One of they key things to me is increased fines that are available. I've likely had my data and families data lost through a variety of terribly insecure services having breaches.

TalkTalk lost 150k peoples information (including bank account numbers, sort codes, dates of birth, etc - people who later then received scam phone calls with people who knew their details) due to extremely basic security failings. They were fined £400k (a record fine). They then did it again and paid £100k.

Properly securing the site and the data over many years could easily cost more than that, added to the chance you'll not get hacked or fined and it is perhaps even a financially sensible position to not put the effort in.

I think being responsible for negligence in security practices and GDPR are not the same. GDPR is overreach. There is a saner middle ground, for example in Australia new laws coming in mean executives can go to prison for the negligence in your example. That makes more sense as it doesn't invalidate 90% of standard tools processes in technical marketing for example.

I think it's interesting you find a fine to be overreach but imprisonment not.

> That makes more sense as it doesn't invalidate 90% of standard tools processes in technical marketing for example.

Can you explain in more detail?

I'm not talking about the fine/prison. The overreach is that they dictate how you have to handle data. In Australia you are only obligied not to get hacked and are trusted to figure it out for yourself. In Europe they have all this right to be forgotten BS and reams of compulsory opt ins etc etc

I don't really have a problem with requiring consent to work with personal data. Right to be forgotten is restricted and I can't think of obvious cases within the restrictions here: https://ico.org.uk/for-organisations/guide-to-the-general-da... that I disagree with.

Stronger restrictions on what data you can hold without good reason or consent means that inevitable breaches become less important.

Do you prosecute your friend and aqaintances for uploading pictures of you to Instagram/fb etc? Block all tracking script/pixels on the Web? Avoid using the phone in order to not generate meta-data?

I'm not sure how it's "easy to avoid sharing identifiable data"?

For the most part no (i block ads because I'm not interested in them not for privacy concerns) but I'm also not irrationally paranoid about such things. I've lived in a world where I'm photographed hundreds of times a day by cctv etc for most of my life. Im not really sure what difference a few photos on social media will make

The difference is the size of the aggregated dataset on you and those you are associated with, and how it might be sold, augmented etc. Granted, some places it might be legal to sell cctv footage too - but it will also fall under the GDPR (not the GDPR alone, there are surveillance bills and "ant-terror" provisions... But there's one remedy for government overreach (throw the government, through elections or protest) another for private overreach: government regulation/laws).

I understand the risk of aggregate data etc and do think we need to hold companies accountable however I disagree with the fundamentals of how GDPR tries to achieve this. It’s the wrong abstraction. I also value what free services, indie apps, small scrappy startups and general maker world productions provide society and life in general way more than I value absolute privacy.

PCI-DSS is essentially about credit/debit card data. GDPR is about personal information is general, such that you need to let your users know what you are collecting, what you will do with it, and how long you will hold it.

A point of fact though — PCI isn’t a law, it’s a voluntary standard.

Yes however i can choose to not interact with non compliant service. The ignorant need to be educated rather than the informed punished.

There are almost no companies that respect the customer's privacy because of the lack of regulation so you can't in fact choose anything.

Companies have failed to regulate themselves since the dawn of time, this is how the world works.

You won't get PCI-DSS accredited without an audit.

Only Level 1 compliance requires an audit. Below that a remote scan of public IPs and a self-assessment is sufficient.