3 ms·

People in Europe need to keep hammering US companies with GDPR violations relentlessly. At some point, if a company keeps violating GDPR, do the executives beco

People in Europe need to keep hammering US companies with GDPR violations relentlessly. At some point, if a company keeps violating GDPR, do the executives become criminally responsible? If not, they should be. I wish the US had something similar at this point.

Nextgrid 6y ago
GDPR enforcement is severely lacking despite there being enough evidence of breaches.
- freehunter 6y ago
  Agreed. I work in information security (risk, compliance, and governance) for a EU-based company and we have a ton of “our lawyers said X” and “we interpret GDPR as Y” kind of policies because there have not been enough court cases to really understand what GDPR actually means. From a security and privacy standpoint I think it’s got great potential but there are too many open questions about enforcement and it muddies actual compliance.
llarsson 6y ago
California is currently getting a similar regulation. And what California does will have lasting effect in the rest of the US as well.
- jonahhorowitz 6y ago
  CCPA isn't as strong as GDPR[0]. Also, not sure if you're referring to Prop 24, but it's terrible[1] for various reasons, including that it can't be updated by the legislature. [0] - https://iapp.org/media/pdf/resource_center/CCPA_GDPR_Chart_PracticalLaw_2019.pdf https://iapp.org/media/pdf/resource_center/CCPA_GDPR_Chart_P... [1] - https://www.theleaguesf.org/#Prop24 https://www.theleaguesf.org/#Prop24
fsflover 6y ago
https://ruben.verborgh.org/facebook/#history https://ruben.verborgh.org/facebook/#history
jskdvsksnb 6y ago
I worked on a compliance effort for a large-ish American tech company. Imagine a lot of boxes and arrows diagrams and plausible deniability. I was told we had to "balance risk", which in practice meant all data was available to everyone with no governance strategy. It was impossible to enumerate all the places data might be collected and stored, let alone find the appropriate person to handle the deletion request. We ended up basically handling the "happy path" and pretended the known unknowns didn't exist. This gave everyone enough plausible deniability to say "well the policy is X" with no means, technical or otherwise, of checking compliance.

Nextgrid 6y ago

GDPR enforcement is severely lacking despite there being enough evidence of breaches.

freehunter 6y ago
Agreed. I work in information security (risk, compliance, and governance) for a EU-based company and we have a ton of “our lawyers said X” and “we interpret GDPR as Y” kind of policies because there have not been enough court cases to really understand what GDPR actually means. From a security and privacy standpoint I think it’s got great potential but there are too many open questions about enforcement and it muddies actual compliance.

llarsson 6y ago

California is currently getting a similar regulation. And what California does will have lasting effect in the rest of the US as well.

jonahhorowitz 6y ago
CCPA isn't as strong as GDPR[0]. Also, not sure if you're referring to Prop 24, but it's terrible[1] for various reasons, including that it can't be updated by the legislature. [0] - https://iapp.org/media/pdf/resource_center/CCPA_GDPR_Chart_PracticalLaw_2019.pdf https://iapp.org/media/pdf/resource_center/CCPA_GDPR_Chart_P... [1] - https://www.theleaguesf.org/#Prop24 https://www.theleaguesf.org/#Prop24

fsflover 6y ago

https://ruben.verborgh.org/facebook/#history https://ruben.verborgh.org/facebook/#history

jskdvsksnb 6y ago

I worked on a compliance effort for a large-ish American tech company. Imagine a lot of boxes and arrows diagrams and plausible deniability. I was told we had to "balance risk", which in practice meant all data was available to everyone with no governance strategy. It was impossible to enumerate all the places data might be collected and stored, let alone find the appropriate person to handle the deletion request. We ended up basically handling the "happy path" and pretended the known unknowns didn't exist. This gave everyone enough plausible deniability to say "well the policy is X" with no means, technical or otherwise, of checking compliance.