4 ms·

Have you read it? It's not that bad, unless you're thinking like an adtech programmer trying to find the exact edge case for the maximal amount of tracking you'

Have you read it? It's not that bad, unless you're thinking like an adtech programmer trying to find the exact edge case for the maximal amount of tracking you're allowed to do, because such a bright line does not exist and that fact infuriates adtech professionals. It is vague because reality is vague and complex; each specific case of alleged violation has to be interpreted by multiple humans; there is no algorithm.

ch4s3 6mo ago
The law mandates a data protection officer with specific duties. It also establishes a board that "issue guidelines, recommendations, and best practices" which is where administrative complication and nonsense always creeps in.
- pocksuppet 6mo ago
  It's not a separate position. It's a role that one of your upper management plays. It's saying someone at the company must respond to data protection requests, and that person is the data protection officer. Every law that mandates companies do things implies that someone at the company has to do those things.
jandrewrogers 6mo ago
It is regulation that imagines companies are a government bureaucracy. I have read GDPR and don't work in adtech. It is vague and it is pretty easy to find pathological scenarios that don't make much sense or impose an unusually high burden for no benefit. Every European law firm seems to agree with this assessment despite what proponents assert. Consequently, it forces a lot of expensive defensive activity in practice. To some extent, it was just a failure of imagination on the part of GDPR's authors. Many things are not nearly as simple as it seems to assume and it bleeds into data models that have nothing to do with people. It is what it is but no one should pretend it is not a burden for companies that have nothing to do with adtech or even data about people.
- troupo 6mo ago
  > I have read GDPR and don't work in adtech. It is vague As laws go, it's crystal clear > is pretty easy to find pathological scenarios Laws in general don't try to tell you how to implement every single facet of every single human endeavor. Otherwise no laws would be written, and those that would get written would be incomprehensible monstrosities. To not repeat myself, I have more here: https://news.ycombinator.com/item?id=47811648 https://news.ycombinator.com/item?id=47811648 For 99.999% of businesses GDPR is trivial. For 99.999% of the remaining businesses it's either covered by other laws (banking) or is only difficult to implement because they were ised to collecting user data en masse (any social netowrk or streaming service). There are very, very, very few instances were GDPR cannot be applied using basic common sense.

ch4s3 6mo ago

The law mandates a data protection officer with specific duties. It also establishes a board that "issue guidelines, recommendations, and best practices" which is where administrative complication and nonsense always creeps in.

pocksuppet 6mo ago
It's not a separate position. It's a role that one of your upper management plays. It's saying someone at the company must respond to data protection requests, and that person is the data protection officer. Every law that mandates companies do things implies that someone at the company has to do those things.

jandrewrogers 6mo ago

It is regulation that imagines companies are a government bureaucracy. I have read GDPR and don't work in adtech. It is vague and it is pretty easy to find pathological scenarios that don't make much sense or impose an unusually high burden for no benefit. Every European law firm seems to agree with this assessment despite what proponents assert. Consequently, it forces a lot of expensive defensive activity in practice. To some extent, it was just a failure of imagination on the part of GDPR's authors. Many things are not nearly as simple as it seems to assume and it bleeds into data models that have nothing to do with people. It is what it is but no one should pretend it is not a burden for companies that have nothing to do with adtech or even data about people.

troupo 6mo ago
> I have read GDPR and don't work in adtech. It is vague As laws go, it's crystal clear > is pretty easy to find pathological scenarios Laws in general don't try to tell you how to implement every single facet of every single human endeavor. Otherwise no laws would be written, and those that would get written would be incomprehensible monstrosities. To not repeat myself, I have more here: https://news.ycombinator.com/item?id=47811648 https://news.ycombinator.com/item?id=47811648 For 99.999% of businesses GDPR is trivial. For 99.999% of the remaining businesses it's either covered by other laws (banking) or is only difficult to implement because they were ised to collecting user data en masse (any social netowrk or streaming service). There are very, very, very few instances were GDPR cannot be applied using basic common sense.