5 ms·

I've done a lot of compliance work, and the laws are _very clearly_ worded. This is definitely a case of "let's see what we can get away with"

• franciscop 5y ago
  Exactly, I don't know what people are saying (well, I smell an agenda) but the GDPR is the easiest "specification" I've read.
  • arkh 5y ago
    But if you can't be bothered to read a RFC, 40ish pages of GDPR will be too much for you. You've got code to write, reading and learning is for schmucks.
  • usr1106 5y ago
    These fines have nothing to do with GDPR. GDPR introduced one stop shopping with EU for data controllers. Google does that in Ireland. GDPR is a regulation, legally binding all over EU. And for others offering services to EU residents, although that's probably unenforcable. When they get fined in France the basis is a French law. Probably a law to implement an EU directive. The cookies directive (don't remember the official name) is older than and different from GDPR.
• LunaSea 5y ago
  This is wrong. The GDPR is anything but clear.
  • chmod775 5y ago
    What specifically isn't clear to you?
    • LunaSea 5y ago
      Situations like needing signed pre-approval of all your customers in a data controller position or giving the possibility to refuse when you act as a sub processor and need to update your own subprocessors.
      • vntok 5y ago
        What isn't clear about these situations?
        • LunaSea 5y ago
          It is so clear cut that the situation I described is illegal. Sub-processors are not allowed to sign data processing agreements. So not that clear it would seem ...
      • avianlyric 5y ago
        That sounds pretty clear cut to me. Sounds like a pain to implement, but the requirements are simple enough.
        • LunaSea 5y ago
          It is so clear cut that the situation I described is illegal. Sub-processors are not allowed to sign data processing agreements. So not that clear it would seem ...
          • avianlyric 5y ago
            That’s because you’re trying to do something fundamentally unsafe. A data controller is responsible for all the data they control and how it’s processed, as a result it needs to control and vet the entire data processing chain, regardless of how many processors or sub-processors there are. If GDPR allows controllers to slip out of their obligations by using sub-contractors to firewall their legal responsibilities, then it would be useless as a data protection law. If you want to run a data processor that relies of byzantine structures in an attempt to create plausible deniability, then you’re gonna have a bad time. Ultimately this is just a problem of dependency resolution, and conflicting dependency requirements, but it’s an unavoidable problem if you want to have truly accountable data controllers. Accountability is far more important than operational convenience. Remember GDPR exists to protect EU citizens, not businesses. It explicitly makes life hard for business, to ensure protection for citizens. Don’t like it, then leave, go exploit some other population.