7 ms·

This article is excessively negative on the effectiveness of the law. I would say the biggest issue is inconsistent enforcement by DPAs. The other problems are

by paol 4y ago

This article is excessively negative on the effectiveness of the law. I would say the biggest issue is inconsistent enforcement by DPAs. The other problems are overstated. Believe me, as someone who sees things from the inside of european companies, compliance is still taken very seriously.

lupire 4y ago
Note that is this an activist website, not an EU government web site.
vesinisa 4y ago
I hear you. These so-called "privacy activists" seem to have no clue how much European corporations are spending on data management, privacy controls, legal due diligence and finally serving the customers' GDPR requests. The last one is the publicly visible part, but it really is just the tip of an iceberg in investment on compliance. This is made even more frustrating by that at least I find GDPR to be not very precise. There are lots of corner cases where it's not clear if some data is covered or not. The strictest interpretations would easily obsolete / criminalize vast majority of ALL software that people today absolutely depend on for their daily lives - like various financial backbone systems - and which largely predate the GDPR. It's hard to not find the regulation a joke - sadly. While GDPR is not precise, I won't even go into the details about the ridiculous cookie law and the braindead portions of the new 2019 digital copyright directive (that French publishers lobbied in to hurt Google News). If GDPR left you in doubt, that idiocy really showed that these EU bureaucrats are completely out of touch with the reality in the field of technology they want to control.
- matthewmacleod 4y ago
  If GDPR left you in doubt, that idiocy really showed that these EU bureaucrats are completely out of touch with the reality in the field of technology they want to control. Honestly, the main thing it revealed is how little value a particular segment of the technology community places on protection of individuals' data. It's actually hard for me to think of any better example of regulation that is designed and written to be in-tune with the technology involved.
- dmitriid 4y ago
  You're the prime example of what's written in the article: belittling the effort, pretending it's hard to comply with etc. etc.
- riedel 4y ago
  I think the GDPR is pretty clear: it is illegal to process personal data if you cannot apply an exception listed in the regulation. Also all data that might be deanonymized by some means is personal data. The message is clear: if you put others at risk, you are at risk to get fined. Yes, this makes many, sometimes ideotic things, illegal. But not I also cross a red light on foot from time to time and I do not think it should be made legal. Regulations that leave a freedom what to prosecute are not bad by design.
  - vesinisa 4y ago
    Yes, GDPR is very clear until it's not. Tell me for example how would you respect the right to be forgotten for web server access logs? The information "IP x.y.z requested /index.html at dd/mm/yyyy" is PII under GDPR. Meaning you have to a) declare that you are collecting it, b) be able to produce all data for the person using IP x.y.z upon request, and c) be able to delete all log rows relating to x.y.z when they ask you to. Unless you have built your system from ground up with this requirement in mind, chances are you are in breach of GDPR. > But not I also cross a red light on foot from time to time and I do not think it should be made legal. Regulations that leave a freedom what to prosecute are not bad by design. This is not comparable as private citizens are able to petition and sue under GDPR. Hence, there is no similar discretion of what actually gets prosecuted as for jaywalking. It would be comparable if I, as a driver of a vehicle, was able to take any jaywalker to court. Which would be indeed complete madness.
    - tomschwiha 4y ago
      Couldn't you for log requests just delete them after 24 hours? So at least you don't need to care for the right to be forgotten. Or instantly sanitize the IP so its not identifyable. In which case is the IP address in the access log helpful?
      - vesinisa 4y ago
