4 ms·

This kind of line of thinking assumes a couple of things: 1. People are doing things the “wrong” way in the first place. It’s already been established that com

This kind of line of thinking assumes a couple of things: 1. People are doing things the “wrong” way in the first place. It’s already been established that compliance isn’t hard if you are doing things the “right” way. 2. Compliance is hard. It really isn’t if you are doing things already the right way Ultimately GDPR is not the problem, it’s people getting into tech that either have no understanding or respect for the data of others wanting to to do business. You wouldn’t expect me to be building bridges without complying to bridge building standards would you? Why is this any different? Lives are not directly on the line here, but the consequences of being sloppy with data are still very bad. This whole paragraph puts the cart before the horse because it assumes the most important thing is that the person in question is supposed to be able to transact business, not that the most important thing is to protect the personal information of people. I’m not expecting the plumber to be a technologist. If the plumber wants to roll his or her own technology, fine, deal with the compliance headache. I expect the plumber to instead pay someone to figure out how to build the thing properly, just like how I don’t go building load bearing structures on my home myself because I’m not a structural engineer and don’t want to spend the time learning how to do that.

ivan_gammel 2y ago
> I expect the plumber to instead pay someone This is fundamentally wrong expectation. To preserve the spirit of EU charter one does not need the law where every business engaging with customers online has to pay a compliance tax to another medieval guild of experts.
- SOLAR_FIELDS 2y ago
  Do you do your own structural engineering or do you pay someone to do it who is qualified to do so in the EU? Structural engineering compliance is a medieval guild of experts, is it not? Do you practice your own medicine in the EU or do you pay someone to do it? Medical compliance is a medieval guild of experts, is it not?
  - ivan_gammel 2y ago
    What are you doing is a classical straw man argument. I‘m not disputing that plumbers, doctors etc should be aware of their professional regulations. However certain regulations aren’t job-specific and work like tax, e.g. if you look at notary costs related to registration of business in Germany. Regulations like GDPR apply to business environment in general and they have to be designed so that the costs of compliance and risks of non-compliance are minimized. They are supposed to be followed by non-professionals, because privacy is not a job of DPO, it’s everyone’s concern. What you fail to understand in my comments is that part. I’m not disputing the usefulness of GDPR. I‘m saying that rather than strangling businesses with high compliance costs and complaining that everyone is choosing to show cookie banner instead of not tracking, we should look at how to avoid this nonsense. As a matter of fact, non-compliance is rife, people do cut corners and take the risk, because DPAs cannot catch or punish everyone. GDPR is suppressing the most egregious behavior, but it certainly not working as expected. It needs some careful reform.
    - SOLAR_FIELDS 2y ago
      > However certain regulations aren’t job-specific and work like tax, e.g. if you look at notary costs related to registration of business in Germany. This is not that. You’re making it sound like every business has to jump through all of these hoops as a matter of doing business. You know how to not be bound by GDPR? Don’t bother storing sketchy cookie data or PII. The plumber in your example could just… not do that and not have to worry about compliance. It’s only but for the plumber choosing to store that data that they opt to be bound by the regulation. It’s not a requirement for them to operate. If the business feels like they need to store the nuclear waste, then I need to know that they are storing it properly. They could just not take in and store the nuclear waste and then there’s no compliance burden. 9 times out of 10 they don’t need it to transact their business anyway, and the tenth business probably only exists but for the sketchy data. In the end we have arrived at the same conclusion: probably the regulation itself, the baby, has some dirty bath water. Any regulatory framework of any significant complexity does, especially a landmark first of its kind in scope regulation in the world. So we should not toss both out. We should try to get rid of just the bath water. With above said, the plumber is not absolved here. Why did they need to store my PII again? I very much value the fact that they have to think about and answer that question. So whatever improvement should just streamline that process and not get rid of it.

ivan_gammel 2y ago

> I expect the plumber to instead pay someone This is fundamentally wrong expectation. To preserve the spirit of EU charter one does not need the law where every business engaging with customers online has to pay a compliance tax to another medieval guild of experts.

SOLAR_FIELDS 2y ago
Do you do your own structural engineering or do you pay someone to do it who is qualified to do so in the EU? Structural engineering compliance is a medieval guild of experts, is it not? Do you practice your own medicine in the EU or do you pay someone to do it? Medical compliance is a medieval guild of experts, is it not?
- ivan_gammel 2y ago
  What are you doing is a classical straw man argument. I‘m not disputing that plumbers, doctors etc should be aware of their professional regulations. However certain regulations aren’t job-specific and work like tax, e.g. if you look at notary costs related to registration of business in Germany. Regulations like GDPR apply to business environment in general and they have to be designed so that the costs of compliance and risks of non-compliance are minimized. They are supposed to be followed by non-professionals, because privacy is not a job of DPO, it’s everyone’s concern. What you fail to understand in my comments is that part. I’m not disputing the usefulness of GDPR. I‘m saying that rather than strangling businesses with high compliance costs and complaining that everyone is choosing to show cookie banner instead of not tracking, we should look at how to avoid this nonsense. As a matter of fact, non-compliance is rife, people do cut corners and take the risk, because DPAs cannot catch or punish everyone. GDPR is suppressing the most egregious behavior, but it certainly not working as expected. It needs some careful reform.
  - SOLAR_FIELDS 2y ago
    > However certain regulations aren’t job-specific and work like tax, e.g. if you look at notary costs related to registration of business in Germany. This is not that. You’re making it sound like every business has to jump through all of these hoops as a matter of doing business. You know how to not be bound by GDPR? Don’t bother storing sketchy cookie data or PII. The plumber in your example could just… not do that and not have to worry about compliance. It’s only but for the plumber choosing to store that data that they opt to be bound by the regulation. It’s not a requirement for them to operate. If the business feels like they need to store the nuclear waste, then I need to know that they are storing it properly. They could just not take in and store the nuclear waste and then there’s no compliance burden. 9 times out of 10 they don’t need it to transact their business anyway, and the tenth business probably only exists but for the sketchy data. In the end we have arrived at the same conclusion: probably the regulation itself, the baby, has some dirty bath water. Any regulatory framework of any significant complexity does, especially a landmark first of its kind in scope regulation in the world. So we should not toss both out. We should try to get rid of just the bath water. With above said, the plumber is not absolved here. Why did they need to store my PII again? I very much value the fact that they have to think about and answer that question. So whatever improvement should just streamline that process and not get rid of it.