Government & Post Election Discussion

So, in summary..

Someone has to allow you to keep any info that can personally identify them, and you need to record that assent.
You can’t use their info for any purpose other than what you said you would.
The info has to be accurate and kept securely.
Have a named person responsible for this info
You have to delete their info when requested.

Sounds fair to me...

[OLD BOY]

Originally Posted by Hugh

So, in summary..

Someone has to allow you to keep any info that can personally identify them, and you need to record that assent.
You can’t use their info for any purpose other than what you said you would.
The info has to be accurate and kept securely.
Have a named person responsible for this info
You have to delete their info when requested.

Sounds fair to me...

Yes, it is. However, that is not my point!

But how is that a huge overhead?

Surely, this is the minimum we should expect - we don't want our personal information to be misused, so the collectors of this information have a responsibility to make sure any info they have on us is relevant, necessary, and secure.

[1andrew1]

Originally Posted by papa smurf

4) 2 contradicts 3

It doesn't.

[OLD BOY]

Originally Posted by Hugh

But how is that a huge overhead?

Surely, this is the minimum we should expect - we don't want our personal information to be misused, so the collectors of this information have a responsibility to make sure any info they have on us is relevant, necessary, and secure.

I am not questioning the need to keep personal data securely. I am questioning why every organisation, large and very small, have to justify their compliance with all this paperwork.

As I said a few times, the requirements to keep data safe should be set out in law, and that's it. No need for privacy statements and the like.

[tweetiepooh]

Because you have to prove that you are following the rules so have to demonstrate the data is secure and you have processes to prevent it's misuse. And misuse would include using it other than intended not just securing it from access.

[jonbxx]

Originally Posted by tweetiepooh

Because you have to prove that you are following the rules so have to demonstrate the data is secure and you have processes to prevent it's misuse. And misuse would include using it other than intended not just securing it from access.

'If it's not written down, it didn't happen', a phrase used in many, many regulated industries.

[OLD BOY]

Originally Posted by tweetiepooh

Because you have to prove that you are following the rules so have to demonstrate the data is secure and you have processes to prevent it's misuse. And misuse would include using it other than intended not just securing it from access.

Why do you have to prove it? Why can't it simply be that if you break the law, you are prosecuted?

I'm not a burglar, but I don't have to prove it with tons of documentation setting out my respect for other people's property!

Can nobody see what a nonsense this is?.

Originally Posted by OLD BOY

Why do you have to prove it? Why can't it simply be that if you break the law, you are prosecuted?

I'm not a burglar, but I don't have to prove it with tons of documentation setting out my respect for other people's property!

Can nobody see what a nonsense this is?.

Because prevention is better than cure? (especially when the cure means that personal data is still out there - a fine won't make the data suddenly disappear from the wrong places).

And with most home insurances, if you don't have window locks and appropriate door locks (and can prove it), you won't be covered.

[Carth]

Are we looking for the phrase 'due diligence' here?
Proof that, even if it all goes wrong, you were aware of it and taking steps to prevent it

[OLD BOY]

Originally Posted by Hugh

Because prevention is better than cure? (especially when the cure means that personal data is still out there - a fine won't make the data suddenly disappear from the wrong places).

And with most home insurances, if you don't have window locks and appropriate door locks (and can prove it), you won't be covered.

You could say that about everything. The law works well enough in other areas without tying everyone in knots.

[1andrew1]

Originally Posted by OLD BOY

You could say that about everything. The law works well enough in other areas without tying everyone in knots.

Why is having a privacy policy tying anyone up in knots? It's just being fair to customers? If you've got pages of procedures written Old Boy then you're gold-plating things.

[OLD BOY]

Originally Posted by 1andrew1

Why is having a privacy policy tying anyone up in knots? It's just being fair to customers? If you've got pages of procedures written Old Boy then you're gold-plating things.

Why not start with 'Because it's not necessary to enforce the law'.

Unfortunately, bureaucratic minds love complication and making life difficult.

And that's not good for business, which works best with straight forward processes and light regulation. You can get absolutely the same result on data protection without requiring organisations to produce all this paperwork.

However, I don't think you will ever understand the concept, Andrew, judging by the responses you have given on this subject.

[1andrew1]

Originally Posted by OLD BOY

Why not start with 'Because it's not necessary to enforce the law'.

Unfortunately, bureaucratic minds love complication and making life difficult.

And that's not good for business, which works best with straight forward processes and light regulation. You can get absolutely the same result on data protection without requiring organisations to produce all this paperwork.

However, I don't think you will ever understand the concept, Andrew, judging by the responses you have given on this subject.

I think you'll find that you've failed in convincing anyone of your unusual views on this subject. Hugh, tweetiepooh, Carth, jonbxx have all challenged your interpretation. I'm not sure what you mean by paperwork, I suspect you have been sold a lemon by a consultant.

Hugh gave a great summary, it really isn't as hard as you make it out to be, and if anyone hands over their personal data they're entitled to know the purpose that it will be used for in plain English. This is pretty straightforward stuff, Old Boy.

It sounds as if you have a 20th century view on the value of personal data and only see the costs and not the benefits in keeping it secure and demonstrating this value to potential clients. That's an uncommercial and outdated approach to 21st century business challenges.

[OLD BOY]

Originally Posted by 1andrew1

I think you'll find that you've failed in convincing anyone of your unusual views on this subject. Hugh, tweetiepooh, Carth, jonbxx have all challenged your interpretation. I'm not sure what you mean by paperwork, I suspect you have been sold a lemon by a consultant.

Hugh gave a great summary, it really isn't as hard as you make it out to be, and if anyone hands over their personal data they're entitled to know the purpose that it will be used for in plain English. This is pretty straightforward stuff, Old Boy.

It sounds as if you have a 20th century view on the value of personal data and only see the costs and not the benefits in keeping it secure and demonstrating this value to potential clients. That's an uncommercial and outdated approach to 21st century business challenges.

Once again, you are failing to grasp the point I am making. Of course personal data should be protected. Where have I said it shouldn't be? What I said was that the obligations of organisations should be set out in law, and not repeated in documentation issued by every organisation. That is efficient and effective and seems to work perfectly well in other areas of law.

By the way, a privacy notice is paperwork, Andrew, as is the millions of letters or emails sent to all service users to say what good, responsible people we are in getting your consent, despite the fact that you already knew why we were collecting your name and address in the first place.

Not every organisation is another Facebook or Cambridge Analytica. Talk about sledgehammers and nuts!