        These are all valid and sensible solutions if you are building a greenfield system. But GDPR applies to all systems, even those that were build years before its inception and the developers of whose could not in a million years have imagined that one day some crazy bureaucrats would criminalize logging IPs. Now think about even a moderately sized enterprise, that runs gazillions of individual apps (in-house, vendor-provided and SaaS), and the work required to auditting all the places you need clean when you want to delete all logs containing one IP. And that's just one small aspect of becoming fully compliant, there are millions of other types of surprising data that can be PII, and hence a liability, under GDPR. Email and IM apps, like Slack, are another interesting conundrum. Under GDPR, a customer should be able to request that all emails and Slack messages that contain/discuss his/her personal information must be a) discoverable and b) erasable. How do you even begin to solve that is beyond me..
- bee_rider 4y ago
  One option would be to collect less data on users, which should make it easier to manage.
  - vesinisa 4y ago
    Easy peasy unless your system was built before it became illegal to "haphazardly" process PII. Even organization that take GDPR very seriously and invest a lot on compliance do not generally really know all the places where their legacy systems are storing PII. The law is draconian.
    - dmitriid 4y ago
      > Easy peasy unless your system was built before it became illegal to "haphazardly" process PII. - GDPR-like legislation existed in most EU countries waaaaaay before GDPR. - It was known for years that GDPR is coming. - GDPR specifically gave companies two years after going in effect to get their act in order. - We are now 4 years after GDPR went in effect. If you're still complaining that it's "a drakonian law that doesn't let your company do haphazard PII processing aka collecting PII wholesale with no consent", then you company deserves to be sued and fined out of existence.
      - orwin 4y ago
        And the watchdogs are helpful. At my previous company, they basically spend 2 man-day (10 hour hands on deck) helping us drafting a compliant architecture document.
    - mmarq 4y ago
      If you are found in breach, the regulator would approach you in good faith and assuming you are in good faith. You will be given time to fix your systems and the regulator would allow some back and forth to get to the right result. In order to get a fine you have to act evidently in bad faith or to lose your users’ PII or credit card information. People don’t get fined billions because a legacy system saves an email address in the wrong table.
    - 4y ago
JumpCrisscross 4y ago
> the biggest issue is inconsistent enforcement by DPAs. The other problems are overstated. Wasn't this called out repeatedly over the years and obvious from the start? That a double forum shopping model will produce paperwork and voluntary compliance, in cases where the offender literally didn't know they were misbehaving, but little real action?
- riedel 4y ago
  Just want to point out that this not an issue only between European countries but also a problem e.g. inside Germany. [1]: a major information breach at a car rental company went with literary no consequences, while other cases get fined so high that they can easily fight decisions in court. I understand people if they complain about GDPR because it produces paperwork but in the end nobody cares about it. A central European regulation might sound nice at first, but if you even can receive not even a symbolic fine for a clear breach because a DPA has pitty with you something is fishy... [1] https://www.heise.de/news/Kein-Bussgeld-fuer-die-Datenpanne-bei-Buchbinder-7072949.html https://www.heise.de/news/Kein-Bussgeld-fuer-die-Datenpanne-...
  - JumpCrisscross 4y ago
    > also a problem e.g. inside Germany. [1]: a major information breach at a car rental company went with literary no consequences, while other cases get fined so high that they can easily fight decisions in court This is the problem of German regulators being too cozy with incumbents. (Also see: Wirecard.) It's related, in that if you're one of the incumbents a regulator is cozy with, you're going to fight to switch forum to Germany. But it's a different problem with different solutions.
    - Radim 4y ago
      Indeed. NOYB's fight with the Irish Data Protection Commission is already legendary: https://techcrunch.com/2021/12/20/facebook-transfers-impact-assessment-noyb/ https://techcrunch.com/2021/12/20/facebook-transfers-impact-... https://noyb.eu/en/irish-dpc-burns-taxpayer-money-over-delay-cases https://noyb.eu/en/irish-dpc-burns-taxpayer-money-over-delay... (DPC = the official Irish body who should be responsible for enforcing GDPR… in bed with Facebook instead. Somewhere between shameful and criminal.)

