GDPR is about to happen.
Has anyone read the provisions?
It's like they put some flat earther anti-vaxers in a room and made them scribble up a law.

For those who don't know - it's a new, EU-wide "data privacy" law that's about to take effect on May 25th.

The gist of it is that if you fuck up even a little bit, you get to personally pay a fine of up to 10 Million Euros (for companies there's a separate clause, this is for employees only), or/and 2-3 years in jail if that fuck-up has caused material damages.
That little fuck-up can be as simple as losing a tiny amount of data between back-ups, or entrusting a third party with full access to some data (which is not prohibited) without controlling 100% what he can do with that data (which IS prohibited).

I shit you not, these are the explicit articles of that law.

If it is enforced in this way, it is the swift death of European economy. Just because some retards didn't read the privacy policy before agreeing to it, and then made a shit storm, everyone has to suffer.

None has to suffer as long as they manage their data correctly. Period.

I personally think gdpr is great. Especially the right to be forgotten.

https://goo.gl/y77JER
Stop whining, GDPR is actually good for your business - TNW

@olback have you read it?

Have you?

It says that when you're passing data to someone else, you have to make sure that any data processing that is done, is done only on the indication of the controller (basically the boss).

How are you gonna do that?

The fine for failing to do that is up to 10 million euros.

This just makes no sense. The only way these laws would be respected is if nobody has any data at all.

@AndSoWeCode don't sell/give/trust other companies with your data? I wouldn't. Why would you want another company to have access to any of your data? Why?

@heyheni read the law. Article 32 for example.

https://gdpr-info.eu/art-32-gdpr/

How do you make sure of that?

@olback not other companies. Other people from the same company.

Also, ever heard of freelancers? Whenever you have a task that's beyond the time allowances, or expertise of your permanently hired employees.

@AndSoWeCode relax, nobody except some big ass companies like google have to pay the 10 million. The 10 million is for scaring everbody to comply and take data security and privacy seriously.

@AndSoWeCode sure, give them test data instead of actual data? Production data should only be accessible by the user.

Commenting to get back here after reading the entire law.

@AndSoWeCode
I don't get what you are trying to say about sharing the information within company. Of course you can share the data to people who need it for their job.

But anyways any company handling (sensitive) user data should restrict the access to it from employees who don't need the said data.

@heyheni the law doesn't specify anything about Google. It's vague on that point, and doesn't set any limits on personal liability of the employee.

The "Relax, nothing bad is gonna happen" is wishful thinking. The law is pretty clear about how shitty things can get (in the case of Google, it's more like the 2% to 4% annual turnover), and pretty vague on how to actually avoid that.

@okkimus "Of course you can share the data to people who need it for their job." - not according to this law.

Article 29 explicitly state that nobody will even try to do more than just look at the data without the explicit indication from the Controller.

Article 32 pretty clearly says that any failure to ensure that nobody looks at the data in a wrong way, is breaking this law.

Both articles fall under the 10 million Euro fine.

@AndSoWeCode
The controller will give permissions to those who need it for their work.

Sorry but I need to call bullshit. There are no personal penalties for employees. That’s nonsense.

GDPR has been a huge part of my life (pain in my ass) for the past year in my role as a senior In a multi billion dollar company.

The company can be fined up to 4% of their annual turnover (not profit, turnover) but the employee isn’t going to get any punishment, except maybe getting fired... but no legal repercussions.

@AndSoWeCode Art 32 isn't difficult, write down the proper protocols for handling data and data security. Every company should kinda have done this already imo.

"under the authority or instructions from/of the controller" - that doesn't mean he has to watch over your shoulder, it solely means that he's the person authorizing it.

"you'll process the client's data" - tada, acting under the authority/instructions of the controller.

@AndSoWeCode why are you scaremongering. Of course people in the company can look at and use the data. The key is “if they need to as part of their job”.

Eg marketing people are FINE to see data relevant to marketing such as email address, location etc. But marketing people (again just an example) shouldn’t be able to see the customer’s personal financial details, if for example the organisation is s bank.

