Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR: Don't Panic

jacquesmattheij.com

Post reply on HN
Print view View original

561–570 of 833 posts

Re: GDPR: Don't Panic

#561

Post by merinowool »

icebraining wrote: post #245
merinowool wrote: post #186

Earlier quoted context omitted.

John Doe says company has personal information on him and doesn't want to delete it. Shows email exchange with the company and company is stating they don't have his personal data, so there is nothing to delete. How do they judge the case has a merit? Let's say a group forms on xchan type of site and flood company and "clearing house" with such claims.

Unless Doe can provide any actual reason for believing they have his data, and as long as the data handling process of the company is sound, the regulator will just close the issue. At least that's my experience. Remember that the Data Protection Directive, which already allows citizens to ask companies if they have data on them and to correct incorrect data, has been around from 1995, yet there hasn't been any mobs…

John Doe could say he had an account with company website. He can't log in because he has got shadow blocked. There would be dozens of such claims .

Re: GDPR: Don't Panic

#562

Post by icebraining »

merinowool wrote: post #559
icebraining wrote: post #240

Earlier quoted context omitted.

As far as I know, you pay for an audit yourself, and then you send them the results.

How difficult would be to pay auditor to close their eyes? Do you need another audit?

Sorry, I don't know the details.

Re: GDPR: Don't Panic

#563

Post by myWindoonn »

losvedir wrote: post #459

It's like if a new law were introduced requiring a license in order to ride a bike, to make sure people don't hit pedestrians or bike dangerously in the road. The license is free, it just takes a weekend to go take a written test and demonstrate that you can safely ride a bike. Some people who would pass but can't be bothered to give up a weekend would instead choose to just stop biking. It's an unavoidable consequen…

It's not like that at all; some of us are small business owners who don't have to take any action, because we already were not mishandling PII and already had a PII-handling section in our data-handling policy.

Re: GDPR: Don't Panic

#564

Post by raverbashing »

kodablah wrote: post #480
meredydd wrote: post #339

Earlier quoted context omitted.

I think you and everyone making similar points in this thread are getting tripped up by the difference between rules-based regulation and principles-based regulation. This is unsurprising, given that the US is so heavily rules-based, but the EU (certainly the UK) has a long history of principles-based regulation. In rules-based regulation, all the rules are spelled out in advance, and the regulator is basically an au…

What you dub principles-based regulation others call trust-based regulation, or randomly-enforced regulation, or we-know-it-when-we-see-it-based regulation. Some don't appreciate this type of regulation. I think the unfortunate thing is that, when the previous/existing incarnations of these protection laws were/remain unenforced, many assumed it was because of lack of "teeth". But those of us familiar with how these…

And rules-based regulation means you commit 3 felonies per day https://www.wsj.com/articles/SB10001424052748704471504574438...

Re: GDPR: Don't Panic

#566

Post by merinowool »

meredydd wrote: post #339
downandout wrote: post #266

Earlier quoted context omitted.

There is nothing - and I do mean nothing - written into the GDPR that requires any warnings of any kind, or places any limits on fines, except for $10/$20 million or 4% of revenue, whichever is greater. Period. A multimillion-dollar fine without warning for a first, minor violation is perfectly lawful under GDPR. The idea that "yes it says that but we can trust EU regulators to not assess large fines against foreign…

I think you and everyone making similar points in this thread are getting tripped up by the difference between rules-based regulation and principles-based regulation. This is unsurprising, given that the US is so heavily rules-based, but the EU (certainly the UK) has a long history of principles-based regulation. In rules-based regulation, all the rules are spelled out in advance, and the regulator is basically an au…

Now if the government interpretation of GDPR will differ from a website owner's they'll be able to shut it down with a fine. Since this law can be interpreted in so many ways they can virtually fine any site they don't like, because depending on interpretation every site can be found non complaint. This is huge and dangerous.

Re: GDPR: Don't Panic

#567

Post by merinowool »

AmericanChopper wrote: post #372
meredydd wrote: post #339

Earlier quoted context omitted.

I think you and everyone making similar points in this thread are getting tripped up by the difference between rules-based regulation and principles-based regulation. This is unsurprising, given that the US is so heavily rules-based, but the EU (certainly the UK) has a long history of principles-based regulation. In rules-based regulation, all the rules are spelled out in advance, and the regulator is basically an au…

>and you'll have to engage with it on those terms Or you can just disengage with Europe all together, which is an obvious choice for many small to medium sized companies, given the risks and costs involved.

