That's why the first line of remedy is to help the company achieve compliance. Good faith on the part of the company goes a long way too.

The law is not like code. Thank god.

Law is not like code but the GDPR is so vague and open to interpretation that it gives almost no real guidance and instead puts you at the whims of whatever the current enforcer thinks.

It gives plenty of guidance and the 'enforcer', if one ever appears (vanishingly unlikely) is bound to be collaborative rather than adversarial, at least in the early stages.

I really don't get the fear mongering over this.

Several companies have already been fined by the various country level data protection authorities that enforce the GDPR. So I'm not sure what you're talking about.

So? Is it better they leave security holes wide open, share private data or don't practice data minimization.

GDPR has been in place for years now, why are people still spreading this narrative that it's super complex and dangerous for every company?

Where are the examples of companies following the spirit of it getting punished regardless?

Enforcement has been light. Companies are still living in fear of an uncertain regime that means whatever the government body accusing you of violating says it means. A primary function of law is to give you certainty of your obligations.

Right, so this is little more than FUD.

The law is clear that enforcement is primarily done via helping companies correct mistakes, not immediately handing out fines, and that's what has been happening.

> And even if you get billed for hundreds of hours of the most premium legal minds thinking about it they can still be wrong.

And that's if you can get said legal minds to take a firm position in the first place, instead of the more usual five - six figure "maybe"

But going through the process where you work out what customer data you need, reviewing how it's stored, letting your customers all this, is good.

It's very much more healthy (and lawful) than just mucking on, stuffing data into limitless digital vaults and then not having a clue when all that data gets leaked.

In the good old days, paper records had the good manners to take up physical space. It was clear when you had too many records because it was a serious inconvenience to your business.

Doing that exercise using your own best judgement is better than not doing it, but nowhere near enough to avoid destruction in case someone with an attitude like the parent commenter's is working on your case at one of the data protection agencies.

Apparently those supporting GDPR would rather have the EU fine Google than to ensure small businesses can survive and be productive with technology, even when the fine to Google is a small amount compared to how much Google makes in the EU. Makes perfect sense, no?

There’s nothing written in GDPR that would prevent a small business from surviving and being productive. It’s also important to understand that the law enforcement is business friendly in general: if you don’t do stupid thing intentionally, but occasionally make a mistake, no one will punish you.

Is that a sarcastic comment?

Because GDPR allows for liquidating fines, even for Google. I believe it has a cap of 2% annual global turnover, per infraction, or something similar.

Problem is, GDPR is not enforced. I haven't heard of small companies being investigated, let alone having any fines imposed, even when blatantly violating GDPR.

Just because you haven't heard of it doesn't mean it doesn't happen..

https://gdpr-fines.inplp.com/list/

https://www.enforcementtracker.com/

All those fines seem pretty reasonable, I don’t see any questionable or odd interpretation of the rules?

A few hundred fines in a union of a half a billion people.Right. I'm based in the UK and from my own professional experience dealing with GDPR and ICO,all I can say that companies can and do play pretty wild with data because the reprecussions are simply not there. Nobody is busting your door with fines unless you do outright absurd things+ backlog of cases is so long that by the time someone will start looking into it, you may not even be in the business anymore.

It’s the law, and it places undue burden on small companies that may not have the technical resources to modify their site/apps/data as expected, as many of them contracted out the work initially at great expense.

An email address is considered PII, so if users request their data be deleted, the small business is honest and says they can’t, and the user and others raise this to the government, you think that small company won’t be fined? That company, worried about doing things illegally, may end up giving a bunch of money to a contractor to fix their application- and for what? To allow users to request that their email address be anonymized or removed? That’s stupid.

If a small business cannot delete customer email address from their database, then it does not deserve to survive. It is not a rocket science and it is not unaffordable to have this functionality even in a custom solution.

I think you are describing very hypothetical situations.

If you know how to get a company fined, could you please share, so I can report and have action taken against companies that violate and misuse personal data?

Here(1) you have a tracker with (most) fines due to breaking GDPR. In my country there is a local office (all EU states must have one) and all citizens can file online complaints. In 2-3 weeks we get feedback. Real feedback. I have seen electricity companies being fined for sending the electricity bill to the wrong person by e-mail, thereby violating personal info security. It's all on this website.

(1) https://www.enforcementtracker.com/

Since you want everyone to be fined, why not start with YCombinator? You can ask them for a list of all of their PII removal requests and to see proof that it was all removed.

I’m sure that’ll go over well.

Then maybe you can submit an Ask HN to see how many startups will self-report to you.

There are over 26M small businesses in the EU. You’d better get started...

By the way, GDPR isn’t just about misuse of PII, it’s about use of PII after it’s been asked to have been removed; and most sites use email addresses as usernames which are PII, so that’s all over the application logs, comments, etc. and when people submit a PII removal request, you can’t share or store the PII in the request itself, so better not use Slack, email, etc. and accidentally refer to the PII to be removed. If you do and need to follow-up again with clean-up, don’t refer to it then either, or you could get stuck in a endless loop of PII removal. Also, how do you know you removed the PII of the user who didn’t specify all of it I’m the removal request? You ask them for it- but does that allow the PII they sent at that point to be kept? I don’t know!you know why? Because it’s not fucking defined in the law clearly enough. What if they requested removal of data that wasn’t their PII?