4 ms·
As someone who has to make product/technical decisions in this space, my experience is that the regulation is so far removed from the technical/physical reality
by bennyelv 3y ago
As someone who has to make product/technical decisions in this space, my experience is that the regulation is so far removed from the technical/physical reality that it becomes impossible to work out what you're supposed to do.
Add to that the complete lack of case law and previous judgements, and you end up in a situation where you can either ignore the regulation and take the risk that no enforcement will happen, or you're so hamstrung that you can't be competitive.
Some examples:
PECR regulation 6 (https://www.legislation.gov.uk/uksi/2003/2426/regulation/6/made https://www.legislation.gov.uk/uksi/2003/2426/regulation/6/m...) - You cannot "gain access to information stored, in the terminal equipment..." without consent. Does this mean I can't have a script that makes a request back to me where that request involves information that was stored in a variable? What about browser properties accessible to javascript? Do I need consent for those? What about the fact that the browser sends me "information stored" whenever it sends an HTTP request and everything other than the initial download of an HTML file is triggered by the contents of that file which I created?
How is one supposed to navigate this minefield? Each DPA publishes guidance about use of cookies and not much else and leaves everyone to try and work out whether a specific technical thing is allowed or not under regulation which is completely woolly and loosely defined.
If you're not based in the EU and don't have any subsidiaries there, you can just ignore it and get on with your life because enforcement isn't practical despite the fact that the regulation claims that it applies to any enterprise which is processing the personal data of EU citizens regardless of where they're based. If you are based in the EU, then you have to try and work out all the answers to these questions at great expense with no way of knowing whether you got it right or you're going to get hit with a big fine in the future because a judge somewhere doesn't agree with your interpretation.
The whole thing is a hot mess that achieves absolutely nothing at the moment.