4 ms·

Has GDPR meaningfully changed enforcement of rights? I’m familiar with the law itself and the details of it. (IAAL who practices in this area.) I’ve seen these

Has GDPR meaningfully changed enforcement of rights? I’m familiar with the law itself and the details of it. (IAAL who practices in this area.) I’ve seen these regulatory pushes toward consumer-oriented privacy in the past, and they seem to serve the consulting industry above all. The consequences of breaking the rules are laughably impotent so far, despite more or less well-meaning words passed as binding legislation. Even the reputational damage of having your company featured in headlines about data leaks has fizzled. People don’t even seem to punish the offenders by shifting their spending habits. Am I wrong?

guitarbill 8y ago
> People don’t even seem to punish the offenders by shifting their spending habits Well, if that was viable, we probably wouldn't have needed such high fines in the GDPR. Two scenarios: A) It's hard to move away because of dominance, e.g. Google. You either have to buy an offensively expensive iPhone, or root an Android phone. Even then living without the Play store is hard. Moving e.g. email providers takes years nowadays regardless of the provider. Google Search and Maps can be replaced in theory, but it's quite a chore - Google didn't get big on bad products. B) What spending? How do you stop spending on something you aren't paying for with money? Yes, ad and tracking blockers, but for Joe Bloggs that isn't obvious. And Consumers weren't paying Equifax directly, otherwise they probably would have been bankrupted. > Has GDPR meaningfully changed enforcement of rights? We don't know yet. (I'm assuming this isn't a rhetorical question.) On the one hand, the fines now have business impact. For example, before the GDPR, the UK's ICO could only hand out a laughable max fine of £500,000. On the other hand, ICO has been toothless, only handing out the max fine once. ICO was severely underfunded, so this is almost by design. Germany is pretty privacy conscious, but unfortunately data protection is also handled on a state level. So there are 16 data protection agencies and one federal one (Datenschutzaufsichtsbehörden, the federal one being the BfDI). From experience, that kind of bureaucracy doesn't help with speed. While this isn't enforcement, it has had some meaningful effect. Having worked for a big multinational, there was a lot of money and hours spent on GDPR compliance. This reduces e.g. data retention, which could help limit damage in future. Before that, data retention was basically endless. We've seen some minor cases, but being a lawyer, I'm sure you know we're at least a few years off the really big cases, especially if the European data protection authorities need to work together.
- fiddlerwoaroof 8y ago
  It’s almost like the reason iPhones are so expensive is that they Apple makes money from selling hardware rather than ads...
- nihonde 8y ago
  I appreciate the points you raise, and basically agree that the jury is still out on my question. I honestly don’t understand why there wouldn’t be enforcement actions on day one this past spring. We all had plenty of time to prepare. As for the compliance effort: it’s mostly security theater in the enterprise, and benefits consultants and lawyers mainly. I take your point about retention, though. We’ll see if any of it really makes any difference. I’m pretty jaded after doing this since the late 90’s.

guitarbill 8y ago

> People don’t even seem to punish the offenders by shifting their spending habits Well, if that was viable, we probably wouldn't have needed such high fines in the GDPR. Two scenarios: A) It's hard to move away because of dominance, e.g. Google. You either have to buy an offensively expensive iPhone, or root an Android phone. Even then living without the Play store is hard. Moving e.g. email providers takes years nowadays regardless of the provider. Google Search and Maps can be replaced in theory, but it's quite a chore - Google didn't get big on bad products. B) What spending? How do you stop spending on something you aren't paying for with money? Yes, ad and tracking blockers, but for Joe Bloggs that isn't obvious. And Consumers weren't paying Equifax directly, otherwise they probably would have been bankrupted. > Has GDPR meaningfully changed enforcement of rights? We don't know yet. (I'm assuming this isn't a rhetorical question.) On the one hand, the fines now have business impact. For example, before the GDPR, the UK's ICO could only hand out a laughable max fine of £500,000. On the other hand, ICO has been toothless, only handing out the max fine once. ICO was severely underfunded, so this is almost by design. Germany is pretty privacy conscious, but unfortunately data protection is also handled on a state level. So there are 16 data protection agencies and one federal one (Datenschutzaufsichtsbehörden, the federal one being the BfDI). From experience, that kind of bureaucracy doesn't help with speed. While this isn't enforcement, it has had some meaningful effect. Having worked for a big multinational, there was a lot of money and hours spent on GDPR compliance. This reduces e.g. data retention, which could help limit damage in future. Before that, data retention was basically endless. We've seen some minor cases, but being a lawyer, I'm sure you know we're at least a few years off the really big cases, especially if the European data protection authorities need to work together.

fiddlerwoaroof 8y ago
It’s almost like the reason iPhones are so expensive is that they Apple makes money from selling hardware rather than ads...
nihonde 8y ago
I appreciate the points you raise, and basically agree that the jury is still out on my question. I honestly don’t understand why there wouldn’t be enforcement actions on day one this past spring. We all had plenty of time to prepare. As for the compliance effort: it’s mostly security theater in the enterprise, and benefits consultants and lawyers mainly. I take your point about retention, though. We’ll see if any of it really makes any difference. I’m pretty jaded after doing this since the late 90’s.