3 ms·
Having recently encountered vague law - specifically GDPR - I cannot give the experience a positive recommendation. The position of being unable to determine wh
by Kalium 8y ago
Having recently encountered vague law - specifically GDPR - I cannot give the experience a positive recommendation. The position of being unable to determine what is actually required of your company, what the consequences might be, and thus what the risks actually are makes for an extremely uncomfortable environment.
Core question: what does "reasonable" mean? Do I get to define it, or some information security peer? Is it going to be defined as a matter of convenience by some functionary looking to make quota?
It's my professional responsibility to provide informative and actionable risk assessments and guidance. Crap like this makes that impossible.
- j88439h84 8y agoThe law isn't there to make the company's job easier.
- Kalium 8y agoYou're absolutely right! Completely, utterly, and unreservedly so. Laws like GDPR are there to protect people from companies. Not make things easier for them. It's perhaps possible that people might be better protected by laws that are clear than by laws that gesture vaguely in the direction of security. Similarly, people are well-protected by clear automotive safety standards, and poorly protected by the regulation around dietary supplements. Might that be worth considering?