4 ms·

These are your customers. If you don't have the time or resources to talk to your customers, then your business is going to fail anyway. This point isn't about

These are your customers. If you don't have the time or resources to talk to your customers, then your business is going to fail anyway. This point isn't about your customers. It's about the bitter ex-customer who decides to take revenge through legal means by exploiting the rights they have under the GDPR to waste your time and money. And if you think this is a hypothetical risk, read the news today about kids lining up to damage exam boards in exactly this way if they didn't get the grades they wanted, and explain to me how that isn't a threat to the integrity of the examination system. You don't have to monitor them, you just need to read them. If you don't have time to read contracts that you're singing, then your business is going to fail anyway. The fact that you have read the privacy policy of one of your suppliers does nothing to help the data subject. Unless they have meaningful information about how personal data about them is being processed and who is doing that processing, they haven't really gained any meaningful control or protection. And no small business has the time to fully read all of the legal paperwork affecting them. Like consumer contracts, it's the great fiction of the legal community. Most new businesses won't even have had time to read the contract with their banks and other financial services before signing to open their account, and those often contain some very nasty and one-sided terms. But of course those contracts all tend to contain similarly nasty and one-sided terms, and you're going to need those services to do business anyway.

DanBC 8y ago
> It's about the bitter ex-customer who decides to take revenge through legal means by exploiting the rights they have under the GDPR to waste your time and money. They don't have that power. They can write you a letter asking for their data.They can write a letter to the regulator asking the regulator to investigate a complaint. The regulator would maybe write you a letter asking for information, and provide some advice about best current practice.
marcus_holmes 8y ago
Anyone in retail deals with nightmare customers who use social media to cause them untold pain and misery, and wastes huge amounts of time. It's no different, except that in the GDPR case you can automate the response, and there's an actual regulator at the other end who can decide that the complaint was frivolous. Dealing with customers is always nightmarish waste of time. But necessary. I haven't heard about the examination board case, sounds interesting. Again, if you don't understand how your customer's data is being used by a third party, then perhaps you shouldn't use that third party. I guess Google Analytics is the poster child for this. By using GA you are inviting Google to insert code into your web pages. This should give you the screaming heebie-jeebies.
- Silhouette 8y ago
  Anyone in retail deals with nightmare customers who use social media to cause them untold pain and misery, and wastes huge amounts of time. Of course. But they don't do it with the active blessing and support of the legal system. Again, if you don't understand how your customer's data is being used by a third party, then perhaps you shouldn't use that third party. Unfortunately, that's easier to say than to respect in practice. For example, I run a business that allows customers to pay by credit card. There are many parties involved in a single card payment. Obviously at some point along the way there are various checks done to try to reduce instances of fraud. Those almost certainly include automatic decision-making processes that affect my customers. And yet I don't even know -- and in fact can't know; I asked -- who is making those decisions that might prevent my customer from buying something from me today, nor what basis is used. There is no meaningful right of appeal if my customer or I don't like the decision. In fact, my business can have the money clawed back months after a payment went through apparently successfully and even be fined if one of those payment services up the chain that I still can't identify doesn't like anything for any reason, with no useful explanation given and again no meaningful right of appeal. This whole arrangement is so totally against the spirit of contracts, money, privacy and data protection rules, and basic common sense that it defies belief. And yet it is absolutely routine: your only alternative as a merchant is not to accept card payments, and your only alternative as a customer is not to have a payment card at all.
  - marcus_holmes 8y ago
    I used to work for a payment processor, I know your pain. The obscurity and lack of information that you complain about, though, is exactly the thing that the GDPR discovery clauses are trying to eradicate. Let's hope that the utterly arbitrary and opaque banking system is held to the same standard eventually.
Aaargh20318 8y ago
> It's about the bitter ex-customer who decides to take revenge through legal means by exploiting the rights they have under the GDPR to waste your time and money. Except you can't sue anyone under the GDPR. All you can do as a consumer/bitter ex-customer is file a complaint with your country's privacy watchdog. IF there really is a problem, they will just tell you to fix it, that's all. You only need to worry if you're doing shady things with personal data and don't intend to stop doing them even after being warned, in which case you deserve everything you get.
- Silhouette 8y ago
  Unfortunately, the entire point of the "nightmare letter" was that much of what you just wrote isn't actually true. It wasn't about suing anyone. It was about wasting their time and potentially their money identifying which of the numerous points actually required a response (and a few traps among them that most certainly did not) and then gathering lots of obscure information they probably didn't just have as standard in their usual information management systems or published in their privacy policy, and highlighting the fact that the GDPR removed the small but non-zero fee that previous law allowed for exercising these rights that served as a practical barrier to this kind of abuse.
  - Aaargh20318 8y ago
    > It was about wasting their time and potentially their money identifying which of the numerous points actually required a response I've seen the letter and it's all questions you should be able to easily answer anyway. If this letter would be a nightmare scenario for you you'd better get your shit in order, regardless of the GDPR.
    - Silhouette 8y ago
      I've seen the letter and it's all questions you should be able to easily answer anyway. The very first point in that letter requires identifying every communication you have ever had with or about the data subject that is still stored anywhere in your organisation, among other actions. If you think that is easy, presumably you know how to automate that process, in which case I look forward to seeing the multi-billion-dollar business you have presumably built scanning unstructured data reliably in ways that no-one else has figured out how to do yet.

