Urban75 Home About Offline BrixtonBuzz Contact

The big Brexit thread - news, updates and discussion

Enforcement agencies overwhelmed with scope — There seem to be staffing shortages that hindered some agencies from keeping up with complaints and notifications.
  • 144,000 complaints filed
  • 89,000 data breaches recorded
That wasn't what I was asking about though. LBJ was suggesting it's open to abuse via vexatious complaints (tbh this is true of many regulations) - I was asking in practice whether this actually happens very much. Can't imagine it does, but I'd be happy to see some figures if there is any.
 
What odds can I get on a last minute deal being signed? The more Boris, Gove et al. make gloomy public pronouncements on how unlikely a deal is looking, the more convinced I become that it’s definitely going to get agreed. Just on the simple logic that they can be relied upon 100% to be lying, each and every time they open their mouths.
surprised you're on second name terms with the liar johnson but don't enjoy a similar intimacy with the wretch gove
 
It has happened at least once. I would be surprised if my organisation were really exceptional. Someone with a petty grudge has wide scope to fuck people up.
well as I said - this is a feature of many regulations.

I had to do a lot of work on GDPR the other year (and on Data Protection in general before that) - it's difficult to know what you could do to make it grudge-proof, without leaving massive gaps in the regulations.
 
well as I said - this is a feature of many regulations.

I had to do a lot of work on GDPR the other year (and on Data Protection in general before that) - it's difficult to know what you could do to make it grudge-proof, without leaving massive gaps in the regulations.
Even before this fucker fucked us around, GDPR was causing massive headaches. It's one thing for businesses trying to make money out of people to be made to tighten up, but quite another for volunteer-run organisations that need to get information across to people. And there was never any proper consensus as to exactly what we were obliged to do, even though some of the people involved did this stuff for a living.
 
If you're holding people's personal data, why would it matter if you're making money out of it or not - you still have a responsibility to make sure it's kept securely and disposed of in a timely fashion when it's no longer needed.

There is a lot of bullshit about regarding it mind, and a lot of companies & orgs went off the deep end calling in consultants and tightening things up way more than they actually needed to. It's not actually all that arduous.
 
There is a lot of bullshit about regarding it mind, and a lot of companies & orgs went off the deep end calling in consultants and tightening things up way more than they actually needed to. It's not actually all that arduous.

This is the key point, when you boil it down to its basics its basically "only use the data for the original use it was collected for and when you don't need it anymore delete it.
 
What counts as personal data? That was one question that didn't have a totally clear answer. We even had someone claiming that an email address was personal data! We had to tighten up on how we stored bank details for people, which was a good thing to do and not that hard, but other stuff impeded us from being able to do our work putting on events for members and communicating clearly.

And this particular vexatious incident involved a demand from a former officer (who had left under a cloud) to see all emails from the last two years that mentioned their name. I voted to tell them to get stuffed, but they were threatening court action and I was outvoted. It took ages because all other names had to be redacted. And this is a problem when someone threatens court action. You can be stuffed even if they're wrong.
 
What counts as personal data? That was one question that didn't have a totally clear answer. We even had someone claiming that an email address was personal data! We had to tighten up on how we stored bank details for people, which was a good thing to do and not that hard, but other stuff impeded us from being able to do our work putting on events for members and communicating clearly.

And this particular vexatious incident involved a demand from a former officer (who had left under a cloud) to see all emails from the last two years that mentioned their name. I voted to tell them to get stuffed, but they were threatening court action and I was outvoted. It took ages because all other names had to be redacted. And this is a problem when someone threatens court action. You can be stuffed even if they're wrong.
I don't claim to be an expert on data protection law, but on a common sense level, an email address clearly is personal data.
 
an email address is personal data, of course.

and your former officer did have the right to see those emails (and did before GDPR, under the old data protection act). It might be annoying, but they're important legal protections, and if you found yourself in need of making a similar demand from an organisation you left under a cloud, I'm pretty sure you'd be glad of them.
 
an email address is personal data, of course.

and your former officer did have the right to see those emails (and did before GDPR, under the old data protection act). It might be annoying, but they're important legal protections, and if you found yourself in need of making a similar demand from an organisation you left under a cloud, I'm pretty sure you'd be glad of them.
Nah. Didn't leave the organisation. Just got booted out as an officer. It was a vexatious action, spite pure and simple.

With GDPR, the problems came with who was allowed to have access to things like members' email addresses. We weren't publishing them, but we need to have them. I don't claim expertise in this, but then that's also one of the problems - when this kind of new regulation comes in for volunteer organisations, it can (and did with us) just make some people say 'fuck it, not doing it any more'.
 
What counts as personal data? That was one question that didn't have a totally clear answer.

Its in the document under Article 4 - Definitions L_2016119EN.01000101.xml

"


‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
 
I voted to tell them to get stuffed, but they were threatening court action and I was outvoted. It took ages because all other names had to be redacted. And this is a problem when someone threatens court action. You can be stuffed even if they're wrong.
people shouldn't really have to threaten court action to get their hands on information about them, should they
 
Nah. Didn't leave the organisation. Just got booted out as an officer. It was a vexatious action, spite pure and simple.
so you say - he may have a different take. The GDPR regulations can't take a view on which it is, but letting the data controller decide if a subject access request was genuine or not would be far more open to abuse than the current system - you must recognise that?
 
Back
Top Bottom