3 ms·

> The GDPR is seen as one of Europe's most complex pieces of legislation by the technology sector Really? Now I'm no bureaucrat, merely an engineer, but GDPR w

by diggan 2y ago

> The GDPR is seen as one of Europe's most complex pieces of legislation by the technology sector Really? Now I'm no bureaucrat, merely an engineer, but GDPR was relatively easy to read through, even the official document (https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...) is only 88 pages long, this cannot realistically be "one of Europe's most complex pieces of legislation". A lot of privacy-conscious SME basically had to do nothing to be compliant, telling me it seems to hit the mark of being not too complicated. Most of the cases I've heard people complaining about GDPR being "complicated" or "impossible to implement correctly" have been from people/organizations who are breaking GDPR, and have no way of reaching compliance without removing things they ultimately earn money from, which in my mind is the exact purpose of GDPR. Most orgs don't seem to be introspective enough to understand why they are having such a hard time with GDPR though. I hope that their proposed "simplification package" doesn't actually remove what makes GDPR useful and good, but since they seem to be making a bunch of bad-faith arguments for this simplification, I'm not super optimistic.

mentalgear 2y ago
On the spot > Most of the cases I've heard people complaining about GDPR being "complicated" or "impossible to implement correctly" have been from people/organizations who are breaking GDPR
james-bcn 2y ago
Yes I agree. A lot of the stuff in GDPR are things that companies should be doing anyway.
deleted 2y ago
[deleted]
pjc50 2y ago
Eh, you can see in this thread how all sorts of things are confusing. What, exactly, requires a cookie banner? Does an IP address in a log count as personal information on its own? And so on. I can see why it was intended to be generic, but the lack of clear guidance and especially the lack of de minimis exemptions (one of the things mentioned to be addressed!) are a very real problem. "What tests do I have to perform before asserting that I am CE compliant" is a similar, even vaguer question.
- johnnyanmac 2y ago
  That's part of the issue. A cookie banner isn't a requirement to begin with. It's their workaround to try and get some tracking data back
BjoernKW 2y ago
It might be relatively easy to read, but for SMBs it's hard to actually implement in real life, because GDPR and the EU's stance so far often doesn't take economic reality into account. For small businesses, GDPR in many regards created a legal limbo while large corporations scoff at that regulation and have their legal departments deal with it however they see fit. For instance, there's this tiny, gnarly aspect of where you are allowed to store your customer data. Hosting data on servers located in the EU isn't required by GDPR in and of itself, as long as you have a valid data processing agreement with the provider stating how and according to which provisions customer data is protected on their machines. However, according to a 2020 European Court of Justice ruling you're not allowed to transfer any personally identifiable information to companies that are in any way affiliated with a US-based entity (e.g., by virtue of having a US-based parent company) anymore. Just being physically located in the EU isn't sufficient according to this ruling. The reason for this is that with FISA US law enforcement can force US-based companies to hand over any data, even if that data is stored with an international subsidiary under a completely different jurisdiction. This basically invalidates all of the provisions and legal frameworks for interacting with non-EU entities that used to be acceptable under GDPR before (e.g., Privacy Shield). However, not interacting with any US-based or US-related entities at all anymore would be tantamount to ceasing almost all economic activity. So, until (or more pessimistically: unless) the US and the EU come to terms on a new agreement regarding privacy rules, there probably isn't anything a business can do on its own to completely address this issue. At this point, merely hosting data on servers physically located in the EU perhaps amounts to little more than window dressing. As soon as a business has dealings with a US-based company or an EU-based company owned by a US-based company that potentially might have access to user data that business technically is in violation of GDPR. As of now, as a business you essentially have three alternatives: 1. Run the entire infrastructure you need yourself or have it run by EU-based companies guaranteed to have no relations with US-based entities whatsoever (Good luck with finding those ...). This, for example, includes payment systems and banking infrastructure, because guess where many EU-based banks host their infrastructure? That's right, AWS. 2. Go out of business. 3. Ignore this aspect of GDPR for now, document everything, continue to do your own due diligence, and hope for the best.
fooker 2y ago
> merely an engineer Exactly. You are unlikely to be personally liable for this. This sort of thing starts becoming complicated when you are responsible for making sure a random government does not try to make an example out of your company for whatever reason.

by diggan 2y ago

mentalgear 2y ago

On the spot > Most of the cases I've heard people complaining about GDPR being "complicated" or "impossible to implement correctly" have been from people/organizations who are breaking GDPR

james-bcn 2y ago

Yes I agree. A lot of the stuff in GDPR are things that companies should be doing anyway.

deleted 2y ago

[deleted]

pjc50 2y ago

Eh, you can see in this thread how all sorts of things are confusing. What, exactly, requires a cookie banner? Does an IP address in a log count as personal information on its own? And so on. I can see why it was intended to be generic, but the lack of clear guidance and especially the lack of de minimis exemptions (one of the things mentioned to be addressed!) are a very real problem. "What tests do I have to perform before asserting that I am CE compliant" is a similar, even vaguer question.

johnnyanmac 2y ago
That's part of the issue. A cookie banner isn't a requirement to begin with. It's their workaround to try and get some tracking data back

BjoernKW 2y ago

It might be relatively easy to read, but for SMBs it's hard to actually implement in real life, because GDPR and the EU's stance so far often doesn't take economic reality into account. For small businesses, GDPR in many regards created a legal limbo while large corporations scoff at that regulation and have their legal departments deal with it however they see fit. For instance, there's this tiny, gnarly aspect of where you are allowed to store your customer data. Hosting data on servers located in the EU isn't required by GDPR in and of itself, as long as you have a valid data processing agreement with the provider stating how and according to which provisions customer data is protected on their machines. However, according to a 2020 European Court of Justice ruling you're not allowed to transfer any personally identifiable information to companies that are in any way affiliated with a US-based entity (e.g., by virtue of having a US-based parent company) anymore. Just being physically located in the EU isn't sufficient according to this ruling. The reason for this is that with FISA US law enforcement can force US-based companies to hand over any data, even if that data is stored with an international subsidiary under a completely different jurisdiction. This basically invalidates all of the provisions and legal frameworks for interacting with non-EU entities that used to be acceptable under GDPR before (e.g., Privacy Shield). However, not interacting with any US-based or US-related entities at all anymore would be tantamount to ceasing almost all economic activity. So, until (or more pessimistically: unless) the US and the EU come to terms on a new agreement regarding privacy rules, there probably isn't anything a business can do on its own to completely address this issue. At this point, merely hosting data on servers physically located in the EU perhaps amounts to little more than window dressing. As soon as a business has dealings with a US-based company or an EU-based company owned by a US-based company that potentially might have access to user data that business technically is in violation of GDPR. As of now, as a business you essentially have three alternatives: 1. Run the entire infrastructure you need yourself or have it run by EU-based companies guaranteed to have no relations with US-based entities whatsoever (Good luck with finding those ...). This, for example, includes payment systems and banking infrastructure, because guess where many EU-based banks host their infrastructure? That's right, AWS. 2. Go out of business. 3. Ignore this aspect of GDPR for now, document everything, continue to do your own due diligence, and hope for the best.

fooker 2y ago

> merely an engineer Exactly. You are unlikely to be personally liable for this. This sort of thing starts becoming complicated when you are responsible for making sure a random government does not try to make an example out of your company for whatever reason.