4 ms·

And you dont need to have one: .... hiring an actual Data Protection Officer is only required by the GDPR if you meet one of three criteria: * Public author

And you dont need to have one: .... hiring an actual Data Protection Officer is only required by the GDPR if you meet one of three criteria: * Public authority — The processing of personal data is done by a public body or public authorities, with exemptions granted to courts and other independent judicial authorities. * Large scale, regular monitoring — The processing of personal data is the core activity of an organization who regularly and systematically observes its “data subjects” (which, under the GDPR, means citizens or residents of the EU) on a large scale. * Large-scale special data categories — The processing of specific “special” data categories (as defined by the GDPR) is part of an organization’s core activity and is done on a large scale. https://gdpr.eu/data-protection-officer/ https://gdpr.eu/data-protection-officer/

jchw 5y ago
This is good to know. But while I will admit my mistake, the problem points to a bigger issue, which is, as a layperson and not an expert on European law, I simply do not have the expertise necessary to understand the law and its implications. This is of course true of any website under any jurisdiction, but most laws don’t come with such absurdly vicious teeth, and therefore the risk profile is a lot different. So perhaps my example was misinformed. But that’s kind of the problem: you need to have a lawyer to really be sure of these things. I don’t have a lawyer.
- amichal 5y ago
  I think the fines/penalty headlines are a big misunderstanding/distraction (which got me too until I had to spend the time on reading the actual law for an actual EU client). They are what happens if you continually, willfully disobey the principal of the laws AND are also proportional to you income (see https://en.wikipedia.org/wiki/Day-fine https://en.wikipedia.org/wiki/Day-fine which are common in some EU countries) If you are a small operator who messes up AND you are in the EU and you ignore strongly worded letters of warning with instructions on what you need to do to comply then you MIGHT be fined/penalized. If you are not making money in the EU than you are seriously unlikely to even be noticed messing up. If you miss-configured the logs on your blog or small non-EU business and kept user ids and IP addresses AND are outside the EU no one will bother you. If a privacy conscious EU citizen contacts you to close an account they made with you or delete your data you have many weeks (90 days i think ultimately) to respond, negotiate and do your best to get it done (and provide them whatever data you may have collected on them) If you have any of a dozen legitimate reasons to have personal data and you clearly explained this to the EU citizens you collected data from you are not going to hear from anyone. e.g. a EU company I work with has extensive logs of their employees changes and updates to data (imagine git commit messages). These are required logs for the business, an ex-employee cannot ask you delete that history under GDPR. Same for their b2b customers. The existence of these logs are made clear up front. It's a regulated requirement that they exist etc. If you decided to sell the log data to a third party as part of some profile of the citizen and you didnt say you intended to do that then you ABSOLUTELY would hear from someone. But I would think you very much should and this is the point. Same principles apply for California Consumer Privacy Act (CCPA) in the US.

jchw 5y ago

This is good to know. But while I will admit my mistake, the problem points to a bigger issue, which is, as a layperson and not an expert on European law, I simply do not have the expertise necessary to understand the law and its implications. This is of course true of any website under any jurisdiction, but most laws don’t come with such absurdly vicious teeth, and therefore the risk profile is a lot different. So perhaps my example was misinformed. But that’s kind of the problem: you need to have a lawyer to really be sure of these things. I don’t have a lawyer.

amichal 5y ago
I think the fines/penalty headlines are a big misunderstanding/distraction (which got me too until I had to spend the time on reading the actual law for an actual EU client). They are what happens if you continually, willfully disobey the principal of the laws AND are also proportional to you income (see https://en.wikipedia.org/wiki/Day-fine https://en.wikipedia.org/wiki/Day-fine which are common in some EU countries) If you are a small operator who messes up AND you are in the EU and you ignore strongly worded letters of warning with instructions on what you need to do to comply then you MIGHT be fined/penalized. If you are not making money in the EU than you are seriously unlikely to even be noticed messing up. If you miss-configured the logs on your blog or small non-EU business and kept user ids and IP addresses AND are outside the EU no one will bother you. If a privacy conscious EU citizen contacts you to close an account they made with you or delete your data you have many weeks (90 days i think ultimately) to respond, negotiate and do your best to get it done (and provide them whatever data you may have collected on them) If you have any of a dozen legitimate reasons to have personal data and you clearly explained this to the EU citizens you collected data from you are not going to hear from anyone. e.g. a EU company I work with has extensive logs of their employees changes and updates to data (imagine git commit messages). These are required logs for the business, an ex-employee cannot ask you delete that history under GDPR. Same for their b2b customers. The existence of these logs are made clear up front. It's a regulated requirement that they exist etc. If you decided to sell the log data to a third party as part of some profile of the citizen and you didnt say you intended to do that then you ABSOLUTELY would hear from someone. But I would think you very much should and this is the point. Same principles apply for California Consumer Privacy Act (CCPA) in the US.