> Erasing everything I ever wrote down about you is difficult.

It is not difficult to avoid storing data you don't need.

You don't need a user phone number? Easy, don't ask for it.

Of course you argument is that it is difficult to change existing systems to follow this principle. Except that your starting position was that this regulation was about stifling competition, which is thus in direct contradition with this argument.

Existing systems were built on the assumption that "misappropriating" PII was a lucrative thing to do. This led to abuse from the industry.

>It is not difficult to avoid storing data you don't need.

Access logs for one thing are pretty unreasonable to force people to avoid storing.

>Existing systems were built on the assumption that "misappropriating" PII was a lucrative thing to do. This led to abuse from the industry.

Can you point out a specific example of somebody suffering actual damages from this "abuse?"

Cambridge analytica is a good example. I guess considering this abuse may be different from a US customer point of view, but for my european sensibility, this is definitely abuse. Furthermore, that Facebook could harvest ghost profiles that could be used in this manner is problematic.

I think it is certainly possible to find cases of identity theft resulting from PII that were leaked in security breaches, made easier by overreaching data collection.

> Access logs for one thing are pretty unreasonable to force people to avoid storing.

Store them for a limited time, it's not hard.

Not "hard" for us, no, even if an unnecessary burden. Now go make some small veterinary clinic with no "computer person" on hand, with a small website they had set up years ago that lets you schedule appointments, figure all this out. They'll probably either stay uncompliant or have to drop the website.

That's a shame, but it's a side effect of anything ever that requires an update. Any small business commissioning a site in 2019 will get something that's compliant, so it's not like this is a permanent drain.

Sometimes it's important to update regulations, despite the inertia of existing implementations.

This attitude reminds me of a quote: "Some of you may die, but it's a sacrifice I am willing to make."

Better than the idea that we can never change any law because someone will have to adjust to it.

Running a single server for a small business is hard anyway they’re occasionally going to need support.

As the first offense only seems to result in a warning, they have a chance to figure things out. Then is asking their webdev to schedule a cron job to delete logs really such a burden?

Your statement makes it sound like the GDPR applies to individuals doing everyday activities (or draws an equivalence). Just for clarity, I looked it up and it doesn’t appear to:

“This Regulation does not apply to the processing of personal data: (...) by a natural person in the course of a purely personal or household activity;"

So, it really only applies to companies, or if you’re processing a large amount of user data for a hobby project.

That being the case, it doesn’t feel like the bar to being able to respect the law is so very high. But I’d be interested in counter examples.

> Erasing everything I ever wrote down about you is difficult.

Why do you think this is required by GDPR?

Here's the actual bit of law. Note how many exceptions there are. https://gdpr-info.eu/art-17-gdpr/

It's not surprising you fear it so much if you think it forces you to do all the stuff you've said. What is surprising is that almost everything you've said isn't in GDPR or has been exagerated beyond recognition.