Your comments in these threads are all more or less identical and typically resort to fearmongering. Please get educated on the subject.
"Please get educated on the subject" is not a substantive comment, and referring to someone's overall trend of commentary is commenting on them, not their post. I've had someone here repeatedly do this to me, and I don't appreciate it.
Don't be afraid to let your existing argument stand against theirs, I think your posts strongly support your position. A response to a given detractor isn't necessary. :)
Spending time arguing with people who are not progressing the discussion at all is also counterproductive. It stresses you out, wastes both their time and your time, and provides for boring reading. Downvote, move on, smile because you know deep inside you're right and they're wrong. ;) And if your original statements are of quality/convincing enough, everyone else who reads it will know this as well.
Please show me where it is written that anything I have said in this thread is factually inaccurate.
The large numbers ARE BUILT INTO THE LAW you are so vehemently defending. We are just supposed to ignore them? Pretend they don’t exist?
Everyone should be afraid of laws that offer possible massive fines that are incredibly easy to violate on technicalities.
Here's an organisation that lost video interviews of children who'd been sexually abused because the organisation sent unencrpyted DVDs via mail. This was a repeat occurance of a very similar thing they did before. They didn't get the maximum fine. https://ico.org.uk/action-weve-taken/enforcement/crown-prose...
Here's an organisation that lost half a million customers details (names, addresses, and telephone numbers) because they lost some unencrypted backup tapes. Again, they were not fined the maximum: https://ico.org.uk/for-organisations/guide-to-data-protectio...
Here's an organisation that is handling sensitive personal data - medical data - who had a legal obligation to register with ICO. They didn't. They didn't even get a fine. (Last para) https://www.bloomberg.com/news/articles/2018-04-26/u-k-healt...
We have countless examples of severe data breaches for dumb stuff, and the maximum fine is never ever applied.
I’m not sure how any of this makes the point you seem to be trying to make that GDPR is lenient.
How can you possibly agree with someone that has written lengthy articles essentially saying “ignore what you’re reading in the text of the law”?
GDPR is actually surprisingly light on concrete technical rules. This isn't PCI compliance where they specify the number of letters that must be in your passwords and what version of TLS you need to use. GDPR creates a framework of general principles you need to adhere to in the best way you know how. (Good laws need to be written this way, since technology changes over time.)
It is not in the EU's best interest to punish you for a minor oversight when you are largely a well-behaving corporation, it's in their best interests to encourage you to fill in any gaps when needed.
What laws have you been reading? The whole basis of law is that it must be absolute - otherwise people don’t know how to follow it. People are both exonerated and convicted every day of serious crimes based on nothing more than technicalities (“absolutes”), even when the legal outcome is in direct conflict with the spirit of the law.
Can you point to any instance of any of the EU regulators imposing the maximum fine available to them for a data protection breach? We've had these laws for 20 years now.
That's the kind of fine that would be imposed after thumbing your nose at the regulators and continuing in your ways after being warned and the violation being a particularly bad one.
Please show me where it says that, and where it defines “pretty hard”.
https://gdpr-info.eu/art-83-gdpr/
--begin--
Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). 2When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:
the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;
the intentional or negligent character of the infringement;
any action taken by the controller or processor to mitigate the damage suffered by data subjects;
the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32;
any relevant previous infringements by the controller or processor;
the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;
the categories of personal data affected by the infringement;
the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement;
where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures;
adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and
any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.
Please get educated on the subject.
The problem is that I am educated on the subject, and spent many thousands of dollars on GDPR-related legal advice for my company. My view comes from actually reading it and from no attorney being able to tell me that I could not possibly be fined 10 or 20 million EUR by one or more of the 28 countries to which GDPR applies.
Of course they won't, since it would give you the freedom to go and do whatever you want and then when you get fined you can take it out on them. You can't get an attorney to assume your liability by asking them for guarantees.
So yes, they can if they choose, and if they can make a convincing case, and you can't make an appeal or a big enough media shitstorm that they back down.
But is it likely?
Are you equally worried that you might die tomorrow because a meteorite crashes into your house?
It could happen, and the consequences would be pretty massive, but it's not generally a serious concern of most people.
Risk is likelihood x harm, and you're seemingly in every thread shouting about the massive potential harm, without ever really considering the likelihoods.
Exactly how likely it is I don't know, but I highly doubt it'll be close to your expectations. And probably not mine, but maybe somewhere in the middle.
No, but then again there is no law that says that a meteorite must crash into my house if I use third party JavaScript on my site, and the only thing up for debate might be the size of that meteorite. I am afraid of things when it is put in writing that I should be afraid of them.