7 ms·

> Real examples of organisations I have come across who have to comply with GDPR include a local community theatre, a parish church etc. They are keep fairly si

> Real examples of organisations I have come across who have to comply with GDPR include a local community theatre, a parish church etc. They are keep fairly simple information, and not exchanging it with anyone, but they still have to put effort into ensuring compliance. Yeah, and that is precisely where you want something like the GDPR to be as well! Large corporations are one thing, they have compliance departments, but so, so many local organizations have gotten hacked or data exfiltrated because "why do software and hardware updates when everything is working" or due to incompetence ("cc all"). GDPR finally gave the younger crowd some leverage to get the old guard to do things at least somewhat decently.

gmueckl 9d ago
Well, wait until you are at the receiving end. It can get nasty pretty quickly. What does each one of your systems store exactly? Do they allow configuration of reasonable data retention policies for PII? What do your systems log? How do you make sure that only the minimum amount of PII (including user IP addresses) is logged and that the covered logs are destroyed at the end of a reasonable retention period? How do you handle Data Subject Access Requests? Can you compile all the data related to that person in a reasonable time to send it to them? How do you handle deletion requests? Can you name all the data storage that is affected if a deletion request comes in? Are your systems technically capable of deleting the data? What data is exempt (e.g. billing addresses can't just be deleted before the mandated archival period is over)? Do you maintain backups? Then how do you make sure that data covered by a deletion request is destroyed and stays gone even in the event of a backup recovery? Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink.
- mschuster91 9d ago
  > Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink. Indeed but it forces you to answer these questions and to think about them during the development process as well, maybe even enough to write decent unit and regression tests for anything authentication/authorization related before some security "researcher" siccs Claude Code or whatever on your API and pwns it.
  - gmueckl 9d ago
    You assume that the business is about developing software and will have a public facing API. That's a very narrow perspective. The vast majority of businesses aren't this. Even a plumber who types up offers and invoices on a computer is subject to all of this mess.
    - mschuster91 9d ago
      > Even a plumber who types up offers and invoices on a computer is subject to all of this mess. Yeah and that plumber has 1000s of customer names, addresses, phone numbers, mail addresses, in Europe maybe even SEPA Direct Debit data. Not funny if that kind of stuff leaks, especially not if you're, say, a person with a public register block due to domestic violence or whatever (basically, one step before witness protection that gives you a whole new identity).
      - gmueckl 9d ago
        Thousands of customers? Your numbers are out of touch with reality.
        mschuster91 9d ago
        In Germany you have to keep your records for 8 years as a commercial entity, and 8 years is a lot of customers you deal with, if you work with private customers. If your primary focus as an electrician, plumber or other tradesperson is SME or industry, of course, then there is far less customers.
        gmueckl 9d ago
        No plumber I know is able to deal with more than a thousand different clients in eight years. This is so absolutely unrealistic it's laughable.
        mschuster91 9d ago
- GJim 9d ago
  > Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink I doubt anybody wants to deal with fire safety inspections either. Though I'm quite sure you will change your mind when your personal data gets hacked or your office burns down.
  - gmueckl 9d ago
    Some of my personal data has leaked. Some of it has to be public because of some laws. Fire safety is less onerous and less complex.
    - mschuster91 9d ago
      > Fire safety is less onerous and less complex. If there is one thing that is incredibly complex, it is fire codes - in no small part because these vary from town to town, or to be more precise, the height of their portable ladder trucks. Once you build higher than these, you have to plan for a second escape route. That's not that bad of a thing if you work exclusively in one area... but good luck if you operate across the nation or, worse, internationally because everyone does things a liiiitle bit differently.
    - thrwl007748 9d ago
      Have you ever been the responsible person for a public building, a big concert or anything of that ilk? Suuuuure, fire and work safety are easy peasy, uncomplicated and totally trivial compared to the GDPR. And the laws and regulations involved are so incredibly brief, well-written and stay consistent over a long time... o_O /s
      - gmueckl 9d ago
        I was talking about the burden on small companies. You are looking at different scales already. Also, I'd take fire safety over GDPR if I had a choice. That is much easier to get a handle on.
        9d ago
- thrwl007748 9d ago
  If you can't answer the oh so complicated and nasty questions you raised, you have no business fucking around with people's personal data and it's a good thing if your business dies (would be even better if you get a slap in the neck and financially hurt for a bit - but not so much that your business fails - and you use the punishment as an impulse to rethink your ways and do better in the future. But how likely is that, given bone-headed positions like yours?!) "I don't want to deal with it" is relatable and human - and one of the main reasons why potentially dangerous things are / have to be regulated.
- Telaneo 9d ago
  I don't want people who can't handle this to start businesses.
- mitxela 9d ago
  Actually I want to ask you why you don't know what your system does, not even approximately?
graemep 8d ago
> so many local organizations have gotten hacked or data exfiltrated because "why do software and hardware updates when everything is working" They have a lot less information. Consider my too examples. What do they record electronically? Name and address. The church will have relationship to people such as spouse and children, which are in public records anyway. A few details of sons preferences and involvements. The theatre is even more public - if you act its publicised. They might both have records of tax deductible donations. They do not have unique identifiers such as appear on ID documents or NI (UK tax and social security) numbers. They do not correlate this with outside sources. There is very little to leak.

