UK to depart from GDPR

One important way is ambiguity. For example, it relies on "legitimate interests" as a lawful basis for a lot of different types of processing, but there is no specific, actionable definition of that term. This is compounded by the right of the data subject to object to some processing, but again with only an ambiguous specification of when those rights take precedence over the legitimate interests of the data controller (other than a few specific cases, such as direct marketing).

As another example, there is a new subject right to erasure of their data, though again this isn't absolute. Several potential complications were discussed about this right. One is how to handle copies of that data in back-ups, archives or retired equipment. Another is how to deal with data held in deliberately tamper-proof formats, some of which will already have existed before this right to erasure was introduced by the GDPR.

Another important way is the compliance costs, and in particular the disproportionate costs to small businesses. For example, it cost mine many hours and thousands of pounds to understand the new requirements, take advice, and update our documentation to be compliant, yet the actual data processing we did was always very light and so wasn't affected much by the new rules either. In other words, it cost us a significant amount of time and money without really benefitting anyone.

Related to that is the enforcement mechanism and penalty regime. Regulators are all-powerful, and again, while they can impose some heavy fines on big businesses, those are meaningfully capped. In contrast, the rules allow them to impose penalties high enough to literally destroy any SME. The practical safeguards are the limited resources of regulators and the idea that those regulators are supposed to work collaboratively with data controllers and impose proportionate penalties for any compliance violations that can't be resolved, but this is awfully close to relying on personal judgement and good will, not what is actually written in law.

Then there is the reality that the GDPR doesn't actually do that much to protect against some of the biggest threats to personal privacy. For example, I would argue that two of the biggest risks in our modern "big data" world are excessive collection and processing of personal data supplied by third parties and excessive collection and processing of data by governments. The GDPR has done very little to curb either of those things. Every time I go out, I'm still potentially being listened to or photographed by countless other people's devices, which may then be uploading that data to big tech firms along with time and place information. Countless people have probably handed over my phone number or email address to big tech firms by allowing apps to scan their address book. We still see ever more intrusive monitoring of normal people's daily lives by governments, with tech like facial recognition cameras or mass surveillance of communications routinely infringing on personal privacy, and the authorities pushing for these things are entirely unrepentant and rely on the usual vague justifications about security and what a dangerous world we live in.

In short, the GDPR imposes significant burdens on data controllers without being clear about what their obligations or how to interpret key details in practice, introduces a penalty regime that hangs like a sword of Damocles over data controllers and represents an existential threat to smaller controllers, and yet at the same time hasn't actually been very effective at reducing the big risks to data subjects or increasing their control over how data about them is used and by whom.

None of these concerns is new. All were discussed extensively around the time the GDPR was introduced. But, perhaps because it was a law meant to improve individual privacy and that's a cause many of us support in principle, sometimes people get very defensive of it instead of looking at it critically and asking whether it actually achieves what it set out to do and whether any costs it introduces are proportionate to any benefits it offers.

Most laws are fairly ambiguous. Jurisprudence and intent play a big role in the justice system, it works to protect people from wrongdoing and not as a strict logical set of rules.

Being filmed in public, having your data handed to third-parties, facial recognition and mass surveillance are precisely some of the issues the GDPR has addressed, and it has already had massive impact; especially on tech companies (I’ve seen it firsthand). You talk about burdens but maybe you’re just angry you wasted money on a consultant? I honestly haven’t seen the bad side of it.

Globalisation allows local economies to specialise and reduce economic waste (e.g. what if every country had its own car factories?) I appreciate that globalisation will lead to localised races-to-the-bottom in the near-term, but in the long-term everyone benefits. Protectionism (for the sake of securing jobs) feels good in the short-term but very few mainstream economists will advocate for it absent other concerns (e.g. safety standards, cultural imports, national security, and human-rights concerns).

Take the UK for example: at the time of its accession to the EU it had a sizeable manufacturing and mining economy. Globalisation directly led to those factories and mines closing, but being in the EU meant the UK could specialise in emerging sectors and immediately export to the rest of the EU for free (e.g. service-sector, information economy, banking, finance, media, etc).

Globalisation and economic-interdependence is also the main driver for world-peace. I’d rather be unemployed because someone in France does my job but cheaper than be fighting in a war against France for some sense of “national pride”.

Globalisation needs a friendlier face, yes. And we need better ways of managing the local negative effects, like better unemployment income for plant closures - but I don’t believe the sentimental negatives in any way outweigh the long-term benefits.

Irish myself. So I upvoted you back for expanding on my [perhaps puzzling to some] inclusion of Ireland in the list of US sphincter hygienists.

Ireland is officially a neutral country but, as you correctly point out, has a long history of allowing the US to use Shannon as a de facto US Airbase. And, as you also correctly point out, has almost built its entire economy in recent years on providing tax incentives and other bribes for US mega-corporations to set up [nominal] HQ there. The phrases "House of Cards" and "They don't love you back" immediately spring to mind.

My previous client is a reasonably large Swedish company with a big German presence and they took GDPR (and data protection in general) EXTREMELY seriously. I know because, outside of the training, I sat in on a few audit meetings.