A) The law seems to extend beyond the borders of the EU.
B) It's extremely long and vague, doesn't really offer a lot of actionable advice, and nobody outside of privacy lawyers seems to really understand it fully.
C) The penalties are harsh.
Further muddying the waters, the EU and US already have some existing bilateral agreements with respect to data privacy [1], but does the GDPR supersede or unilaterally invalidate these...? Who knows?
A) It covers behaviour towards the citizens (ie passport carrying members) of the EU. It basically says: "please do not be evil" - OK it says a lot more but I think you get the idea.
B) It does cover a lot of ground but it is written in pretty accessible language for such a large and complex subject.
C) The possible maximum penalties are set at a level that will not destroy a serial transgressor but should hopefully deter anyone from becoming such a beast in the first place.
Overall, GDPR is really a manifesto for how people should be treated in the burgeoning data economy. I still find it hard to understand how such a reasonable and farsighted set of regs came to be designed in the first place. As a citizen of the UK, at least I am reasonably certain that the GDPR will stay on the local statute books post Brexit because to contemplate otherwise is economic suicide.
> The law seems to extend beyond the borders of the EU.
Hi guys,
It's Kim from the Best Korea, and we just decided that we are going to allow our people to access the Internet.
There is a tiny little thing though, our internet policy stipulates that for every traffic hit to sites outside our borders, the country of origin either donates 1 nuke or if it doesn't have nukes an item of great value, or a 24 hour TV broadcast featuring me.
A) The law seems to extend beyond the borders of the EU.
B) It's extremely long and vague, doesn't really offer a lot of actionable advice, and nobody outside of privacy lawyers seems to really understand it fully.
C) The penalties are harsh.
Further muddying the waters, the EU and US already have some existing bilateral agreements with respect to data privacy [1], but does the GDPR supersede or unilaterally invalidate these...? Who knows?
[1] https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield