3 ms·
Either: 1) They aren't collecting personally identifiable information, and therefore don't fall within the scope of the GDPR, and therefore the cost of complia
by rlpb 4y ago
Either:
1) They aren't collecting personally identifiable information, and therefore don't fall within the scope of the GDPR, and therefore the cost of compliance is virtually nil
or:
2) They are collecting personally identifiable information. For just visiting their site, that's abuse.
> And what's your knowledge of their code stack and backends?
Not relevant.
- googlryas 4y agoI don't think there is an agreed upon definition of "personally identifiable information" at the edges, therefore I doubt that the GDPR got it right. For example, when the RIAA was suing everyone for pirating music...it was claimed by the tech community that an IP address is not enough to personally identify someone for a lawsuit. But the GDPR claims that IP addresses are PII. Which is correct? Our choices are live in a world where website operators can't log an IP address, but the RIAA or anybody can use an IP address to target someone for a lawsuit? Or we can live in a world where website operators can log an IP address, but the RIAA can't use an IP address to target someone for a lawsuit. And your knowledge of their backend is relevant, because you made a claim about its behavior - specifically that it would be easy to stop abuse for everyone. But what if parts of their system rely on, say, a logged IP address to aggregate some statistic that is important for the business folk? It might require reworking a large portion of their backend if they need to derive this non-abusive information in a different manner.