9 ms·

I really don't get the big deal with GDRP. Consider what you are storing and why you are storing. Decide if those things align. If they do not, well don't imple

by Ekaros 9d ago

I really don't get the big deal with GDRP. Consider what you are storing and why you are storing. Decide if those things align. If they do not, well don't implement that in first place. And I suppose LLMs are perfect for the boiler plate documentation so not big effort there either. Somethings are big more challenging like getting the data for customer when asking or deleting it when reasonable. But as user I also like at least having that option. It is least any business can do.

graemep 9d ago
GDPR is reasonable, maybe too weak regulation of big businesses with lots of data. The problem is that it applies to small organisations, even non-profits, that do not trade that information which is proportionately a much bigger burden. Real examples of organisations I have come across who have to comply with GDPR include a local community theatre, a parish church etc. They are keep fairly simple information, and not exchanging it with anyone, but they still have to put effort into ensuring compliance. They are pretty good and ethical anyway - the theatre recently impressed me when I found out that if you give them medical information in case of emergency they put it in a sealed envelope and no one opens it unless there is an actually emergency that requires it (i.e. you keel over there!).
- mschuster91 9d ago
  > Real examples of organisations I have come across who have to comply with GDPR include a local community theatre, a parish church etc. They are keep fairly simple information, and not exchanging it with anyone, but they still have to put effort into ensuring compliance. Yeah, and that is precisely where you want something like the GDPR to be as well! Large corporations are one thing, they have compliance departments, but so, so many local organizations have gotten hacked or data exfiltrated because "why do software and hardware updates when everything is working" or due to incompetence ("cc all"). GDPR finally gave the younger crowd some leverage to get the old guard to do things at least somewhat decently.
  - gmueckl 9d ago
    Well, wait until you are at the receiving end. It can get nasty pretty quickly. What does each one of your systems store exactly? Do they allow configuration of reasonable data retention policies for PII? What do your systems log? How do you make sure that only the minimum amount of PII (including user IP addresses) is logged and that the covered logs are destroyed at the end of a reasonable retention period? How do you handle Data Subject Access Requests? Can you compile all the data related to that person in a reasonable time to send it to them? How do you handle deletion requests? Can you name all the data storage that is affected if a deletion request comes in? Are your systems technically capable of deleting the data? What data is exempt (e.g. billing addresses can't just be deleted before the mandated archival period is over)? Do you maintain backups? Then how do you make sure that data covered by a deletion request is destroyed and stays gone even in the event of a backup recovery? Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink.
    - mschuster91 9d ago
      > Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink. Indeed but it forces you to answer these questions and to think about them during the development process as well, maybe even enough to write decent unit and regression tests for anything authentication/authorization related before some security "researcher" siccs Claude Code or whatever on your API and pwns it.
      - gmueckl 9d ago
        You assume that the business is about developing software and will have a public facing API. That's a very narrow perspective. The vast majority of businesses aren't this. Even a plumber who types up offers and invoices on a computer is subject to all of this mess.
        mschuster91 9d ago
        > Even a plumber who types up offers and invoices on a computer is subject to all of this mess. Yeah and that plumber has 1000s of customer names, addresses, phone numbers, mail addresses, in Europe maybe even SEPA Direct Debit data. Not funny if that kind of stuff leaks, especially not if you're, say, a person with a public register block due to domestic violence or whatever (basically, one step before witness protection that gives you a whole new identity).
- GJim 9d ago
  > The problem is that it applies to small organisations, even non-profits, that do not trade that information which is proportionately a much bigger burden. Eh? Collect only the personal data you need (with permission) and keep it secure. Such a basic responsibility to your members privacy and safety is hardly a burden.
mitxela 9d ago
The thing is American businesses try to read the entire thing in excruciating detail and proactively comply with every possibility they can think of while European businesses just make a good faith effort to comply with the spirit, and if an authority tells them they can't do something, they stop doing it. Based on this behavior I'd have to infer American courts are punitive oriented (so you must never slip up) while European courts are resolution oriented (so good faith is enough and stop worrying so much). My inference also explains why American businesses don't listen to European courts until the fines get big. They get some small penalty on their first violation and think "that's all?" and continue the violation, then four or five cases later the penalty gets big enough to make them comply. See Apple with the interop rulings.

