I didn't have the chance to hear about this new copyright law yet, so have no opinion on that. But I have to deal a lot with the GDPR nonsense because of my job. Everyone is currently getting quite hysterical and doesn't want to touch anything that uses any kind of data with a 10 foot pole.
Essentially the new law makes it really clear that any data which can be used to positively identify a REAL person (not a juristical one) has to be treated with the utmost care and protected, and the need to collect such data has to be evident/make sense for its purpose. So a music player app should not be crawling through your contact list for no reason, just because it can, but a HR payroll app obviously can and needs to collect name, salary, address, date of birth from people to perform its job. Anonymized or aggregated data is fine to process and publish though.
There is an element of over-hysteria and over-reach in this new regulation, especially considering the question just how exactly companies should go about protecting that data and what reasonable measures can be expected, e.g. for smaller companies.
But I can also see the reasoning behind such a draconic regulation and the real need to protect people's data. The alternative shouldn't be the wild west approach of the US with basically zero protection for anyone. It doesn't matter how hardcore dick swinging alpha behind 7 proxies you are, you WILL lose in the war of attrition for privacy against huge corporations. No company has ever any incentive to not just grab all the rights and data for itself that it can, simply because it technically can dictate the terms of engagement.
Essentially the new law makes it really clear that any data which can be used to positively identify a REAL person (not a juristical one) has to be treated with the utmost care and protected, and the need to collect such data has to be evident/make sense for its purpose. So a music player app should not be crawling through your contact list for no reason, just because it can, but a HR payroll app obviously can and needs to collect name, salary, address, date of birth from people to perform its job. Anonymized or aggregated data is fine to process and publish though.
There is an element of over-hysteria and over-reach in this new regulation, especially considering the question just how exactly companies should go about protecting that data and what reasonable measures can be expected, e.g. for smaller companies.
But I can also see the reasoning behind such a draconic regulation and the real need to protect people's data. The alternative shouldn't be the wild west approach of the US with basically zero protection for anyone. It doesn't matter how hardcore dick swinging alpha behind 7 proxies you are, you WILL lose in the war of attrition for privacy against huge corporations. No company has ever any incentive to not just grab all the rights and data for itself that it can, simply because it technically can dictate the terms of engagement.