Thanks for the series of articles. I can't wait to see the rest of the world(especially the US) catch up with the visionary EU regulations. It's sad that so many Americans/Anglos dislike regulations so much.
EDIT: take a look at that slide, google invested 40 human years for assessment alone https://twitter.com/winfriedveil/status/995951301132537857?s...
Take a business about as far away from data as you can imagine. For instance, a business that makes replacement knobs for antique radio restorations. They have a website with an online catalog and a shopping cart where you can order replacement knobs, pay online, and they ship the knobs to you.
They collect your name and address for shipping, your email address to contact you if there are any questions or issues with the order and to give you order processing updates, and payment information.
If this business is offering their goods to people in the Union, that data collection falls under GDPR, and they have to have a designated representative in the Union.
I've not been able to find anything so far on (1) how some random small business in the US goes about finding someone to be their designated representative in the EU, and (2) what they will have to pay that person to take do so.
And if they do run their own shopping infrastructure they obviously will have to deal with all the ins and outs of that, including operations, keeping the whole thing up-to-date and secured as well as compliance with the law.
Won't that mean they are still under GDPR and still need to have a designated representative?
Can you point to which bit of GDPR says this please?
Article 3(2) is the one that says GDRP applies to the processing of personal data of data subjects in the Union by controllers or processors not in the Union if the processing activities are related to the offering of goods or services in the Union.
If you are smaller than that and you outsource processing of the personal data of your customers, then all you have to do is make sure the customers consent to this, and you are good to go with GDPR. It's practically effortless, unless your business model relies on monetizing innocent victimes without their consent.
The Article 27 representative must be in the Union, which is why it can be problematical for a company whose office and employees are all outside the Union.
To be excluded, the processing has to satisfy three requirements:
• "is occasional"
• "does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10"
• "is unlikely to result in a risk to the rights and freedoms of natural persons"
Most businesses probably won't process any of the Article 9(1) special categories or the Article 10 criminal stuff, so that shouldn't my much of a hurdle for most.
All kinds of data pose a risk to the rights and freedoms of natural persons. See Recital 75 for examples. Of particular note, if it can lead to identity theft, fraud, or financial loss it poses such a risk. This is going to snag a lot of businesses.
Then there is that "is occasional" requirement for being excluded. I have no idea how that is going to be interpreted.
> The obligation laid down in paragraph 1 of this Article shall not apply to:
> processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or
I think the processing is "occasional".
As an end-user/customer, I’ll have the regulated version every single time, thank you.
You can reframe this either way you like, but what it will come down to is that IT has so far been one of the few completely unregulated industries, with only its own merits to show for why such regulation shouldn’t be needed. So far it’s not doing a very good case for itself.
People like Alan Kay has warned about this. If we don’t start taking our profession seriously (like doctors take not killing their patients seriously), someone else will. And then the future of programming will be legislated.
If that’s how it all will turn out, that’s because we as a industry has deserved it.
The GDPR is merely about basic decency and should only be considered a taste of what the future holds. Unless we ourselves show that we can act responsibly without further regulation.
Edit: Ofcourse if you are the world’s biggest privacy-violater with 100s of thousands of employees worldwide working every day to mine and AI even more shit out of you, ofcourse trying to get GDPR-compliant will take some effort. That’s the whole fucking point.
Smaller businesses treating user-data decently and with respect won’t have any such issues or conflicts of interests.
"Oops, did that airport take three times the money compared to expectations to build? Time to pony up more or end up with a half built airport".
You say that like it's a bad thing.
I'm obviously biased because I work for a company providing CRM software. That said, that gives me a decent amount of expertise in the matters too.
Basically we need to get all our own customer-data and systems GDPR-compliant. Which I won't deny has been a reasonably big effort on our part.
But instead of only doing this for ourselves, we've put all this effort into getting our own CRM-software GDPR-compliant instead, meaning in the process all our customers get to benefit from this at near zero cost.
Basically: By using a modern, maintained and competent CRM-solution, you should get GDPR-compliance in your core-databases almost "for free". I won't push my own company here, but it should be trivial to find should you be curious.
If your CRM-solution does not help you provide GDPR-compliance, you should consider how serious they are in these matters and if you want to continue using them.
And if you don't have a CRM-solution at all (really?) it's definitely time to consider getting one, because that's going to be the absolutely best tool you will get w.r.t. ensuring compliance.
> Oh, and did you know that GDPR also affects the work of teachers, solo entrepreneurs, doctors and the like?
It affects stored and processed privacy-sensitive information. Why should certain professions or business-categories be excluded?
This is quite funny considering you are writing this on the WWW, which runs on top of the TCP/IP stack. The WWW came out of CERN, the TCP/IP stack came out of DARPA. The web is at its roots a pretty global affair.
This is not about 'stifling competition', this is about privacy.