4 ms·

I think you did not understand my comment. 1. It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the

I think you did not understand my comment. 1. It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the beginning. The accidental non-compliance is possible and there's usually a cost to prevent it. 2. It may work as expected from EU charter perspective, but current implementation is adding extra to an already high bureaucratic workload. My point is, it can be better than that.

diggan 2y ago
> It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the beginning Saying it's complicated because of missing experience or knowledge is like saying creating a CRUD application is difficult. Yes, it might be difficult if you've never done it before, but that doesn't mean the thing itself is complicated, just that you potentially lack experience. Instead, I'd say it would be complicated if it's hard even if you have experience and knowledge about it. And for GDPR and safely storing data, it isn't difficult in a greenfield project if you have experience with it. > but current implementation is adding extra to an already high bureaucratic workload As someone who've helped SMEs become GDPR compliant, in terms of engineering, there really isn't a high bureaucratic workload unless you were already very careless with how you stored data. For the ones who considered how personal data was stored for more than half a second, becoming GDPR compliant was mostly about confirming things rather than having to shift things around. Few companies though, had huge problems as they 1) were revenue dependent on selling user data or 2) never considered how they were storing or protecting personal data at all. If you're speaking from the experience of those last companies, then again I think it works as expected.
- SOLAR_FIELDS 2y ago
  This is mostly true with security compliance in general from my experience. SOC II, for instance, is pretty straightforward if you were already doing things in a sane way. It’s only a lot of work if you were previously sloppy with security and need to rectify that
- ivan_gammel 2y ago
  Ok, let me try to explain once again: > if you have experience with it This must not be an expectation for any regulation that applies to business in general. Let’s say I just graduated from a college where I learned to be a plumber. I registered my firm and now want to acquire customers online, so I hire some local agency to build a website and an order form. You cannot realistically expect that I have any experience with GDPR or fully understand its requirements. It is the job of legislators to ensure that I can achieve compliance with minimum effort. But now I have to carry the burden, because no business can survive without digital marketing channels and I have to outsource the compliance work to ensure I don’t accidentally break the law. In comparison to pre-digital era doing any business today is more expensive and I‘d argue, it’s unnecessarily more expensive. It is not how it should have been done and it doesn’t work as expected from business point of view. Non-compliant businesses are not those who are malicious or ignorant, they can make mistakes because legislators did not help them.
  - const_cast 2y ago
    [dead]
  - SOLAR_FIELDS 2y ago
    This kind of line of thinking assumes a couple of things: 1. People are doing things the “wrong” way in the first place. It’s already been established that compliance isn’t hard if you are doing things the “right” way. 2. Compliance is hard. It really isn’t if you are doing things already the right way Ultimately GDPR is not the problem, it’s people getting into tech that either have no understanding or respect for the data of others wanting to to do business. You wouldn’t expect me to be building bridges without complying to bridge building standards would you? Why is this any different? Lives are not directly on the line here, but the consequences of being sloppy with data are still very bad. This whole paragraph puts the cart before the horse because it assumes the most important thing is that the person in question is supposed to be able to transact business, not that the most important thing is to protect the personal information of people. I’m not expecting the plumber to be a technologist. If the plumber wants to roll his or her own technology, fine, deal with the compliance headache. I expect the plumber to instead pay someone to figure out how to build the thing properly, just like how I don’t go building load bearing structures on my home myself because I’m not a structural engineer and don’t want to spend the time learning how to do that.

diggan 2y ago

> It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the beginning Saying it's complicated because of missing experience or knowledge is like saying creating a CRUD application is difficult. Yes, it might be difficult if you've never done it before, but that doesn't mean the thing itself is complicated, just that you potentially lack experience. Instead, I'd say it would be complicated if it's hard even if you have experience and knowledge about it. And for GDPR and safely storing data, it isn't difficult in a greenfield project if you have experience with it. > but current implementation is adding extra to an already high bureaucratic workload As someone who've helped SMEs become GDPR compliant, in terms of engineering, there really isn't a high bureaucratic workload unless you were already very careless with how you stored data. For the ones who considered how personal data was stored for more than half a second, becoming GDPR compliant was mostly about confirming things rather than having to shift things around. Few companies though, had huge problems as they 1) were revenue dependent on selling user data or 2) never considered how they were storing or protecting personal data at all. If you're speaking from the experience of those last companies, then again I think it works as expected.

SOLAR_FIELDS 2y ago
This is mostly true with security compliance in general from my experience. SOC II, for instance, is pretty straightforward if you were already doing things in a sane way. It’s only a lot of work if you were previously sloppy with security and need to rectify that
ivan_gammel 2y ago
Ok, let me try to explain once again: > if you have experience with it This must not be an expectation for any regulation that applies to business in general. Let’s say I just graduated from a college where I learned to be a plumber. I registered my firm and now want to acquire customers online, so I hire some local agency to build a website and an order form. You cannot realistically expect that I have any experience with GDPR or fully understand its requirements. It is the job of legislators to ensure that I can achieve compliance with minimum effort. But now I have to carry the burden, because no business can survive without digital marketing channels and I have to outsource the compliance work to ensure I don’t accidentally break the law. In comparison to pre-digital era doing any business today is more expensive and I‘d argue, it’s unnecessarily more expensive. It is not how it should have been done and it doesn’t work as expected from business point of view. Non-compliant businesses are not those who are malicious or ignorant, they can make mistakes because legislators did not help them.
- const_cast 2y ago
  [dead]
- SOLAR_FIELDS 2y ago
  This kind of line of thinking assumes a couple of things: 1. People are doing things the “wrong” way in the first place. It’s already been established that compliance isn’t hard if you are doing things the “right” way. 2. Compliance is hard. It really isn’t if you are doing things already the right way Ultimately GDPR is not the problem, it’s people getting into tech that either have no understanding or respect for the data of others wanting to to do business. You wouldn’t expect me to be building bridges without complying to bridge building standards would you? Why is this any different? Lives are not directly on the line here, but the consequences of being sloppy with data are still very bad. This whole paragraph puts the cart before the horse because it assumes the most important thing is that the person in question is supposed to be able to transact business, not that the most important thing is to protect the personal information of people. I’m not expecting the plumber to be a technologist. If the plumber wants to roll his or her own technology, fine, deal with the compliance headache. I expect the plumber to instead pay someone to figure out how to build the thing properly, just like how I don’t go building load bearing structures on my home myself because I’m not a structural engineer and don’t want to spend the time learning how to do that.