3 ms·
I work as a developer in the European public sector, we already took privacy and security rather serious because the laws governing it had always been and are s
by moksly 6y ago
I work as a developer in the European public sector, we already took privacy and security rather serious because the laws governing it had always been and are still tougher than the GDPR.
I actually like that the EU is doing something, and I guess this is the best you get from a bureaucracy, but what it’s changed is that we document everything. Whenever I build anything that moves privacy data, even if it’s just hooking up a new system to our ADFS which accesses employee names, I need to fill out 4 forms and write a risk assessment. It all goes somewhere I suppose, I’m not sure because once I file them I never hear anything about it unless my wording wasn’t good enough.
As far as security goes, it hasn’t actually changed anything. I guess it does if you weren’t taking security very serious before, but the idea that we as developers will think about security first or design better systems if a bunch of lawyers force us to fill out forms and write essays on what can go wrong... I just can’t wrap my head about why anyone would actually believe that stuff.
Like I said, it’s a great idea, on paper, but the bureaucracy that is enforcing it is just so clueless. Passing inspections is more about having the right answers and documentation than having actual security, so it’s no wonder that the outcome is full of mixed signals and weird enforcement.
Still better than nothing, in my opinion, and it’ll probably get better with time.
- ThePhysicist 6y agoNot sure why this is getting downvoted, seems to be a perfectly reasonable point?
- Barrin92 6y agobecause there's a rabid anti-regulation and anti-EU bias on this site. Well thought out answers get frequently downvoted while free market platitudes get upvoted.
- lmkg 6y agoThere is a privacy benefit to adding friction to spreading personal data around everywhere. At the margin, some services will decide not to bother processing non-essential personal data just to avoid the paperwork. And really, that's one of the excesses that GDPR was a reaction to: that the "default" was "track everything in case the data magically becomes valuable," and now the it's become "perhaps not."
- p_l 6y agoA lot of GDPR can be summarized as "GDPR makes PII into high-grade radioactive waste. You want the least of it, and take care of the remaining bits you end up with"
- zenhack 6y agoRelevant: https://idlewords.com/talks/haunted_by_data.htm https://idlewords.com/talks/haunted_by_data.htm (Maybe you were familiar). The closing is particularly worth taking in: > Finally, don't be surprised. The current model of total surveillance and permanent storage is not tenable. > If we keep it up, we'll have our own version of Three Mile Island, some widely-publicized failure that galvanizes popular opinion against the technology. > At that point people who are angry, mistrustful, and may not understand a thing about computers will regulate your industry into the ground. You'll be left like those poor saps who work in the nuclear plants, who have to fill out a form in triplicate anytime they want to sharpen a pencil. > You don't want that. Even I don't want that. > We can have that radiant future but it will require self-control, circumspection, and much more concern for safety that we've been willing to show. > It's time for us all to take a deep breath and pull off those radium underpants. I'm not sure it came in the form of a single event (though I can think of some candidates -- the cambridge analytica scandal made a big impression for one), but it's clear to me at this point that the warning was ignored, and our industry has missed the window for self-regulation.