4 ms·

>Why is the marketing firm/platform not on the hook for noncompliance in your first example? Because they act in good faith and expect that consent is collecte

>Why is the marketing firm/platform not on the hook for noncompliance in your first example? Because they act in good faith and expect that consent is collected before their script is executed. This is usually written in their ToS, e.g. see Google Analytics. Google expects that you maintain compliance and if, because of your failure to stay compliant, they collect PII without consent, you are liable for the damages. See what happens? Every small business who wants to know something about visitors of their website is now on the hook. They are expected to understand GDPR, to understand legal details of Google ToS etc. Since you cannot avoid having digital presence today, this looks pretty much like a compliance tax. >I genuinely believe if people are dumb enough to keep PII in spreadsheets You are speaking about majority of population of this planet now. Everyone prepared at least once in their life a list of contacts to send wedding invitations, list of customers for a freelance job etc etc. People are not dumb. They just keep doing what they were always doing: having a sheet with a list of contacts. And honestly, they should continue, because why not? Why we should put significantly more thought in this simple task? Yes, the tools have changed and we now have implicit privacy and security risks associated with them. We should fix the tools and assign liability properly.

SOLAR_FIELDS 2y ago
> Because they act in good faith and expect that consent is collected before their script is executed. This is the unaddressed rub here. If the doctor commits malpractice in good faith, they’re still liable. If the structural engineer built a bridge that collapsed in good faith, they’re still liable. Why does the marketing firm get off the hook here? The argument being presented here, that regular people should continue to be allowed to do Sloppy and Dangerous Thing, because it’s normal, is not sufficient. It also used to be normal and way easier for people to get on a plane without being strip searched and their privacy being violated. Society decided that forcing regular people to go through a ton of more hassle for safety was worth the trade off. The security is mostly theater, the implementation is burdensome, onerous and unpopular and a regular person is expected to navigate some kafkaesque nightmare with a bunch of rules and might unknowingly burn themselves. But we sure as hell don’t see a ton of plane hijackings any more, do we?
- ivan_gammel 2y ago
  >Why does the marketing firm get off the hook here? You may be surprised, but this is how this regulation is designed. Per GDPR it is the duty of controller to ensure compliance. Processor acts per instructions from controller. MarTech is not allowed to do anything outside of their contract with their users, but they are also not required to enforce consent collection, only to assist controllers with that when possible. >The argument being presented here, that regular people should continue to be allowed to do Sloppy and Dangerous Thing No, this is not the argument being presented here. Storing personal contacts or advertising is not "sloppy and dangerous thing" per se. The privacy risk is not that someone is processing your PII, but that this data may be used to harm you by processor or 3rd party. So the goal of regulation should not be to prevent processing, but to minimize such risks with minimal costs for society. If regulation focuses on just risk, but does not consider the costs, it must be fixed and solutions should be found that enable typical use cases.

SOLAR_FIELDS 2y ago

> Because they act in good faith and expect that consent is collected before their script is executed. This is the unaddressed rub here. If the doctor commits malpractice in good faith, they’re still liable. If the structural engineer built a bridge that collapsed in good faith, they’re still liable. Why does the marketing firm get off the hook here? The argument being presented here, that regular people should continue to be allowed to do Sloppy and Dangerous Thing, because it’s normal, is not sufficient. It also used to be normal and way easier for people to get on a plane without being strip searched and their privacy being violated. Society decided that forcing regular people to go through a ton of more hassle for safety was worth the trade off. The security is mostly theater, the implementation is burdensome, onerous and unpopular and a regular person is expected to navigate some kafkaesque nightmare with a bunch of rules and might unknowingly burn themselves. But we sure as hell don’t see a ton of plane hijackings any more, do we?

ivan_gammel 2y ago
>Why does the marketing firm get off the hook here? You may be surprised, but this is how this regulation is designed. Per GDPR it is the duty of controller to ensure compliance. Processor acts per instructions from controller. MarTech is not allowed to do anything outside of their contract with their users, but they are also not required to enforce consent collection, only to assist controllers with that when possible. >The argument being presented here, that regular people should continue to be allowed to do Sloppy and Dangerous Thing No, this is not the argument being presented here. Storing personal contacts or advertising is not "sloppy and dangerous thing" per se. The privacy risk is not that someone is processing your PII, but that this data may be used to harm you by processor or 3rd party. So the goal of regulation should not be to prevent processing, but to minimize such risks with minimal costs for society. If regulation focuses on just risk, but does not consider the costs, it must be fixed and solutions should be found that enable typical use cases.