News for hackers. Stuff that matters.

A comment on Intention to fine Marriott more than £99M under GDPR for data breach. Parent comment

Re:Intention to fine Marriott more than £99M under GDPR for ... by hedders on Tuesday July 09, 2019 @04:43PM (#20396372)
The way art 30(5) is drafted though means that the exception applies to basically nobody. What business can, honestly, say that it only occasionally processes personal data? Does it have no employees? Does it only occasionally communicate with people? That hardly seems likely.

Yes, it's probably a drafting defect, but I think one would be very brave indeed to try to rely on it, especially given that establishing an art 30 record is, practically speaking, a prerequisite for being in a position to comply with the rest of GDPR.

[ Parent | on HN ]
Re:Intention to fine Marriott more than £99M under GDPR for ... by diminoten on Tuesday July 09, 2019 @04:52PM (#20396466)
Then I guess we're back to letting big companies, who have the resources to do this shit, have Europe, and the small companies, who are too busy building new things, will just grow in other areas before expanding to the EU.
[ Parent | on HN ]
Re:Intention to fine Marriott more than £99M under GDPR for ... by hedders on Tuesday July 09, 2019 @05:11PM (#20396635)
Hardly. I mean, it's not like it's difficult for a small business to maintain an art 30 record. Unless it's doing a Cambridge Analytica, of course.
[ Parent | on HN ]
Re:Intention to fine Marriott more than £99M under GDPR for ... by diminoten on Thursday July 11, 2019 @11:52AM (#20412485)
You need a lawyer to ensure you're complying with EU law...
[ Parent | on HN ]
Re:Intention to fine Marriott more than £99M under GDPR for ... by gcthomas on Wednesday July 10, 2019 @09:20AM (#20401663)
The exemption is only for the record keeping requirement to help keep costs down. Every organisation still needs to meet the data protection regulations.
[ Parent | on HN ]
Re:Intention to fine Marriott more than £99M under GDPR for ... by Silhouette on Tuesday July 09, 2019 @06:00PM (#20397103)
The way art 30(5) is drafted though means that the exception applies to basically nobody.

Unfortunately, this is a good demonstration of two criticisms made of the GDPR right from the start: the costs of creating new paperwork in the approved format even if it makes no material difference to any actual data processing, and ambiguity about what is required or permitted even in quite fundamental respects.

[ Parent | on HN ]