momentsmusicaux: (Default)

[personal profile] momentsmusicaux 2018-05-18 12:47 pm (UTC)(link)
I've worked on tons of sites for charities and small organizations that are just collecting data from users or visitors because they're convinced it'll be useful to them and because, so far, they've simply been able to. (Seriously, some clients are like kids in a sweet shop.)

That doesn't mean it's their business model.

And every site has technical debt. Sites for non-profits often have years of it. For instance, I have for the last year been working on a complete rebuild of a not-for-profit's site that was built about 7-8 years ago. If they hadn't come along and stumped up for the rebuild, they would have a massive heap of tech debt.
skington: (chicken)

[personal profile] skington 2018-05-18 12:56 pm (UTC)(link)
With respect, if people have been hoovering up data just because they could, that is precisely the sort of behaviour the GDPR is designed to thwart. It's unfortunate that things we like, like small charities, are guilty of it as well as large corporations, but on the other hand the EU is likely to be lenient towards them as long as they show willing.

As for technical debt, it's like any debt: some is fine, if it means you get what you need faster, and you can then pay it back at your leisure. It's if it becomes unmanageable that you have a problem. If the GDPR means lots of companies need to look at their legacy systems and put in some work to make them manageable again, again that's a good thing, like the Millennium Bug was.
momentsmusicaux: (Default)

[personal profile] momentsmusicaux 2018-05-18 01:01 pm (UTC)(link)
Oh absolutely. I've been telling clients for years that they have no damn need to hoover all this data up, and they don't bloody listen to me!

The point I am taking issue with is just that it's no big deal to comply with this. It's not necessarily.

> As for technical debt, it's like any debt: some is fine, if it means you get what you need faster, and you can then pay it back at your leisure. It's if it becomes unmanageable that you have a problem.

Yeah, well most websites are built on bit of glue and string and fly on sheer blind hope and luck. I should know, I build them. GDPR doesn't expose this. This gets exposed any time there is any kind of major security issue, and we see that most sites just aren't keeping up to date (e.g. Panama papers, where the site that leaked them hadn't applied a security patch that had been released something like a year previously). But then that's not just websites -- all aspects of software are glue and string and luck. Look at all the things that were in trouble with the SSH bug that came to light about a year ago.