33 ms·

This site was made by an agency that sells privacy and compliance services. It is in their direct interest to sell the GDPR as an extremely complex problem that

This site was made by an agency that sells privacy and compliance services. It is in their direct interest to sell the GDPR as an extremely complex problem that you need their help with solving. Laws are generally complex, GDPR isn't really special in that sense; it's just newer than the rest. You can probably draft a similarly complex 16-page document for your country's/state's employment laws too, but that doesn't mean you need to work through all of that mess when hiring your startup's first five employees. In reality, if you honor user data deletion requests, don't track people without asking (with easy "no"), and follow proper modern security practices, you're already so far ahead of the majority of tech businesses wrt the GDPR that you're good. Or at least, that's my impression.

homarp 6y ago
cnil is https://en.m.wikipedia.org/wiki/Commission_nationale_de_l%27informatique_et_des_libert%C3%A9s https://en.m.wikipedia.org/wiki/Commission_nationale_de_l%27... its name in french means 'National Commission on Informatics and Liberty', it is an independent French administrative regulatory body whose mission is to ensure that data privacy law is applied to the collection, storage, and use of personal data. Created in 1978. National data protection authority for France.
- skrebbel 6y ago
  Thanks! I was wrong about that one.
BeniBoy 6y ago
This is a bit saddening to read your take on this guide. The goal is specifically to make the GDPR less daunting and more accessible! I guess it missed the mark. But yeah, the GDPR has to formalize a lot of common sense practices, if you don't consider your user as "data trove" you want to abuse, you will be mostly ok!
- Mirioron 6y ago
  >you will be mostly ok! But you won't. Mostly OK does not protect you from ruinous lawsuits or investigations. With the way the justice system works on the EU level I would never trust "mostly OK". We had an EU court find that posting factual information about a religion was blasphemy and not protected as freedom of speech as a human right.[0] [0] https://en.wikipedia.org/wiki/E.S._v._Austria_(2018) https://en.wikipedia.org/wiki/E.S._v._Austria_(2018)
  - detaro 6y ago
    The ECtHR is not an EU institution. If you want to be angry at someone about that case, be primarily angry at Austria for their law. (Although I'd appreciate it too if the EU states gave themselves an updated set of protections in these areas, without some of the compromises the convention has)
    - Mirioron 6y ago
      Why would Austria's law matter? Freedom of speech is either protected as a human right in the EU or it's not. This case shows that the judicial system in the EU thinks it's not protected. If the officials can't even get something like this right, then how are they ever going to get anything else right? Just because they aren't an official EU institution doesn't mean much. It's still largely the same culture and legal traditions running it and every EU country is under it.
      - detaro 6y ago
        Because they were sentenced in Austria, under Austrian law, and the ECtHR can merely check if that violates the convention (which is an agreement by states, which explicitly added a clause allowing local laws to add those restrictions). And given that the convention on human rights includes states like Russia, Turkey and Azerbaijan, there's some different standard to be expected. (which is why I think the EU should maybe have their own, narrower convention on top of it. Which again is something the states need to do in the end, and Austria could just fix their own laws first if they thought that needed doing)
fbn79 6y ago
I totally agree with your view. The same can be expanded for many services that sells cookie approval management solutions.
Fradow 6y ago
This site is not made by an agency that sells anything (as far as I know). It is made by the French government agency which enforces the GDPR and which main mission is helping out companies complying with the GDPR (distributing fines is NOT their goal, they will only fine companies as a last recourse). As such, it's one of the best guides you can find around, because everything you find in there is almost guaranteed to be exact (contrary to some companies selling compliance tools that are not compliant, or a random blog on the internet). And if there is any mistake there, well you can refer the CNIL to its own guide when they investigate you. Obviously they want to make a guide to get to 100% compliance, but they as you said in your last phrase, they indeed don't have the manpower to investigate everyone, and if you are generally respectful of your users privacy, you don't handle sensitive data at a large scale and don't have any complaint against you, they have no reason to ask you for documentation (which is generally going to be the first step of an investigation).

homarp 6y ago

cnil is https://en.m.wikipedia.org/wiki/Commission_nationale_de_l%27informatique_et_des_libert%C3%A9s https://en.m.wikipedia.org/wiki/Commission_nationale_de_l%27... its name in french means 'National Commission on Informatics and Liberty', it is an independent French administrative regulatory body whose mission is to ensure that data privacy law is applied to the collection, storage, and use of personal data. Created in 1978. National data protection authority for France.

skrebbel 6y ago
Thanks! I was wrong about that one.

BeniBoy 6y ago

This is a bit saddening to read your take on this guide. The goal is specifically to make the GDPR less daunting and more accessible! I guess it missed the mark. But yeah, the GDPR has to formalize a lot of common sense practices, if you don't consider your user as "data trove" you want to abuse, you will be mostly ok!

Mirioron 6y ago
>you will be mostly ok! But you won't. Mostly OK does not protect you from ruinous lawsuits or investigations. With the way the justice system works on the EU level I would never trust "mostly OK". We had an EU court find that posting factual information about a religion was blasphemy and not protected as freedom of speech as a human right.[0] [0] https://en.wikipedia.org/wiki/E.S._v._Austria_(2018) https://en.wikipedia.org/wiki/E.S._v._Austria_(2018)
- detaro 6y ago
  The ECtHR is not an EU institution. If you want to be angry at someone about that case, be primarily angry at Austria for their law. (Although I'd appreciate it too if the EU states gave themselves an updated set of protections in these areas, without some of the compromises the convention has)
  - Mirioron 6y ago
    Why would Austria's law matter? Freedom of speech is either protected as a human right in the EU or it's not. This case shows that the judicial system in the EU thinks it's not protected. If the officials can't even get something like this right, then how are they ever going to get anything else right? Just because they aren't an official EU institution doesn't mean much. It's still largely the same culture and legal traditions running it and every EU country is under it.
    - detaro 6y ago
      Because they were sentenced in Austria, under Austrian law, and the ECtHR can merely check if that violates the convention (which is an agreement by states, which explicitly added a clause allowing local laws to add those restrictions). And given that the convention on human rights includes states like Russia, Turkey and Azerbaijan, there's some different standard to be expected. (which is why I think the EU should maybe have their own, narrower convention on top of it. Which again is something the states need to do in the end, and Austria could just fix their own laws first if they thought that needed doing)

fbn79 6y ago

I totally agree with your view. The same can be expanded for many services that sells cookie approval management solutions.

Fradow 6y ago

This site is not made by an agency that sells anything (as far as I know). It is made by the French government agency which enforces the GDPR and which main mission is helping out companies complying with the GDPR (distributing fines is NOT their goal, they will only fine companies as a last recourse). As such, it's one of the best guides you can find around, because everything you find in there is almost guaranteed to be exact (contrary to some companies selling compliance tools that are not compliant, or a random blog on the internet). And if there is any mistake there, well you can refer the CNIL to its own guide when they investigate you. Obviously they want to make a guide to get to 100% compliance, but they as you said in your last phrase, they indeed don't have the manpower to investigate everyone, and if you are generally respectful of your users privacy, you don't handle sensitive data at a large scale and don't have any complaint against you, they have no reason to ask you for documentation (which is generally going to be the first step of an investigation).