Most GDPR Emails Unnecessary and Some Illegal, Say Experts (theguardian.com)

The vast majority of emails flooding inboxes across Europe from companies asking for consent to keep recipients on their mailing list are unnecessary and some may be illegal, privacy experts have said, as new rules over data privacy come into force at the end of this week. From a report: Many companies, acting based on poor legal advice, a fear of fines of up to $23.5 million and a lack of good examples to follow, have taken what they see as the safest option for hewing to the General Data Protection Regulation (GDPR): asking customers to renew their consent for marketing communications and data processing. But Toni Vitale, the head of regulation, data and information at the law firm Winckworth Sherwood, said many of those requests would be needless paperwork, and some that were not would be illegal.

Comments

Only $23.50?

[innocent_white_lamb]

$23.50 seems like a pretty insignificant penalty.

I had previously read that the fines were "crippling".

Did someone miss a zero (or several)?

Re:Only $23.50?

[Northdot]

$23.50 seems like a pretty insignificant penalty.

I had previously read that the fines were "crippling".

Did someone miss a zero (or several)?

I think they missed the "M". The potential penalties are big enough to put all but the biggest players out of business.

We're simply going to block all of the EU, because the consequences for even an inadvertent misstep could be catastrophic.

Re:Only $23.50?

[Anonymous Coward]

Is it $23.50 per user? A small business that has several thousand on their mailing list could go kaput over-night if they got hit with $23.50 for everyone that gets their marketing blasts.

Re:Only $23.50?

[Anonymous Coward]

A "tier 2" penalty is up to €20 million ($23,500,000), or 4% of total global gross revenue, whichever is greater. For less severe breaches, there is a "tier 1" penalty of up to €10 million, of 2% of total global gross revenue, whichever is greater.

In both cases, those penalties are the criminal penalties. Claims for damages are assessed separately and not included in these limits.

Re:Only $23.50?

[dotancohen]

We're simply going to block all of the EU, because the consequences for even an inadvertent misstep could be catastrophic.

Please block my IP address as well: 192.117.111.61, because the consequences for even an inadvertent misstep by you could be catastrophic for me.

Re:Only $23.50?

[Anonymous Coward]

Make it $23.50 per email, and the math changes substantially ;-)

Re:Only $23.50?

[Anonymous Coward]

We're simply going to block all of the EU, because the consequences for even an inadvertent misstep could be catastrophic.

Unfortunately that won't work for you since EU citizens in your country are also covered.

Re:Only $23.50?

[Anonymous Coward]

How will OP blocking email from the EU be catastrophic for your Israeli ISP business?

Re:Only $23.50?

[mSparks43]

But does that apply to the House of Saxe-Coburg and Gotha (that secretive building next to the EU Parliament), because they've been using every EU citizens data for decades for fraudulent means and no one seems to care.

Re: Only $23.50?

[Anonymous Coward]

Well shit... My big black rubber dildo wholesaler just lost its biggest customer!

Re:Only $23.50?

[Narcocide]

He runs an anonymous international spamming proxy, obviously.

Re:Only $23.50?

[AmiMoJo]

Do you operate in the EU? If not, how would you be fined? And if so are you just closing your EU business entirely?

Re:Only $23.50?

[Anonymous Coward]

I had previously read that the fines were "crippling".

Those complaining about the "crippling" fines are the companies that doesn't intend to stop when they get the first warning.

EU have found that if you want to get some companies to follow the law you have to raise the fines until they do.
This doesn't mesh well with companies that are used to a situation where breaking the law and paying the fines is more profitable than following the law.
As a result they find the fines "crippling" since it limits what they can do.

Re:Only $23.50?

[Anonymous Coward]

We're simply going to block all of the EU, because the consequences for even an inadvertent misstep could be catastrophic.

Go ahead. If your business is of the nature that you need to ask a lawyer if what you are doing is legal then chances are that EU will gladly get rid of you.
If you need to toe the line of criminality to make a profit then chances are that EU doesn't want you.

If you make a profit while staying within the boundaries of the law chances are that you won't be willing to leave EU since you are still making a profit.

Re:Only $23.50?

[Anonymous Coward]

a fear of fines of up to $23.5 million

Yes, you missed several zeroes in the summary.

Re:Only $23.50?

[Anonymous Coward]

Unfortunately that won't work for you since EU citizens in your country are also covered.

Nope (unless "your country" is the EU). Just read Article 3 of the GDPR.

Re:Only $23.50?

[thegarbz]

We're simply going to block all of the EU, because the consequences for even an inadvertent misstep could be catastrophic.

