regulations. We're dealing with things like a website to sell wood carvings that someone makes as a hobby. They've got names and addresses because they need to know where to ship them. This is not a reasonable place to apply a complex regulatory framework. The idea that this involves "serious responsibility" or "grave risks" is akin to applying a regulatory framework designed for an oil refinery to a garage sale because a used lawnmower may contain some "hazardous" motor oil. It's not that the danger isn't theoretically possible, it's that the regulatory requirements are totally inappropriate to the context.
- jdietrich 8y ago
  >This is not a reasonable place to apply a complex regulatory framework. The idea that this involves "serious responsibility" or "grave risks" is akin to applying a regulatory framework designed for an oil refinery to a garage sale because a used lawnmower may contain some "hazardous" motor oil. You're subject to exactly the same regulations on health and safety and hazardous materials handling. The steps you need to take are smaller and simpler, because the scope of your activities are smaller and less hazardous. You're not allowed to take the guards off your machine tools or pour motor oil down the drain just because you're a small shop. Same with GDPR. If you're a small company that sells wood carvings, you don't need to do very much to comply. If you're a small company that maintains a blacklist of construction workers, you're in deep trouble. https://en.wikipedia.org/wiki/Consulting_Association https://en.wikipedia.org/wiki/Consulting_Association
  - AnthonyMouse 8y ago
    > You're subject to exactly the same regulations on health and safety and hazardous materials handling. It's appropriate to have special requirements for large scale operations, e.g. to have fire suppression systems with regular inspections, an assigned safety officer with specific training, material safety data sheets, site zoning requirements and so on. None of that is appropriate for someone who just has some motor oil in their garage. And the requirements that are appropriate -- the small subset like not pouring motor oil down the drain -- are easy to understand and consist of a simple prohibition rather than an unfunded mandate to affirmatively take specific actions. > If you're a small company that sells wood carvings, you don't need to do very much to comply. If that were true there wouldn't be small companies writing off the EU because of the compliance costs.

AnthonyMouse 8y ago

> Being a small business doesn't give you the right to be negligent. I can't understand this attitude that it's negligence to not want to be bankrupted by poorly crafted regulations. We're dealing with things like a website to sell wood carvings that someone makes as a hobby. They've got names and addresses because they need to know where to ship them. This is not a reasonable place to apply a complex regulatory framework. The idea that this involves "serious responsibility" or "grave risks" is akin to applying a regulatory framework designed for an oil refinery to a garage sale because a used lawnmower may contain some "hazardous" motor oil. It's not that the danger isn't theoretically possible, it's that the regulatory requirements are totally inappropriate to the context.

jdietrich 8y ago
>This is not a reasonable place to apply a complex regulatory framework. The idea that this involves "serious responsibility" or "grave risks" is akin to applying a regulatory framework designed for an oil refinery to a garage sale because a used lawnmower may contain some "hazardous" motor oil. You're subject to exactly the same regulations on health and safety and hazardous materials handling. The steps you need to take are smaller and simpler, because the scope of your activities are smaller and less hazardous. You're not allowed to take the guards off your machine tools or pour motor oil down the drain just because you're a small shop. Same with GDPR. If you're a small company that sells wood carvings, you don't need to do very much to comply. If you're a small company that maintains a blacklist of construction workers, you're in deep trouble. https://en.wikipedia.org/wiki/Consulting_Association https://en.wikipedia.org/wiki/Consulting_Association
- AnthonyMouse 8y ago
  > You're subject to exactly the same regulations on health and safety and hazardous materials handling. It's appropriate to have special requirements for large scale operations, e.g. to have fire suppression systems with regular inspections, an assigned safety officer with specific training, material safety data sheets, site zoning requirements and so on. None of that is appropriate for someone who just has some motor oil in their garage. And the requirements that are appropriate -- the small subset like not pouring motor oil down the drain -- are easy to understand and consist of a simple prohibition rather than an unfunded mandate to affirmatively take specific actions. > If you're a small company that sells wood carvings, you don't need to do very much to comply. If that were true there wouldn't be small companies writing off the EU because of the compliance costs.