c1ll1an

That is heartening to hear - your strong attitude to privacy I mean @mikece. Agree with you that if you've worked in software for long enough a breach of some kind is an inevitability and that's really important for every dev to understand.

I still meet so many who are laboring under the impression that it won't happen to them - it's just not the case so we all have to have a privacy and security first mindset.

Agreed @swiley. I'm usually heartened when I remember that security wasn't dissimilar a few years ago and while it arguably still has a lot of challenges, security is part of a healthy dev mindset today. We've a way to go for privacy but I believe by building the right tools to make it easier for devs, this will happen.

Really good point fitblipper - I see this all the time.

Organizations have poor/no data retention policies so they accumulate information they no longer need for many years and on the other side they continue to build new data processing capabilities that might leverage that old data which lacks any context as to what it was gathered for or how it can (or cannot) be used.

On the point of what degree of identification can be learned (i.e. how personal is the information), I'm constantly reminding by folks in the ML field that you can discern a huge amount about an individual quite precisely from what might initially look like anonymized data - that's one of the exploits that most concern privacy specialists when they talk about differential privacy and pseudonymization - arguably we're not where we need to be yet but thankfully there are a number of teams working on solutions to this.

By this I mean the data analysis part; the retention and policy issue, that's still one most companies need to do better on.

That's an interesting one - I'm not sure I follow TeeMassive, do you mean to say that privacy is unimportant culturally?

If that's the case, we probably differ on POV a little so I'd love to know more about why you think this?

In my experience average people who don't work in tech (non devs) do not understand privacy or data use in a system - so it's hard for them to comprehend the potential impact. They're trusting people that work in tech (devs and others) to do the right thing and this is where the problem might be; we're being trusted to ensure we don't abuse or accidentally misuse a position of tremendous knowledge and power.

My parents certainly understand where/how their data is stored or used when they use their phone - aren't we then responsible for keeping those people who don't know safe?

Right b3morales - they can and should be proportionate to both size of company, revenue and the type of regulatory infraction - all of these must be evaluated but it doesn't mean we shouldn't enforce.

To take the restaurant example, a mom/pops restaurant may have less resource to bear for cleanliness and safety but if it consistently, knowingly persists in doing something that makes it's patrons ill - it is any less at fault than a chain of restaurants that does the same? The fine may be proportional to that organization - that's the goal with the GDPR's revenue % based fine format but it could/should go further for large companies that consistently fail.

Definitely true that enforcement has to be proportional to both the infraction and the size of the organization.

However, I would argue that there are plenty of very small companies that also take advantage of that. i.e. very high growth, early stage companies with loads of vc backing that don't prioritize this because they're small and there's only two founders.

All I mean to say here is, again I'm not a regulator, however we do need a way to enforce against bad behavior.

In the 1950's no one wanted seatbelts, not car owners/public or auto manufacturers. Today no one would get in a car without seatbelts without thinking it was weird/crazy. Sometimes we have to enforce rules to drive change, otherwise bad behavior (particularly at large companies) goes unchecked.

We're both agreed on this point @pjmlp - regulations must have teeth and that often takes time. I can't speak to it, as it's not my area of expertise but we also have allowed a type of golem to form, in that big tech is now "too big to fail" and many governments struggle with balancing their ability to enforce against the level of employment that tech provides their country (look at Ireland for a prime example of how tough this balance is)

TLDR; I agree with you, but I'm not a politician and can't effect change there, so I'll keep chasing a realistic solution that makes it easier for devs to do of their own accord as we (dev community) are pretty good at solving things when we turn our mind to it.

Commendable work @Stubish on writing that script. You've nailed the exact problem that I'm referring to here.

Strong privacy is a kind of anachronistic issue in that the regulations came long after many systems were designed/built but also most of the common methods used to continue to design systems. So consistent data deletion across distributed system should be easy, but of course in truth as you know, it's a nightmare and often a brittle solution that needs to be updated as your software continues to change.

This specific example you've taken is a really good one of how painful privacy can be and how avoidable this issue should be for all devs, both software and data teams.

@atoav - this is awesome to hear! I'd love to know more about where you work and how you guys have done such a good job of helping devs understand and drive privacy. It doesn't really matter if the software's end-user is internal teams or customers, they're all people and privacy matters across the board.