News for hackers. Stuff that matters.

A comment on When Employees Use Software That IT Hasn’t Approved. Parent comment

Re:When Employees Use Software That IT Hasn’t Approved by lmkg on Wednesday June 12, 2019 @04:42PM (#20169088)
One of the side-effects I'm seeing of GDPR is a stronger incentive to consolidate systems under central management. Companies that allowed different departments the leeway to control their own systems now find themselves literally not knowing how many different places a customer's data might live.
[ Parent | on HN ]
Re:When Employees Use Software That IT Hasn’t Approved by snowwrestler on Thursday June 13, 2019 @10:21AM (#20175120)
That was absolutely a factor in this decision. And it's not just GDPR, many states and even the federal government are likely to impose more regulation on how personal data is collected and stored.
[ Parent | on HN ]
Re:When Employees Use Software That IT Hasn’t Approved by IMTDb on Wednesday June 12, 2019 @04:51PM (#20169189)
> stronger incentive to consolidate systems under central management

Which in turn makes it easier to over analyse and identify user data, exactly what GDPR was meant to avoid.

[ Parent | on HN ]
Re:When Employees Use Software That IT Hasn’t Approved by TeMPOraL on Wednesday June 12, 2019 @06:16PM (#20169927)
Not necessarily. Another way of looking at it is that GDPR is forcing companies to eliminate a common dysfunction, while at the same time restricting their ability to play shenanigans with user data. The end result is companies that are more efficient at what they should be doing, and restricted from doing what they shouldn't be doing. A win-win.

(While many business people used to how things worked are unhappy with the changes, sometimes you really have to bludgeon a fix through the broken incentive structures that plague businesses.)

[ Parent | on HN ]
Re:When Employees Use Software That IT Hasn’t Approved by antod on Wednesday June 12, 2019 @06:49PM (#20170160)
> Which in turn makes it easier to over analyse and identify user data, exactly what GDPR was meant to avoid.

GDPR "cares" about identifying user data - how else are you going to protect it and control access to it?

As for over analysing it (whatever that means), it really doesn't care too much about that as long as you have explicit meaningful informed permission from the user to do so, protect it properly, and let them control what happens to it (both during and afterwards).

[ Parent | on HN ]