2018 reform of EU data protection rules

(Hint: The right to erasure is not absolute, and applies to personal data.)

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

For example, here's their page on the right to erasure:

https://ec.europa.eu/info/law/law-topic/data-protection/refo...

Its opening paragraph reads as if data subjects have an automatic right to have their data deleted unless one of the three exceptions applies. In fact, Article 17 of the GDPR itself grants that right only under a list of specific circumstances, and the exceptions are just that, which is an entirely different situation that will lead to the opposite decision on whether data must be erased in many normal situations. Even the list of exceptions shown isn't complete.

For another example, here's their page on demonstrating compliance:

https://ec.europa.eu/info/law/law-topic/data-protection/refo...

There is literally nothing on that page that would help any business I'm dealing with to demonstrate compliance, unless you count the references to the primary sources at the end. There are a couple of ideas about codes of conduct or certifications that contain no substantial details, and even the vague hints about other things you might have to do don't go into any detail about who does or doesn't, leaving the entire page almost entirely content-free unless you happen to be in an industry where the kind of scheme they mention exists.

This sort of "guidance" is everything that is wrong with how the GDPR is being handled. It is verbose, ambiguous, sometimes seriously misleading, and almost entirely non-actionable. I'm actually worse off than I was before I read it, because I know nothing useful now that I didn't know before, I would have been misled by several of the pages such as the one I mentioned above if I hadn't already known better, and that's still half an hour of my life wasted.

Hi, I'm a European who doesn't support it and who does find it confusing.

To be more precise, while I'm generally in favour of better privacy protections in law, I don't support this poorly implemented attempt, because I think it will have all sorts of unintended consequences that may not be in individuals' best interests, while also imposing a disproportionate burden on controllers and processors who weren't abusing that data for unsavoury purposes anyway, particularly smaller organisations.

And maybe "confusing" isn't quite the right word, but in my view it's far too ambiguous in its treatment of some of the most fundamental issues to provide a good platform for future data protection. Much of the official guidance is confusing, often to the point of being misleading and counterproductive, however.

we've had similar provisions in EU countries for a while, so it's not a big deal.

All regulation is a big deal if you're running a microbusiness and don't have dedicated staff to deal with it. In any case, there are several new or significantly extended rights introduced by the GDPR that certainly weren't there before in my country (the UK).

So what's the minimum period you absolutely need that data/those logs/those backups for?

Given that things like access history/event logs are important for things like protecting ourselves against potential legal actions, disputed charges and the like, there is no possible way to give an intelligent answer to that. I can, however, state as fact that we have had to rely on detailed log records from several years ago when threatened with actual action by someone who was clearly trying to take advantage of the situation and hadn't expected us to still have evidence that undermined their claims, so any claim that we can just cycle these things out after a few days is demonstrably false. Given that we're not doing anything particularly unusual either legally or in processing data for everyday business purposes, I have to assume we are far from alone in having these experiences and the concerns they raise.

There's no one-size-fits-all approach, so the law isn't written like that.

While that may be true, it is entirely useless to someone well-intentioned and acting in good faith who is trying to work out what they actually have to do to comply with the new regulations.

> We just assume most people will be decent/"reasonable" in implementing it, and if not, there's the sanctions.

My definition of "reasonable" isn't the same as that of European regulators. I know this because I don't consider IP Address to be PII. Luckily for me on this particular point the GDPR is explicit in saying that it is. If I were left to define PII myself though, I could well have opened myself to regulatory action as IP Addresses were logged and shared incidentally with third parties in many places.

I think this style of writing laws gives way, way too much power to regulators. Particularly for companies with no physical EU presence and thus no way to vote or have any say in how the regulators work.

I think very few online businesses will be fully 100% compliant with every provision of the GDPR and all it's current and future interpretations. So we need to just hope and trust that all the regulators in all the Union countries won't punish anyone who doesn't really deserve it. That's not a good situation.

> So what's the minimum period you absolutely need that data/those logs/those backups for?

There is no answer to this question. Strictly speaking I don't need any backups or logs. I've also, rarely, encountered subtle data corruption bugs in the wild where having backups that go back months was critical and the more the better.