Why? Do you do business in the EU? Do you advertise to EU customers, or have EU offices?

If you answered yes to any of the above then blocking the EU probably isn't in your interest. If you answered no to all of them, they maybe you learn how the GDPR works and applies.

Re:Only $23.50?

[mjwx]

Do you operate in the EU? If not, how would you be fined? And if so are you just closing your EU business entirely?

This is one of the biggest problems with the GDPR, it only applies to businesses in the EU... Then again, most marketing email I get from American companies ends up in my Spam folder already (even the stuff I want to get).

Re:Only $23.50?

[Anonymous Coward]

It's only the world's largest market, after all.

I'm even getting them as snail mail.

[Anonymous Coward]

From various junk mail companies who want my "consent" to keep junking me.

Ask for consent

[Anonymous Coward]

Still a rapist. Where have I seen this before?

Best Practice

[Going_Digital]

Companies wouldn't have to go through this nonsense if they had set-out treating people properly in the first place. If their email list was created from an explicit opt-in process with clear information on how the customer's email is to be used then it they would not have to go through this re-subscribe nonsense. They all thought they were clever by auto-opting in and buying mailing lists and other questionable ways of subscribing people. Now 90% of their 'customers' will not re-subscribe so they are stuffed.

Re:Best Practice

[Anonymous Coward]

Ah, the "why are you hitting yourself" argument.

Re:Best Practice

[Anonymous Coward]

Yea, screw them for not being able to predict the future and be in compliance of yet unwritten laws. Laws that are so vague even now that they have been written and passed nobody really knows how to follow. Not even government officials who can often only reply "that has to be determined in courts".

Re:Best Practice

[Zocalo]

Confirmed Opt-In, or COI, has been touted as a best practice for mailing lists for many years now. You didn't need to be psychic and predict the future to anticipate GDPR; you just needed to be above-board about what you were doing with the sign-up process and follow well published best practice. If you'd done that, and retained a copy of all of your opt-in confirmations, then all your end-user interaction for GDPR compliance would have required would have been a simple rider on a regular marketing email reminding your subscribers of where they could view your GDPR policies, contact you if required, and to change their communications preferences if they wished. No further end-user action required.

Sadly, even amongst those lists that have been using COI for years, this point seems to have escaped most mailing list maintainers.

Re:Best Practice

[Anonymous Coward]

The GPDR is extraordinary; claiming extra-judicial reach.

Do you keep debug logs of your system? Not any more you don't unless they're so anonymous you can't actually investigate anything.

Do you write all the code required to let users download some kind of record of all their activities?

Do you have the ability to expunge logs of what users have done?

Yeah, it reaches THAT far.

" If you'd done that, and retained a copy of all of your opt-in confirmations,"
Doing that probably breached the GPDR unless you said that you would keep a copy of the opt-in confirmation.

Re:Best Practice

[Anonymous Coward]

You jump to the conclusion that every business has the kind of resources necessarily needed to do each and every little fucking thing that government or more specifically you ass holes demand. It's simply not possible for a small entity to do all the things already demanded. I don't have the time or energy to update our site to comply with bull shit cookie laws or go back and predict that the future would someday mandate that we get permission to send our own customers emails when they already were voluntarily providing that info or it was otherwise a requirement of purchasing goods from us. We do maintain *sane* policies and make sure people can opt out which is all that is *reasonable* and to the best of a small businesses ability and we shouldn't be put out of business because of laws that may otherwise be reasonable for large mega corporations the size of eBay, Google, Microsoft, Apple, Facebook, Netflix, Comcast, and others- who really are abusing customers. The majority of businesses do not comply with this bull shit [because they can't] and you enable these regulators to discriminate and abuse the small business owners into shutting down. That ain't right. And at the end of the day the parties which are abusing people and NOT letting you opt out tend to be criminal enterprises rather than legitimate business anyway and not the parties these laws would work on in the first place because if your willing to defraud people of something you've got no problem ignoring some data privacy law.

Privacy is not something you obtain by law. It's something you obtain by action. If you don't want facebook to have your data don't use facebook. etc etc

Re:Best Practice

[Calydor]

No, screw them for being unethical leeches from the get-go.

Re:Best Practice

[Cederic]

Oh, nice propaganda. But tell me, do you have any factual information regarding GDPR or just the bullshit you spouted here?

GDPR is fucking trivial to comply with unless you're someone like Equifax with a plethora of acquisitions that all have disparate data and processes. In which case you have the resources to comply anyway.

Logging personally identifiable information was never good practice in the first place.

