Two years in, GDPR defined by mixed signals, unbalanced enforcement

A person commented and asked me about suggestions, but deleted his comment before I could answer so here it is anyways:

Super quickly (I'm sure you have heard of, or can quickly use a search engine to find the commonly listed issues):

Damages: damages need to be scaled according to the company size, severity and amount. GDPR was created to punish Big Players, but the wording that would have fit them is equally (and should be, laws should be equal) applied to small companies resulting in an impedance mismatch. Frankly, the damages are too small for the Big Players, but insane to the small ones. GDPR also does not apply to the state, but holy shit it fucking should!

Enforcement: it needs to be equally enforced and you need to be able to sue by yourself over it instead of just limiting it to a state organisation.

Data: it should be data that is directly tied to you, ie leave the normal web logs etc out of it. PII is just a sham as it's defined today. A factor of usage also needs to play into it, ie normal web server ip logs that are separate and don't feed into a user specific connection into a database should not be a consideration.

Access: access _needs_ to be able to be done online if the data is collected or transferred online. Ie no this "you need to physically mail us a certified mail with your id" shit. GPDR is a fucking failure in this aspect. Also no required strong authentication: access should be just directly through your account you can access normally without strong authentication.

Usage: GDPR does not allow you to trade tracking for access (ie monetisation of content is almost impossible if you care about user privacy): this is insane. GDPR also supposedly does not allow for those complicated "accept all or modify your preferences" windows, but it should have no saying in that: if a site wants to make the experience painful, that's up to them. It is up to the user to select if they want to use that site or not.

A person commented and asked me about suggestions, but deleted his comment before I could answer so here it is anyways:

Super quickly (I'm sure you have heard of, or can quickly use a search engine to find the commonly listed issues):

Damages: damages need to be scaled according to the company size, severity and amount. GDPR was created to punish Big Players, but the wording that would have fit them is equally (and should be, laws should be equal) applied to small companies resulting in an impedance mismatch. Frankly, the damages are too small for the Big Players, but insane to the small ones. GDPR also does not apply to the state, but holy shit it fucking should!

Enforcement: it needs to be equally enforced and you need to be able to sue by yourself over it instead of just limiting it to a state organisation.

Data: it should be data that is directly tied to you, ie leave the normal web logs etc out of it. PII is just a sham as it's defined today. A factor of usage also needs to play into it, ie normal web server ip logs that are separate and don't feed into a user specific connection into a database should not be a consideration.

Access: access _needs_ to be able to be done online if the data is collected or transferred online. Ie no this "you need to physically mail us a certified mail with your id" shit. GPDR is a fucking failure in this aspect. Also no required strong authentication: access should be just directly through your account you can access normally without strong authentication.

Usage: GDPR does not allow you to trade tracking for access (ie monetisation of content is almost impossible if you care about user privacy): this is insane. GDPR also supposedly does not allow for those complicated "accept all or modify your preferences" windows, but it should have no saying in that: if a site wants to make the experience painful, that's up to them. It is up to the user to select if they want to use that site or not.

They continue to operate and are not bogged down in regulation. Even if there are unofficial rules of what matters and what doesn't, they have figured out those rules.

Relevant: https://idlewords.com/talks/haunted_by_data.htm

(Maybe you were familiar). The closing is particularly worth taking in:

> Finally, don't be surprised. The current model of total surveillance and permanent storage is not tenable.

> If we keep it up, we'll have our own version of Three Mile Island, some widely-publicized failure that galvanizes popular opinion against the technology.

> At that point people who are angry, mistrustful, and may not understand a thing about computers will regulate your industry into the ground. You'll be left like those poor saps who work in the nuclear plants, who have to fill out a form in triplicate anytime they want to sharpen a pencil.

> You don't want that. Even I don't want that.

> We can have that radiant future but it will require self-control, circumspection, and much more concern for safety that we've been willing to show.

> It's time for us all to take a deep breath and pull off those radium underpants.

I'm not sure it came in the form of a single event (though I can think of some candidates -- the cambridge analytica scandal made a big impression for one), but it's clear to me at this point that the warning was ignored, and our industry has missed the window for self-regulation.

Exactly, and I think we're usually way off intuitively.

For example when considering how many facts of what nature I'd need to individually identify you. SSN? Ok, done, everybody knows that. But how far do I get with birth date, height and city? What if I add one chronic health issue, no matter how small? Chronic sinusitis, born on August 8th, lives in $city and is 186cm? In most cases, I probably don't even need all four.

But most people intuitively don't think about it in combination, they figure "oh so you know I live in $city, big deal, so do a million other people", "oh so you know my birthday, well a million other people in the country have that birthday".