undefined | Better HN

0 pointsKalium8y ago0 comments

> Nothing has been learned.

I don't know about you, but I have learned a great deal!

I've mostly learned that Eurocrats can't actually write useful regulation. Blah blah blah human rights blah blah reasonable measures. Next chapter. Blah blah envisage blah blah reasonable measures. Blah blah blah inter-government communications protocols blah blah codes of conduct.

What's a reasonable measure? How do I know if I'm compliant? How do I know if a vendor is compliant?

GDPR is a wonderful, incredible, essential document for laying out human rights for the digital world. It's also terrible and incomprehensible regulation.

0 comments

2 comments · 2 top-level

shabble8y ago

Can you think of any good technical regulations that do lay out requirements & obligations in a useful manner without being massively outdated, trivially bypassable, or some sort of hugely onerous 'one size swamps all'?

I mostly agree that the lack of concrete measures makes it horrible from a compliance view, but I'm not sure you can have both things, especially in a relatively immature area of law.

1 more reply

pbhjpbhj8y ago

>How do I know if a vendor is compliant? //

Did they ask for explicit permission to use your data? Do they provide the service if you only provide the data they actually need, rather than asking for a swathe of PII so they can sell it on? Do they provide info on how your data is stored, and who has access to it? Do they provide a way for you to view and/or delete all the PII they have on you?

1 more reply

j / k navigate · click thread line to collapse