Re: Best Practice

[guruevi]

IP addresses are considered private information. Not just to GDPR but HIPAA too. That's how far reaching these regulations go, everyone in the world can receive or query your IP address.

Re: Best Practice

[Cederic]

GDPR doesn't stop them.

Re:Best Practice

[mjwx]

Confirmed Opt-In, or COI, has been touted as a best practice for mailing lists for many years now. You didn't need to be psychic and predict the future to anticipate GDPR; you just needed to be above-board about what you were doing with the sign-up process and follow well published best practice. If you'd done that, and retained a copy of all of your opt-in confirmations, then all your end-user interaction for GDPR compliance would have required would have been a simple rider on a regular marketing email reminding your subscribers of where they could view your GDPR policies, contact you if required, and to change their communications preferences if they wished. No further end-user action required.

Sadly, even amongst those lists that have been using COI for years, this point seems to have escaped most mailing list maintainers.

I think it's an arse covering exercise. Sadly there's been so much FUD about GDPR, much of it from outside the EU that it's made a lot of people unnecessarily nervous.

Also whilst COI is best practice, its not a widespread practice and a lot of companies, even companies inside the EU practice use unconfirmed opt in (Usually via a box that is checked by default) or sometimes don't even bother asking at all (Looking at you Vodafone). Some businesses are nervous for a good reason.

Got an email from SUSE about their mailing list

[Anonymous Coward]

I unsubscribed from SUSE's mailing list over ten years ago after Novell bought them and their product went to shit. Now, they email me:

We've noticed that we haven't heard from you in awhile -- are you still interested in hearing about SUSE events, products, and whitepapers? We have so many great things going on from SUSE Expert Days to data explosions!

No, I don't want to hear from you. It's been ten years.

Clean up time

[ruddk]

I am getting a lot of those and quite frankly, most of them I reallly don’t care if they delete me if I don’t accept because hey are not relevant for me anymore. :)

Re:Clean up time

[Anonymous Coward]

Same here. This has been a useful process for unsubscribing me from marketing emails that I have never got round to doing myself.

Irony

[Nidi62]

Ironically enough, as I was reading this thread I received an email about opting in/out of emails due to GPDR. Gave me a nice chance to unsubscribe for a mailing list I didn't even care about or was even aware I was on.

Re:email filters

[Anonymous Coward]

But if you are travelling thru Europe and are in a european airport and do something on the web, are you not covered for that period?
Likewise, if you are using a VPN that exits from Europe, does it not appear that you there and hence covered - how is business supposed to know which is which?

Re:Hillary says it's OK

[Anonymous Coward]

I heard that the Jews somehow were able to get in to the World Trade Center prior to 9/11 and rig the buildings with demolition explosives. Is this true?

What are they supposed to do?

[imidan]

The government has passed a law that provides for fines on the order of $23 million (or more, if the business is large). Businesses that are requesting new opt-ins are doing it so they can demonstrate that they have explained what they do with customer data and have obtained explicit permission to do so.

Yeah, it would have been great if these businesses had been doing that all along, but there was no legal requirement for them to do so. They may not have kept records that would allow them to demonstrate compliance. Why would it be a surprise to anybody that businesses are trying to cover their asses to avoid paying fines that could destroy them? This is a completely foreseeable result.

Re:What are they supposed to do?

[jareth-0205]

The government has passed a law that provides for fines on the order of $23 million (or more, if the business is large). Businesses that are requesting new opt-ins are doing it so they can demonstrate that they have explained what they do with customer data and have obtained explicit permission to do so.

Yeah, it would have been great if these businesses had been doing that all along, but there was no legal requirement for them to do so. They may not have kept records that would allow them to demonstrate compliance. Why would it be a surprise to anybody that businesses are trying to cover their asses to avoid paying fines that could destroy them? This is a completely foreseeable result.

It's an annoying week of emails, but I'm ok with it. Atleast from now on we will be in a state where companies have to care about how they deal with me. It's kindof revelatory how many companies have come out of the woodwork that have my details, rather glad that I can now fail to confirm that they can keep it.

Re:What are they supposed to do?

[Xest]

Actually in a lot of cases depending on what data they were storing there was a legal requirement to show consent.

Since the European Data Protection Directive in 1995 went into law in around 1998 in most EU countries it was always necessary to gain explicit consent to hold someone's personal data (unless you had a law enforcement exemption or similar).

So many companies if they held your name or address along with your mailing list subscription were already breaking the law if they did not do so with explicit consent and opt in. This doesn't likely apply to mailing lists who just held an e-mail address only of course, though even that's a grey area - if someone's e-mail address has their name in it, then it's always been PII for example.

