100% of our customers would not accept the costs of strictly follow this requirements. They are for sure good advice, but not much practical into everyday web dev life.
Sounds dystopian
So a competitor can charge customers less. That in turn will mean your business will disappear, and the conforming implementation will still be around.
This is part of the point, isn't it?
You shouldn't have to read anything, that's the point. GDPR is the law that recognizes that people will never read, so the only protection possible is to both a) make acceptance explocit and b) make opt out default.
That is - If I just "accept" the policy or click accept to enter the website, I must be sure that I only accepted to the minimum you need to perform the business task, and not e.g. 3rd party advertising cookies, regardless of whether those cookies is what keeps the lights on.
This seems to apply in pre-GDPR codebases which I'm not sure this guide has taken into account. It probably is a lot less costly to architect an application from scratch, therefore easier to justify to a customer.
How much is it costing you to have all the ad cookies and trackers compared to their returns?
Do you know how to edit an individual out of the Postgres WAL in last week's full disk backup?
You either maintain a deletion list for when you recover backups (which is tricky) or you keep data encrypted with a different key for each user, then delete the key to forget the corresponding information
Hence the importance of data minimization and governance
Laws are generally complex, GDPR isn't really special in that sense; it's just newer than the rest. You can probably draft a similarly complex 16-page document for your country's/state's employment laws too, but that doesn't mean you need to work through all of that mess when hiring your startup's first five employees.
In reality, if you honor user data deletion requests, don't track people without asking (with easy "no"), and follow proper modern security practices, you're already so far ahead of the majority of tech businesses wrt the GDPR that you're good. Or at least, that's my impression.
The goal is specifically to make the GDPR less daunting and more accessible! I guess it missed the mark.
But yeah, the GDPR has to formalize a lot of common sense practices, if you don't consider your user as "data trove" you want to abuse, you will be mostly ok!
But you won't. Mostly OK does not protect you from ruinous lawsuits or investigations. With the way the justice system works on the EU level I would never trust "mostly OK". We had an EU court find that posting factual information about a religion was blasphemy and not protected as freedom of speech as a human right.[0]
Just because they aren't an official EU institution doesn't mean much. It's still largely the same culture and legal traditions running it and every EU country is under it.
its name in french means 'National Commission on Informatics and Liberty', it is an independent French administrative regulatory body whose mission is to ensure that data privacy law is applied to the collection, storage, and use of personal data. Created in 1978. National data protection authority for France.
As such, it's one of the best guides you can find around, because everything you find in there is almost guaranteed to be exact (contrary to some companies selling compliance tools that are not compliant, or a random blog on the internet). And if there is any mistake there, well you can refer the CNIL to its own guide when they investigate you.
Obviously they want to make a guide to get to 100% compliance, but they as you said in your last phrase, they indeed don't have the manpower to investigate everyone, and if you are generally respectful of your users privacy, you don't handle sensitive data at a large scale and don't have any complaint against you, they have no reason to ask you for documentation (which is generally going to be the first step of an investigation).