zlacker

>>grabeh+(OP)
This doesn't consider some factors that dictate how strong any company will experience their firehose of GDPR requests to be:

- how incentivised people are to make GDPR subject access requests of the company (how angry, confused, hostile curious they are)

- how easy it is for them to make requests (entirely manual vs. online service)

- wildcard factors (internet flash mobs bent on vengeance against a corporate)

There are also possible business models that might incentivize technology players to deliberately ramp up GDPR requests.

For example, unsuccessful candidates applying for a job at a company could forward their rejection email to a bot. The bot parses the details and fires a GDPR access request in to the HR department. The candidate gets back a formatted dump by email of all sorts of recruitment data, including interview notes, etc. There are obvious ways to monetise a service like this, hence incentive for someone to do it. Recruitment at a large company means engaging with thousands of people and then rejecting them. It is natural for people to have bruised feelings, and also to be curious about why they were not hired. A GDPR button lets them indulge their curiousity and start digging in to interview notes etc.

Naturally GDPR requests like this won't flood a company on the first day of GDPR. But the internet is a turbulent place.

>>abraae+K2
This sounds like the arguments that organisations make against freedom of information laws. There is that risk, but what is the alternative? There doesn't seem to be a middle ground to me - either people can make subject access requests or they can't.

>>frereu+Y2
FOI laws apply to governments, not corporations.

And yes, civil servants did use those arguments to try and stop FOI. They lost because ultimately they pay themselves out of tax revenues, and when you force people to buy something the bar for denying them information about how that money is used is a lot higher.

This doesn't apply in the case of companies and especially not job candidates.

>>repolf+f3
Fair point about it being public bodies. But my point stands in terms of abuse of the system - the deluge didn't happen.

>>frereu+B3
I have actually seen government agencies complain about being deluged by FOI requests, the cost of dealing with them etc. They mostly get ignored because on inspection the "deluge" of FOI requests tends to be from journalists digging for stories, and that's sort of what we want them to do. Also because the high cost of FOI responses tends to reflect messy and disorganised internal information systems rather than anything fundamental.

That said, I don't think it's really comparable to the GDPR. For one FOI compliance is a joke, organisations get out of it all the time on the thinnest of pretexts. There's no real incentive for a government to police itself in this regard. But GDPR enforcement is incentivised by large sums of money, for an organisation that is technically bankrupt.

>>repolf+C4
> But GDPR enforcement is incentivised by large sums of money, for an organisation that is technically bankrupt.

What do you mean here? It seems to be about suggesting that GDPR is about getting the fine money? Elsewhere the law is quoted where it states the fine should be appropriate to be effective. So even if you don't trust this there's legal ground to back it up. Secondly, why is the EU technically bankrupt? Or is this a theoretical organization?

Appreciate some clarification because currently the sentence I quoted is too open to interpretation.