The real game changer with GDPR is that the fines are now sufficiently high that companies are scared shitless of breaching GDPR, whereas before it could often just be dismissed as a cost of doing business. That's why companies are now finally taking this seriously.

Re:What are they supposed to do?

[AmiMoJo]

It's this actually a problem? All I've seen is a reduction in spam and better privacy.

I really can't see any down side to this.

Not quite. Didn't tell users what we won't do

[raymorris]

That's not quite true. As an example, GDPR requires that before getting consent, you must inform the user whether you will or won't do certain things with the data. Before GDPR, a lot of companies didn't bother saying "we won't ..." where it wouldn't even make sense to mention that, of course they don't. Those consents are no longer valid since they didn't comply with irrelevant parts of a law that didn't exist at the time.

  Another is that very often when someone subscribes to a mailing list, they get an email telling them how they can unsubscribe, and the bottom of every email sent to the list has an unsubscribe link. People who joined such discussion lists have to be removed because they weren't told how to unsubscribe BEFORE they joined. Telling them after they join doesn't comply with GDPR. If you didn't give them the unsubscribe info BEFORE they signed up, legally they never signed up.

Re:Not quite. Didn't tell users what we won't do

[mrbester]

So you're saying that GDPR is retroactive? It might be shonky in many ways, but that isn't one of them.

Some ass used my domain to sign up for google...

[Xenolith0]

Some ass used one of my domains to sign up for literally hundreds of Google accounts. Now, Google is spamming all those accounts with GDPR emails. It got so bad I had to blacklist all of Google. Google also totally ignores the reject code from the email server, if I send 'em a 554 they'll just keep trying and trying, so now I kill 'em with a 421, but they still don't give up.

$ grep google /var/log/maillog | grep NOQUEUE | wc -l
11763

$ grep google /var/log/maillog | grep NOQUEUE
May 16 17:35:46 aurora postfix/smtpd[8251]: NOQUEUE: reject: RCPT from mail-ot0-f199.google.com[74.125.82.199]: 421 4.1.8 <3kTL5Wg8TALgnpgtYaw-lmpcnjwnmjgagcq.emmejc.amk@chime-notifications.bounces.google.com>: Sender address rejected: Wow, spammy.; from=<3kTL5Wg8TALgnpgtYaw-lmpcnjwnmjgagcq.emmejc.amk@chime-notifications.bounces.google.com> to=<lata30Sep411da506@hidden-domain-privacy> proto=ESMTP helo=<mail-ot0-f199.google.com>
May 16 17:36:52 aurora postfix/smtpd[8251]: NOQUEUE: reject: RCPT from mail-ot0-f198.google.com[74.125.82.198]: 421 4.1.8 <32hf8Wg8TCNcIKBO35R-GHK7IERIHEB5B7L.9HH9E7.5HFA3KKRSRRQGT.HK9@chime-notifications.bounces.google.com>: Sender address rejected: Wow, spammy.; from=<32hf8Wg8TCNcIKBO35R-GHK7IERIHEB5B7L.9HH9E7.5HFA3KKRSRRQGT.HK9@chime-notifications.bounces.google.com> to=<harryzyy@hidden-domain-privacy> proto=ESMTP helo=<mail-ot0-f198.google.com>
May 16 17:37:26 aurora postfix/smtpd[8251]: NOQUEUE: reject: RCPT from mail-ot0-f199.google.com[74.125.82.199]: 421 4.1.8 <3SIn6Wg8TACMOQHU9BX-MNQDOKXONKHBHDR.FNNFKD.BNL@chime-notifications.bounces.google.com>: Sender address rejected: Wow, spammy.; from=<3SIn6Wg8TACMOQHU9BX-MNQDOKXONKHBHDR.FNNFKD.BNL@chime-notifications.bounces.google.com> to=<lata6Augaeb87106@hidden-domain-privacy> proto=ESMTP helo=<mail-ot0-f199.google.com>
May 16 17:37:29 aurora postfix/smtpd[8251]: NOQUEUE: reject: RCPT from mail-ot0-f199.google.com[74.125.82.199]: 421 4.1.8 <3uIb6Wg8TAI068zCrtF-458v62F652ztzv9.x55x2v.t53@chime-notifications.bounces.google.com>: Sender address rejected: Wow, spammy.; from=<3uIb6Wg8TAI068zCrtF-458v62F652ztzv9.x55x2v.t53@chime-notifications.bounces.google.com> to=<lata31Aug625ff506@hidden-domain-privacy> proto=ESMTP helo=<mail-ot0-f199.google.com>
May 16 17:39:30 aurora postfix/smtpd[8272]: NOQUEUE: reject: RCPT from mail-oi0-f71.google.com[209.85.218.71]: 421 4.1.8 <36yX6Wg8TAPwtvmzeg2-rsvitp2tspmgmiw.ksskpi.gsq@chime-notifications.bounces.google.com>: Sender address rejected: Wow, spammy.; from=<36yX6Wg8TAPwtvmzeg2-rsvitp2tspmgmiw.ksskpi.gsq@chime-notifications.bounces.google.com> to=<lata15Junc8673e06@hidden-domain-privacy> proto=ESMTP helo=<mail-oi0-f71.google.com>
May 16 17:39:35 aurora postfix/smtpd[8272]: NOQUEUE: reject: RCPT from mail-ot0-f198.google.com[74.125.82.198]: 421 4.1.8 <3QBT5Wg8TACsWYPcHJf-UVYLWSfWVSPJPLZ.NVVNSL.JVT@chime-notifications.bounces.google.com>: Sender address rejected: Wow, spammy.; from=<3QBT5Wg8TACsWYPcHJf-UVYLWSfWVSPJPLZ.NVVNSL.JVT@chime-notifications.bounces.google.com> to=<lata11Jun68784706@hidden-domain-privacy> proto=ESMTP helo=<mail-ot0-f198.google.com>
May 16 17:39:49 aurora postfix/smtpd[8272]: NOQUEUE: reject: RCPT from mail-ot0-f198.google.com[74.125.82.198]: 421 4.1.8 <3aLX6Wg8TAJsKMDQ57T-IJM9KGTKJGD7D9N.BJJBG9.7JH@chime-notifications.bounces.google.com>: Sender address rejected: Wow, spammy.; from=<3aLX6Wg8TAJsKMDQ57T-IJM9KGTKJGD7D9N.BJJBG9.7JH@chime-notifications.bounces.google.com> to=<lata9Jul1cac7206@hidden-domain-privacy> proto=ESMTP helo=<mail-ot0-f198.google.com>
May 16 17:40:14 aurora postfix/smtpd[8272]: NOQUEUE: reject: RCPT from mail-ot0-f199.google.com[74.125.82.199]: 421 4.1.8 <3tA37Wg8TAJkIKBO35R-GHK7IERIHEB5B7L.9HH9E7.5HF@chime-notifications.bounces.google.com>: Sender address rejected: Wow, spamm

