I don’t have much of an opinion on the overall value of GDPR, but I’ve been asked multiple times now to create indexes of personal data to _comply_ with the law when said indexes were not wanted for business or technical reasons.
An example is in big data repositories where personal data may have been provided but not used for anything. Yes it’s there but nothing uses it. To enable the reporting and deletion requirements you build a system that keeps track of all that, now the data _is_ trivially correlated which seems like the opposite of the intent.
Even when I build systems that prunes the data on ingest it feels weird. To conform with a privacy law I’m building a sophisticated filter for finding personal data I don’t even want.
An example is in big data repositories where personal data may have been provided but not used for anything. Yes it’s there but nothing uses it. To enable the reporting and deletion requirements you build a system that keeps track of all that, now the data _is_ trivially correlated which seems like the opposite of the intent.
Even when I build systems that prunes the data on ingest it feels weird. To conform with a privacy law I’m building a sophisticated filter for finding personal data I don’t even want.