3 ms·

The GDPR seems to me to be just another example of nontechnical authorities trying to regulate what they don't understand. Why don't more technical people beco

The GDPR seems to me to be just another example of nontechnical authorities trying to regulate what they don't understand. Why don't more technical people become politicians, or at least form lobbying groups or think tanks?

DanBC 8y ago
The response to the GDPR seems to me to be a bunch of people who fundamentally misunderstand how law works, especially in Europe, and who have a pathological relationship to regulators because their own legal system is fucked beyond all recognition. GDPR requires you to only gather the data you need; only keep it for as long as you need it; tell people what you're doing with it; and allow them to correct it if it's wrong. How is that too hard?
- TomVDB 8y ago
  Read the nightmare letter. How hard is it to reply to just “a few” questions like that?
  - DanBC 8y ago
    You point people to the privacy policy. The Nightmare letter is mostly bullshit scaremongering.
- Matticus_Rex 8y ago
  ... and document every instance of processing, as well as the legal basis for processing for each use of each piece of data, and how you decided that legal basis (and if you used "legitimate interest," you need to do a LIA -- the template I use is several pages before you enter the information). Then you have to negotiate different DPA terms with a dozen clients whose privacy lawyers told them they each need a different term because we privacy professionals still have no idea what parts of this law mean. Oh, and then you have to handhold customers who think they know more about privacy law than you do because they read a 500-word rundown of the GDPR, because if you don't nicely convince them they're wrong, they'll make a complaint. There's plenty more, but you get the idea. Anyone who says implementing this law is simple isn't implementing this law in a business of normal size and complication.
  - DanBC 8y ago
    > and document every instance of processing, as well as the legal basis for processing for each use of each piece of data, and how you decided that legal basis But only if that's proportionate. https://gdpr-info.eu/art-24-gdpr/ https://gdpr-info.eu/art-24-gdpr/ > Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. 2Those measures shall be reviewed and updated where necessary. > Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.
    - Matticus_Rex 8y ago
      The bar for that is very, very low given the guidance we've received from the supervisory authorities, so that doesn't really minimize my point. An incredibly small number of businesses would be able to argue that this doesn't apply to them.
icelancer 8y ago
>> Why don't more technical people become politicians, or at least form lobbying groups or think tanks? Technical fields pay a lot more and you control most of your destiny. Politics pays nothing and you deal with bureaucracy. Hmm.
lucb1e 8y ago
> The GDPR seems to me to be just another example of nontechnical authorities trying to regulate what they don't understand. Either you are against any laws at all and believe that corporations could provide physical security and wage wars, or you are misinformed. If you gossip about me behind my back, is it wrong of me to ask what you told others about me? If you are a company sharing my data with other companies, should I not be allowed to demand to know with whom you're sharing my data? If you process personal data of millions of people, wouldn't it make sense that you have to have someone in charge of watching out for their data? If you want to track people to create profiles of them, should you not ask them whether they're actually okay with that, rather than doing it secretly? If you accidentally lose my data and hackers could be stealing my identity or using my password, should I not be told? These are the things covered by GDPR, or previously, the data protection directive, cookie law and the data leak reporting laws. For example, the previous cookie law was also deemed a stupid idea by a tech-illiterate government, because lots of websites started popping up cookie walls and everyone got annoyed. But the truth is, the websites with cookie walls are the ones who want to do extensive profiling beyond any normal visitor count trackers or login systems or whatever. Of course they should inform you about that. GDPR is not much more than common sense should already tell you to do. But since corporations are not people and do not have a collective conscience, it has to be codified in laws.

DanBC 8y ago

The response to the GDPR seems to me to be a bunch of people who fundamentally misunderstand how law works, especially in Europe, and who have a pathological relationship to regulators because their own legal system is fucked beyond all recognition. GDPR requires you to only gather the data you need; only keep it for as long as you need it; tell people what you're doing with it; and allow them to correct it if it's wrong. How is that too hard?

TomVDB 8y ago
Read the nightmare letter. How hard is it to reply to just “a few” questions like that?
- DanBC 8y ago
  You point people to the privacy policy. The Nightmare letter is mostly bullshit scaremongering.
Matticus_Rex 8y ago
... and document every instance of processing, as well as the legal basis for processing for each use of each piece of data, and how you decided that legal basis (and if you used "legitimate interest," you need to do a LIA -- the template I use is several pages before you enter the information). Then you have to negotiate different DPA terms with a dozen clients whose privacy lawyers told them they each need a different term because we privacy professionals still have no idea what parts of this law mean. Oh, and then you have to handhold customers who think they know more about privacy law than you do because they read a 500-word rundown of the GDPR, because if you don't nicely convince them they're wrong, they'll make a complaint. There's plenty more, but you get the idea. Anyone who says implementing this law is simple isn't implementing this law in a business of normal size and complication.
- DanBC 8y ago
  > and document every instance of processing, as well as the legal basis for processing for each use of each piece of data, and how you decided that legal basis But only if that's proportionate. https://gdpr-info.eu/art-24-gdpr/ https://gdpr-info.eu/art-24-gdpr/ > Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. 2Those measures shall be reviewed and updated where necessary. > Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.
  - Matticus_Rex 8y ago
    The bar for that is very, very low given the guidance we've received from the supervisory authorities, so that doesn't really minimize my point. An incredibly small number of businesses would be able to argue that this doesn't apply to them.

icelancer 8y ago

>> Why don't more technical people become politicians, or at least form lobbying groups or think tanks? Technical fields pay a lot more and you control most of your destiny. Politics pays nothing and you deal with bureaucracy. Hmm.

lucb1e 8y ago

> The GDPR seems to me to be just another example of nontechnical authorities trying to regulate what they don't understand. Either you are against any laws at all and believe that corporations could provide physical security and wage wars, or you are misinformed. If you gossip about me behind my back, is it wrong of me to ask what you told others about me? If you are a company sharing my data with other companies, should I not be allowed to demand to know with whom you're sharing my data? If you process personal data of millions of people, wouldn't it make sense that you have to have someone in charge of watching out for their data? If you want to track people to create profiles of them, should you not ask them whether they're actually okay with that, rather than doing it secretly? If you accidentally lose my data and hackers could be stealing my identity or using my password, should I not be told? These are the things covered by GDPR, or previously, the data protection directive, cookie law and the data leak reporting laws. For example, the previous cookie law was also deemed a stupid idea by a tech-illiterate government, because lots of websites started popping up cookie walls and everyone got annoyed. But the truth is, the websites with cookie walls are the ones who want to do extensive profiling beyond any normal visitor count trackers or login systems or whatever. Of course they should inform you about that. GDPR is not much more than common sense should already tell you to do. But since corporations are not people and do not have a collective conscience, it has to be codified in laws.