Because you don't have the training and knowledge level that they were written for. Assuming you're a developer, imagine taking a programming language spec and giving it to a layperson. Would you expect them to perfectly understand it? I wouldn't think so.
Ask HN: Why are law documents (GDPR) so difficult to understand?
31–40 of 85 posts
Re: Ask HN: Why are law documents (GDPR) so difficult to understand?
#32Same reason large tax preparation companies lobby against simplification of rules. They need you to need them.
Re: Ask HN: Why are law documents (GDPR) so difficult to understand?
#33Leave it to the socialist Europeans to fuck up the world's internet. GDPR is so terrible.
Yes. How dare they request that you actually take care of your user's data, and ask yourself if you really need it, instead of just gobbling it all up as fast as you can.
Re: Ask HN: Why are law documents (GDPR) so difficult to understand?
#34FWIW I recently attempted to translate literally the entirety of the GDPR into Plain English (albeit for a technical audience). It's at: https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... In general I think legislatures putting out goals/guidelines instead of detailed specifications is a feature not a bug. Tech moves faster than they can possibly keep up with and to call out things down to the patchnote…
Nice summary, I liked the "plain english" format, I enjoyed reading it.
You might want to put a disclaimer in your blogpost that this is not legal advice.
Re: Ask HN: Why are law documents (GDPR) so difficult to understand?
#35You don‘t really expect a law to specify which hash algorithm you‘re supposed to use, do you? The answer is simple: the law will stand for a long time, and legislators know their limits. Unlike many engineers, unfortunately. Having courts interpret laws, with help from experts, is not a bug, but a feature!
Exactly. The law should express the intent, not the implementation means, which can—and does—improve over time.
Imagine a law mandating SHA-1 in 1999; it would end up enforcing a security problem today.
Re: Ask HN: Why are law documents (GDPR) so difficult to understand?
#36There is a good guide for developers here
Re: Ask HN: Why are law documents (GDPR) so difficult to understand?
#37Okay, let me try to translate that legalese for you (I'm not a lawyer BTW but I regularly deal with GDRP and data protection issues):
"In a manner" means that you're absolutely free to use whichever means (i.e. technologies, systems, ...) you want to do your data processing with, as long as you make sure you keep the data secure.
"Appropriate security" is indeed a very vague term, but it is vague on purpose: As you probably know firsthand, technologies change rapidly these days, and what's considered "state of the art" today might be a "legacy system" in five years. Therefore, laws often do leave the interpretation of terms like the "appropriateness" above open to interpretation by the executive branch. In case of the GDPR, this means that at the highest level it will be the European Court that will decide if a given measure/technology was appropriate or not. In practice we can't (and do not want to) fight out each definition in court of course, so in addition to that last instance the member countries try to release guidelines that should help companies to judge what measures are appropriate. Unfortunately, there's not always consensus between individual countries here so you will have to find a compromise or look at the guidelines of the country you're based in (as that's where complaints about your company will be handled in the first instance). For Germany, the BSI (Bundesamt für die Sicherheit in der Informationstechnik) would be the relevant instance to look for guidance when it comes to IT security best practices, and the standard that they define will (usually) be followed by the federral data protection agencies.
As a final remark, what helped me a lot in understanding the intent behind the law is to read the "motivations" section, which is where the lawmakers write down the actual intent they had when creating a given law. These are used by courts to interpret laws in case of ambiguity and can (in my opinion) greatly help to gain a better understanding of some of the more cryptic articles. Here's the link:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A...
If you have any specific questions about appropriate measures or the GDPR please feel free to reach out to me (contact info in my profile), I'm always eager to learn about your problems and will be glad to give you free advice wherever I can.
Re: Ask HN: Why are law documents (GDPR) so difficult to understand?
#38Lawyers find code hard to read as well.
I guess the difference is that the law doesn't have to implement code. Code has to implement the law.
Re: Ask HN: Why are law documents (GDPR) so difficult to understand?
#39Also, is hackernews complied to GDPR? I didn't seem to see a "delete account" button? As I know GDPR asks that users' data can be deleted at anytime?
What a wonderful feature for the professional astroturfing companies. Are public comments really "personal data"? This is part of the war on general purpose computing, it's an attack on memory.
Re: Ask HN: Why are law documents (GDPR) so difficult to understand?
#40It is amazing with the confusion that is arising with GDPR. I have to participate in a negotiation on a data processing agreement with a vendor because of GDPR. The material data they have to handle for us (the reason we buy their services) has very little personal data in it, so I thought this will not be a big deal. But it turns out that we can (not that we do, but that we can) transfer more or less anything to them in their support / incident channel, which is implemented with email. So we spend hour after hour to discuss how to regulate the case that emails might end up on various devices in their organisation. Completely unstructured data where mentions of names or addresses might occur.