4 ms·

For larger businesses, relying on whistleblowers or auditing might be one way. For smaller ones using tools like the one discussed here. Or maybe a browser plug

by janto 5y ago

For larger businesses, relying on whistleblowers or auditing might be one way. For smaller ones using tools like the one discussed here. Or maybe a browser plugin that automatically notifies visitors. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ "... is an overview of fines and penalties which data protection authorities within the EU have imposed under the EU [GDPR]"

rpdillon 5y ago
Ah, I see, I think we're talking past one another. I was critiquing this approach from a technical perspective, since once data is sent over the wire, I don't know of any good way to figure out what's being done with it, and whether in complies with any given policy (including GDPR). E.g. we can see if the _browser_ is connecting to Cloudflare in the US, but what if a connection to a US server is happening on the backend? If I'm understanding your point, it's more along the lines of: "Lots of people are looking into this sort of thing, and we can aggregate resources about their findings." This makes sense to me, but wasn't what I was intending to critique.
- janto 5y ago
  There can indeed be lots of magic going on in a backend and various ways GDPR violations may or may not be discovered. Here's an amusing 320k euro fine https://ico.org.uk/media/action-weve-taken/enforcement-notices/2616741/doorstop-en-20191217.pdf https://ico.org.uk/media/action-weve-taken/enforcement-notic... On 24 July 2018 the MHRA had executed a search warrant at the premises of Doorstep Dispensaree under the Human Medicines Regulations. In the course of its search, the MHRA discovered, stored in a rear courtyard, 47 crates, 2 disposal bags and 1 cardboard box full of documents containing personal data. MHRA estimated approximately 500,000 documents but cannot estimate the number of data subjects. MHRA have inspected the crates and the information contains: a. Names b. Addresses c. Dates of Birth d. NHS Numbers e. Medical Information f. Prescriptions The dates on the documents range from January 2016 - June 2018. The documents were not secure and they were not marked as confidential waste. Some of the documents were soaking wet, indicating that they had been stored in this way for some time. I doubt there is a purely technical solution to finding this kind of problem :) Edit: to be clear, the violation type here seems to have been "Insufficient technical and organisational measures to ensure information security"

by janto 5y ago

rpdillon 5y ago

Ah, I see, I think we're talking past one another. I was critiquing this approach from a technical perspective, since once data is sent over the wire, I don't know of any good way to figure out what's being done with it, and whether in complies with any given policy (including GDPR). E.g. we can see if the _browser_ is connecting to Cloudflare in the US, but what if a connection to a US server is happening on the backend? If I'm understanding your point, it's more along the lines of: "Lots of people are looking into this sort of thing, and we can aggregate resources about their findings." This makes sense to me, but wasn't what I was intending to critique.

janto 5y ago
There can indeed be lots of magic going on in a backend and various ways GDPR violations may or may not be discovered. Here's an amusing 320k euro fine https://ico.org.uk/media/action-weve-taken/enforcement-notices/2616741/doorstop-en-20191217.pdf https://ico.org.uk/media/action-weve-taken/enforcement-notic... On 24 July 2018 the MHRA had executed a search warrant at the premises of Doorstep Dispensaree under the Human Medicines Regulations. In the course of its search, the MHRA discovered, stored in a rear courtyard, 47 crates, 2 disposal bags and 1 cardboard box full of documents containing personal data. MHRA estimated approximately 500,000 documents but cannot estimate the number of data subjects. MHRA have inspected the crates and the information contains: a. Names b. Addresses c. Dates of Birth d. NHS Numbers e. Medical Information f. Prescriptions The dates on the documents range from January 2016 - June 2018. The documents were not secure and they were not marked as confidential waste. Some of the documents were soaking wet, indicating that they had been stored in this way for some time. I doubt there is a purely technical solution to finding this kind of problem :) Edit: to be clear, the violation type here seems to have been "Insufficient technical and organisational measures to ensure information security"