gmueckl 9d ago

Well, wait until you are at the receiving end. It can get nasty pretty quickly. What does each one of your systems store exactly? Do they allow configuration of reasonable data retention policies for PII? What do your systems log? How do you make sure that only the minimum amount of PII (including user IP addresses) is logged and that the covered logs are destroyed at the end of a reasonable retention period? How do you handle Data Subject Access Requests? Can you compile all the data related to that person in a reasonable time to send it to them? How do you handle deletion requests? Can you name all the data storage that is affected if a deletion request comes in? Are your systems technically capable of deleting the data? What data is exempt (e.g. billing addresses can't just be deleted before the mandated archival period is over)? Do you maintain backups? Then how do you make sure that data covered by a deletion request is destroyed and stays gone even in the event of a backup recovery? Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink.

mschuster91 9d ago
> Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink. Indeed but it forces you to answer these questions and to think about them during the development process as well, maybe even enough to write decent unit and regression tests for anything authentication/authorization related before some security "researcher" siccs Claude Code or whatever on your API and pwns it.
- gmueckl 9d ago
  You assume that the business is about developing software and will have a public facing API. That's a very narrow perspective. The vast majority of businesses aren't this. Even a plumber who types up offers and invoices on a computer is subject to all of this mess.
  - mschuster91 9d ago
    > Even a plumber who types up offers and invoices on a computer is subject to all of this mess. Yeah and that plumber has 1000s of customer names, addresses, phone numbers, mail addresses, in Europe maybe even SEPA Direct Debit data. Not funny if that kind of stuff leaks, especially not if you're, say, a person with a public register block due to domestic violence or whatever (basically, one step before witness protection that gives you a whole new identity).
    - gmueckl 9d ago
      Thousands of customers? Your numbers are out of touch with reality.
      - mschuster91 9d ago
        In Germany you have to keep your records for 8 years as a commercial entity, and 8 years is a lot of customers you deal with, if you work with private customers. If your primary focus as an electrician, plumber or other tradesperson is SME or industry, of course, then there is far less customers.
        gmueckl 9d ago
        No plumber I know is able to deal with more than a thousand different clients in eight years. This is so absolutely unrealistic it's laughable.
        mschuster91 9d ago
GJim 9d ago
> Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink I doubt anybody wants to deal with fire safety inspections either. Though I'm quite sure you will change your mind when your personal data gets hacked or your office burns down.
- gmueckl 9d ago
  Some of my personal data has leaked. Some of it has to be public because of some laws. Fire safety is less onerous and less complex.
  - mschuster91 9d ago
    > Fire safety is less onerous and less complex. If there is one thing that is incredibly complex, it is fire codes - in no small part because these vary from town to town, or to be more precise, the height of their portable ladder trucks. Once you build higher than these, you have to plan for a second escape route. That's not that bad of a thing if you work exclusively in one area... but good luck if you operate across the nation or, worse, internationally because everyone does things a liiiitle bit differently.
  - thrwl007748 9d ago
    Have you ever been the responsible person for a public building, a big concert or anything of that ilk? Suuuuure, fire and work safety are easy peasy, uncomplicated and totally trivial compared to the GDPR. And the laws and regulations involved are so incredibly brief, well-written and stay consistent over a long time... o_O /s
    - gmueckl 9d ago
      I was talking about the burden on small companies. You are looking at different scales already. Also, I'd take fire safety over GDPR if I had a choice. That is much easier to get a handle on.
      - 9d ago
thrwl007748 9d ago
If you can't answer the oh so complicated and nasty questions you raised, you have no business fucking around with people's personal data and it's a good thing if your business dies (would be even better if you get a slap in the neck and financially hurt for a bit - but not so much that your business fails - and you use the punishment as an impulse to rethink your ways and do better in the future. But how likely is that, given bone-headed positions like yours?!) "I don't want to deal with it" is relatable and human - and one of the main reasons why potentially dangerous things are / have to be regulated.
Telaneo 9d ago
I don't want people who can't handle this to start businesses.
mitxela 9d ago
Actually I want to ask you why you don't know what your system does, not even approximately?

graemep 8d ago

> so many local organizations have gotten hacked or data exfiltrated because "why do software and hardware updates when everything is working" They have a lot less information. Consider my too examples. What do they record electronically? Name and address. The church will have relationship to people such as spouse and children, which are in public records anyway. A few details of sons preferences and involvements. The theatre is even more public - if you act its publicised. They might both have records of tax deductible donations. They do not have unique identifiers such as appear on ID documents or NI (UK tax and social security) numbers. They do not correlate this with outside sources. There is very little to leak.