by paol 4y ago

lupire 4y ago

Note that is this an activist website, not an EU government web site.

vesinisa 4y ago

I hear you. These so-called "privacy activists" seem to have no clue how much European corporations are spending on data management, privacy controls, legal due diligence and finally serving the customers' GDPR requests. The last one is the publicly visible part, but it really is just the tip of an iceberg in investment on compliance. This is made even more frustrating by that at least I find GDPR to be not very precise. There are lots of corner cases where it's not clear if some data is covered or not. The strictest interpretations would easily obsolete / criminalize vast majority of ALL software that people today absolutely depend on for their daily lives - like various financial backbone systems - and which largely predate the GDPR. It's hard to not find the regulation a joke - sadly. While GDPR is not precise, I won't even go into the details about the ridiculous cookie law and the braindead portions of the new 2019 digital copyright directive (that French publishers lobbied in to hurt Google News). If GDPR left you in doubt, that idiocy really showed that these EU bureaucrats are completely out of touch with the reality in the field of technology they want to control.

matthewmacleod 4y ago
If GDPR left you in doubt, that idiocy really showed that these EU bureaucrats are completely out of touch with the reality in the field of technology they want to control. Honestly, the main thing it revealed is how little value a particular segment of the technology community places on protection of individuals' data. It's actually hard for me to think of any better example of regulation that is designed and written to be in-tune with the technology involved.
dmitriid 4y ago
You're the prime example of what's written in the article: belittling the effort, pretending it's hard to comply with etc. etc.
riedel 4y ago
I think the GDPR is pretty clear: it is illegal to process personal data if you cannot apply an exception listed in the regulation. Also all data that might be deanonymized by some means is personal data. The message is clear: if you put others at risk, you are at risk to get fined. Yes, this makes many, sometimes ideotic things, illegal. But not I also cross a red light on foot from time to time and I do not think it should be made legal. Regulations that leave a freedom what to prosecute are not bad by design.
- vesinisa 4y ago
  Yes, GDPR is very clear until it's not. Tell me for example how would you respect the right to be forgotten for web server access logs? The information "IP x.y.z requested /index.html at dd/mm/yyyy" is PII under GDPR. Meaning you have to a) declare that you are collecting it, b) be able to produce all data for the person using IP x.y.z upon request, and c) be able to delete all log rows relating to x.y.z when they ask you to. Unless you have built your system from ground up with this requirement in mind, chances are you are in breach of GDPR. > But not I also cross a red light on foot from time to time and I do not think it should be made legal. Regulations that leave a freedom what to prosecute are not bad by design. This is not comparable as private citizens are able to petition and sue under GDPR. Hence, there is no similar discretion of what actually gets prosecuted as for jaywalking. It would be comparable if I, as a driver of a vehicle, was able to take any jaywalker to court. Which would be indeed complete madness.
  - tomschwiha 4y ago
    Couldn't you for log requests just delete them after 24 hours? So at least you don't need to care for the right to be forgotten. Or instantly sanitize the IP so its not identifyable. In which case is the IP address in the access log helpful?
    - vesinisa 4y ago
      These are all valid and sensible solutions if you are building a greenfield system. But GDPR applies to all systems, even those that were build years before its inception and the developers of whose could not in a million years have imagined that one day some crazy bureaucrats would criminalize logging IPs. Now think about even a moderately sized enterprise, that runs gazillions of individual apps (in-house, vendor-provided and SaaS), and the work required to auditting all the places you need clean when you want to delete all logs containing one IP. And that's just one small aspect of becoming fully compliant, there are millions of other types of surprising data that can be PII, and hence a liability, under GDPR. Email and IM apps, like Slack, are another interesting conundrum. Under GDPR, a customer should be able to request that all emails and Slack messages that contain/discuss his/her personal information must be a) discoverable and b) erasable. How do you even begin to solve that is beyond me..
bee_rider 4y ago
One option would be to collect less data on users, which should make it easier to manage.
- vesinisa 4y ago
  Easy peasy unless your system was built before it became illegal to "haphazardly" process PII. Even organization that take GDPR very seriously and invest a lot on compliance do not generally really know all the places where their legacy systems are storing PII. The law is draconian.
  - dmitriid 4y ago
    > Easy peasy unless your system was built before it became illegal to "haphazardly" process PII. - GDPR-like legislation existed in most EU countries waaaaaay before GDPR. - It was known for years that GDPR is coming. - GDPR specifically gave companies two years after going in effect to get their act in order. - We are now 4 years after GDPR went in effect. If you're still complaining that it's "a drakonian law that doesn't let your company do haphazard PII processing aka collecting PII wholesale with no consent", then you company deserves to be sued and fined out of existence.
    - orwin 4y ago
      And the watchdogs are helpful. At my previous company, they basically spend 2 man-day (10 hour hands on deck) helping us drafting a compliant architecture document.
  - mmarq 4y ago
    If you are found in breach, the regulator would approach you in good faith and assuming you are in good faith. You will be given time to fix your systems and the regulator would allow some back and forth to get to the right result. In order to get a fine you have to act evidently in bad faith or to lose your users’ PII or credit card information. People don’t get fined billions because a legacy system saves an email address in the wrong table.
  - 4y ago

JumpCrisscross 4y ago

> the biggest issue is inconsistent enforcement by DPAs. The other problems are overstated. Wasn't this called out repeatedly over the years and obvious from the start? That a double forum shopping model will produce paperwork and voluntary compliance, in cases where the offender literally didn't know they were misbehaving, but little real action?

riedel 4y ago
Just want to point out that this not an issue only between European countries but also a problem e.g. inside Germany. [1]: a major information breach at a car rental company went with literary no consequences, while other cases get fined so high that they can easily fight decisions in court. I understand people if they complain about GDPR because it produces paperwork but in the end nobody cares about it. A central European regulation might sound nice at first, but if you even can receive not even a symbolic fine for a clear breach because a DPA has pitty with you something is fishy... [1] https://www.heise.de/news/Kein-Bussgeld-fuer-die-Datenpanne-bei-Buchbinder-7072949.html https://www.heise.de/news/Kein-Bussgeld-fuer-die-Datenpanne-...
- JumpCrisscross 4y ago
  > also a problem e.g. inside Germany. [1]: a major information breach at a car rental company went with literary no consequences, while other cases get fined so high that they can easily fight decisions in court This is the problem of German regulators being too cozy with incumbents. (Also see: Wirecard.) It's related, in that if you're one of the incumbents a regulator is cozy with, you're going to fight to switch forum to Germany. But it's a different problem with different solutions.
  - Radim 4y ago
    Indeed. NOYB's fight with the Irish Data Protection Commission is already legendary: https://techcrunch.com/2021/12/20/facebook-transfers-impact-assessment-noyb/ https://techcrunch.com/2021/12/20/facebook-transfers-impact-... https://noyb.eu/en/irish-dpc-burns-taxpayer-money-over-delay-cases https://noyb.eu/en/irish-dpc-burns-taxpayer-money-over-delay... (DPC = the official Irish body who should be responsible for enforcing GDPR… in bed with Facebook instead. Somewhere between shameful and criminal.)