So the lawyer provided a letter which demonstrates what would happen in the worst case due to the GDPR. How does that make him dumb?
The author of this piece just twisted the meaning of the letter completely.
The blog post is a response to this Ask HN:
The GDPR is a response to that lawyering, but that's no reason why the public at large should now push the pendulum the other way. This law doesn't 'actually suck', but it can be made to 'actually suck' and then we all lose something of value.
Of course GDPR is a well intentioned law. It's implementation is debatable though, and you're basically asking people to not talk about its problems.
On the contrary. I'd love to talk about those problems, but this isn't one of them. Data Subjects should have the right to make Data Subject Access Requests. But the context matters.
If you want to really talk about the GDPR's problems then I think it would be better to focus on the Designated Representative bit, which is prohibitively expensive for small companies.
So you realize that this is a problem, but you'd rather not talk about it?
Context matters, but the law should codify the context, and not leave it up for interpretation.
You have a very US centric view of laws and legality, this is not a US law so please try to shift your viewpoint to the EU way of doing this and then re-interpret.
You should also look at the whole thing from a US perspective before calling people with a US centric view "dumb".
Where did I do that?
Really? The cookie law, however well-intentioned, could never have been useful. The simplest reason for this is that you can never know if a site is not complying with the cookie law or simply doesn't set cookies. The only way to be certain of this was to use the already existing browser mechanisms for dealing with cookies. In other words, the cookie law would never have done anything even if companies handled it exactly as intended.
Implementing the cookie law costs money and time. It costs developer money and time, and it costs the time of consumers, because some developers are always going to get it wrong simply by virtue of not knowing everything about the law or how to handle it. They will hear about it from third parties and not know how to handle it and simply follow the first steps that tells them how to handle it.
The way the cookie law went should have been expected. It shouldn't have been a surprise to anyone that it didn't do anything and it simply wasted people's time and money.
>This law doesn't 'actually suck', but it can be made to 'actually suck' and then we all lose something of value.
Then we're pretty much guaranteed to all lose something of value. In IT you should expect things to go wrong and for people to abuse the system. Because inevitably that's going to happen.
This is allowed under the law! If you don’t like it, change the law!
The reason people have been complaining about GDPR this whole time is exactly this. Things take on a whole new meaning when complied with at scale when all you need to send is an email. This seems worse than FOIA (the US Freedom of Information Act) and Europe placed it on their entire private sector.
EDIT: clarity.
A law allows what it allows. 'Let's pass a law that sets a maximum penalty of death, but promise just to impose $10 fines for the first decade' is a recipe for disaster.
A law which purports to protect privacy but instead demands that any visitor be permitted to rewrite your year-old web server logs is beyond Orwellian.
Is it because this is not law, but rather, regulation which is only selectively enforced and suits cannot be brought by individuals but rather by central regulators that will never keep up with the avalanche?
Does the EU never enforce law by the letter, so the letters are unreliable and really more like a guideline? (If so, why bother with law?
Lack of EU sovereignty over member states means it won't get enforced if it's really an inconvenience anyway?
Something else?
This is the first part where your view of how things would likely play out and reality diverge. Under the GDPR a Data Subject whose request is not answered satisfactorily or timely could sue but that will likely go nowhere because they should direct their complaints towards the regulators, not towards the courts.
> You have to prepare for that if you want to be responsible, right?
No, to prepare you have to be 'in compliance', which is a different thing. Essentially you should read the law, decide which part of your operation is 'in scope' and adapt your business to reflect your understanding of the law.
In case of a complaint to a regulator they may (but not necessarily) investigate and if they find transgressions they will issue some guidance on how you should achieve compliance. If upon re-testing it appears that you have not followed the guidance you will most likely be hit with a fine. If the original investigation was because of a data breach or other serious issue they may decide to fine you immediately as well.
> Does the EU never enforce law by the letter, so the letters are unreliable and really more like a guideline? (If so, why bother with law?
The EU tries to achieve a certain effect with the law: to make it harder for companies to wipe breaches under the carpet, to give Data Subjects more control over their data and to stop the worst excesses in the world of data brokering.
So if you cross any of those you can expect enforcement.
> Lack of EU sovereignty over member states means it won't get enforced if it's really an inconvenience anyway?
All member states have automatically adopted the law when it went in force (April 2016).
> Something else?
That's up to you :)
All that said, it likely can and will be mis-used, and citizens will likely sue and cite the regulation if the regulator refuses to enforce the regulation so if I were Europe, I would try my best to prepare for such an eventuality as part of the law to reduce burden. I don't think it's alarmist to suggest this.
I also don't think it is alarmist to suggest that regulators will not always be rational actors, and there are politics at play. It will be interesting to see if any blatant cases of prosecution result from crossing an EU government or leader. Fingers crossed that never happens.