GDPR in itself is not bad, it is people who hide behind it.. eg using it
as an excuse NOT to be internet friendly.. it makes it tougher on law
enforcement of course..
And a lot of businesses use GDPR as an excuse to do things like whois
privacy by default, or not implement egress monitoring etc..
The GDPR does say as long as you tell the person that their information
'might' be shared, and the reason for sharing is clear, transparent and
reasonable.. etc. etc.. but a lot easier to simply not be transparent.
IMHO, it's just as open to abuse, as the opposite end of the spectrum.
I fully support GDPR when used correctly.. eg customers deserve the
right to know what their data is being used for, and not secretly hidden
in a 100 page terms of service, or behind an 'opt out' button..
It's just that I am tired of hearing.. "We can't.. GDPR and all"
On 2026-08-18 13:20, Jaroslaw Rafa via mailop wrote:
Dnia 18.08.2026 o godz. 13:31:36 Randolf Richardson, Postmaster via mailop
pisze:
Thank you. It's helpful because I'm in Canada and so my perspective
is from abroad. Do you find that most Europeans take the GDPR
seriously, or do many find it to be controversial?
I'm an European. I'm not a lawyer, but at one of my previous jobs I was
responsible for GDPR compliance.
There are some people (and especially companies) in Europe who find GDPR
"controversial", but these are mostly "absolute freedom freaks" who shudder
at the slightest thought of anything being regulated by the state ;) They
condemn GDPR but if you ask them specifically why, they usually don't know
and repeat myths like the ones you have quoted in your previous email :).
From my experience in the mentioned role, GDPR is nothing to fear of if you
are honest and want to use the data reasonably and decently. There is,
however, something to fear if you want to abuse the data :)
GDPR basically states that:
- you should not collect more data than you actually need (eg. to complete
an order in an online shop, you definitely need customer's name and address,
but NOT their birth date)
- you can collect data only if:
a) it is needed to provide a service requested by the person, or
b) you have a "legitimate interest" to collect that data (that clause is the
most vague and most often abused), or
c) the person gave their consent to collect the data (the consent must be
explicit, ie. opt-in, not opt-out), or
d) it is required by the law
- you must be transparent about what data you collect and what are you using
it for; you must remove the data at the person's request, except when the
law prohibits it (eg. you have to keep the records for tax purposes)
- you can not transfer the data to a third party without consent (except when
the third party is only a "data processor", ie. it processes the data on
your behalf - eg. by providing storage space in the cloud - but is not using
it for their own purposes; in that case you have to verify upfront that the
data processor is GDPR compliant)
- there are also some requirements regarding how the data should be
protected against unauthorized access
Of course that's a very rough approximation, there are many details, but
that's basically all there's to it. Sounds very reasonable for me.
--
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
