51–60 of 98 posts
Earlier quoted context omitted.
I suspect there will simply be a direct pipe for logging to the government, where companies don't need to retain anything.
GDPR requires you to make that kind of information available.
I doubt GDPR will significantly affect information to which the government wants access
Can I ask the government to delete all information on me?
Earlier quoted context omitted.
> I'm not so sure - how do you make sure the cost isn't so high that it deters people with legitimate reasons to request their data, but also high enough to actually cover the cost of obtaining it? I would expect that those are two very different amounts. If the cost of doing something legitimately exceeds the value of doing it to the person asking for it to be done, isn't not doing it then the rational outcome?
GDPR is trying to push a change in society's norms regarding privacy. The value of that change cannot be meaningfully measured by multiplying the "value" of one person's privacy by the number of people; there are effects that happen at scale that don't happen when you change privacy/data handling for an individual person for an individual company. And it's definitely unclear that the ability of any individual to pay…
What obviously doesn't work is to try to say that the auto repair shop pays all the costs and never charges anything to anyone who wants to have their car repaired, because then they go out of business.
Earlier quoted context omitted.
I think hygiene was mostly in place, but there was no PR points to score. Before GDPR an information that company stores something for 3 months would be a non-news. GDPR doesn't in any way protect people from data leaks.
>GDPR doesn't in any way protect people from data leaks. Article 32: Security of processing Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measure…
Requirements for post mortem actions are quite sensible though, but given arbitrary rules that is likely only going to be a cash cow for the governments, as even a second of the delay is undue.
Earlier quoted context omitted.
(a) How do you get the total number of visits. (b) This doesn't correctly distribute funds because there is a correlation between how much someone is willing to give per month and what kind of sites they frequent.
You can calculate the numbers as soon as the data about visits come in and then immediately discard all data. You certainly don't need to store the browsing history. You need the payment amount though and even that you can discard after a month. I am going through this at work right now where we are working data collection about a medical device. First we wanted to suck up all data and figure out what to do with it l…
How does this work, exactly? You are eliding all of the important details that require more information than just "My webserver reported a visit".
Earlier quoted context omitted.
You can calculate the numbers as soon as the data about visits come in and then immediately discard all data. You certainly don't need to store the browsing history. You need the payment amount though and even that you can discard after a month. I am going through this at work right now where we are working data collection about a medical device. First we wanted to suck up all data and figure out what to do with it l…
There isn't enough data to calculate numbers as soon as the visits come in. If I pay $3/month and visit your site, the amount you get depends on how many other site visits I accumulate during the month. If I visit 2 sites, you get $1.50. If I visit 20 sites, you get $0.15. You also need to store browsing history to avoid scammers redirecting other users donations. This happens on similar platforms like Spotify. You r…
Earlier quoted context omitted.
> Your proposed solution gives companies zero incentive to minimize data collected The expense of producing the data isn't supposed to be an incentive to minimize data collected, that is what the other sections are for. For large companies it wouldn't be regardless because they could automate the process. > and even incentivizes them to make fulfilling such a request as convoluted and expensive as possible. A company…
The problem is we don't all agree about what "outrageous prices" are, and courts are unlikely to conclude that anything that matches standard industry practices is "outrageous". The cost of complying with the GDPR nightmare letter, for the average large company that's not designed around the ability to comply with it, is likely to involve multiple engineers for several months digging out the data - if not a large int…
If the cost of preparing for compliance is reasonable then amortizing it over each request should not produce unreasonable costs per user. If the costs are unreasonable to begin with then that is the root of the problem which is what needs to be corrected independent of who pays.
Earlier quoted context omitted.
GDPR requires you to make that kind of information available.
However governments often have undisclosed access not even known to the holder of the information. I doubt GDPR will significantly affect information to which the government wants access Can I ask the government to delete all information on me?
Earlier quoted context omitted.
I suspect there will simply be a direct pipe for logging to the government, where companies don't need to retain anything.
GDPR requires you to make that kind of information available.
I feel like this whole thing with the GDPR is people fighting each other for the wrong reasons. The people for it argue that gets large companies to behave better. The people against it argue that it's unnecessarily complicated, poorly drafted and burdensome to small businesses. But it's both at the same time . The issue is that it doesn't have to be. It's possible to get the desired effect without using such a compl…
Earlier quoted context omitted.
Your proposed solution gives companies zero incentive to minimize data collected, and even incentivizes them to make fulfilling such a request as convoluted and expensive as possible. What people online love to call "common sense solutions" are usually not solutions a all.
> Your proposed solution gives companies zero incentive to minimize data collected The expense of producing the data isn't supposed to be an incentive to minimize data collected, that is what the other sections are for. For large companies it wouldn't be regardless because they could automate the process. > and even incentivizes them to make fulfilling such a request as convoluted and expensive as possible. A company…
Outrageous? No, just the mere cost that really happens.
Say, the data can only be accessed by the CEO personally. For privacy reasons, okay? Very reasonable, and totally in the spirit of the GDPR.
It can only be accessed in a very secure server location in Norway. Also commendable.
Our CEO needs to travel (first-class air travel) to Norway. He stays in a first-class hotel. Oh, and his time as value, too. So let's say three days business trip, that adds 1 percent of his salary to the bill.
Of course, this is an hypothetical, not-really-serious exaggeration. But it demonstrates the effect that would certainly happen on a much smaller scale.