Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR: Don't Panic

jacquesmattheij.com

Post reply on HN
Print view View original

271–280 of 833 posts

Re: GDPR: Don't Panic

#271

Post by flexie »

nabla9 wrote: post #251

> The GDPR will require me to hire people and my entity is too small to be able to afford this Q: Does my business need to appoint a Data Protection Officer (DPO)? A: DPOs must be appointed in the case of: (a) public authorities, (b) organizations that engage in large scale systematic monitoring, or (c) organizations that engage in large scale processing of sensitive personal data (Art. 37). If your organization does…

GDPR requires those organisations to appoint a DPO, not to hire anyone new. It's like when you designate Ben to answer the phone after 5PM, Lisa to water the plants and the last guy to leave the office to turn off the light and close the windows (and for many companies there will be a lot less work involved with being a DPO, than with switching off the lights).

Re: GDPR: Don't Panic

#272

Post by zerostar07 »

mstolpm wrote: post #258
zerostar07 wrote: post #210

Earlier quoted context omitted.

I think it gets "hate" from people who don't have much data but they still have to implement all the requirements, which go beyond than their own data storage. Ad-supported websites are probably the most common case here, even if the sites don't store any data themselves.

Or perhaps these people/businesses have much more data about you and don't want to share how they monetize their "free" services by selling/renting/aggregating/analyzing your data? Think of all the free apps: I was in a conference with startup founders bragging about the business they make selling the location data of app users by incorporating some third party libraries in their apps without the users knowing. Of co…

I d wager for the vast amount of websites (>90%) it's just the ads, IPs and email addresses. Most websites have no monetizable use of your private info other than ads.

Re: GDPR: Don't Panic

#273

Post by rsj_hn »

dingo_bat wrote: post #219

Remember guys, while you are stressing over how to work with GDPR, Facebook literally listed all their existing data collection items and forced everyone to consent. Total increase in privacy: 0

People can now remove that consent whenever they want and force their data to be deleted at any time. This is a win. There are other wins, too.

Re: GDPR: Don't Panic

#274

Post by laumars »

downandout wrote: post #266
frereubu wrote: post #50

For those of you understandably intimidated by the GDPR regulations themselves, here's a good summary in plain English: https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... The UK's ICO also has a good structured summary: https://ico.org.uk/for-organisations/guide-to-the-general-da... In general I agree with the sentiments in this article. I've probably spent a total of three to four days reading around th…

There is nothing - and I do mean nothing - written into the GDPR that requires any warnings of any kind, or places any limits on fines, except for $10/$20 million or 4% of revenue, whichever is greater. Period. A multimillion-dollar fine without warning for a first, minor violation is perfectly lawful under GDPR. The idea that "yes it says that but we can trust EU regulators to not assess large fines against foreign…

In principle I might agree with you, however the EU has a long history of striking a fair balance between consumer rights and commercial interests. There is no point, in history, of the EU doing anything remotely like you've described. Which actually gives me more faith in the GDPR than legislation in a corrupt ecosystem as corrupt individuals will find a way to warp legislation in their favor anyway.

So yes, I do trust the EU and their history has proven that the aforementioned idea isn't a hollow one.

Re: GDPR: Don't Panic

#275

Post by pjc50 »

flexie wrote: post #271
nabla9 wrote: post #251

> The GDPR will require me to hire people and my entity is too small to be able to afford this Q: Does my business need to appoint a Data Protection Officer (DPO)? A: DPOs must be appointed in the case of: (a) public authorities, (b) organizations that engage in large scale systematic monitoring, or (c) organizations that engage in large scale processing of sensitive personal data (Art. 37). If your organization does…

GDPR requires those organisations to appoint a DPO, not to hire anyone new. It's like when you designate Ben to answer the phone after 5PM, Lisa to water the plants and the last guy to leave the office to turn off the light and close the windows (and for many companies there will be a lot less work involved with being a DPO, than with switching off the lights).

Exactly. Most businesses will already be required to have several "responsible person" roles for e.g. health and safety and fire evacuations. It's just that in a 1-person business they're all the same person.

Re: GDPR: Don't Panic

#276

Post by omginternets »

downandout wrote: post #266
frereubu wrote: post #50

For those of you understandably intimidated by the GDPR regulations themselves, here's a good summary in plain English: https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... The UK's ICO also has a good structured summary: https://ico.org.uk/for-organisations/guide-to-the-general-da... In general I agree with the sentiments in this article. I've probably spent a total of three to four days reading around th…

There is nothing - and I do mean nothing - written into the GDPR that requires any warnings of any kind, or places any limits on fines, except for $10/$20 million or 4% of revenue, whichever is greater. Period. A multimillion-dollar fine without warning for a first, minor violation is perfectly lawful under GDPR. The idea that "yes it says that but we can trust EU regulators to not assess large fines against foreign…

>we can trust EU regulators

I want to stress that this is a major point of political polarization in Europe at the moment. Even if this claim is true, it warrants a clear and articulated defense.

Re: GDPR: Don't Panic

#277

Post by doktrin »

frereubu wrote: post #50

For those of you understandably intimidated by the GDPR regulations themselves, here's a good summary in plain English: https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... The UK's ICO also has a good structured summary: https://ico.org.uk/for-organisations/guide-to-the-general-da... In general I agree with the sentiments in this article. I've probably spent a total of three to four days reading around th…

> I've probably spent a total of three to four days reading around the GDPR and I don't really see what's special about this law other than it's imposing decent standards on what was in effect a wildly unregulated industry in people's personal data

We are still waiting for the first court battles that will help determine how GDPR is actually enforced in practice. Until then being in compliance with GDPR is gonna be like herding invisible cats, and it's likely well intentioned people will get burned and OP ends up with major egg on his face within a years time. I want to drink the EU koolaid as much as the next person, but that's just naive.

Re: GDPR: Don't Panic

#278

Post by simion314 »

downandout wrote: post #266
frereubu wrote: post #50

For those of you understandably intimidated by the GDPR regulations themselves, here's a good summary in plain English: https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... The UK's ICO also has a good structured summary: https://ico.org.uk/for-organisations/guide-to-the-general-da... In general I agree with the sentiments in this article. I've probably spent a total of three to four days reading around th…

There is nothing - and I do mean nothing - written into the GDPR that requires any warnings of any kind, or places any limits on fines, except for $10/$20 million or 4% of revenue, whichever is greater. Period. A multimillion-dollar fine without warning for a first, minor violation is perfectly lawful under GDPR. The idea that "yes it says that but we can trust EU regulators to not assess large fines against foreign…

Isn't there wording that says the punishment is proportional with your transgression?

Re: GDPR: Don't Panic

#279

Post by nabla9 »

xtrapolate wrote: post #11

There's currently no case law surrounding GDPR. Moreover, some elements of the GDPR are up for interpretation. People are rightfully concerned. > "This post is an attempt to calm the nerves of those that feel that the(ir) world is about to come to an end" This post is actually a single person's viewpoint, a mere speculation of how things may or may not turn out to be. Your mileage may vary.

Legal system in European Union leans heavily towards civil law (aka Roman law) and the case law is secondary.

Re: GDPR: Don't Panic

#280

Post by [deleted] »

therealmarv wrote: post #138

This is no hysteria. Depending on where your company is located the sueing risk is really high. E.g. in countries like Germany there is a whole industry which lives from sueing companies and people and I can imagine that GDPR will open a whole new sueing market there. In other countries like Austria you get first warned and then sued on big GDPR violations which is a much better solution. So it all depends.

[deleted]
Post reply on HN