> Dnia 18.08.2026 o godz. 13:31:36 Randolf Richardson, Postmaster via mailop
> pisze:
> > Thank you. It's helpful because I'm in Canada and so my perspective
> > is from abroad. Do you find that most Europeans take the GDPR
> > seriously, or do many find it to be controversial?
>
> I'm an European. I'm not a lawyer, but at one of my previous jobs I was
> responsible for GDPR compliance.
>
> There are some people (and especially companies) in Europe who find GDPR
> "controversial", but these are mostly "absolute freedom freaks" who shudder
> at the slightest thought of anything being regulated by the state ;) They
> condemn GDPR but if you ask them specifically why, they usually don't know
> and repeat myths like the ones you have quoted in your previous email :).
>
> From my experience in the mentioned role, GDPR is nothing to fear of if you
> are honest and want to use the data reasonably and decently. There is,
> however, something to fear if you want to abuse the data :)
That makes sense. There are some "absolute freedom freaks" here in
Canada as well, and some of them quote America's First Amendment as
if it applies here when interacting with Canadian police (I get the
impression that many of them intentionally look for trouble, and I
appreciate those of them who seem highly skilled at finding it and
posting on YouTube as it provides interesting entertainment).
> GDPR basically states that:
>
> - you should not collect more data than you actually need (eg. to complete
> an order in an online shop, you definitely need customer's name and address,
> but NOT their birth date)
> - you can collect data only if:
> a) it is needed to provide a service requested by the person, or
> b) you have a "legitimate interest" to collect that data (that clause is the
> most vague and most often abused), or
> c) the person gave their consent to collect the data (the consent must be
> explicit, ie. opt-in, not opt-out), or
> d) it is required by the law
> - you must be transparent about what data you collect and what are you using
> it for; you must remove the data at the person's request, except when the
> law prohibits it (eg. you have to keep the records for tax purposes)
> - you can not transfer the data to a third party without consent (except when
> the third party is only a "data processor", ie. it processes the data on
> your behalf - eg. by providing storage space in the cloud - but is not using
> it for their own purposes; in that case you have to verify upfront that the
> data processor is GDPR compliant)
> - there are also some requirements regarding how the data should be
> protected against unauthorized access
>
> Of course that's a very rough approximation, there are many details, but
> that's basically all there's to it. Sounds very reasonable for me.
Canadian privacy law is not too far off from that. It seems
reasonable to me as well, plus I've heard some talk of tightening
restrictions here on third-party processors since there've been some
data breaches in recent years, including with a well-known credit
rating institution.
--
Postmaster - [email protected]
Randolf Richardson, CNA - [email protected]
Inter-Corporate Computer & Network Services, Inc.
Vancouver, Beautiful British Columbia, Canada
https://www.inter-corporate.com/
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
