2 ms·
I mean, at our company, GDPR requests have to cost at least $50 a pop. It goes to a human team to review and process with a dedicated legal representative.
by legitster 4y ago
I mean, at our company, GDPR requests have to cost at least $50 a pop. It goes to a human team to review and process with a dedicated legal representative.
- olyjohn 4y agoNot my problem. You're the one collecting the data. You pay for the costs. Can't afford to collect my data? Go out of business then.
- legitster 4y agoWe have to process the request regardless of whether we actually have your data or not.
- smileysteve 4y agoseems like you should either make the lookup automatable or stop collecting. eu citizens wont have such a fee.
- legitster 4y ago>make the lookup automatable Yes we should. But there are a few too many systems, and we add and drop systems with such regularity that it would still be a non-stop engineering challenge. >stop collecting For the few records we do return as part of GDPR requests, they are usually associated to customer and billing data. I don't know how you run a business without that. > eu citizens wont have such a fee. They do and it's collected in the cost of higher product costs.
- micromacrofoot 4y agoIt's your problem until there's a law saying otherwise.
- gbear605 4y agoSounds like an appropriate cost of doing business with data. If you don’t want to pay for it, collect less data.
- prego_xo 4y agoVery fair point, and I understand the necessity of data collection in some cases. I do feel like that's a cost that's incurred voluntarily, though, and shouldn't fall on the shoulders of users/customers. Some people might not want data to be collected to begin with, so the cost ends up being your company's fault and not theirs.
- legitster 4y agoBut we have to process every request even if we do not find any of their data. A majority of requests are actually this way - people use online services that submit blanket removal requests.
- prego_xo 4y agoYeah, that's definitely the case and I see where the hassle is, but to restate my point, those costs are simply a part of overhead and not the business of users. Unless the users are given an opt-out first and foremost, they're owed ownership over their personal data.
- legitster 4y agoAgain, the language of the proposed bill is requiring 2 free requests per person. $100 for an occasional person? No biggie. Potentially infinite? That's a bit more than normal overhead. While we haven't seen this sort of DDoS attack through our GDPR process yet, the potential is already there if bad actors or competitors wanted to exploit it.