'Good companies' will have been preparing for this for the last two years (after all, this isn't something recent - it's been around since 2016), so I can't see why you think it will cost them a 'fortune in fines'.
As for this being 'Pathetic busy body nonsense', I would suggest that you perhaps don't fully understand what GDPR is actually about.
The reality is GDPR is about ensuring that 'personal data' is only processed with either:
- the specific consent of the person whose data it is; or
- in line with a 'legitimate interest' (which are mainly related to legal obligations and powers)
GDPR also updates data protection legislation, provides a consistent approach across the EU (and the UK when it leaves the EU) and bring it into the new digital age.
What GDPR does is firmly reset the relationship between individuals and organisations. It makes it clear that someone's personal data is theirs - organisations can no longer take the approach that you 'give' your data to them and that's it. Despite what some people might suggest, you cannot sign away your rights to your personal data under GDPR.
'Personal data' is defined as “any information relating to an identified or identifiable natural person”, whether it relates to their private, professional or public life. As a general rule, any information that could be used to identify an individual – either on its own or when combined with another piece of information* – is classified as personal data. This can include:
- a name (including a username);
- a photo;
- an email address (including a work email address);
- posts on social networking websites;
- location data (e.g. IP addresses)
as well as the more specific and easily recognisable 'personal' stuff such as biometric or genetic data, medical records, banks records, criminal records, HR records etc.
The GDPR has also closed down some of the loopholes used by unscrupulous organisations (both big and small) to try and avoid meeting their data protection obligations (e.g. offshoring).
Given the whole Facebook and Cambridge Analytica issues in recent weeks, this could not have come at a more opportune time.
* This is a very important bit of the equation, as it means that pseudonymised data is also covered. Organisations won't be able to try to get around their obligations by (for example) changing a username.
