3 ms·

Seems like the GDPR is working as expected. If your company can't be bothered to apply some common sense to handling user data (which is what the GDPR is mostly

by CrLf 8y ago

Seems like the GDPR is working as expected. If your company can't be bothered to apply some common sense to handling user data (which is what the GDPR is mostly about, if you take a couple of hours to actually read it), then we're better off without it. I'm sure if what you're doing is relevant, some other company will happily take your place.

Silhouette 8y ago
If your company can't be bothered to apply some common sense to handling user data Which of the specific points the GP mentioned do you think is about how they handle user data? As far as I can see, every one of them is administrative in nature. They're not saying they're going to be tracking everyone in shady ways. They're not saying they're going to be storing unencrypted details and unhashed passwords. They're not saying they're going to be forwarding your every secret to a Sith lord. They are saying they don't have time to respond to a legal DoS if someone sends them a letter obviously written in bad faith, and they are saying they don't have the resources for their startup to police every major service they depend on. I imagine almost any startup would be in the same position. As it happens, this person also seems to have some common misunderstandings about their obligations and may be over-estimating the actual risks. That also happens when you write this kind of law, and as we see here, the chilling effect is real.
- lenlorijn 8y ago
  Well, for example, one of the mentioned points is about sending PII to a 3rd party where the startup didn't read the 3rd party's privacy policy. So how would the startup be able to accurately present me with information on how my data will be used if they don't even know? I think having an accurate and updated privacy policy is common sense handling of data, wouldn't you agree?
  - Silhouette 8y ago
    That's a reasonable point, but it's also reasonable to observe that businesses rely on other businesses all the time. As a small business, you usually have little meaningful oversight of the internal processes of outside services you use. You don't get to audit your bank's finances to make sure they're safe to trust with your money. You don't get to review your lawyer's office security arrangements to make sure no-one can break in and steal confidential data about your contracts. You don't get to review which products your office cleaning firm uses. At some point, you just have to trust that they do a decent job, and you change who you work with if you have reason to believe they aren't doing that. If a privacy regime is going to have any value in practice, it has to work on the same basis. The emphasis has to be ensuring that each individual or organisation who actually knows about the way data is being processed and has the ability to influence that processing is behaving reasonably. Then you can have some sort of trust framework that can actually mean something, from the data subject to their direct contacts and right on through to the indirect service providers however far the chain goes. The rest is just CYA and box-ticking, no matter how many laws you write or what penalties you threaten.
    - simion314 8y ago
      > You don't get to review which products your office cleaning firm uses. Seems a bad analogy, do you make a contract with them but not read it? I mean in the contract you will specify what cleaning products can or should be used(like in some hospitals strong cleaning products must be supplied and you ask for those in the contract if the supplier gives you bad quality ones then sure it is not your fault but it is your fault if you don't even want to read the contract terms) I imagine the OP was thinking that he wants to embed in his pages some analytics or similar scripts, maybe some advertising scripts, use a few third party APIs and it seems a lot of work for him. At least his US customers can now know that their data are could be shared with many third parties that could have weird terms like those third parties could sell it further.
      - Klathmon 8y ago
        Okay, but do you ensure the manufacturer of those cleaning supplies is making them correctly? Do you test the products coming from that facility to ensure they are of sufficent quality before allowing them to be used by your office cleaning firm? And do you vet the ingredients that the manufacturing facility uses to ensure they are pure and safe? Because the commenter above makes a fantastic point that I hadn't thought about before, the GDPR requires that kind of knowledge and verification of user data. Not just in your company, not just in the companies you work with, but the companies they work with, and the ones that they work with, and so on. It's akin to requiring the gas station to post legal notices that the computers it uses for the POS system are manufactured by a company which has verified that the parts that it uses were sourced from a place which was able to check that the materials used were mined by a company that treats their employees safely. (i'm not against something like the GDPR, but I do feel it goes a bit too far in a handful of areas)
        simion314 8y ago
        No, my point was about the OP that said he does not have the time to read the TOS of the third parties he uses. About the cleaning example if you had a contract that asked for a certain level of quality and they sent you bad product or did a bad job then it is your duty to stop this if you are aware the contract requirements are not respected. I would also do some tests on the quality of the cleaning products just because people are greedy and they could send me bad products and cost me later.
- deleted 8y ago
  [deleted]
- ID1452319 8y ago
  You don't have to hire a DPO. You do have to appoint someone within your company to be resposible for data protection, which seems like good practice anyway. You don't have to hire an expensive company to go through your systems. There is no such thing as GDPR "compliant" it is a series of steps for which a company can self-certify based upon the data they collect and the way that data is used. These steps are again good practice e.g. only collect the data you really need, database encryption, access controls and so on. In terms of "nightmare letters" - your company should have a privacy policy which answers a user's generic concerns, again this is good practice. If a user requests a copy of their data or to have data removed this is a simple reapeatable process that you should design into your system from day one. Remember, the key premise of GDPR is "privacy by design". If you take that into consideration when designing and building your solution, you are 90% of the way there. You don't have to constantly monitor 3rd parties privacy policies and update your own. Your privacy policy, which I think we all agree every company which collects personal data should have, can link to the privacy policies of the companies you send data to.
  - Silhouette 8y ago
    We had all these debates ad nauseam in the time leading up to 25 May. The basic concerns haven't changed. There's still little clarity about the main ambiguities. Just linking from your privacy policy to each of your suppliers' is still as useful to data subjects as a clause saying "We can change our terms unilaterally at any time" in a contract, and in any sane world it would carry a similar amount of legal weight.