@linuxxx You'll probably have to write it down as a protocol somewhere (who may access what data and who's required/authorizes to access/process it), then you've got it black on white.

@okkimus giving or not giving permission is not enough. The controller and processor are responsible for ensuring that the data is only processed in the explicit way dictated by the controller. I'm not making this up. This is in Art. 32. It doesn't say that having and NDA or similar agreement would be enough. No word about that. It's pretty vague, which means that if Joe gives data to Henry and tells him to do X, and Henry does Y, Joe risks a 10M fine. And so does Henry, because he ran a query which Joe did not ask for.

Do queries that return a wrong result count as unauthorized processing? The law says nothing about that, and the closest thing to it would be a 10M fine.

@AndSoWeCode you are the definition of “fake news”

@SSDD you can call bullshit all you want, but you need to read this:

I quote from the official website:

Infringements of the following provisions shall, in accordance with (2), be subject to

administrative fines of up to EUR 10,000,000, or in the case of a company, up to 2% of the total

worldwide annual turnover of the preceding financial year, whichever is higher:

a) the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39, 42 and

43;

@SSDD "The key is “if they need to as part of their job”. " - which article is that?

in most countries in europe you don't get sued for every bullshit like in the USA. And if it happens the judge has a good eye measure (proportionality principle) that the punishment doesn't destroy your life.

@linuxxx

"The controller and processor shall _____ take steps to ensure ____ that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller"

Could you clarify which steps are those, and where in the law they are specified.

@AndSoWeCode I don’t need to read it as I’ve been living it for the past year. You’re interpreting that incorrectly.

The “controller” doesn’t individually assess every fucking query. He or she or they set out guidelines that say:

Marketing can see / access / use datasets X, Y and Z

Legal can see / access / use datasets 1, 2 and 3

Software development can see everything because as part of their job they need to construct the database etc etc.

And the stuff about personal fines for employees is buckets and buckets of outrageous shit.

@heyheni I would settle for that. Except that there are precedents of very stupid laws being enacted. Which means that if someone wants to fuck you over, there will be legal ways to ruin your life without blinking an eye.

Laws should be defined unambiguously. Not like this. I've read a ton of laws in my life, and I've seen shitty laws, but this one trumps them all in vagueness and ambiguity, and the grossness of the differences of its interpretation.

Look man, I'm reasonable, in that I don't think that the worst case scenarios should ever be enacted on actual employees. However, the thing is, that there is NOTHING stopping it from happening. And that's the scary thing. You screw over someone with more influence in a stupid situation, and you're capitally fucked.

@SSDD show me where in the law that thing is described.

I don't care what and how you are doing, or the consultants that you or your firm has hired are advising you to do it.

I don't care for any of that.

I care for unambiguous laws that clearly define crime, punishment, and legal ways to proceed.

This does not.

@AndSoWeCode Reading only number 29 and 32 (I fully read them, quite short and understandable), those are very easy to implement and maintain.

32 in short:
1.
a) proper encryption for data protection: shouldn't be that hard?
b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services: keep'em up to date and use security software and access control. Should already be 'implemented' everywhere as this is a basic security requirement I'd say
c) Make. Backups.
d) write a plan so you can test if the above steps still work. Not that hard.

2. Use proper data protection and access control technology and document them. Easy.
3) haven't read the mentioned articles yet but you have to demonstrate number 1 which shouldn't hard.
4) Make employees follow the written protocols. Welcome to any modern company I'd say?

29:
Make sure employees have your authorization and no other people can access the data this is about. Access control isn't hard.

8 very short:
Age verification of a reasonable kind?!

11:

Don't collect unnecessary data and make sure you can demonstrate that you don't. Easy I'd say as well personally.

43:
Make sure the people processing certain data are certified to do so. A little harder one but definitely a thing loads of companies can work with. I'd even think a diploma would suffice?

