5 ms·

Easy peasy unless your system was built before it became illegal to "haphazardly" process PII. Even organization that take GDPR very seriously and invest a lot

Easy peasy unless your system was built before it became illegal to "haphazardly" process PII. Even organization that take GDPR very seriously and invest a lot on compliance do not generally really know all the places where their legacy systems are storing PII. The law is draconian.

dmitriid 4y ago
> Easy peasy unless your system was built before it became illegal to "haphazardly" process PII. - GDPR-like legislation existed in most EU countries waaaaaay before GDPR. - It was known for years that GDPR is coming. - GDPR specifically gave companies two years after going in effect to get their act in order. - We are now 4 years after GDPR went in effect. If you're still complaining that it's "a drakonian law that doesn't let your company do haphazard PII processing aka collecting PII wholesale with no consent", then you company deserves to be sued and fined out of existence.
- orwin 4y ago
  And the watchdogs are helpful. At my previous company, they basically spend 2 man-day (10 hour hands on deck) helping us drafting a compliant architecture document.
mmarq 4y ago
If you are found in breach, the regulator would approach you in good faith and assuming you are in good faith. You will be given time to fix your systems and the regulator would allow some back and forth to get to the right result. In order to get a fine you have to act evidently in bad faith or to lose your users’ PII or credit card information. People don’t get fined billions because a legacy system saves an email address in the wrong table.
remus 4y ago
> Even organization that take GDPR very seriously and invest a lot on compliance do not generally really know all the places where their legacy systems are storing PII. The law is draconian. I think this is an extremely poor excuse. You're basically saying they don't understand their systems well enough. It is like a chemical company blaming environmental legislation when they've left barrels of polluting chemicals all over the place and not kept track of them.

dmitriid 4y ago

> Easy peasy unless your system was built before it became illegal to "haphazardly" process PII. - GDPR-like legislation existed in most EU countries waaaaaay before GDPR. - It was known for years that GDPR is coming. - GDPR specifically gave companies two years after going in effect to get their act in order. - We are now 4 years after GDPR went in effect. If you're still complaining that it's "a drakonian law that doesn't let your company do haphazard PII processing aka collecting PII wholesale with no consent", then you company deserves to be sued and fined out of existence.

orwin 4y ago
And the watchdogs are helpful. At my previous company, they basically spend 2 man-day (10 hour hands on deck) helping us drafting a compliant architecture document.

mmarq 4y ago

If you are found in breach, the regulator would approach you in good faith and assuming you are in good faith. You will be given time to fix your systems and the regulator would allow some back and forth to get to the right result. In order to get a fine you have to act evidently in bad faith or to lose your users’ PII or credit card information. People don’t get fined billions because a legacy system saves an email address in the wrong table.

remus 4y ago

> Even organization that take GDPR very seriously and invest a lot on compliance do not generally really know all the places where their legacy systems are storing PII. The law is draconian. I think this is an extremely poor excuse. You're basically saying they don't understand their systems well enough. It is like a chemical company blaming environmental legislation when they've left barrels of polluting chemicals all over the place and not kept track of them.