Hacker News Reader

Oh right, the other one that was totally baffling is people have a right to request their data, and we should give it to them in a timely manner -- but it's not sufficiently clear how we should know that the person making a request, possibly based on PII, is in fact the data subject in question. How do you check that? How do you find all the data that is associated to a person, given that accounts are not people? Sometimes it's gonna be impossible but GDPR doesn't say that your company's obligation to give people their data is contingent on them still having control of the email address they used to sign up years go, etc.

> but we need to remember enough that when we encounter you again, we recognize that you've objected to further processing. How are we supposed to know in future interactions that you've opted out if we've deleted all mentions of you and your PII?

Just hash the PII, delete the original and reinsert the hashed version (perhaps into another table). On insert check if hashes match and the opt out bit is set, if they match and it’s set then act appropriately.

You used the word "just" there, but I don't think storing hashed PII is necessarily an out here. Clearly, the whole point of the suggestion is that we can still match the person against a record, and the hashed device id or ip or email or whatever else is functioning as an identifier.

The best thing about GDPR is that in case of violation, you're not immediately raked over coals.

The responsible national body is supposed to cooperate with willing business in ensuring compliance - if the business cooperates in good faith, the fines are minor or can be waived altogether.

And part of such cooperation would be for regulator to help specify down the case.

Hmm, if anything the emphasis on national bodies having discretion in when this is enforced seems sketchy and concerning to me. Sketchy on the regulatory side because I don't trust them to not pick targets in a manner which is informed by public sentiment or some other motivation. Concerning on the corporate side because I have heard people say things like "oh, it doesn't have to be 100%, we just need to be good enough to not be a target for enforcement", which then becomes the basis for not making an entirely good faith effort.

Whereas something like PCI compliance for businesses handling credit card transactions isn't a law, but does have pretty clear standards, a certification process, and serious potential risks to your business if you do it wrong. But you go through the process, you get certified, and then you know you're doing it.

It's not "discretion at enforcement".

It's that the goal of the national body is to get you up to compliance, with reduced fines as incentives for helping you get there. The difference with PCI is that with PCI non-compliance means that payment networks will refuse to work with you, but at least in theory you're not forced to work with them either - you can not "opt out" of GDPR. So the purpose of the national body is to get the rules followed, and it has both ways to sweeten the deal (reduced fines for cooperating business) and the stick (vast increase in fines).

Worst thing about GDPR was the cottage industry of "GDPR lawyers" that exploded around it coming into force in order to capitalize on panicking businesses, often fueling said panic. In reality, the main difference in GDPR versus previously active law is that GDPR increased fines and introduced policy framework for enforcing and helping compliance.

BTW, there's no such thing as "not being a target". It's just enforcement depends on finite resources - and on complaints from people.

And "do the minimum to not be target for enforcement" would be actually grounds for increased fines for acting in bad faith.

Your description sounds exactly like I'd expect a regulator to describe discretionary enforcement.

My point about PCI is that people can actually implement it and know that they've done so. If the goal of GDPR is to get people up to compliance ... well since no one but the regulators can determine if a company is complying, we have no idea whether they're actually accomplishing that goal.

The cottage industry you're complaining about exists precisely because the law was so unclear. I remember reviewing "non-binding recital" documents before it went into effect which were not helpful. For a law which created new requirements for systems at thousands of companies, they could have written material which directly was targeted at the parties who would be responsible for implementation, and which they would commit to being binding. But they didn't.

> you can not "opt out" of GDPR

For companies based elsewhere, there was a very serious consideration of should we just not try to do business in the EU. If you're a midsized company in the US faced with a large engineering effort to possibly meet regulatory requirements for a region where you have a small minority of customers, it's a real question.

I wonder of some of that doesn't come from different interpretation doctrines in different places. Under teleological interpretation used in practically by all relevant to GDPR courts, there's more flexibility than mechanical direct wording approach used in some places - and practiced by many PCI implementations and auditors to the point of being a running joke in some circles. A basic guiding principle with GDPR can be considered to metaphorically make "personal data" toxic, something you want to deal with as little as possible (with "sensitive private data" being extra toxic), with goal of preventing profiling and other abuses. Significant majority of business processes do not actually require sensitive data. A company that does not handle sensitive data does not even require a DPO.

Similarly, the flexibility means that as a company you can make a point of showing action in good faith, while regulator does not have to update the law for every possible new detail.

Consider for a moment that GDPR provided, on average, about ZERO new requirements compared to previous law on the books.

Yes, zero. If anything, it cleared up some questions from before.

The big difference is that previously, most member states law had consequences for non-compliance that were pretty much ignorable especially for bigger companies.

The cottage industry that sprung was majorly oriented at extracting as much value from the panic, and in fact often increased said panic on purpose. In fact, if you're in B2B market, you might have close to 0 work anyway.

The big problem was that with extremely lacking enforcement before, corporations built up, often unknowingly, huge amounts of mess and now someone started considering that the fines might be substantial.