I'm tired so not going to read every one of them right now.

@AndSoWeCode Oh and that's an easy one. They're authorized? Give them access to a database. They're not (anymore)? Revoke the access. Easy enough I'd say?

For the record, I read the entire articles of every one of them I described a bit up.

@linuxxx what if someone does something to data that you (controller) didn't ask?

You have failed, as a controller, to "ensure that [he] does not process them except on instructions from the controller". It's stupid, but that fits under that definition. If you're unlucky to get a clueless judge ... well ... you're legally screwed.

29. is not about authorization, no. It explicitly says that it's about people who already have authorization. It's about what they do with it.

Neither of them has anything to do with access control, as both of them explicitly state that it's about people who already have access.

That's the whole point why I raised this question.

@AndSoWeCode I have a life rule that I’m pretty strict with where I only get 2 or 3 replies deep when engaged in debate with an ignorant, so this will be my last acknowledgment of you.

You are wrong. You are interpreting the GDPR guidelines in some crazy way that is incorrect.

You basically just said this:

“I don’t care what your big company and all their lawyers and consultants say. I don’t care about that. They are all wrong and I am right.”

Do I need to say anymore?

@linuxxx

29. The processor and any person [bla bla bla], ***who has access*** to personal data [...]

You see? It's not about authorization. It's meant for people who are already authorized, and should be authorized.

And if that refers to the Processor who has access, then the ending literally makes no sense...

"unless he or she is required to do so by Union or Member State law."

if there's no authorization, this is redundant.

Same for 32.4

[...] to ensure that any natural person [...] acting under the authority of the controller or the processor who has access to personal data [will not do what he/she is not told to do explicitly], unless required to do so by Union or Member State law.

What's the point in the last part if it's about authorization?

@heyheni I've read the article you posted. Word by word, slowly, carefully.

First of all, who still reads TNW?

Second of all, who reads and trusts articles written by someone who doesn't have any other articles and is a biased interested party to this, with zero experience in data handling?

Now about the article itself: It's complete bogus.

1. It says that customer-provided data is of highest quality. WRONG. Read "Everybody Lies" - a book about Big Data, with tons of examples of why user-provided data should never be trusted. I mean tons of them can't even spell their name and address correctly!

2. It refers a "study" by Veritas - a company that makes money from cleaning data. One should realize it's pure BS, when they refer to data as "obsolete". There is no such thing as obsolete data, nor trivial data. One of the cornerstones of a good data warehouse is that all data is kept, in multiple temporal snapshots.

I'd go on, but at this point it's clearly a BS piece.

This has already deteriorated in to a clusterf*ck but I'm going to add my 2 cents anyway...

From a consumer point of view, gdpr is one the best things to ever happen, privacy wise.

From a company point of view, it enforces proper data handling, which is something we all should strive to do. Yes the fines seem huge, but they are for companies, never for individuals.

@AndSoWeCode @linuxxx article 83, section 2. "When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:"

Subsection d "the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32;"

Basically make sure you got your instructions in writing along with clearly outlined guidelines for any third party and have them sign acknowledgement of these.

Boom, sorted.

Now stop stirring the pudding.

@joykill Thank you
@seraphimsystems Thank you

This law describes a certain system/set of protocols every company should have and to be honest, every company already should have this.

It's very easy to implement and the entire law is quite easy to understand as well.

@AndSoWeCode As I described in my comment to you when you asked how that controller/access part worked, that's literally just making sure to give and revoke access to employees and documenting the fucking procedure!

@AndSoWeCode But you can limit access. Just like with a database for example. Someone is ONLY allowed to do a certain thing? Lock down the computer so they can only do that thing :)

Unless you are the company. You don't get fined. There are some restrictions for those who really work with customer data that already had to comply with.

More to that. Gdpr ensures that what a bussiness say will do. You don't collect data "just because" and you don't leave the data out in the open.

Companies took a ton of data from you without you knowing what exactly.

