Hacker News Reader

Comment by mtkd | Hacker News Reader

GDPR has significant scope to enable DDOSing of commercial organisations with information requests - it will likely become a tool for political activism as the new information request system has no fee.

It also has potential to spawn new greasy organisations that facilitate mass requests for personal info on your behalf which could lead to some new PPI-style compensation claim situations.

It's a good step for custody of identity information but I'm not sure impact has been completely thought through.

View on HN

> GDPR has significant scope to enable DDOSing of commercial organisations with information requests

Another way of looking at it is that it adds significant incentives for organizations to make user data more easily accessible to users. There's no reason information requests _have_ to be expensive operations.

Or an incentive not to collect the data at all in the first place.

Lawyer for the U.S. business I work at said that we can look at it more in the coming year since he suspects it won't come to life in its current form for the exact points you make.

Guess we will see. I'm all for individual rights and privacy, but there should also be options that are reasonably achieved by all parties.

I suppose that would depend on your view point. I am of the view that much of this data collection is something companies have no right to, especially when it's done to people who have not agreed to it ala Facebook's shadow profiles. From that viewpoint I say tough shit if you get swamped by these requests.

If we found that a group of companies had made a business model of dumping garbage in public areas through a legal loophole, Id hope that people wouldn't be saying that we have to figure out some solution that's reasonable for all parties when the government goes to stop that

I think the cost of handling personal data should be so high that current shady practices would make no economical sense.

That would be ideal solution for all this mass personal data collection and mishandling.

We already have something like this in Germany and no such thing has happened.

>GDPR has significant scope to enable DDOSing of commercial organisations with information requests - it will likely become a tool for political activism as the new information request system has no fee.

@vecna (https://github.com/vecna, former Hacking Team employee turned privacy activist) is working towards that, and I think he wouldn't mind contributions.

Reply on news.ycombinator.com