GDPR Hysteria Part II, Nuts and Bolts, Actionable Advice
One challenge is that everyone&#x27;s reading is different.  What reading will regulators have?  And what reading will they have in 6 months vs now?<p>For example in this article it is assumed that everyone needs a data protection officer - the only question is whether you want someone full-time, or you want to share one with several other companies.  However when I read <a href="https:&#x2F;&#x2F;gdpr-info.eu&#x2F;art-37-gdpr&#x2F;" rel="nofollow">https:&#x2F;&#x2F;gdpr-info.eu&#x2F;art-37-gdpr&#x2F;</a> it seems that most companies don&#x27;t fall under 1.a or 1.c.<p>The question mark is 1.b, <i>the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and&#x2F;or their purposes, require regular and systematic monitoring of data subjects on a large scale</i>.  If you&#x27;re just recording transactions, clearly you are not monitoring them.  If you&#x27;re running a data broker, clearly you are monitoring them.  If you&#x27;re running queries against your transactional data to decide who to send a marketing email to..is that monitoring?  &quot;Find all people who put something into a cart yesterday and then didn&#x27;t complete the transaction.&quot;  I don&#x27;t think of that query as monitoring, but I can see how someone else might.