4 ms·

>If you're careful about how you store personal data in the first place Unfortunately this is a really big "if" looking at typical businesses. They have no ide

>If you're careful about how you store personal data in the first place Unfortunately this is a really big "if" looking at typical businesses. They have no idea about how compliance should work and they also hire barely qualified people to marketing teams (often interns), who may accidentally add some privacy-breaking stuff. To prevent that they hire an external DPO and then deal with the paperwork for that DPO, who never visits the company onsite and never meets real people touching privacy topics. So no, it's not a breeze, because there's generally no enough expertise and temptation to use American non-compliant MarTech is high. One possible solution to that could be a pan-European registry of data processors with enough metadata to a) generate privacy policy, b) request correct consent, c) provide a compliance implementation checklist for non-trivial cases. There could be a small fee for adding services to this registry, but that would make maintaining compliance much easier.

diggan 2y ago
Yeah, compliance for people who weren't careful before indeed is harder than for the rest. I think this works as expected? Consider if wire fraud wasn't illegal before, but next week there is a new law coming into effect that makes it illegal. Of course all the companies who were doing wire fraud since before will struggle to be compliant, some might not even be feasible to run anymore if their core business becomes illegal. Again, sounds like it works as expected, compliance for organizations who been ignorant for a long time is expected to be more cumbersome.
- ivan_gammel 2y ago
  I think you did not understand my comment. 1. It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the beginning. The accidental non-compliance is possible and there's usually a cost to prevent it. 2. It may work as expected from EU charter perspective, but current implementation is adding extra to an already high bureaucratic workload. My point is, it can be better than that.
  - diggan 2y ago
    > It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the beginning Saying it's complicated because of missing experience or knowledge is like saying creating a CRUD application is difficult. Yes, it might be difficult if you've never done it before, but that doesn't mean the thing itself is complicated, just that you potentially lack experience. Instead, I'd say it would be complicated if it's hard even if you have experience and knowledge about it. And for GDPR and safely storing data, it isn't difficult in a greenfield project if you have experience with it. > but current implementation is adding extra to an already high bureaucratic workload As someone who've helped SMEs become GDPR compliant, in terms of engineering, there really isn't a high bureaucratic workload unless you were already very careless with how you stored data. For the ones who considered how personal data was stored for more than half a second, becoming GDPR compliant was mostly about confirming things rather than having to shift things around. Few companies though, had huge problems as they 1) were revenue dependent on selling user data or 2) never considered how they were storing or protecting personal data at all. If you're speaking from the experience of those last companies, then again I think it works as expected.
    - SOLAR_FIELDS 2y ago
      This is mostly true with security compliance in general from my experience. SOC II, for instance, is pretty straightforward if you were already doing things in a sane way. It’s only a lot of work if you were previously sloppy with security and need to rectify that
    - ivan_gammel 2y ago
      Ok, let me try to explain once again: > if you have experience with it This must not be an expectation for any regulation that applies to business in general. Let’s say I just graduated from a college where I learned to be a plumber. I registered my firm and now want to acquire customers online, so I hire some local agency to build a website and an order form. You cannot realistically expect that I have any experience with GDPR or fully understand its requirements. It is the job of legislators to ensure that I can achieve compliance with minimum effort. But now I have to carry the burden, because no business can survive without digital marketing channels and I have to outsource the compliance work to ensure I don’t accidentally break the law. In comparison to pre-digital era doing any business today is more expensive and I‘d argue, it’s unnecessarily more expensive. It is not how it should have been done and it doesn’t work as expected from business point of view. Non-compliant businesses are not those who are malicious or ignorant, they can make mistakes because legislators did not help them.

diggan 2y ago

Yeah, compliance for people who weren't careful before indeed is harder than for the rest. I think this works as expected? Consider if wire fraud wasn't illegal before, but next week there is a new law coming into effect that makes it illegal. Of course all the companies who were doing wire fraud since before will struggle to be compliant, some might not even be feasible to run anymore if their core business becomes illegal. Again, sounds like it works as expected, compliance for organizations who been ignorant for a long time is expected to be more cumbersome.

ivan_gammel 2y ago
I think you did not understand my comment. 1. It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the beginning. The accidental non-compliance is possible and there's usually a cost to prevent it. 2. It may work as expected from EU charter perspective, but current implementation is adding extra to an already high bureaucratic workload. My point is, it can be better than that.
- diggan 2y ago
  > It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the beginning Saying it's complicated because of missing experience or knowledge is like saying creating a CRUD application is difficult. Yes, it might be difficult if you've never done it before, but that doesn't mean the thing itself is complicated, just that you potentially lack experience. Instead, I'd say it would be complicated if it's hard even if you have experience and knowledge about it. And for GDPR and safely storing data, it isn't difficult in a greenfield project if you have experience with it. > but current implementation is adding extra to an already high bureaucratic workload As someone who've helped SMEs become GDPR compliant, in terms of engineering, there really isn't a high bureaucratic workload unless you were already very careless with how you stored data. For the ones who considered how personal data was stored for more than half a second, becoming GDPR compliant was mostly about confirming things rather than having to shift things around. Few companies though, had huge problems as they 1) were revenue dependent on selling user data or 2) never considered how they were storing or protecting personal data at all. If you're speaking from the experience of those last companies, then again I think it works as expected.
  - SOLAR_FIELDS 2y ago
    This is mostly true with security compliance in general from my experience. SOC II, for instance, is pretty straightforward if you were already doing things in a sane way. It’s only a lot of work if you were previously sloppy with security and need to rectify that
  - ivan_gammel 2y ago
    Ok, let me try to explain once again: > if you have experience with it This must not be an expectation for any regulation that applies to business in general. Let’s say I just graduated from a college where I learned to be a plumber. I registered my firm and now want to acquire customers online, so I hire some local agency to build a website and an order form. You cannot realistically expect that I have any experience with GDPR or fully understand its requirements. It is the job of legislators to ensure that I can achieve compliance with minimum effort. But now I have to carry the burden, because no business can survive without digital marketing channels and I have to outsource the compliance work to ensure I don’t accidentally break the law. In comparison to pre-digital era doing any business today is more expensive and I‘d argue, it’s unnecessarily more expensive. It is not how it should have been done and it doesn’t work as expected from business point of view. Non-compliant businesses are not those who are malicious or ignorant, they can make mistakes because legislators did not help them.