3 ms·
In order to enforce by lawsuit, the people who have standing to sue (or a regulator acting on their behalf) need to somehow know that an organization is out of
by mlyle 4y ago
In order to enforce by lawsuit, the people who have standing to sue (or a regulator acting on their behalf) need to somehow know that an organization is out of compliance.
For the ADA, you can see whether there's enough parking spaces or whether the ramp is legal or whether you were denied a reasonable accommodation.
Here, there's a mandatory audit mechanism, but it's unclear whether the proper recordkeeping will be required to really allow issues to be spotted at audit.
- d4mi3n 4y agoIs there any way to know if any audit mechanism works before it's actually been put into practice? I share your concerns, but it seems a bit early to worry that auditing + lawsuit enforcement isn't worth giving a spin. Do we have examples of similar legislation that has or hasn't been successful with similar contexts/enforcement? The closest examples I can think of are in finance, like fair lending laws or SOX compliance; both of which are heavily dependent on auditing data.
- mlyle 4y agoAs a sibling commenter puts out, a uniform deletion "certificate" or other notice that could be used as verification of requests would be useful to ensure that audits would have a corresponding record to use to determine what records should not be present. Then, data broker keeps a list of such deletion notices. If any of those notices ends up having data still stored, that's a violation. If any customer presents such a certificate but isn't in the list of such notices on the data broker, that could be a violation. This way there's an effective, enforceable mechanism. Otherwise, a broker can just lose deletion requests entirely and no one would know.