3 ms·
Is there any way to know if any audit mechanism works before it's actually been put into practice? I share your concerns, but it seems a bit early to worry tha
by d4mi3n 3y ago
Is there any way to know if any audit mechanism works before it's actually been put into practice?
I share your concerns, but it seems a bit early to worry that auditing + lawsuit enforcement isn't worth giving a spin.
Do we have examples of similar legislation that has or hasn't been successful with similar contexts/enforcement? The closest examples I can think of are in finance, like fair lending laws or SOX compliance; both of which are heavily dependent on auditing data.
- mlyle 3y agoAs a sibling commenter puts out, a uniform deletion "certificate" or other notice that could be used as verification of requests would be useful to ensure that audits would have a corresponding record to use to determine what records should not be present. Then, data broker keeps a list of such deletion notices. If any of those notices ends up having data still stored, that's a violation. If any customer presents such a certificate but isn't in the list of such notices on the data broker, that could be a violation. This way there's an effective, enforceable mechanism. Otherwise, a broker can just lose deletion requests entirely and no one would know.