3 ms·
It's best effort. No regulator is going to fine you massively if you miss some data in an edge case like this. Worst case scenario, they'll tell you to do bette
by disgruntledphd2 6y ago
It's best effort. No regulator is going to fine you massively if you miss some data in an edge case like this. Worst case scenario, they'll tell you to do better in future.
I do see your point though, the intersection with phishing attacks is not something I'd considered in the context of GDPR.
However, as long as you provide a way for users with an account to download their data, you're 90% of the way towards compliance.
Again, unless you are FB or Google, the regulators will cut you some slack (just look at the lack of bankruptcies caused by GDPR).
- strken 6y agoUnless the text of the law is "the company shall try very hard (but if they miss a weird edge case they shall be merely sent a warning letter)", the GDPR allows selective enforcement. You note that it's already one rule for FB and Google, another for smaller companies. To what extent do you trust the courts to selectively apply the law in a sensible way, vs selectively applying the law in a harmful but legal way?
- disgruntledphd2 6y agoIt's mostly the regulators who interpret the law and determine the remedies, as specified in the laws. In general, European regulators are aiming for compliance rather than fines, and I don't see that changing any time soon.