by Ekaros 9d ago

graemep 9d ago

GDPR is reasonable, maybe too weak regulation of big businesses with lots of data. The problem is that it applies to small organisations, even non-profits, that do not trade that information which is proportionately a much bigger burden. Real examples of organisations I have come across who have to comply with GDPR include a local community theatre, a parish church etc. They are keep fairly simple information, and not exchanging it with anyone, but they still have to put effort into ensuring compliance. They are pretty good and ethical anyway - the theatre recently impressed me when I found out that if you give them medical information in case of emergency they put it in a sealed envelope and no one opens it unless there is an actually emergency that requires it (i.e. you keel over there!).

mschuster91 9d ago
> Real examples of organisations I have come across who have to comply with GDPR include a local community theatre, a parish church etc. They are keep fairly simple information, and not exchanging it with anyone, but they still have to put effort into ensuring compliance. Yeah, and that is precisely where you want something like the GDPR to be as well! Large corporations are one thing, they have compliance departments, but so, so many local organizations have gotten hacked or data exfiltrated because "why do software and hardware updates when everything is working" or due to incompetence ("cc all"). GDPR finally gave the younger crowd some leverage to get the old guard to do things at least somewhat decently.
- gmueckl 9d ago
  Well, wait until you are at the receiving end. It can get nasty pretty quickly. What does each one of your systems store exactly? Do they allow configuration of reasonable data retention policies for PII? What do your systems log? How do you make sure that only the minimum amount of PII (including user IP addresses) is logged and that the covered logs are destroyed at the end of a reasonable retention period? How do you handle Data Subject Access Requests? Can you compile all the data related to that person in a reasonable time to send it to them? How do you handle deletion requests? Can you name all the data storage that is affected if a deletion request comes in? Are your systems technically capable of deleting the data? What data is exempt (e.g. billing addresses can't just be deleted before the mandated archival period is over)? Do you maintain backups? Then how do you make sure that data covered by a deletion request is destroyed and stays gone even in the event of a backup recovery? Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink.
  - mschuster91 9d ago
    > Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink. Indeed but it forces you to answer these questions and to think about them during the development process as well, maybe even enough to write decent unit and regression tests for anything authentication/authorization related before some security "researcher" siccs Claude Code or whatever on your API and pwns it.
    - gmueckl 9d ago
      You assume that the business is about developing software and will have a public facing API. That's a very narrow perspective. The vast majority of businesses aren't this. Even a plumber who types up offers and invoices on a computer is subject to all of this mess.
      - mschuster91 9d ago
        > Even a plumber who types up offers and invoices on a computer is subject to all of this mess. Yeah and that plumber has 1000s of customer names, addresses, phone numbers, mail addresses, in Europe maybe even SEPA Direct Debit data. Not funny if that kind of stuff leaks, especially not if you're, say, a person with a public register block due to domestic violence or whatever (basically, one step before witness protection that gives you a whole new identity).
GJim 9d ago
> The problem is that it applies to small organisations, even non-profits, that do not trade that information which is proportionately a much bigger burden. Eh? Collect only the personal data you need (with permission) and keep it secure. Such a basic responsibility to your members privacy and safety is hardly a burden.

mitxela 9d ago

The thing is American businesses try to read the entire thing in excruciating detail and proactively comply with every possibility they can think of while European businesses just make a good faith effort to comply with the spirit, and if an authority tells them they can't do something, they stop doing it. Based on this behavior I'd have to infer American courts are punitive oriented (so you must never slip up) while European courts are resolution oriented (so good faith is enough and stop worrying so much). My inference also explains why American businesses don't listen to European courts until the fines get big. They get some small penalty on their first violation and think "that's all?" and continue the violation, then four or five cases later the penalty gets big enough to make them comply. See Apple with the interop rulings.