3 ms·

> It was about wasting their time and potentially their money identifying which of the numerous points actually required a response I've seen the letter and i

by Aaargh20318 8y ago

> It was about wasting their time and potentially their money identifying which of the numerous points actually required a response I've seen the letter and it's all questions you should be able to easily answer anyway. If this letter would be a nightmare scenario for you you'd better get your shit in order, regardless of the GDPR.

Silhouette 8y ago
I've seen the letter and it's all questions you should be able to easily answer anyway. The very first point in that letter requires identifying every communication you have ever had with or about the data subject that is still stored anywhere in your organisation, among other actions. If you think that is easy, presumably you know how to automate that process, in which case I look forward to seeing the multi-billion-dollar business you have presumably built scanning unstructured data reliably in ways that no-one else has figured out how to do yet.
- Aaargh20318 8y ago
  > The very first point in that letter requires identifying every communication you have ever had with or about the data subject that is still stored anywhere in your organisation, among other actions. The magic words here are "still stored", PII is a liability so you never want to store it longer than absolutely necessary. Why are you hoarding this data when you can't even retrieve it easily, what is the point ?
  - Silhouette 8y ago
    Why are you hoarding this data when you can't even retrieve it easily, what is the point ? Do you have a filing system for every email you ever wrote? Can you identify every backup copy, every forwarded message, every print-out, every excerpt copied and pasted into a Word document? Can you remember or look up every individual ever referenced in those messages? Now, let's talk about letters. The paper kind. And faxes. Including unsolicited ones that aren't part of any formal process where a customer helpfully included their password so you knew it was from them. And mentioned that it's their mother's birthday, in case you were wondering. Have you ever written down an address or phone number on a piece of paper because that was what you had to hand when someone read it out to you over the phone? Or opened up a quick text file to keep notes from a meeting? If you're a director responsible for a company of 2,000 staff, do you think anyone else in your company has ever done any of those things, and would you like to bet your job that no-one ever kept a record other than as part of your comprehensive, perfectly-specified and loophole-free official processes? If you're a director of a startup with 5 people, do you even have those processes, or is almost everything actually being done with text files and Post-It notes (or Slack channels and Google Docs, or...)? This is not an easy problem. People have made very, very large amounts of money building businesses trying to solve this problem, and the first people who really nail it are going to make even more. You can't just hand-wave away the possibility of having personal data that is not immaculately organised, rigorously controlled and fully indexed in any organisation of significant size and lifetime. A law that makes such a requirement is like a law that says you can only ship software with no bugs, or a law that says all laws will be unambiguous and enforced with zero tolerance.
    - marcus_holmes 8y ago
      GDPR wasn't put in place to monitor people scribbling down phone numbers on pieces of paper. It was put in place to stop companies from hoarding vast amounts of personal data and using it to infringe on people's privacy (as well as making sure they looked after it properly). If the regulator finds out that one of your staff scribbled down a customer's phone number once on a piece of paper while serving that customer, they won't care. If they find that your customer service process requires your customer service staff to scribble down phone numbers on scraps of paper that are then put out with the garbage, where they can be dumpster-dived, they will care (and so should you). This is not some huge regulatory over-reach that will force you to go through every piece of paper in your organisation. It's a check on your data handling that forces you to acknowledge the trust placed in you by your customers.
      - Silhouette 8y ago
        GDPR wasn't put in place to monitor people scribbling down phone numbers on pieces of paper. It was put in place to stop companies from hoarding vast amounts of personal data and using it to infringe on people's privacy (as well as making sure they looked after it properly). Sure. The intent of the GDPR has not received much criticism, at least not that I've seen. The concerns some of us have always had are more about ambiguity and interpretation, because on the one hand the law as actually written doesn't allow for much leeway in some cases, and yet on the other hand it has huge ambiguities in key areas hiding behind words like "reasonable" or "legitimate". It's easy to look at extreme positions, such as the example I gave above for illustrative purposes, and say no regulator is ever going to expect all of that. Probably you'd be right. The difficulty is that somewhere between not doing much of anything to comply and the other extreme such as I described, you cross an invisible line from being sufficiently compliant in the regulator's view (or potentially a court's if it really came to that) to not being sufficiently compliant and no-one really knows where that line is. When you have not just the threat of fines but also potentially very significant costs in adapting your systems and processes, that sort of uncertainty is never good for anyone. That is particularly true in a case like GDPR, because many of those adaptations are more about being seen to comply than about fixing any actual security vulnerability or abuse of privacy or other tangible problem.

