3 ms·

Your description sounds exactly like I'd expect a regulator to describe discretionary enforcement. My point about PCI is that people can actually implement it

by abeppu 2y ago

Your description sounds exactly like I'd expect a regulator to describe discretionary enforcement. My point about PCI is that people can actually implement it and know that they've done so. If the goal of GDPR is to get people up to compliance ... well since no one but the regulators can determine if a company is complying, we have no idea whether they're actually accomplishing that goal. The cottage industry you're complaining about exists precisely because the law was so unclear. I remember reviewing "non-binding recital" documents before it went into effect which were not helpful. For a law which created new requirements for systems at thousands of companies, they could have written material which directly was targeted at the parties who would be responsible for implementation, and which they would commit to being binding. But they didn't. > you can not "opt out" of GDPR For companies based elsewhere, there was a very serious consideration of should we just not try to do business in the EU. If you're a midsized company in the US faced with a large engineering effort to possibly meet regulatory requirements for a region where you have a small minority of customers, it's a real question.

p_l 2y ago
I wonder of some of that doesn't come from different interpretation doctrines in different places. Under teleological interpretation used in practically by all relevant to GDPR courts, there's more flexibility than mechanical direct wording approach used in some places - and practiced by many PCI implementations and auditors to the point of being a running joke in some circles. A basic guiding principle with GDPR can be considered to metaphorically make "personal data" toxic, something you want to deal with as little as possible (with "sensitive private data" being extra toxic), with goal of preventing profiling and other abuses. Significant majority of business processes do not actually require sensitive data. A company that does not handle sensitive data does not even require a DPO. Similarly, the flexibility means that as a company you can make a point of showing action in good faith, while regulator does not have to update the law for every possible new detail. Consider for a moment that GDPR provided, on average, about ZERO new requirements compared to previous law on the books. Yes, zero. If anything, it cleared up some questions from before. The big difference is that previously, most member states law had consequences for non-compliance that were pretty much ignorable especially for bigger companies. The cottage industry that sprung was majorly oriented at extracting as much value from the panic, and in fact often increased said panic on purpose. In fact, if you're in B2B market, you might have close to 0 work anyway. The big problem was that with extremely lacking enforcement before, corporations built up, often unknowingly, huge amounts of mess and now someone started considering that the fines might be substantial.

by abeppu 2y ago

p_l 2y ago

I wonder of some of that doesn't come from different interpretation doctrines in different places. Under teleological interpretation used in practically by all relevant to GDPR courts, there's more flexibility than mechanical direct wording approach used in some places - and practiced by many PCI implementations and auditors to the point of being a running joke in some circles. A basic guiding principle with GDPR can be considered to metaphorically make "personal data" toxic, something you want to deal with as little as possible (with "sensitive private data" being extra toxic), with goal of preventing profiling and other abuses. Significant majority of business processes do not actually require sensitive data. A company that does not handle sensitive data does not even require a DPO. Similarly, the flexibility means that as a company you can make a point of showing action in good faith, while regulator does not have to update the law for every possible new detail. Consider for a moment that GDPR provided, on average, about ZERO new requirements compared to previous law on the books. Yes, zero. If anything, it cleared up some questions from before. The big difference is that previously, most member states law had consequences for non-compliance that were pretty much ignorable especially for bigger companies. The cottage industry that sprung was majorly oriented at extracting as much value from the panic, and in fact often increased said panic on purpose. In fact, if you're in B2B market, you might have close to 0 work anyway. The big problem was that with extremely lacking enforcement before, corporations built up, often unknowingly, huge amounts of mess and now someone started considering that the fines might be substantial.