refleks posted:

Is it enough to inform people about GDPR by linking to a new privacy policy for a service and implicitely say "You accept if you don't do anything"

3peat posted:

this is a really funny part of gdpr

Have you ever wondered what your boss or co-workers say about you behind your back? If you’re located in Europe, it will soon be extremely easy to find out.

Under the General Data Protection Regulation that comes into play on 25th of May, any individual located in Europe can ask any company for the data it collects about them – and that includes their employer.

If an employee files a “subject access request” – an email, fax or letter asking for their personal data – their employer will have 30 days to collate a cache of all of the information stored about that person. This includes any email that refers to the worker, as well as performance reviews, job interviews, payroll records, absence records, disciplinary records, computer access logs, CCTV footage, and recordings of phone calls to, from or about the person.

In responding to a subject access request, the company must not include another employee’s personal information. This means that each item must be painstakingly redacted.

“Imagine going through every email sent to you or about you,” said Carvel.

If a company deletes any of the data to prevent disclosure after the subject access request is made, it can be liable for criminal sanctions.

Because of how onerous such requests can be, some data privacy experts warn that they could be exploited by activists to punish a company. A group of unhappy former employees could all file requests at the same time, forcing the company to dedicate resources to respond within the 30-day timeframe.

“If you look at it from that angle it seems unfair for companies. But think about the pensioner who was refused a mortgage and doesn’t understand why,” said Carvel, referring to a case for which the regulation was designed. “It’s not intended to be for malicious activists or disgruntled employees.”

Subject access requests generally allow an individual to see a copy of the information an organisation holds about them, whether it’s a mortgage lender, social media company or retailer.

3peat posted:

this is a really funny part of gdpr

Have you ever wondered what your boss or co-workers say about you behind your back? If you’re located in Europe, it will soon be extremely easy to find out.

Under the General Data Protection Regulation that comes into play on 25th of May, any individual located in Europe can ask any company for the data it collects about them – and that includes their employer.

If an employee files a “subject access request” – an email, fax or letter asking for their personal data – their employer will have 30 days to collate a cache of all of the information stored about that person. This includes any email that refers to the worker, as well as performance reviews, job interviews, payroll records, absence records, disciplinary records, computer access logs, CCTV footage, and recordings of phone calls to, from or about the person.

In responding to a subject access request, the company must not include another employee’s personal information. This means that each item must be painstakingly redacted.

“Imagine going through every email sent to you or about you,” said Carvel.

If a company deletes any of the data to prevent disclosure after the subject access request is made, it can be liable for criminal sanctions.

Because of how onerous such requests can be, some data privacy experts warn that they could be exploited by activists to punish a company. A group of unhappy former employees could all file requests at the same time, forcing the company to dedicate resources to respond within the 30-day timeframe.

“If you look at it from that angle it seems unfair for companies. But think about the pensioner who was refused a mortgage and doesn’t understand why,” said Carvel, referring to a case for which the regulation was designed. “It’s not intended to be for malicious activists or disgruntled employees.”

Subject access requests generally allow an individual to see a copy of the information an organisation holds about them, whether it’s a mortgage lender, social media company or retailer.

obstipator posted:

thats not a hall of shame. it should be intentionally as inconvenient as possible for the EU to do things in order to properly protest this dumb law

FAT32 SHAMER posted:

counterpoint: get hosed you gigantic dipshit

obstipator posted:

do you work on anything that users use?
if so, you are required by law to put cycles into features such as “Oops! I didn’t actually want to voluntarily give you my data! Delete the web sight!!!”

obstipator posted:

do you work on anything that users use?
if so, you are required by law to put cycles into features such as “Oops! I didn’t actually want to voluntarily give you my data! Delete the web sight!!!”

Crusader posted:

Themage posted:

do you work at a company that derives its revenue from selling personal information

NEED MORE MILK posted:

lmao here's npr in its gdpr compliant form



gdpr is destroying javascript and css therefore it is good

obstipator posted:

no im a guy that makes internal websites for work, but now i have to jump thru hoops for that or else my company will be fined 20million euros when some idiot gets fired and complains “boo hoo hoo! i’ll show them!”

Jonny 290 posted:

seriously i can see literally zero downside to GDPR

any company with their poo poo together doesn't even care because they were set up to integrate the new requirements pretty readily and theyre compliant and fine
every lovely company that doesnt actually respect their users is getting owned, either via panic-overtime coder salaries or gdpr fines themselves

icann is making GBS threads their pants, jquery is trolling doubleclick, and the npr homepage is plain links on a white background

remind me of the negatives again

Jonny 290 posted:

seriously i can see literally zero downside to GDPR

any company with their poo poo together doesn't even care because they were set up to integrate the new requirements pretty readily and theyre compliant and fine
every lovely company that doesnt actually respect their users is getting owned, either via panic-overtime coder salaries or gdpr fines themselves

icann is making GBS threads their pants, jquery is trolling doubleclick, and the npr homepage is plain links on a white background

remind me of the negatives again

obstipator posted:

yall probs havent made anything anyone else has ever used