That's a good thing. It means the regulator can't issue instant fines for non-compliance except in the very worst most obvious cases. Because of this planet sized gap they need to ask everyone else to come into compliance before issuing the fine.
> It means the regulator can't issue instant fines for non-compliance
The regulator interprets the gap. "Planet-sized gap" means the regulator can choose to be lenient or capricious based on their own preferences. That kind of uncertainty is anathema for modern businesses. (It's also beneficial to those who pay to build relationships with said regulators.)
> The regulator interprets the gap. "Planet-sized gap" means the regulator can choose to be lenient or capricious based on their own preferences. That kind of uncertainty is anathema for modern businesses. (It's also beneficial to those who pay to build relationships with said regulators.)
This is classic anti-regulation BS. I would like to see a regulation which did not have this issue brought up against it. Heck, isn't this the core of the anti-regulation camp? Clearly though, regulations have not destroyed the world...
Technically, it will be the courts who (ultimately) interpret the gap, and it's worked so far for other standards like 'beyond reasonable doubt'. Courts have a tendency to be less capricious than a regulator.
I'd even go so far as to argue that "reason" is one of those things where specific examples can illustrate, but no more. Especially with regards to technology -- what is reasonable today, can be unreasonable tomorrow (eg: SHA1).
In the meantime, I'm positive that as of right now, 99% of the interpretation is performed by the data processors, and in most cases to their own benefit.
What is a reasonable mean? Imaginr you can take 100 blobs of data, and for each blob it's really hard to get a fix on a particular person, but combined through a magic probabilistic heuristic yields predictions that are "good enough" to extract value from. Does the mere existence of this "join" trick make your individual blobs personal data? Or only once your company actually implements the join?
Dynamic IPs were considered as possibly being personal info, since a law existed which could allow an entity to connect dynamic IPs they have connected to other information (from an ISP), if they believe that connections from the dynamic IP are undertaking cyberattacks against them. Proto-GDPR actually considered collecting dynamic IPs in this case reasonable, and it was a specific German law that was more restrictive. The main question thus became: should proto-GDPR be used, or the existing more restrictive German law? Going off topic though. Point is that "reasonable" is used not as a mathematically precise definition, but in a human language sense of "reasonable". If you don't get what reasonable means, then I am sorry to say that in the case of law, you will generally have to suffer what most people consider to be reasonable in spirit.
In other words, you have a problem with all laws in general, since they are not nearly precise enough for you.
Be reasonable! Just as even interpreted software must eventually appeal to hardware actions to give them meaning, laws must eventually appeal to human-judged concepts, including reasonabless.
A definition like the one above actually strikes a good balance. It leaves it up to courts faced with real situations to evolve rules about what constitutes "reasonable"; while giving those courts a definite thing to judge the reasonableness of.
