3 ms·

Hmm, if anything the emphasis on national bodies having discretion in when this is enforced seems sketchy and concerning to me. Sketchy on the regulatory side b

by abeppu 2y ago

Hmm, if anything the emphasis on national bodies having discretion in when this is enforced seems sketchy and concerning to me. Sketchy on the regulatory side because I don't trust them to not pick targets in a manner which is informed by public sentiment or some other motivation. Concerning on the corporate side because I have heard people say things like "oh, it doesn't have to be 100%, we just need to be good enough to not be a target for enforcement", which then becomes the basis for not making an entirely good faith effort. Whereas something like PCI compliance for businesses handling credit card transactions isn't a law, but does have pretty clear standards, a certification process, and serious potential risks to your business if you do it wrong. But you go through the process, you get certified, and then you know you're doing it.

p_l 2y ago
It's not "discretion at enforcement". It's that the goal of the national body is to get you up to compliance, with reduced fines as incentives for helping you get there. The difference with PCI is that with PCI non-compliance means that payment networks will refuse to work with you, but at least in theory you're not forced to work with them either - you can not "opt out" of GDPR. So the purpose of the national body is to get the rules followed, and it has both ways to sweeten the deal (reduced fines for cooperating business) and the stick (vast increase in fines). Worst thing about GDPR was the cottage industry of "GDPR lawyers" that exploded around it coming into force in order to capitalize on panicking businesses, often fueling said panic. In reality, the main difference in GDPR versus previously active law is that GDPR increased fines and introduced policy framework for enforcing and helping compliance. BTW, there's no such thing as "not being a target". It's just enforcement depends on finite resources - and on complaints from people. And "do the minimum to not be target for enforcement" would be actually grounds for increased fines for acting in bad faith.
- abeppu 2y ago
  Your description sounds exactly like I'd expect a regulator to describe discretionary enforcement. My point about PCI is that people can actually implement it and know that they've done so. If the goal of GDPR is to get people up to compliance ... well since no one but the regulators can determine if a company is complying, we have no idea whether they're actually accomplishing that goal. The cottage industry you're complaining about exists precisely because the law was so unclear. I remember reviewing "non-binding recital" documents before it went into effect which were not helpful. For a law which created new requirements for systems at thousands of companies, they could have written material which directly was targeted at the parties who would be responsible for implementation, and which they would commit to being binding. But they didn't. > you can not "opt out" of GDPR For companies based elsewhere, there was a very serious consideration of should we just not try to do business in the EU. If you're a midsized company in the US faced with a large engineering effort to possibly meet regulatory requirements for a region where you have a small minority of customers, it's a real question.
  - p_l 2y ago
    I wonder of some of that doesn't come from different interpretation doctrines in different places. Under teleological interpretation used in practically by all relevant to GDPR courts, there's more flexibility than mechanical direct wording approach used in some places - and practiced by many PCI implementations and auditors to the point of being a running joke in some circles. A basic guiding principle with GDPR can be considered to metaphorically make "personal data" toxic, something you want to deal with as little as possible (with "sensitive private data" being extra toxic), with goal of preventing profiling and other abuses. Significant majority of business processes do not actually require sensitive data. A company that does not handle sensitive data does not even require a DPO. Similarly, the flexibility means that as a company you can make a point of showing action in good faith, while regulator does not have to update the law for every possible new detail. Consider for a moment that GDPR provided, on average, about ZERO new requirements compared to previous law on the books. Yes, zero. If anything, it cleared up some questions from before. The big difference is that previously, most member states law had consequences for non-compliance that were pretty much ignorable especially for bigger companies. The cottage industry that sprung was majorly oriented at extracting as much value from the panic, and in fact often increased said panic on purpose. In fact, if you're in B2B market, you might have close to 0 work anyway. The big problem was that with extremely lacking enforcement before, corporations built up, often unknowingly, huge amounts of mess and now someone started considering that the fines might be substantial.

by abeppu 2y ago

p_l 2y ago

It's not "discretion at enforcement". It's that the goal of the national body is to get you up to compliance, with reduced fines as incentives for helping you get there. The difference with PCI is that with PCI non-compliance means that payment networks will refuse to work with you, but at least in theory you're not forced to work with them either - you can not "opt out" of GDPR. So the purpose of the national body is to get the rules followed, and it has both ways to sweeten the deal (reduced fines for cooperating business) and the stick (vast increase in fines). Worst thing about GDPR was the cottage industry of "GDPR lawyers" that exploded around it coming into force in order to capitalize on panicking businesses, often fueling said panic. In reality, the main difference in GDPR versus previously active law is that GDPR increased fines and introduced policy framework for enforcing and helping compliance. BTW, there's no such thing as "not being a target". It's just enforcement depends on finite resources - and on complaints from people. And "do the minimum to not be target for enforcement" would be actually grounds for increased fines for acting in bad faith.

abeppu 2y ago
Your description sounds exactly like I'd expect a regulator to describe discretionary enforcement. My point about PCI is that people can actually implement it and know that they've done so. If the goal of GDPR is to get people up to compliance ... well since no one but the regulators can determine if a company is complying, we have no idea whether they're actually accomplishing that goal. The cottage industry you're complaining about exists precisely because the law was so unclear. I remember reviewing "non-binding recital" documents before it went into effect which were not helpful. For a law which created new requirements for systems at thousands of companies, they could have written material which directly was targeted at the parties who would be responsible for implementation, and which they would commit to being binding. But they didn't. > you can not "opt out" of GDPR For companies based elsewhere, there was a very serious consideration of should we just not try to do business in the EU. If you're a midsized company in the US faced with a large engineering effort to possibly meet regulatory requirements for a region where you have a small minority of customers, it's a real question.
- p_l 2y ago
  I wonder of some of that doesn't come from different interpretation doctrines in different places. Under teleological interpretation used in practically by all relevant to GDPR courts, there's more flexibility than mechanical direct wording approach used in some places - and practiced by many PCI implementations and auditors to the point of being a running joke in some circles. A basic guiding principle with GDPR can be considered to metaphorically make "personal data" toxic, something you want to deal with as little as possible (with "sensitive private data" being extra toxic), with goal of preventing profiling and other abuses. Significant majority of business processes do not actually require sensitive data. A company that does not handle sensitive data does not even require a DPO. Similarly, the flexibility means that as a company you can make a point of showing action in good faith, while regulator does not have to update the law for every possible new detail. Consider for a moment that GDPR provided, on average, about ZERO new requirements compared to previous law on the books. Yes, zero. If anything, it cleared up some questions from before. The big difference is that previously, most member states law had consequences for non-compliance that were pretty much ignorable especially for bigger companies. The cottage industry that sprung was majorly oriented at extracting as much value from the panic, and in fact often increased said panic on purpose. In fact, if you're in B2B market, you might have close to 0 work anyway. The big problem was that with extremely lacking enforcement before, corporations built up, often unknowingly, huge amounts of mess and now someone started considering that the fines might be substantial.