by CrLf 8y ago

Silhouette 8y ago

If your company can't be bothered to apply some common sense to handling user data Which of the specific points the GP mentioned do you think is about how they handle user data? As far as I can see, every one of them is administrative in nature. They're not saying they're going to be tracking everyone in shady ways. They're not saying they're going to be storing unencrypted details and unhashed passwords. They're not saying they're going to be forwarding your every secret to a Sith lord. They are saying they don't have time to respond to a legal DoS if someone sends them a letter obviously written in bad faith, and they are saying they don't have the resources for their startup to police every major service they depend on. I imagine almost any startup would be in the same position. As it happens, this person also seems to have some common misunderstandings about their obligations and may be over-estimating the actual risks. That also happens when you write this kind of law, and as we see here, the chilling effect is real.

lenlorijn 8y ago
Well, for example, one of the mentioned points is about sending PII to a 3rd party where the startup didn't read the 3rd party's privacy policy. So how would the startup be able to accurately present me with information on how my data will be used if they don't even know? I think having an accurate and updated privacy policy is common sense handling of data, wouldn't you agree?
- Silhouette 8y ago
  That's a reasonable point, but it's also reasonable to observe that businesses rely on other businesses all the time. As a small business, you usually have little meaningful oversight of the internal processes of outside services you use. You don't get to audit your bank's finances to make sure they're safe to trust with your money. You don't get to review your lawyer's office security arrangements to make sure no-one can break in and steal confidential data about your contracts. You don't get to review which products your office cleaning firm uses. At some point, you just have to trust that they do a decent job, and you change who you work with if you have reason to believe they aren't doing that. If a privacy regime is going to have any value in practice, it has to work on the same basis. The emphasis has to be ensuring that each individual or organisation who actually knows about the way data is being processed and has the ability to influence that processing is behaving reasonably. Then you can have some sort of trust framework that can actually mean something, from the data subject to their direct contacts and right on through to the indirect service providers however far the chain goes. The rest is just CYA and box-ticking, no matter how many laws you write or what penalties you threaten.
  - simion314 8y ago
    > You don't get to review which products your office cleaning firm uses. Seems a bad analogy, do you make a contract with them but not read it? I mean in the contract you will specify what cleaning products can or should be used(like in some hospitals strong cleaning products must be supplied and you ask for those in the contract if the supplier gives you bad quality ones then sure it is not your fault but it is your fault if you don't even want to read the contract terms) I imagine the OP was thinking that he wants to embed in his pages some analytics or similar scripts, maybe some advertising scripts, use a few third party APIs and it seems a lot of work for him. At least his US customers can now know that their data are could be shared with many third parties that could have weird terms like those third parties could sell it further.
    - Klathmon 8y ago
      Okay, but do you ensure the manufacturer of those cleaning supplies is making them correctly? Do you test the products coming from that facility to ensure they are of sufficent quality before allowing them to be used by your office cleaning firm? And do you vet the ingredients that the manufacturing facility uses to ensure they are pure and safe? Because the commenter above makes a fantastic point that I hadn't thought about before, the GDPR requires that kind of knowledge and verification of user data. Not just in your company, not just in the companies you work with, but the companies they work with, and the ones that they work with, and so on. It's akin to requiring the gas station to post legal notices that the computers it uses for the POS system are manufactured by a company which has verified that the parts that it uses were sourced from a place which was able to check that the materials used were mined by a company that treats their employees safely. (i'm not against something like the GDPR, but I do feel it goes a bit too far in a handful of areas)
      - simion314 8y ago
        No, my point was about the OP that said he does not have the time to read the TOS of the third parties he uses. About the cleaning example if you had a contract that asked for a certain level of quality and they sent you bad product or did a bad job then it is your duty to stop this if you are aware the contract requirements are not respected. I would also do some tests on the quality of the cleaning products just because people are greedy and they could send me bad products and cost me later.
deleted 8y ago
[deleted]
ID1452319 8y ago
You don't have to hire a DPO. You do have to appoint someone within your company to be resposible for data protection, which seems like good practice anyway. You don't have to hire an expensive company to go through your systems. There is no such thing as GDPR "compliant" it is a series of steps for which a company can self-certify based upon the data they collect and the way that data is used. These steps are again good practice e.g. only collect the data you really need, database encryption, access controls and so on. In terms of "nightmare letters" - your company should have a privacy policy which answers a user's generic concerns, again this is good practice. If a user requests a copy of their data or to have data removed this is a simple reapeatable process that you should design into your system from day one. Remember, the key premise of GDPR is "privacy by design". If you take that into consideration when designing and building your solution, you are 90% of the way there. You don't have to constantly monitor 3rd parties privacy policies and update your own. Your privacy policy, which I think we all agree every company which collects personal data should have, can link to the privacy policies of the companies you send data to.
- Silhouette 8y ago
  We had all these debates ad nauseam in the time leading up to 25 May. The basic concerns haven't changed. There's still little clarity about the main ambiguities. Just linking from your privacy policy to each of your suppliers' is still as useful to data subjects as a clause saying "We can change our terms unilaterally at any time" in a contract, and in any sane world it would carry a similar amount of legal weight.