GDPR spam

[Max_W]

The EU should create laws in such a way that we are spared from the spam.

Was it difficult to include a clause in the law forbidding mass sending of e-mails?

Re:GDPR spam

[Cederic]

Well, yes. There are numerous legitimate reasons to mass send emails, not least of which is "I want to subscribe to your mailing list".

GDPR

[ledow]

Ironically, in the last few months I have received several dozen pieces of unsolicited commercial email to an unadvertised address, without consent, concerning "How to get ready for GDPR", GDPR conferences, GDPR auditors, and even people claiming to help me form my own GDPR policies.

I find it absolutely hilarious - who on Earth is going to touch the GDPR companies that can't even follow the rules themselves?

That said, it's just a return to common sense. Did I ask you to email me? Specifically YOU? No? Then why are you emailing me?

GDPR lets me give the same response as I would to someone knocking on my door. Do I know you? Do you have legitimate business that required you to wake me up?
  No? Then fuck off, and never darken my door again.

Dealing with from the IT end has also been enlightening. We hired a member of staff just to get us through GDPR. They went through all my systems and processes. Pretty much, it doesn't affect us.

Explicit consent before sending email? Check.
People able to stop such email on demand? Check.
People able to request the data that we have on them? Check.
Data being held only as long as necessary? Check.

Because most of this stuff was just obviously what the Data Protection Act required anyway. And being a good business.

All the changes that have happened are to do with things like paper records (nothing to do with IT), etc. and databases that are outside IT control (e.g. our alumni list was hand-managed on paper, they've since digitised it because GDPR doesn't distinguish how you store it, so there's no longer any advantage to avoiding the DPA because you're not storing it on computer), and formalising policies that were already in place.

Actual IT changes necessitated? None. I've updated a bunch of software which now have GDPR deletion/anonymisation features (but we won't use those for a long time because pretty much we only store what's necessary and stuff which we need to keep anyway) and things like "obtaining and recording explicit consent" features.

