4 ms·

Most laws are fairly ambiguous. Jurisprudence and intent play a big role in the justice system, it works to protect people from wrongdoing and not as a strict l

by jiofih 6y ago

Most laws are fairly ambiguous. Jurisprudence and intent play a big role in the justice system, it works to protect people from wrongdoing and not as a strict logical set of rules. Being filmed in public, having your data handed to third-parties, facial recognition and mass surveillance are precisely some of the issues the GDPR has addressed, and it has already had massive impact; especially on tech companies (I’ve seen it firsthand). You talk about burdens but maybe you’re just angry you wasted money on a consultant? I honestly haven’t seen the bad side of it.

Silhouette 6y ago
While many laws are somewhat ambiguous, usually the intent is reasonably clear, and there are courts to decide cases where there is a disagreement about interpretation. The GDPR doesn't have either that clarity of intent or that independent, impartial form of adjudication. We didn't hire a consultant. Those guys were charging thousands per day, and no business our size has that kind of money to spend. We did take real legal advice from a real lawyer, but the main cost was our time understanding the new rules and updating things to be seen to be compliant. I am irritated that a lot of my own time, as a founder and at that time lead technical person for a business, was wasted on a bureaucratic exercise, and likewise for other key people. That hurt us, and once again, it benefitted no-one. Not our customers. Not our staff. Not our suppliers. Literally no-one was better off because, for example, we rewrote our documents to provide information in some new format that was specified by the GDPR. Personal irritation aside, even if you just took the cost to us and scaled it by the number of businesses in the country to estimate the economic impact, that would mean billions in lost productivity as a result of the new rules. And that's clearly an underestimate, as the costs were running into millions for a lot of large organisations. A law that is going to cause that kind of economic hit should be justified by a greater benefit to society in some way, but I just don't see that "massive impact" you mentioned. There have been a few incremental changes here and there, but there hasn't been a big change in culture. The attitude at bigger organisations is still often about how they can tick the required boxes while continuing to do what they want with the data. Just look at Facebook's resistance to even disclosing what personal data it has and how it's been using it, for example, despite data subjects having a clear right to that information under the GDPR. Tracking is still going on everywhere, and if anything it's getting worse as the technological capabilities increase. Ironically, it's recent actions by Apple, not the GDPR, that have started to make some significant improvements in this area for users on their platform. Small organisations are still often ignorant of their obligations under the GDPR and not compliant anyway. Governments are still encroaching further into individual privacy all the time. Individual privacy hasn't been improved at all in these kinds of situations. This will be my last comment on this thread, because HN tends to downvote any comments critical of the GDPR, even if based on direct personal experience of implementing it, and that doesn't encourage open and constructive discussion. But I hope the above helps to explain why I have reached a different conclusion about these issues to you.

by jiofih 6y ago

Silhouette 6y ago

While many laws are somewhat ambiguous, usually the intent is reasonably clear, and there are courts to decide cases where there is a disagreement about interpretation. The GDPR doesn't have either that clarity of intent or that independent, impartial form of adjudication. We didn't hire a consultant. Those guys were charging thousands per day, and no business our size has that kind of money to spend. We did take real legal advice from a real lawyer, but the main cost was our time understanding the new rules and updating things to be seen to be compliant. I am irritated that a lot of my own time, as a founder and at that time lead technical person for a business, was wasted on a bureaucratic exercise, and likewise for other key people. That hurt us, and once again, it benefitted no-one. Not our customers. Not our staff. Not our suppliers. Literally no-one was better off because, for example, we rewrote our documents to provide information in some new format that was specified by the GDPR. Personal irritation aside, even if you just took the cost to us and scaled it by the number of businesses in the country to estimate the economic impact, that would mean billions in lost productivity as a result of the new rules. And that's clearly an underestimate, as the costs were running into millions for a lot of large organisations. A law that is going to cause that kind of economic hit should be justified by a greater benefit to society in some way, but I just don't see that "massive impact" you mentioned. There have been a few incremental changes here and there, but there hasn't been a big change in culture. The attitude at bigger organisations is still often about how they can tick the required boxes while continuing to do what they want with the data. Just look at Facebook's resistance to even disclosing what personal data it has and how it's been using it, for example, despite data subjects having a clear right to that information under the GDPR. Tracking is still going on everywhere, and if anything it's getting worse as the technological capabilities increase. Ironically, it's recent actions by Apple, not the GDPR, that have started to make some significant improvements in this area for users on their platform. Small organisations are still often ignorant of their obligations under the GDPR and not compliant anyway. Governments are still encroaching further into individual privacy all the time. Individual privacy hasn't been improved at all in these kinds of situations. This will be my last comment on this thread, because HN tends to downvote any comments critical of the GDPR, even if based on direct personal experience of implementing it, and that doesn't encourage open and constructive discussion. But I hope the above helps to explain why I have reached a different conclusion about these issues to you.