Hacker News Reader

Comment by cm2012 | Hacker News Reader

cm2012

I just want to note how non-obvious compliance with GDPR is. Two experts on GDPR and privacy in this thread (Jacquesm and Ainiriand) have been disagreeing throughout the thread on just the basis of whether one should reply to GDPR complaints like this. Imagine how much up for interpretation the more gritty parts of the law will be.

View on HN

And Jacquesm is saying don't be alarmed in some comments while in other comments he admits there could be problems with people trolling with this letter. So I'm even more skeptical of allowing any EU users.

I think it would be best if people like you would just go ahead and block all EU users. There's so much "well I might just block them then!" going around these days, when you should just do it if you think it's the best approach.

It's a very consistent position: no need to be alarmed, yes you will have to answer a letter like this, even if it is trolling. But if a letter like this alarms you then you probably have bigger problems.

It's alarming because you describe the letter as analogous to an "exploit toolkit" and we all know no patch is coming.

Perhaps proponents of GDPR should have considered this very obvious weaponization of the law...

They did consider it, there is a pretty extensive part written on what can go into a DSAR and from what I can see this letter skirts the edge and in some places goes over it but on the whole it is not an unreasonable burden to deal with it as it is.

Take into account the lengths to which companies will go to collect data, it stands to reason that in that context there is some balance to be found if a Data Subject makes a request about that collected data. If you don't collect data the request can be answered immediately and without further work.

There are no experts on the law, even lawyers arent. The only one who can authoritatively produce interpretations of the law is the european Court of Justice. For that to happen a country's Supreme court must refer a case to them for consultation which is then binding throughout the EU. In the meanwhile, 28 different privacy regulatots can independently try to interpret it. Most of the regulators are not staffed yet and not up to the task.

At the monent the law is unenforceable

Reply on news.ycombinator.com