It is not possible, unless you'll check id and residence certificate of all visitors. Blocking EU IP is not sufficient.

Re: GDPR: Don't Panic

#568

Post by davorak »

crankylinuxuser wrote: post #531
AmericanChopper wrote: post #500

Earlier quoted context omitted.

I’m sorry, but this is simply the naive opinion of somebody that has clearly never had to deal with compliance before on a meaningful level. My customers are all happy with my privacy policy, and not a single one outside of the EU has expressed any interest at all in the GDPR. We are actually compliant with a majority of the regulation, however there are some areas where we would have to re-architect to gain full com…

Right now we are going through a federal audit. We sell only to US orgs, but also have a social media platform. Because our social media platform is open to all, we are addressing adhering to the GDPR. In spirit, we already do, but they want what amounts to 5 documents how we use metrics and user data. (Edit: we use metrics only in a '20 new people signed up'. We treat all data as federal confidential data. We also a…

> And given your comments above, I'd put you in the company of "Hoover, Dyson, and Electrolux".

Comments like this come across like a personal insult.

For you an others, please refrain from such comments I see it shutting down interesting conversations(that help me understand additional view points).

Re: GDPR: Don't Panic

#569

Post by thomaskcr »

pjc50 wrote: post #257
ThePhysicist wrote: post #250

Earlier quoted context omitted.

I really don't know why people think that the authorities will (or even could) automatically punish each minor infraction with 4 % of global revenue or 20 million €. GPDR article 87 specifies in great detail when fines should be imposed and how their value should be calculated, and the Article 29 WP also has a guideline on that: https://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889 It is therefore simply not p…

I'm starting to wonder if there's an active disinformation campaign about this somewhere. Are people getting their fears from Facebook again? Edit: If there is such a thing I bet it's Cambridge Analytica/"SCL group" involved, since they made their money from large scale nonconsensual abuse of political personal data, and have an arm dedicated to swinging elections with misleading Facebook adverts.

I mean part of the issue is that I literally cannot answer the question "are we GDPR compliant?". The amount of time we've spent figuring out whether we need to sanitize apache logs has been ridiculous.

If you search for GDPR IP address you'll get 100 different opinions on what you need to do. That in my opinion is what makes this law ridiculous. How can companies be expected to comply with something this unclear? I'm sure I would have had your opinion before I was the person who is ultimately responsible if my answer to GDPR compliance is wrong.

Everyone having issues with this is somewhere in the line of fire for a wrong answer to any of these questions. Our concern over the fuzziness of this law is very valid, I don't like uncertainty personally.

Re: GDPR: Don't Panic

#570

Post by kodablah »

raverbashing wrote: post #564
kodablah wrote: post #480

Earlier quoted context omitted.

What you dub principles-based regulation others call trust-based regulation, or randomly-enforced regulation, or we-know-it-when-we-see-it-based regulation. Some don't appreciate this type of regulation. I think the unfortunate thing is that, when the previous/existing incarnations of these protection laws were/remain unenforced, many assumed it was because of lack of "teeth". But those of us familiar with how these…

And rules-based regulation means you commit 3 felonies per day https://www.wsj.com/articles/SB10001424052748704471504574438...

Going on a bit of a tangent here, I am becoming concerned with how we discuss these things. You're completely either for or against it. And if you're against one way you are automatically for the other. If you think one thing is bad, obviously you need to be corrected that other thing is bad too. And then you'll get extreme examples showing it. Call it whataboutism, appeal to emotion, whatever.

Every time these GDPR discussions come up, someone is always quick to say the US is worse, US is getting a taste of its own medicine, that dissenters must want surreptitious data collection, and on and on. Oddly enough, bringing it full circle, the tendencies for humans to argue in these directions instead of stay focused on the issue at hand make me glad to have more strict boundaries that are less subject to the whims of idle thought. Obviously this can't be absolute, so we should craft our rules to limit their scope at least from the outset. It's not about one country/continent vs another, it's about the goals and how they are achieved. Some believe and/or have experienced difficulties conforming to all sorts of government rules, it is a human thing not a location one. IMO, we need to stop deflecting and we need to stop being so absolute. People that are feeling pain of impending laws are not hysterical and laws are not magically OK because other forms/interpretations have downsides.

Post reply on HN