GDPR = DPA + case law. If you've been keeping up over the years, GDPR is no shock. If you haven't.... well, you've been at risk for quite a while whether you think so or not. It only needed one stroppy customer to take you to court to expose practices that judges have been saying you MUST do (to be classed as "reasonably protecting the data" even under the previous DPA) but that just weren't codified in an actual law.

About the biggest pain in GDPR? Gathering all the GDPR compliance statements from everyone else we deal with. (Hey, Apple! Are you done yet?!).

Re:GDPR

[Anonymous Coward]

"Explicit consent before sending email? Check."

If you want to do this properly: you should only send email after getting email from that address first. Or... perhaps... after receiving payment for a service that is delivered by email. One shouldn't send out spam just because someone typed an email address into a web page...

Re:GDPR

[Anonymous Coward]

Also, you need to store a copy of the consent (time, method, text, etc).

Re:GDPR

[ledow]

Well... yes... that's kind of what explicit consent means!

In our case, it's a signed agreement. Before we can send an email.

And about once a month, someone "opts out" by mistake by clicking a link in an email (or via some webmail's Junk function which then asks if you want to visit the unsubscribe link) and I get stroppy enquiries about why they're not getting emails and weren't told they'd unsubscribed.

Why? Because I *can't* email you to tell you that you'd unsubscribed... you'd unsubscribed! And if you didn't notice that you did so, with the confirmation screen, then there's nothing I can reasonably do.

Re:GDPR

[Anonymous Coward]

GDPR = DPA + case law. If you've been keeping up over the years, GDPR is no shock. If you haven't.... well, you've been at risk for quite a while whether you think so or not.

It's a shock for non-EU/EEA businesses to whom the old DPAs did not apply.

Re:GDPR

[ledow]

But they did apply.

If you're handling EU data, they've always applied. To get that data you SHOULD have had to sign the same kind of guarantees / waivers as anyone else.

Ignorance of the law is no excuse, and if you're collecting data on EU citizens, of course it's liable to EU law just the same.

If GDPR doesn't affect you now, the various DPAs never did.
If it does affect you, the various DPAs always did.

Re:Brexit

[Anonymous Coward]

Nope GDPR is what happens when good-intentions become laws.

Basically everyone who deals with "Cookies" for websites are having a heart attack right now because the GDPR makes it illegal to store cookies for EU citizens, and there's no fucking way to tell if someone is a EU citizen from ip address alone.

EU pee-eww

[Anonymous Coward]

I love how I keep seeing that the GDPR applies to any company with a website even if the company has no presence in the EU because people in the EU can access the website. Pretty sure we decided way back in 1776 that laws from across the pond don't apply to us. Good luck enforcing your GDPR over here.

Re:EU pee-eww

[Anonymous Coward]

You must be very old if you decided something in 1776.

We had the same problem with an anti-spam law

[davecb]

Some companies waited until after the last date for asking their customers to re-consent, then sent requests that were, you guessed it, SPAM!

Re:Brexit

[Dogtanian]

Yeah, because I trust the current Hard-Brexiteer-pandering UK government who think "AI" will magically be able to spot and take down offensive social media posts and intend- from this position of ignorance- to compel social media networks to make that work *so* much more.

(Not that I have any liking for the social media companies either, but my enemy's enemy is *not* my friend here).

reminds me of HIPPA

[Anonymous Coward]

I used to work in a state gov't department that was responsible for making sure organizations were in compliance with HIPPA when it first started so I had more than the average bear's knowledge of the area and over the years I have personally seen medical professional invoke HIPPA for scenarios that have nothing to do with it.

The most egregious, one friend was taken to the Emergency Room by another. The receiving nurse tried to claim that if the sick friend did not immediately sign a HIPPA release, the other friend had to leave the ER.

The reality was that the non-sick friend was raising a stink because he felt like the sick friend wasn't getting the attention he needed. They felt like trying to force someone writhing in agony to sign a legal document wouldn't happen so they would be able to get rid of the nuisance party.

Others were obviously more just obsessive CYA scenarios. So I'm sure we'll have years of these three things applied to GDPR:

1) false claims for deliberate scams
2) false claims because they're trying to bamboozle people into compliance with their wishes
3) false claims out of pure ignorance/an over abundance of caution

Re:reminds me of HIPPA

[Cederic]

I find that most of the paranoia about things like HIPAA comes from people that can't even fucking spell it.

Re: email filters

[cyber-vandal]

Yeah why would anyone want their private personal data handled properly? What a waste of time.

Re: Brexit

[cyber-vandal]

You can hand over your personal data to identity thieves via Equifax or TalkTalk if you like - I prefer it to be handled properly myself.

Re:Some ass used my domain to sign up for google..

