3 ms·

No, because the mills of justice grind slowly (translated German proverb), and because the DPAs are horrendously under-funded and overloaded. However, I do hav

No, because the mills of justice grind slowly (translated German proverb), and because the DPAs are horrendously under-funded and overloaded. However, I do have the impression that the situation has already started improving significantly, and as the fines and other enforcement actions start happening, these practices will become less attractive (as in "I don't want this in my company because my competitor had it and got bankrupted by the fines"). A nice aspect of GDPR is the civil enforcement, allowing NGOs to sue on behalf of individuals whose data was abused. This helps resolve the problem that the DPAs are useless and it is infeasible for you to sue Facebook. NOYB.eu is one of the NGOs doing some work in that area (mostly pushing the DPAs to do their job by filing complaints, for now) that has led to fines.

amelius 8y ago
> A nice aspect of GDPR is the civil enforcement, allowing NGOs to sue on behalf of individuals whose data was abused. Is there a practical way to demonstrate, in a court of law, that one's data has been stored/used/traded in an illegal way? For example, assume I use a specifically generated unique email address when signing up to one service. After a while I get spam on that email address from a different company. Can I use this as evidence in a lawsuit? How strong will the case be? Would it help if I ask a trusted party (notary) to deal with the generated email address (so nobody ever sees it except the notary and the company)? What options do I have in collecting evidence?
- tgsovlerkhgsel 8y ago
  In a civil suit, you'd typically need "preponderance of the evidence", i.e. you have to convince the judge that it's more likely than not. In practice, the worst data sellers will pretend to act legally, so they'll often admit in some fine print what they're doing. Also, if the judge asks the representative of the company whether the company is selling your data, the possible answers are "yes", "I don't know", or "no". The former two mean you win. The latter means the representative risks jail time if it later comes out that the company did sell the data.

amelius 8y ago

> A nice aspect of GDPR is the civil enforcement, allowing NGOs to sue on behalf of individuals whose data was abused. Is there a practical way to demonstrate, in a court of law, that one's data has been stored/used/traded in an illegal way? For example, assume I use a specifically generated unique email address when signing up to one service. After a while I get spam on that email address from a different company. Can I use this as evidence in a lawsuit? How strong will the case be? Would it help if I ask a trusted party (notary) to deal with the generated email address (so nobody ever sees it except the notary and the company)? What options do I have in collecting evidence?

tgsovlerkhgsel 8y ago
In a civil suit, you'd typically need "preponderance of the evidence", i.e. you have to convince the judge that it's more likely than not. In practice, the worst data sellers will pretend to act legally, so they'll often admit in some fine print what they're doing. Also, if the judge asks the representative of the company whether the company is selling your data, the possible answers are "yes", "I don't know", or "no". The former two mean you win. The latter means the representative risks jail time if it later comes out that the company did sell the data.