Now they must give a reason. And no "donating the data facebook way isn't ok".

A well just so you know... Lots of companies kept the data in open and didnt give a flying turd who sees it... And it was very personal data

@AndSoWeCode, I do not appreciate your handling of this argument.

It aggravates others.

If you want others to listen and consider your viewpoint(s), then civility is a must.

However, I do not want to aggravate you @AndSoWeCode either, I simply ask that you consider this comment.

@joykill "From a consumer point of view, gdpr is one the best things to ever happen" - the problem is that the consumer's interest does not end at his nose without any consequences. Without prospering business, consumer options are severely limited. Also don't forget that every consumer is also an employee.

The economy is a whole body where you can't just separate one entity from another. If half are getting screwed - everybody is getting screwed.

As for the company point of view: it does not enforce proper data handling. Proper data handling is basically not letting it fall into the wrong hands and not to be exploited. This is much more.

So far I have asked concrete questions (more than I did here) of how things would be done according to this law, and nobody can answer them, 2 months from it being enforced.

Also, please read the law. I am tired of copy-pasting the same paragraph over and over again. 10M Euro fine is specifically for individuals, not companies.

@linuxxx "that's literally just making sure to give and revoke access to employees and documenting the fucking procedure!" - I get that it's how you want to view it, but it's not what it says in the law, as I have shown before, as you can read in the law without inserting your own words in the middle.

@IrreleventIdiot "I do not appreciate your handling of this argument." - I do not appreciate people attacking me, calling me a liar, when I'm literally quoting the law.

@curlyDev "Unless you are the company. You don't get fined" - read the law. It...

ughhhh....

Why must I tell everyone to read the law? Why you no read the law?

It explicitly states, that 10M euro fine is FOR THE INDIVIDUAL, NOT the company. READ IT. It's there.

@curlyDev "and you don't leave the data out in the open." - it's not about that.

Dude.

....

I am tired. I am honestly tired.

The law is vague, but on some things it is very specific and non-ambiguous:

* The 10M fine is for the INDIVIDUAL

* This is not only about authorization (that is self-evident and not up for discussion), but about how you are allowed to look at the data that you already have.

@Condor "I hope that this will make corporate sysadmins (or shitadmins?) realize that they should really start to care about the data they keep.

[...] Cookie messages [...] are a pain."

Again, I am all for accurate authorization and good security practices. That's not what I'm raising alarms about.

This is about how you, your company, the people inside it, look at the data that they are supposed to look. That's what article 32 is about. Read it word for word, without any wishful thinking, because the exact interpretation of words is the only thing that matters in the court of law, and if ambiguity is present, then it will mean whatever the most influential party will want this to mean.

Breaking these laws (for ex. performing an analysis on a dataset that you have access to, in a different way than you're told to), are grounds for termination, fines of up to 10Million Euros (as a natural person), or 2-3 years in jail, with NOTHING stating exactly which and when.

@AndSoWeCode and i said again.

The people that should have had access to it already had fines related to their job.

You need a certificate to handle private data. Now the private data is more broad.

You can't keep data safe? Don't collect it. This is what i did. Keep the data to minimum and what i need to function.

For example i can keep log
everywhere a user went because it helps me debug and tell the user what happened. But i shouldn't tell facebook about it....

@curlyDev dude. It's not about that.

None of the articles I mentioned over and over again even mention the word "safe". That's your interpretation, with your own inserted words, that are just not there.

It's not about sharing the data, access authorization, safe keeping and all that evident stuff. It's about the way you look at it. To loosely quote using their own words: it's illegal for the processor to process the data without being told to do so by the controller. It's also illegal for the processor to fail to ensure that another authorized person does not process it without being told to do so by the controller.

Processing doesn't mean sharing. It means performing transformation, aggregation, drill-downs, merging, data mining, machine learning, etc. Any operation that will get you a data set that's different from the original data set is called Processing.

Technically, when you don't obtain the data requested by the controller, you have processed it in a way you weren't told to.