[Anonymous Coward]

This is just plain funny.
So-called expert gets hacked then can't stop it. Then he complains to /.
Like anyone really gives a shit.

In a way, yea it is

[raymorris]

In order to have a person be a part of the discussion group TOMORROW, we will need to have consent records that comply with GDPR. In order to be GDPR compliant, there consent (sign up) must come after they've been informed of how to unsubscribe, the fact that you don't sell their email address to marketers, etc.

Here it is in programmatic form:

Are you sending them an email? (No: Goto Ok)
Do you have their consent? (No: Goto jail)
Is it informed consent? Meaning they saw GDPR disclosures before consenting. (No: Goto jail)

You need "informed consent". It's not sufficient under GDPR to inform them afterwards, "informed consent" under GDPR requires that they have the information BEFORE they sign up. Therefore you don't have GDPR-compliant informed consent from people who signed up prior to changing your site to be GDPR-compliant, including listing things you don't do.

It's not informed consent under GDPR if you didn't give them the GDPR info before they consented. Therefore you can't use their information after GDPR is in effect. Basically they either have to sign up again after receiving the GDPR disclosures, or you have to delete them because you don't have informed consent.

Re:In a way, yea it is

[Anonymous Coward]

Ok, so some corps just got their mailing lists taken away by law. Cry me a river.

Those who want to get back on such lists can do so, of course. Corporations can't reach out to them, but must fall back on generic advertising to try to get people to sign up. That is not easy - their loss not mine.

If any company goes under - it was a company we didn't need and won't miss.

Re:Brexit

[Anonymous Coward]

Pity for you that the GDPR will continue to be in UK law after Brexit.

Re:Brexit

[Anonymous Coward]

The road to hell is paved with good intentions. Big websites can circumvent this rubbish whereas smaller websites are petrified by the scope of the law, and unlikely to want to risk the hefty fines. It's not just about cookies, every user has the right to know everything you know about them, and the right to have all that deleted.

Re:Brexit

[Anonymous Coward]

I didn't trust any of them. I wanted to leave the EU after right to be forgotten smelled too much of 1984 and the removal of our collective right to remember what has happened and who by. The EU is not democratic, the people who make the EU laws are not elected, therefore the EU is technically an oligarchy.

Re: Brexit

[Anonymous Coward]

I don't like big companies either. The government is far more destructive than any company. Handing over power to them just because they seem benevolent is never a good idea. Tomorrow an elected government could use these tools and others to benefit its members and supporters to the detriment of dissenters. This would mean the end of democracy and the installation of a dictatorship, and it would all done with our consent.

Re:Brexit

[Anonymous Coward]

Pity for you too. We are all victims here. This EU law was not created by a democratic body. Tomorrow, when you may want to start an internet business of your own, you will have to take all of this into consideration, and you may decide that it is too expensive to comply from the beginning. Your venture may die before it begins because of this law and others like it.

Re: Brexit

[cyber-vandal]

How would you force companies to give a shit about protecting users' private information? Taking my business elsewhere is meaningless if my details have already been exposed, and the case of Equifax i can't do that anyway because I'm not the customer.

Re: Brexit

[Anonymous Coward]

Equifax and companies like it, exist because of government intervention. Pointless bureaucratic nonsense brought in in the name of protecting people, but ultimately leading to their detriment. Thomas Jefferson said the best government governs least (or words to that effect.)

I believe that it's government intervention that makes monopolies exist by hurting the prospects of smaller competing companies that can't afford to comply with the measures imposed on them. Facebook already dedicates a huge budget on compliance, who can afford to spend that kind of money from the outset? The more rules and regulations we impose, the less likely that a competitor will take hold, and the more likely that a small group of established companies will rise to dominance and power. Power which they in turn can abuse. Abuse which persuades people to support more rules and regulations.

Re:Some ass used my domain to sign up for google..

[Anonymous Coward]

I found it insanely interesting and tantalising.

Your drivel, however, has numbed my mind and you should feel bad.

Re: email filters

[hjf]

Yes. Not *MY* private personal data. I'm not european. I'm not protected by those laws. Why do I care?

Re: Brexit

[cyber-vandal]

What government intervention created Equifax? You still haven't answered my point though. How will the market make businesses give a shit about protecting their customers' data given that the market has totally failed to punish offenders thus far?

Re: Brexit

[Anonymous Coward]

Who up-voted your comment? Are you so insecure that you up-vote your own comments? Did you down-vote my comment? Is this the spirit of enlightened discussion you aspire to?

Re: Brexit

[cyber-vandal]

No I didn't. Are you going to answer my question?