DanBC 8y ago

> It's about the bitter ex-customer who decides to take revenge through legal means by exploiting the rights they have under the GDPR to waste your time and money. They don't have that power. They can write you a letter asking for their data.They can write a letter to the regulator asking the regulator to investigate a complaint. The regulator would maybe write you a letter asking for information, and provide some advice about best current practice.

marcus_holmes 8y ago

Anyone in retail deals with nightmare customers who use social media to cause them untold pain and misery, and wastes huge amounts of time. It's no different, except that in the GDPR case you can automate the response, and there's an actual regulator at the other end who can decide that the complaint was frivolous. Dealing with customers is always nightmarish waste of time. But necessary. I haven't heard about the examination board case, sounds interesting. Again, if you don't understand how your customer's data is being used by a third party, then perhaps you shouldn't use that third party. I guess Google Analytics is the poster child for this. By using GA you are inviting Google to insert code into your web pages. This should give you the screaming heebie-jeebies.

Silhouette 8y ago
Anyone in retail deals with nightmare customers who use social media to cause them untold pain and misery, and wastes huge amounts of time. Of course. But they don't do it with the active blessing and support of the legal system. Again, if you don't understand how your customer's data is being used by a third party, then perhaps you shouldn't use that third party. Unfortunately, that's easier to say than to respect in practice. For example, I run a business that allows customers to pay by credit card. There are many parties involved in a single card payment. Obviously at some point along the way there are various checks done to try to reduce instances of fraud. Those almost certainly include automatic decision-making processes that affect my customers. And yet I don't even know -- and in fact can't know; I asked -- who is making those decisions that might prevent my customer from buying something from me today, nor what basis is used. There is no meaningful right of appeal if my customer or I don't like the decision. In fact, my business can have the money clawed back months after a payment went through apparently successfully and even be fined if one of those payment services up the chain that I still can't identify doesn't like anything for any reason, with no useful explanation given and again no meaningful right of appeal. This whole arrangement is so totally against the spirit of contracts, money, privacy and data protection rules, and basic common sense that it defies belief. And yet it is absolutely routine: your only alternative as a merchant is not to accept card payments, and your only alternative as a customer is not to have a payment card at all.
- marcus_holmes 8y ago
  I used to work for a payment processor, I know your pain. The obscurity and lack of information that you complain about, though, is exactly the thing that the GDPR discovery clauses are trying to eradicate. Let's hope that the utterly arbitrary and opaque banking system is held to the same standard eventually.

Aaargh20318 8y ago

> It's about the bitter ex-customer who decides to take revenge through legal means by exploiting the rights they have under the GDPR to waste your time and money. Except you can't sue anyone under the GDPR. All you can do as a consumer/bitter ex-customer is file a complaint with your country's privacy watchdog. IF there really is a problem, they will just tell you to fix it, that's all. You only need to worry if you're doing shady things with personal data and don't intend to stop doing them even after being warned, in which case you deserve everything you get.

Silhouette 8y ago
Unfortunately, the entire point of the "nightmare letter" was that much of what you just wrote isn't actually true. It wasn't about suing anyone. It was about wasting their time and potentially their money identifying which of the numerous points actually required a response (and a few traps among them that most certainly did not) and then gathering lots of obscure information they probably didn't just have as standard in their usual information management systems or published in their privacy policy, and highlighting the fact that the GDPR removed the small but non-zero fee that previous law allowed for exercising these rights that served as a practical barrier to this kind of abuse.
- Aaargh20318 8y ago
  > It was about wasting their time and potentially their money identifying which of the numerous points actually required a response I've seen the letter and it's all questions you should be able to easily answer anyway. If this letter would be a nightmare scenario for you you'd better get your shit in order, regardless of the GDPR.
  - Silhouette 8y ago
    I've seen the letter and it's all questions you should be able to easily answer anyway. The very first point in that letter requires identifying every communication you have ever had with or about the data subject that is still stored anywhere in your organisation, among other actions. If you think that is easy, presumably you know how to automate that process, in which case I look forward to seeing the multi-billion-dollar business you have presumably built scanning unstructured data reliably in ways that no-one else has figured out how to do yet.