2018 reform of EU data protection rules

What he meant is that right now, because targeted ads exist, non-targeted ads sell far worse. Once targeted ads are not an option anymore, non-targeted ads will get more attention again, because the demand for advertising will not go away.

There will be somewhat of a drop in demand, because advertising might be less effective, so it makes more sense for companies to invest into developing their products instead. But you can hardly justify unethical behaviour with some industry making money off of it. Drug dealing, slavery, forced prostitution etc. are also illegal, even though there's a hugely profitable market for those.

You have to draw the line somewhere. Governments are supposed to draw the line there, where the effect of doing something results in a net negative for this society by given values that this society considers important.

But even assuming a society only cares about its overall profit, I would be surprised if there's not some effects going on, due to targeted advertising being sharp enough of a tool to psychologically influence people to buy useless crap they don't need. And people buying useless crap they don't need is not good for the overall profit of a society. They could be buying useful crap that they can use to make more of a profit instead.

Advertising often can have a very negative and destructive effect, we shouldn't base our societies around how best to sell stuff.

Web companies and web advertising companies have been building huge, secret dossiers on all their visitors, unexpectedly selling, sharing and distributing sensitive data about their customers with totally unrelated third parties.

Now society's saying, that's not cool. Here are the new rules. We'll heavily punish your companies if you do it again.

Mom and pop publishers who don't have the resources or ability to staff their own ad sales team are going to be in trouble. The big players who can work around this obstacle are going to be fine. I'm not happy about this.

Hi, I'm a European who doesn't support it and who does find it confusing.

To be more precise, while I'm generally in favour of better privacy protections in law, I don't support this poorly implemented attempt, because I think it will have all sorts of unintended consequences that may not be in individuals' best interests, while also imposing a disproportionate burden on controllers and processors who weren't abusing that data for unsavoury purposes anyway, particularly smaller organisations.

And maybe "confusing" isn't quite the right word, but in my view it's far too ambiguous in its treatment of some of the most fundamental issues to provide a good platform for future data protection. Much of the official guidance is confusing, often to the point of being misleading and counterproductive, however.

we've had similar provisions in EU countries for a while, so it's not a big deal.

All regulation is a big deal if you're running a microbusiness and don't have dedicated staff to deal with it. In any case, there are several new or significantly extended rights introduced by the GDPR that certainly weren't there before in my country (the UK).

So what's the minimum period you absolutely need that data/those logs/those backups for?

Given that things like access history/event logs are important for things like protecting ourselves against potential legal actions, disputed charges and the like, there is no possible way to give an intelligent answer to that. I can, however, state as fact that we have had to rely on detailed log records from several years ago when threatened with actual action by someone who was clearly trying to take advantage of the situation and hadn't expected us to still have evidence that undermined their claims, so any claim that we can just cycle these things out after a few days is demonstrably false. Given that we're not doing anything particularly unusual either legally or in processing data for everyday business purposes, I have to assume we are far from alone in having these experiences and the concerns they raise.

There's no one-size-fits-all approach, so the law isn't written like that.

While that may be true, it is entirely useless to someone well-intentioned and acting in good faith who is trying to work out what they actually have to do to comply with the new regulations.

> We just assume most people will be decent/"reasonable" in implementing it, and if not, there's the sanctions.

My definition of "reasonable" isn't the same as that of European regulators. I know this because I don't consider IP Address to be PII. Luckily for me on this particular point the GDPR is explicit in saying that it is. If I were left to define PII myself though, I could well have opened myself to regulatory action as IP Addresses were logged and shared incidentally with third parties in many places.

I think this style of writing laws gives way, way too much power to regulators. Particularly for companies with no physical EU presence and thus no way to vote or have any say in how the regulators work.

I think very few online businesses will be fully 100% compliant with every provision of the GDPR and all it's current and future interpretations. So we need to just hope and trust that all the regulators in all the Union countries won't punish anyone who doesn't really deserve it. That's not a good situation.

> So what's the minimum period you absolutely need that data/those logs/those backups for?

There is no answer to this question. Strictly speaking I don't need any backups or logs. I've also, rarely, encountered subtle data corruption bugs in the wild where having backups that go back months was critical and the more the better.

Or are you saying that if I went to an ISP with the reduced IP address, they could disclose details of the person, if they only had 1 account within the range of IP addresses that the restricted IP address covered? This doesn't seem particularly likely to me? I thought ISPs hold a block of IPs and dole them out on that basis, and so resulting in only a loose connection between IP address and location?

On large companies, that would be out of scope, because whilst the reduced ISP may be linked to 1 large company, the assumption would be that the large company had multiple employees. On that basis although the account may be linked to a particular employee, no one employee could be singled out because multiple people would be relying on the same base IP potentially I would have thought?

Right now, everyone is in "wait and see" mode on how this will play out.