4 ms·

> The very people who comply with and execute the GDPR consider it to be positive for their company, positive for privacy and not a pointless, bureaucratic regu

> The very people who comply with and execute the GDPR consider it to be positive for their company, positive for privacy and not a pointless, bureaucratic regulation. It's their job to do GDPR, of course they consider it a positive.

gatinsama 2y ago
So, regulators consider that regulating is good. Science is amazing, really.
- bojan 2y ago
  Not just regulators, I'm a developer in the EU and I find GDPR a great thing. I have yet to find a fellow developer here that disagrees. Yes, it can sometimes be a hassle to comply with it. But it's a no-brainer that it's a good idea. In that sense is this site a bit of a bubble. In real life it's not even a discussion.
  - ranger_danger 2y ago
    > I find GDPR a great thing. I have yet to find a fellow developer here that disagrees. Besides compliance costs, operational complexity, impact on small businesses, inconsistent implementation across EU Member States, and extraterritorial reach and global compliance challenges... IMO a lot of the text in the law is extremely vague and subjective, while simultaneously sounding very longwinded and authoritative. > Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data Notice it says “should”, not shall. Does this mean consent is technically optional? What is their definition of informed, affirmative, or agreement? Requiring companies to remove individual records from backups also quickly proves to be a practical impossibility. And it’s ironic to me that the law requires you to have even more centralized control over personal data from start to finish than they have now. To me this is a bit alarming from a security AND privacy perspective. > The requirement to notify regulators of data breaches Here’s a scary thought… what if they just stopped acknowledging breaches in the first place and claim they weren’t aware of it? What if they actually were unaware because the system was designed that way? There’s no law against being oblivious to breaches. Other undefined terms such as “undue delay,” “likelihood of (high) risk to rights and freedoms” and “disproportionate effort” will require further clarity by the courts or regulators, or time for specific market practices to develop. They don’t even define what a website is. Does that require HTTP be used to qualify? Or HTML? What about FTP or other protocols? Also, it forces even non-EU platforms with zero domestic presence to risk being blocked due to not complying with rules that don’t even apply to them. Seems like net neutrality is fundamentally incompatible with GDPR in some ways. What if the US blocked EU sites for not being free enough?
    - remus 2y ago
      > Besides compliance costs, operational complexity, impact on small businesses, inconsistent implementation across EU Member States, and extraterritorial reach and global compliance challenges... In my experience the compliance cost really isn't that big for the vast majority of businesses. Where it does get trickier is if you're collecting a lot of data relative to the size of your customer base e.g. facebook, google etc. and in those cases I think some extra eyeballs on how data is handled is sensible. Pretty much everything GDPR gets you to do is good practice, so if as a business you can't comply then imo your business is on shaky ground. For example: - Right to be informed -> have a privacy policy which explains what data you collect, what it's used for, how long you keep it, when you delete it and so on. - Right of access - > have a mechanism for providing users with a copy of their data. - Right of rectification -> have a process where you can update customer data. [1] > There’s no law against being oblivious to breaches. Im not sure where you got this idea from. One of the seven key principles of GDPR is "Integrity and confidentiality (security)" or more explicitly "You must ensure that you have appropriate security measures in place to protect the personal data you hold." [2] Being oblivious to breaches clearly goes against this. > Also, it forces even non-EU platforms with zero domestic presence to risk being blocked due to not complying with rules that don’t even apply to them. GDPR applies to the resident who's data you are processing, so if as a business you wan to deal with those customers you need to deal with those laws. Seems reasonable enough to me. [1] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re... [2] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/the-principles/integrity-and-confidentiality-security/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
      - ranger_danger 2y ago
        > Being oblivious to breaches clearly goes against this I don't see how it does. Even "ensuring appropriate security measures" is subjective in the first place, plus as we all know, no amount of security is perfect and breaches will always happen either way. Even if you took enough subjectively appropriate security measures, and it still happened anyway, there's nothing that guarantees you'll even know about it in the first place.
  - aleph_minus_one 2y ago
    > Not just regulators, I'm a developer in the EU and I find GDPR a great thing. I have yet to find a fellow developer here that disagrees. I know lots of developers who are still today incredibly furious about the legal effort that complying to GDPR requires (even if they - typically - don't intend to track users).
    - p_l 2y ago
      Then they should change whoever is advising them on law, cause they got duped.
Y-bar 2y ago
I’m a run of the mill developer and I consider it a net positive. Less sensitive customer data to process. Less stuff compromised in case of a security breach. Easier to say no to product managers who wants to unnecessarily track customers. Faster response times since fewer scripts are loaded on fist visit. The largest flaw is the lax enforcement in some EU countries.
seszett 2y ago
This is about the random sysadmins and devs that have to ensure their app or systems must comply with GDPR. Not the regulators.
jonwinstanley 2y ago
It's usually not their main job. In many companies, managing GDPR is a responsibility that just gets added to someone's job description.
james-bcn 2y ago
> It's their job to do GDPR, of course they consider it a positive. No, actually it is annoying to do. But it is extremely positive. The two things do not conflict. It's annoying for restaurants to maintain the high level of hygiene that the laws enforce. But I expect most people in the restaurant business see it as a positive (and I'm not going to the restaurants that don't...)