Silhouette 8y ago

I've seen the letter and it's all questions you should be able to easily answer anyway. The very first point in that letter requires identifying every communication you have ever had with or about the data subject that is still stored anywhere in your organisation, among other actions. If you think that is easy, presumably you know how to automate that process, in which case I look forward to seeing the multi-billion-dollar business you have presumably built scanning unstructured data reliably in ways that no-one else has figured out how to do yet.

Aaargh20318 8y ago
> The very first point in that letter requires identifying every communication you have ever had with or about the data subject that is still stored anywhere in your organisation, among other actions. The magic words here are "still stored", PII is a liability so you never want to store it longer than absolutely necessary. Why are you hoarding this data when you can't even retrieve it easily, what is the point ?
- Silhouette 8y ago
  Why are you hoarding this data when you can't even retrieve it easily, what is the point ? Do you have a filing system for every email you ever wrote? Can you identify every backup copy, every forwarded message, every print-out, every excerpt copied and pasted into a Word document? Can you remember or look up every individual ever referenced in those messages? Now, let's talk about letters. The paper kind. And faxes. Including unsolicited ones that aren't part of any formal process where a customer helpfully included their password so you knew it was from them. And mentioned that it's their mother's birthday, in case you were wondering. Have you ever written down an address or phone number on a piece of paper because that was what you had to hand when someone read it out to you over the phone? Or opened up a quick text file to keep notes from a meeting? If you're a director responsible for a company of 2,000 staff, do you think anyone else in your company has ever done any of those things, and would you like to bet your job that no-one ever kept a record other than as part of your comprehensive, perfectly-specified and loophole-free official processes? If you're a director of a startup with 5 people, do you even have those processes, or is almost everything actually being done with text files and Post-It notes (or Slack channels and Google Docs, or...)? This is not an easy problem. People have made very, very large amounts of money building businesses trying to solve this problem, and the first people who really nail it are going to make even more. You can't just hand-wave away the possibility of having personal data that is not immaculately organised, rigorously controlled and fully indexed in any organisation of significant size and lifetime. A law that makes such a requirement is like a law that says you can only ship software with no bugs, or a law that says all laws will be unambiguous and enforced with zero tolerance.
  - marcus_holmes 8y ago
    GDPR wasn't put in place to monitor people scribbling down phone numbers on pieces of paper. It was put in place to stop companies from hoarding vast amounts of personal data and using it to infringe on people's privacy (as well as making sure they looked after it properly). If the regulator finds out that one of your staff scribbled down a customer's phone number once on a piece of paper while serving that customer, they won't care. If they find that your customer service process requires your customer service staff to scribble down phone numbers on scraps of paper that are then put out with the garbage, where they can be dumpster-dived, they will care (and so should you). This is not some huge regulatory over-reach that will force you to go through every piece of paper in your organisation. It's a check on your data handling that forces you to acknowledge the trust placed in you by your customers.
    - Silhouette 8y ago
      GDPR wasn't put in place to monitor people scribbling down phone numbers on pieces of paper. It was put in place to stop companies from hoarding vast amounts of personal data and using it to infringe on people's privacy (as well as making sure they looked after it properly). Sure. The intent of the GDPR has not received much criticism, at least not that I've seen. The concerns some of us have always had are more about ambiguity and interpretation, because on the one hand the law as actually written doesn't allow for much leeway in some cases, and yet on the other hand it has huge ambiguities in key areas hiding behind words like "reasonable" or "legitimate". It's easy to look at extreme positions, such as the example I gave above for illustrative purposes, and say no regulator is ever going to expect all of that. Probably you'd be right. The difficulty is that somewhere between not doing much of anything to comply and the other extreme such as I described, you cross an invisible line from being sufficiently compliant in the regulator's view (or potentially a court's if it really came to that) to not being sufficiently compliant and no-one really knows where that line is. When you have not just the threat of fines but also potentially very significant costs in adapting your systems and processes, that sort of uncertainty is never good for anyone. That is particularly true in a case like GDPR, because many of those adaptations are more about being seen to comply than about fixing any actual security vulnerability or abuse of privacy or other tangible problem.