News for hackers. Stuff that matters.

A comment on The Nightmare Letter: A Subject Access Request Under GDPR. Parent comment

Re:The Nightmare Letter: A Subject Access Request Under GDPR by discoursism on Saturday March 17, 2018 @03:06PM (#16608495)
Hrm, did you expect me to design the output of an entire industry in an HN comment? I didn't say it was easy to do. But it is what must be done. My goal was not to provide code, but an outline, a very rough sketch, rough to the extent that it could fit in a pair of sentences. I guess in that sense the owl metaphor is accurate!

We've had two years to work on this. At my company, we've had entire teams spending significant fractions of their time over the last year prepping. As a result, we'll be ready when the switch flips.

[ Parent | on HN ]
Re:The Nightmare Letter: A Subject Access Request Under GDPR by Radim on Saturday March 17, 2018 @04:49PM (#16609001)
It's refreshing to see such responsible approach.

What you suggest is (as far as I understand you) orthogonal to automated data discovery / inventory mapping, though.

[ Parent | on HN ]
Re:The Nightmare Letter: A Subject Access Request Under GDPR by discoursism on Saturday March 17, 2018 @05:43PM (#16609218)
I agree we are not using the same definition of data discovery. In my use case, you know a priori which user provided the data, you just need to plumb the information through to all downstream systems. This seems sufficient for GDPR as I understand it. I had not read your entire comment and did not realize you were promoting a system to try to do something like this automatically. I did not realize the initial question was rhetorical.

FWIW I would be worried about relying on such a system! But based on the description it seems helpful. What does it do about derivative data that doesn't directly contain any PII?

[ Parent | on HN ]