3 ms·

what's really missing in all this GDPR and privacy discussion is a technical way to enforce it. If you have a large multinational company with 50 TLD's you migh

what's really missing in all this GDPR and privacy discussion is a technical way to enforce it. If you have a large multinational company with 50 TLD's you might have several hundred (including all the subdomains) that are Internet facing. For a company on that scale to remain compliant to things like cookie law (mention every cookie and what it does for opt-in) there is no easy way to see if you're compliant. We need some standard (like security.txt) which defines how cookie data, impressum or other site specific links are expected which has to be machine readable. Right now every company creates it's own mess of html which is no fun scraping to figure out if the company is compliant or not. (yet scraping is what everyone in compliance expects to happen). I wonder how these laws can be enforced without creating a huge administrative backlog.

mqus 7y ago
for this there's a e-privacy regulation in the works[1] but it already took a lot of time... GDPR only got as much support as it did because the snowden leaks happened shortly before the vote. As I understand it, it will include things like Do-Not-Track and a better cookie banner legislation, which makes the banners less common. Enforcement is trickier. Let's wait for a few more rulings and see if that's enough. [1] https://ec.europa.eu/digital-single-market/en/proposal-eprivacy-regulation https://ec.europa.eu/digital-single-market/en/proposal-epriv...
Someone 7y ago
”Right now every company creates it's own mess of html which is no fun scraping to figure out if the company is compliant or not.” I fail to understand how anybody could scrape a web site to figure out whether it is compliant with the GDPR. For example, if I claim my site encrypts your data at rest, how do you verify it by scraping the site? If I say I don’t share your data with third parties, how do you verify it by scraping the site? If I say I throw away the encryption key when you delete your account, how do you verify it by scraping the site? if I say that, after deleting your account, all data is gone after at most 30 days, how do you verify it by scraping the site?
M2Ys4U 7y ago
>what's really missing in all this GDPR and privacy discussion is a technical way to enforce it. The GDPR isn't solving a (purely) technical problem. It applies even if you're using a pen, paper, and a filing cabinet just as much as if you're running a global social media platform. What's the technical solution to showing compliance with "data protection by default and by design"? What's the technical solution to ensuring that "only personal data which are necessary for each specific purpose of the processing are processed"? These are inherently organisational issues, not technical ones.

mqus 7y ago

for this there's a e-privacy regulation in the works[1] but it already took a lot of time... GDPR only got as much support as it did because the snowden leaks happened shortly before the vote. As I understand it, it will include things like Do-Not-Track and a better cookie banner legislation, which makes the banners less common. Enforcement is trickier. Let's wait for a few more rulings and see if that's enough. [1] https://ec.europa.eu/digital-single-market/en/proposal-eprivacy-regulation https://ec.europa.eu/digital-single-market/en/proposal-epriv...

Someone 7y ago

”Right now every company creates it's own mess of html which is no fun scraping to figure out if the company is compliant or not.” I fail to understand how anybody could scrape a web site to figure out whether it is compliant with the GDPR. For example, if I claim my site encrypts your data at rest, how do you verify it by scraping the site? If I say I don’t share your data with third parties, how do you verify it by scraping the site? If I say I throw away the encryption key when you delete your account, how do you verify it by scraping the site? if I say that, after deleting your account, all data is gone after at most 30 days, how do you verify it by scraping the site?

M2Ys4U 7y ago

>what's really missing in all this GDPR and privacy discussion is a technical way to enforce it. The GDPR isn't solving a (purely) technical problem. It applies even if you're using a pen, paper, and a filing cabinet just as much as if you're running a global social media platform. What's the technical solution to showing compliance with "data protection by default and by design"? What's the technical solution to ensuring that "only personal data which are necessary for each specific purpose of the processing are processed"? These are inherently organisational issues, not technical ones.