Re: Brexit

[Anonymous Coward]

Equifax exists in order for banks to judge you when you ask them for a loan. If the government wasn't intervening in the free capitalist market, banks and ratings companies such as Equifax would be much smaller due to healthy competition. GDPR will make it harder for a competitor to take Equifax down a notch due to high cost of employing compliance lawyers and the additional cost of compliance itself. A large established company can afford to do this, a small company will struggle with this. Does this answer your question? Do you see how government intervention makes big companies bigger and hence more dangerous, and small companies bankrupt? We are adding layers of bureaucracy in order to correct distortions in the market caused by previous layers of bureaucracy.

Re: Brexit

[cyber-vandal]

How will the market make businesses give a shit about protecting their customers' data given that the market has totally failed to punish offenders thus far?

Re: Brexit

[Anonymous Coward]

Are you referring to data breaches? You want to punish companies for data breaches? That's like calling the police after you've been burgled and being fined for 'letting' the burglars in. That's stupid! No wonder you keep up-voting your own comments!

Re: Brexit

[cyber-vandal]

Yes I do want companies that are cavalier about protecting my personal data to be punished. Most of the serious data breaches have been due to the business in question not being prepared to spend the time and money to ensure their customers are adequately protected. That is what GDPR is for, to force organisations to give a shit about the people they are supposed to be serving. Unless of course you're happy for your personal data like credit card or social security numbers to be stored unencrypted on unpatched servers that is.

This is my only account. I have no interest in karma since it's already maxed out. How about you answer my question instead of giving me a load of guff about how my data would be safer if there were 10000 banks and 100 credit agencies. It wouldn't because security is a cost that a lot of organisations don't care about. I can start posting examples of data breaches in markets that have a lot of competition if that will focus your mind.

Re: Brexit

[Anonymous Coward]

No system is perfect, there is no absolute vault of data. Data breaches will continue. GDPR is about what information companies are permitted to collect about you, what they can do with that information and giving you the right to view and delete this information. You have to grow up and accept that there is no privacy any more. Your information will be freely available. The laws are there to stop people abusing this information, not to stop the information from existing.

I never said your data would be safer with 10000 banks. Pay attention!

GDPR won't stop data breaches and was never designed to do so. The criminal is not the person who stores your credit card information, it is the person to takes it and uses it without your permission. My credit card is not encrypted, anyone who looks at it has the information. I hand it over at restaurants and shops to people who could easily copy that information. If you still haven't understood my point of view, maybe you should ask an adult to draw you a picture.

Re: Brexit

[cyber-vandal]

GDPR is absolutely about the secure handling of personal information, hence the colossal fines. Perhaps you should go away and read it. It won't prevent a determined attacker but what it will do is force organisations to have proper policies in place to make it less likely. I work for an organisation that is currently going through GDPR compliance and we are hardening our systems, tightening up who has access to them and ensuring that everything is up to date. What do you know about GDPR? Very little judging by your comments. I'm still waiting for you to tell me how the market will force organisations to take proper care of people's private information.

Re: Brexit

[Anonymous Coward]

I'm still waiting for you to tell me...

Do your shoes have Velcro?

So tell me all knowing wise guy, what are all the emails about? Why do I have to confirm that they can keep in touch? Who gives a crap about cookies anyway? Why do messaging apps on my phone ask me to confirm my date of birth? How is any of this to do with breaches of data? Why is giving them extra data going to prevent my data from leaking? Are they hoping that by telling criminals when I was born, that they will miraculously choose not to steal my data? Why is everyone talking about GDPR data requests? You say less likely, so do you accept that all of these lost work hours are futile and that data will still leak? After all, it only needs to leak once. You say colossal fines, so even after all your hard work and diligence, you may still be wiped out by the actions of some criminals. Is that correct? Is that the right way to go about things? Beat the victim of a crime over the head with colossal fines? You work for an organisation pouring resources (time and money) into compliance, do you think that a smaller organisation would be able to dedicate the same amount of resources as yours? Do you think that you are lucky to work for a large organisation, because or course some people will loose their jobs in the smaller ones that will close as a result of GDPR and the high cost of compliance? Have you read GDPR?

Here is the GDPR in pdf:
http://data.consilium.europa.eu/doc/document/ST-9565-2015-INIT/en/pdf

Have you read all 201 pages? Did you understand them all? Did you have to lookup some of the big words? Am I wasting my time talking to you?

Re: Brexit

[cyber-vandal]

I think someone needs their nappy changed

Re: Brexit

[Anonymous Coward]

Off you go then.