GDPR: Removing Monal from the EU

Post by ucaetano » Thu, May 17, 2018, 9:12 PM UTC

orf wrote: post #54

ucaetano wrote: post #23

Earlier quoted context omitted.

Regardless of what you log, here is a minimum cost of compliance, from the article: > I do not have the resources to hire a Data Protection Officer (DPO) or EU Representative as required by GDPR. I do not have designated EU contacts. If a single user decides to send him/her the letter ( https://www.linkedin.com/pulse/nightmare-letter-subject-acce... ), he/she would either have to spend an enormous amount of resources…

Implying that every company operating in the EU needs to hire someone to be a DPO is as ridiculous as it is completely false.

Post by CobrastanJorji » Thu, May 17, 2018, 9:13 PM UTC

DanBC wrote: post #51

CobrastanJorji wrote: post #40

Earlier quoted context omitted.

That seems insane, and I'm definitely not a lawyer, so maybe there's an out, but I think maybe he's right. Article 37 is pretty clear that if your core business involves processing data that's subject to the GDPR, you need to appoint a DPO, and it can't just be you, because they also require that the DPO can't have a conflict of interest. Man, that's unfortunate. https://gdpr-info.eu/art-37-gdpr/

No. That article says you only need a DPO if you're a public authority or if you're processing certain data or you're processing very large amounts of data. I'm struggling to understand why that's unclear. Is it the use of "public authority or body"?

Post by dbbk » Thu, May 17, 2018, 9:13 PM UTC

GalacticDomin8r wrote: post #43

viraptor wrote: post #18

I'm both surprised that people react so strongly and... mostly ok with it. Majority of GDPR is pretty reasonable - know what data you have and make sure your users know it as well. Allow removing it, make sure you don't share with parties who don't need it. For normal services it doesn't appear to be a tough retirement. You certainly don't need to hire extra people like author suggests and federation should be just f…

"Allow removing it" is a pretty big barrier for many.

Post by mnkypete » Thu, May 17, 2018, 9:14 PM UTC

greglindahl wrote: post #68

mnkypete wrote: post #5

There is so much misconception about GDPR. It is cleary directed at large data-tracking corps, not single person IM apps. Even if someone tries to "sue" you (which he can't, only report you to authorities), it first needs to go through many iterations where you can make your case. At the very least read this: https://privacylawblog.fieldfisher.com/2016/what-you-think-y...

One misconception about GDPR is that you can ignore it if your company is small. And that's basically what you're saying. And then the next would be that it's inexpensive to "make your case" if you get reported.

Post by greglindahl » Thu, May 17, 2018, 9:14 PM UTC

mnkypete wrote: post #65

nickpp wrote: post #55

Earlier quoted context omitted.

If he really said "probably", then he’s the one who doesn’t have to worry about the advice he gave you being incorrect.

The thing is, he can't say anything else. There are no reference cases in court yet, so it will need to be decided what is actually true. However, this cases will be fought with the Googles & Facebooks, not with 5 person companies.