It’s not that I was trying to cut ethical corners or do things poorly, I just didn’t know what the right way to do things was. Computer science education is often very theoretical and high level and not at all practical .
I’ll be the first person to say that I was not the most experienced and or talented programmer in the world, but do we want to prevent such people from starting companies?
And secondly, not all PII is the same. We stored names and addresses and phone numbers and websites. Not exactly medical histories or DNA profiles.
Yes. You should be fine as long as you're not collecting anybody's data or potentially harming them in any way, but apart from that, there should be established a bar to entry to what has become the fundamental motor of almost every single thing on the earth.
Later, outside of that legislation, when I'm collecting it, I deal with the Australian Privacy Principles [0].
It doesn't bother me that much, because I take a "well if we don't need it, we shouldn't be collecting it, and if we are collecting it, we should do so minimally and protect it anyway."
I believe under GDPR, if you need it, you can collect it. If you don't need it, why would you be/collecting or holding it?
There are certainly legal problems/ambiguities around ip and data collection, and yes, its usually legislated by people who really don't understand tech or information theory or data linking, but frankly I haven't heard very many legitimate ones brought up in relation to GDPR.
What I think someone naive and fresh out of college would do, for instance, when asked to delete data is...delete data.
And if they think that "delete my data" means go through a database and put a '1' in a delete flag against a record that is still retained, then I think they're not so naive, they picked that up somewhere from someone acting nefariously who told them it was "best practice".
And if they picked that up somewhere and it is industry "best practice", that's the kind of bullshit we should be weeding out of the tech industry.
If the user can't view/delete their data, that's a dark pattern. Which again, see above: needs to be weeded out of tech.
[0] https://www.oaic.gov.au/privacy-law/privacy-act/australian-p...
They don't really agree that all PII is not the same. To them, storing their IP address without permission is a horrific violation of their human rights.
It strikes me personally as illogical and paranoid to the point of hysteria. However, that's just me, and at the end of the day, I think there's a cultural divide here as to what constitutes privacy, who owns what data, and what power we should trust the government with.
There's a lot in the GDPR that I like, but having just been through a massive compliance effort, there's a lot in there that overreaches and is just there to leech money out of the companies that make an effort to comply.
Look at the ways that the US targeted online poker sites. None of them are in the US and subject to US law. But lots of banks are, and US lawmakers made it illegal for those banks to transfer money into or out of the poker sites and that basically worked.
Those seems like impositions on people who implement bad practice or work in fields that have morally questionable practices regarding people's data and identification. Many people I know don't engage or work in such industries because of the moral implications of doing so and what people are doing with data.
Its not about "just ask your lawyers" or "just call HR". Its about "well don't do dodgy/disrespectful stuff with customer data".
And if everyone is doing it or its regarded as "best practice" (as the old joke goes, best practice is just orwellian-speak for average), then that seems like MORE of an arguement why GDPR type activities and policies are required.