GDPR After One Year
This overlooks one of the biggest under-reported problems GDPR has created: a large percentage of all <i>industrial</i> sensor data is &quot;personal data&quot; under GDPR. These are systems and companies that nobody associates with collecting or using personal data, because their business isn&#x27;t about people, but the regulations have defined the scope broadly enough that there is universal agreement among their legal experts that are liable for not treating this data as &quot;personal&quot; under GDPR.<p>This raises some difficult challenges that the average Internet business doesn&#x27;t have to deal with:<p>- Compliance with GDPR requirements for personal data in many industrial settings is operationally impossible. These aren&#x27;t Internet ad tech databases.<p>- Some industrial systems aren&#x27;t the kinds of things you can trivially upgrade to make them compliant in any case. We are talking embedded systems with operational lifespans measured in decades. In many cases there are <i>other</i> strict regulatory compliance requirements around the design and modification of these systems.<p>- The workloads and data models for some high-scale sensor data models make it technically impossible, given the current state of computer science and hardware, to comply with some obligations under GDPR when handling &quot;personal&quot; data. And for a much larger set of systems, it would be economically implausible even though theoretically possible.<p>- Sensor data infrastructure software often lacks the basic functionality required to support compliance, as the functionality that the regulators assumed exists for other purposes has no purpose in this context and therefore has never been implemented. There is a disconnect between what is required of the software users and what the upstream vendors can or are willing to provide. These aren&#x27;t software companies.<p>- For some specific industry sectors, compliance costs disproportionately fall on EU-based companies by virtue of the fact that their primary operations are in a European country, even though they sell into a global market. That&#x27;s an economic own goal.<p>This has become a Sword of Damocles over some industrial companies because their legal teams have studied their exposure to GDPR, identified substantial compliance obligations, and <i>realized that compliance is effectively impossible</i>. It is pretty clear to me that the regulators were so focused on Internet advertising companies and similar that they were completely oblivious to the unintended consequences for unrelated industrial sectors.<p>I&#x27;ve been studying this problem for a few industrial sectors for a couple years now. You have companies scrambling to find technology that often doesn&#x27;t exist and in some cases requires hardcore computer science R&amp;D before it could exist. And this is a business opportunity for someone to add a tax to what these companies produce. But the worst part is that this extremely expensive compliance exercise does almost nothing for personal privacy because most of this data was being collected for boring industrial applications.