Hacker News Reader

Comment by jpgvm | Hacker News Reader

I take issue with their response, quoted below:

> A comprehensive action plan has been launched to improve the internal auditing practices to ensure data privacy compliance, strengthen leadership knowledge to assure a safe and compliant work environment, and continue to train and educate both staff and leaders in this area

How is the response to this incident to try prevent further breaches rather than vowing to not collect this data in the first place? Why is this an acceptable response at all?

View on HN

I don't read this as saying they'll prevent further breaches. It seems to be saying that they will improve compliance with data privacy regulation.

Right, collecting the data in the first place was a compliance breach.

We're so used to the only kind of data protection enforcement being for data leakage - but this is actually a great example of what GDPR is really for: putting a framework around what personal data it's acceptable for companies to process in the first place.

To expand: it’s not necessarily the collection that’s bad, but that leaks will happen. It’s not a matter of if, but when. So by putting limits on what can be collected, it mitigates some of the damage of a leak.

No, it really is that collecting the data is bad! GDPR is not about making breaches less harmful (though that is a benefit) - it is about preventing businesses from secretly gathering data about you, without your knowledge, and using it in ways that harm you.

One of the ways in which a business can harm you through abusing the data they have about you is certainly allowing it to leak out - but that is very much not the only intention of data protection law.

I'm with you, the process of collecting this data is the issue. This issue shouldn't be about compliance and audits, it should be about not intruding into the lives of your employees. I would never work for a company that treated me that way.

How did they even accomplish this level of monitoring/spying? I'm imagining GPS, webcam, and drones. Surely that can't be right?

It's cause they want to collect even more data, and they promise to keep it all safe.

Reply on news.ycombinator.com