4 ms·

I will take your point, but I'd say you also need to account for how the GDPR has been enforced to this point. I regularly submit complaints to supervisory auth

by _cenw 3y ago

I will take your point, but I'd say you also need to account for how the GDPR has been enforced to this point. I regularly submit complaints to supervisory authorities and I've been employed by a few companies that regularly have meetings with their local SAs for guidance regarding potential pitfalls. Most enforcement is directed towards total disregard of the GDPR. Data that hasn't been properly deleted after requests, requests that go unanswered, and entities like Meta who think their legitimate interest towers over protected categories of information (i.e. allowing microtargeting based on health). Companies also get away with a lot of easy to see violations (i.e. I've complained about Microsoft doing dark patterns to obscure whether agreeing to data collection is a requirement for a service to work). Usually you'll be fine if you understand the basic framework and intent. And I'm not sure how you get to 88 pages. It comes out to 68 pages with very generous margins and a line-height of 22pt on A4 for me.[1] (also, all EU law, including translated judgements, is canonical in all member state languages, FYI) [1]: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504&qid=1688752895008 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

Silhouette 3y ago
I will take your point, but I'd say you also need to account for how the GDPR has been enforced to this point. ... Most enforcement is directed towards total disregard of the GDPR. I agree this is true. And at least here in the UK the regulators appear to be acting in good faith and according to the spirit of the law. However I don't like the principle that not enforcing a bad rule somehow makes it better. If something doesn't need to be enforced then it doesn't need to be a rule at all. Then it can't be selectively and possibly punitively enforced against someone the authorities take a dislike to or simply because of a bureaucratic mistake caused by incompetence rather than malice. Moreover having rules that are rarely enforced effectively penalises those who do make a good faith effort to comply but probably would not have suffered any ill effects if they had not done so. They're being penalised by paying extra compliance costs for trying to do "the right thing" and that doesn't seem like a good idea to me. In a business context it is literally giving a direct financial advantage to competitors who bend or outright ignore the rules and get away with it. And I'm not sure how you get to 88 pages. Official PDF: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...
- _cenw 3y ago
  The actual text starts on page 32. Also, legal texts are the always longer than a conceptual tl;dr of them. Covering for all eventualities. It's not a flaw of the legislation itself that some boilerplate is required. Also, a lot of it is contextually relevant (e.g. there's entire sections for regulating specific industries). Your average contract contains the same boilerplate by percentage.

by _cenw 3y ago

Silhouette 3y ago

I will take your point, but I'd say you also need to account for how the GDPR has been enforced to this point. ... Most enforcement is directed towards total disregard of the GDPR. I agree this is true. And at least here in the UK the regulators appear to be acting in good faith and according to the spirit of the law. However I don't like the principle that not enforcing a bad rule somehow makes it better. If something doesn't need to be enforced then it doesn't need to be a rule at all. Then it can't be selectively and possibly punitively enforced against someone the authorities take a dislike to or simply because of a bureaucratic mistake caused by incompetence rather than malice. Moreover having rules that are rarely enforced effectively penalises those who do make a good faith effort to comply but probably would not have suffered any ill effects if they had not done so. They're being penalised by paying extra compliance costs for trying to do "the right thing" and that doesn't seem like a good idea to me. In a business context it is literally giving a direct financial advantage to competitors who bend or outright ignore the rules and get away with it. And I'm not sure how you get to 88 pages. Official PDF: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...

_cenw 3y ago
The actual text starts on page 32. Also, legal texts are the always longer than a conceptual tl;dr of them. Covering for all eventualities. It's not a flaw of the legislation itself that some boilerplate is required. Also, a lot of it is contextually relevant (e.g. there's entire sections for regulating specific industries). Your average contract contains the same boilerplate by percentage.