gatinsama 2y ago

So, regulators consider that regulating is good. Science is amazing, really.

bojan 2y ago
Not just regulators, I'm a developer in the EU and I find GDPR a great thing. I have yet to find a fellow developer here that disagrees. Yes, it can sometimes be a hassle to comply with it. But it's a no-brainer that it's a good idea. In that sense is this site a bit of a bubble. In real life it's not even a discussion.
- ranger_danger 2y ago
  > I find GDPR a great thing. I have yet to find a fellow developer here that disagrees. Besides compliance costs, operational complexity, impact on small businesses, inconsistent implementation across EU Member States, and extraterritorial reach and global compliance challenges... IMO a lot of the text in the law is extremely vague and subjective, while simultaneously sounding very longwinded and authoritative. > Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data Notice it says “should”, not shall. Does this mean consent is technically optional? What is their definition of informed, affirmative, or agreement? Requiring companies to remove individual records from backups also quickly proves to be a practical impossibility. And it’s ironic to me that the law requires you to have even more centralized control over personal data from start to finish than they have now. To me this is a bit alarming from a security AND privacy perspective. > The requirement to notify regulators of data breaches Here’s a scary thought… what if they just stopped acknowledging breaches in the first place and claim they weren’t aware of it? What if they actually were unaware because the system was designed that way? There’s no law against being oblivious to breaches. Other undefined terms such as “undue delay,” “likelihood of (high) risk to rights and freedoms” and “disproportionate effort” will require further clarity by the courts or regulators, or time for specific market practices to develop. They don’t even define what a website is. Does that require HTTP be used to qualify? Or HTML? What about FTP or other protocols? Also, it forces even non-EU platforms with zero domestic presence to risk being blocked due to not complying with rules that don’t even apply to them. Seems like net neutrality is fundamentally incompatible with GDPR in some ways. What if the US blocked EU sites for not being free enough?
  - remus 2y ago
    > Besides compliance costs, operational complexity, impact on small businesses, inconsistent implementation across EU Member States, and extraterritorial reach and global compliance challenges... In my experience the compliance cost really isn't that big for the vast majority of businesses. Where it does get trickier is if you're collecting a lot of data relative to the size of your customer base e.g. facebook, google etc. and in those cases I think some extra eyeballs on how data is handled is sensible. Pretty much everything GDPR gets you to do is good practice, so if as a business you can't comply then imo your business is on shaky ground. For example: - Right to be informed -> have a privacy policy which explains what data you collect, what it's used for, how long you keep it, when you delete it and so on. - Right of access - > have a mechanism for providing users with a copy of their data. - Right of rectification -> have a process where you can update customer data. [1] > There’s no law against being oblivious to breaches. Im not sure where you got this idea from. One of the seven key principles of GDPR is "Integrity and confidentiality (security)" or more explicitly "You must ensure that you have appropriate security measures in place to protect the personal data you hold." [2] Being oblivious to breaches clearly goes against this. > Also, it forces even non-EU platforms with zero domestic presence to risk being blocked due to not complying with rules that don’t even apply to them. GDPR applies to the resident who's data you are processing, so if as a business you wan to deal with those customers you need to deal with those laws. Seems reasonable enough to me. [1] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re... [2] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/the-principles/integrity-and-confidentiality-security/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
    - ranger_danger 2y ago
      > Being oblivious to breaches clearly goes against this I don't see how it does. Even "ensuring appropriate security measures" is subjective in the first place, plus as we all know, no amount of security is perfect and breaches will always happen either way. Even if you took enough subjectively appropriate security measures, and it still happened anyway, there's nothing that guarantees you'll even know about it in the first place.
- aleph_minus_one 2y ago
  > Not just regulators, I'm a developer in the EU and I find GDPR a great thing. I have yet to find a fellow developer here that disagrees. I know lots of developers who are still today incredibly furious about the legal effort that complying to GDPR requires (even if they - typically - don't intend to track users).
  - p_l 2y ago
    Then they should change whoever is advising them on law, cause they got duped.

Y-bar 2y ago

I’m a run of the mill developer and I consider it a net positive. Less sensitive customer data to process. Less stuff compromised in case of a security breach. Easier to say no to product managers who wants to unnecessarily track customers. Faster response times since fewer scripts are loaded on fist visit. The largest flaw is the lax enforcement in some EU countries.

seszett 2y ago

This is about the random sysadmins and devs that have to ensure their app or systems must comply with GDPR. Not the regulators.

jonwinstanley 2y ago

It's usually not their main job. In many companies, managing GDPR is a responsibility that just gets added to someone's job description.

james-bcn 2y ago

> It's their job to do GDPR, of course they consider it a positive. No, actually it is annoying to do. But it is extremely positive. The two things do not conflict. It's annoying for restaurants to maintain the high level of hygiene that the laws enforce. But I expect most people in the restaurant business see it as a positive (and I'm not going to the restaurants that don't...)