GDPR Hall of Shame

I promise: we're not all like that. In fact, I suspect there is a significant minority of people--including myself--that think just like you. I look forward to the end of all these data and privacy abuses.

I was on the internet as an undergrad first at UofT in 1988, it was mostly FTP and usenet back then.

Our machines didn't even use DNS yet IIRC there was a HOSTS.TXT file sent around that had to be updated as new sites were added to the network.

It was fairly early, and I got to see the internet before the marketers started to take notice of it.

I remember the internet worm[1] and the Canter and Siegel usenet spam a bit later[2].

I'm glad the internet was made public of course but I wish the standards from back then had better security built in.

Of course encrypting everything back then would have been a significant drain on computational resources. We used to login 40 students at a time on TTYs to a Sun 3/280 (25mhz CPU!).[3]

[1] https://en.wikipedia.org/wiki/Morris_worm [2] https://en.wikipedia.org/wiki/Laurence_Canter_and_Martha_Sie... [3] https://en.wikipedia.org/wiki/Sun-3

There are many differences; it's hard to generalize because each EU country is different (there's no harmonization for this, and there are major differences especially along the "ex-Warsaw-Pact" border; half of EU had their whole financial system [re]built in 1990s), but you'll often see the following differences:

1) There's no "EU score", each lending market is somewhat separate. Past history in one location may or may not influence your score in another location.

2) Instead of a general/universal "credit score" calculated by an agency, there's often a concept of "credit history" which (depending on the country) may or may not list the amounts of existing loans, of previous loans, and history of late payments. The difference being that instead of lenders getting a score calculated by some agency, the lenders get the data and make their own decision, with possibly very different opinions on which factors are important. Not everywhere, of course, some countries (e.g. UK or Nordics) are more like USA.

3) The process tends to be highly regulated. If you're providing factual data as opposed to an opaque score, each item better be correct - distributing to all lenders "Bob defaulted on a loan in 1999" is libel if it's not true; the dispute process tends to be more consumer-friendly than USA - e.g. a requirement to remove the disputed items immediately and return them only if the debtor can prove its validity), maybe a requirement to expire entries of missed payments within x years, etc.

4) In some countries, that agency is run by the gov't, i.e. purely a central official registry of loans and/or bad loans, which is somewhat sufficient to verify creditworthiness. In others, it's like Equifax.

5) There often is a principle that the credit reporting agencies can't give/sell that data to anyone - you must give explicit permission for every company before they can gain access to that data.

6) In many countries there's no concept of "building credit" - where there only information provided is about negative events (e.g. defaults or missed payments), so having never taken a loan combined with good income gets a perfect rating, as it's not distinguishable from a long credit history and having never missed a payment.

So it's quite tricky - similar but different.

IMHO the process in many of these places was ran something like delegating it all to the legal department and treating it as a challenge of adjusting their privacy policies and other legal documents, but not expecting (or allowing) that project to change any of their core business processes.

However, in many (most?) cases that cannot possibly be sufficient to comply, so we're seeing how the legal people have done as much as they could to cover their arses, given that the actual behavior of the company around them wasn't allowed to change.

It also may be that some companies are intentionally planning a delaying tactic - i.e. a plan to flip the switch on private data processing only when the regulators will get to them and start writing stern letters, so that they can reap the benefits of (ab)using user data for some more months.

I think that there are two contrary trends.

Large companies that substantially profit from personal data are testing the boundaries of GDPR. They've got competent legal advice and know that a blatant effort would earn the wrath of the regulators, so they're being subtle about it. They're creatively interpreting grey areas. They're using complex and confusing opt-outs justified by spurious technical issues. They're carefully planning a strategy that will allow them to drag out the enforcement process and gain as much ground as possible, while maintaining the pretence that they're making a good-faith effort to comply. They'd rather avoid a heavy fine, but they're not afraid of butting heads with the regulators.

A lot of small companies without in-house counsel are going a bit crazy. Maybe they've spoken to a data protection consultant who has fed them a bunch of FUD, maybe they've just read a few articles in the press, but they haven't really scrutinised the text of the GDPR or spoken to a regulatory authority. They don't understand what their obligations are under the GDPR or the overarching principles of data protection, but they're doing something. Sometimes that thing is completely overzealous, sometimes it's totally inadequate. I've seen a lot of misguided efforts by SMEs to indemnify themselves against GDPR, akin to the "no copyright intended" statements you see in YouTube descriptions. Many of these companies had been completely ignoring the old Data Protection Directive, so they've got a lot of catching up to do.