The GDPR just went into effect...

[Angst]

Facebook is peeing its pants over this, and Wall Street are watching. Large US data companies are prissy about it, and I've received a couple of mails saying I won't receive spam from them anymore.

I'm yay for this.

What are you?

Will it change anything?

Is it too technical for you to understand? It is for me. So my yay is kind of hollow. There are a few attempts to summarize it outside layman's terms...

http://www.wired.co.uk/article/what-is-gdpr-uk-eu-legislation-compliance-summary-fines-2018

This is not a RD thread because I like the jokes, but you're welcome to try and explain to me what this is about and why it's potentially a horrible idea.

I like having Facebook but I try to turn a blind eye to its handling of my data for professional reasons. I'm dependant upon it for professional contacts and communication.

I'd prefer paying $5 a month for something that doesn't sell everything about me to corporations I don't know. But I'm not a teen (which social networks try to grab in order to keep them later in life.)

 

[Timsup2nothin]

If you are Facebook, you have a legal department that has already determined how to make compliance fairly painless for you. If you are a mid sized or smaller entity that somehow has access to data about people the odds are you've been violating existing law all along and can continue violating this one with impunity because you are too small to be of serious concern to regulators.

 

[Noble Zarkon]

The idea of GDPR is a good thing but, as usual, the EU have vastly over complicated it.

 

[uppi]

A lot of the effect will be determined how this will be enforced. There are quite painful fines for violating it, but it is unclear whether these will be enforced and against whom. It is also unclear what exactly will be allowed and what will be forbidden under the new law and that will be up to the courts to decide. There are likely going to be a few high profile cases until the companies learn how to write the indecipherable legalese to cover their buts. But no one wants to be the target of those high profile cases, so for the moment they need to take data protection somewhat serious. The problem is that unless you stop doing business altogether, it is going to be hard to be fully compliant to the letter, so everyone is waiting for the courts to draw the line.

 

[Noble Zarkon]

until the companies learn how to write the indecipherable legalese to cover their buts

Except the legislation says agreements must be in plain language!

 

[uppi]

Except the legislation says agreements must be in plain language!

Well, yeah, but they're going to try to push "plain language" to its limits until the courts reign them back in.

 

[Cheetah]

GDPR is absolutely awesome!

Could be even better, but baby steps and all that. It's a very good start.

 

[Kyriakos]

I got a few emails too. I think it won't matter much, though.

 

[Birdjaguar]

GGG updated their ToS.

 

[Timsup2nothin]

GDPR is absolutely awesome!

Could be even better, but baby steps and all that. It's a very good start.

Except it isn't really a start. It's not like there was no law in place previously governing data collection, management and security. This is an upgrade, not a start. Sooooo...let's look at what it actually does: nominally toughens regulations in an area where the previous level of regulation was generally not understood, not complied with, and not enforced. The new version includes absolutely no provision for stepping up enforcement, so what is it really likely to accomplish? Maybe the larger fines will scare up a little more effort towards voluntary compliance. Maybe the publicity will lead to a bit more in the way of citizen complaints, which are pretty much the only thing that triggers any sort of investigation or enforcement in this area, at least until the excitement dies down (call it fifteen minutes). I mean, it isn't a bad thing; not at all. But I don't see it having much effect on anything.

EDIT: Relevant text from a GDPR compliance notice I just received.

"Most simply, nothing is changing about the way we process or handle your data. We’ve always kept our users’ data personal and private. We’re not in the business of selling your personal information. While GDPR only holds us accountable for how we process EU users’ personal data, we’ve taken this opportunity to review our practices and ensure that our high standards for data privacy extend to all our more than 20 million users worldwide."

In short; yeah, makes no difference. Now, if they are what they say and have been doing the 'right thing' all along, which in their case may well be the truth, then great. But if they haven't they would probably say exactly the same thing.

 

[Broken_Erika]

So does any one have a list of rules that this thing puts into place?
I thought there were a list over on 'poly but it's just a bunch of various meanings for GDPR(Giant Death Panda Robots) and tips for the admin there.
I was hoping for more of an actual list or a link to a list just out of curiosity.
(and one-liner posts are generally frowned upon here so there goes most of the possible jokes...).

 

[Timsup2nothin]

So does any one have a list of rules that this thing puts into place?
I thought there were a list over on 'poly but it's just a bunch of various meanings for GDPR(Giant Death Panda Robots) and tips for the admin there.
I was hoping for more of an actual list or a link to a list just out of curiosity.(and one-liner posts are generally frowned upon here so there goes most of the possible jokes....)

There's a list, but it's seven hundred pages long. Do you really want it?

 

[Broken_Erika]

There's a list, but it's seven hundred pages long. Do you really want it?

Doesn't the GDPR have like a summary page or something?
[joke question]Does it mean Giant Disco Party Rooster?[/joke question]

 

[Valka D'Ur]

I've been inundated by emails, some from sites I had long forgotten about.

For the average forum user like most of us, is there anything about this that is actually bad?

 

[Timsup2nothin]

I've been inundated by emails, some from sites I had long forgotten about.

For the average forum user like most of us, is there anything about this that is actually bad?

There's nothing bad about it for much of anyone. Companies that have ignored existing laws might continue ignoring the stricter laws, but that's about the worst that can happen.

 

[Arakhor]

The BBC did comment yesterday that certain companies are going to refuse all European web traffic to avoid implementing the GDPR, but that seems excessive. Here's one of the BBC's guides on the matter.

 

[Kyriakos]

The BBC did comment yesterday that certain companies are going to refuse all European web traffic to avoid implementing the GDPR, but that seems excessive. Here's one of the BBC's guides on the matter.

I got an email from Revolution Games (british adventure game company). They asked if they can keep a record of my email, since i wrote to them in the past. Given they never replied after the one discussion, i found their email mostly annoying ^_^

 

[really]

I hold personal identifiable information about employees of the company. This is a pain for me if someone wants their records or wants them destroyed. I don't have the time to go looking through years of emails or hard copies of reports.
Lots of it is mixed with payroll reports.

It is an overreach and conflicts with my obligations to keep tax and accounting records.

 

[Bamspeedy]

Upgrade in progress...
We're currently upgrading our sites to bring you new features, GDPR-compliant privacy controls and a faster experience.

This may take a few days but rest assured we're working as quick as we can.

 

[EnglishEdward]

I have had about thirty emails and a dozen paper posted letters.

The idea of GDPR is a good thing but, as usual, the EU have vastly over complicated it.

Too True

I hold personal identifiable information about employees of the company. This is a pain for me if someone wants their records or wants them destroyed. I don't have the time to go looking through years of emails or hard copies of reports.
Lots of it is mixed with payroll reports.

It is an overreach and conflicts with my obligations to keep tax and accounting records.

I agree and I am sympathetic.


In the UK, there was a last week rush to destroy unindexable old records before the Freedom of Information Act came into force; and more recently
the UK's Home Office claimed that it destroyed its records of Windrush immigrants arrivals to comply with the Data Protection acts.

And no doubt many organisations' change managers and fraudsters will likely use the GDPR as a convenient excuse to wholesale delete old records.