There is a huge redundancy in handling personal information. Every service provider asks for an ID, proof of address, bank details etc. For many people all those details are already stored in their email accounts or smartphone-related storage. What happens is the data is unnecessarily replicated to badly managed business storages of all kind. This also keeps alive lots of redundant IT support businesses.

Large cloud providers together with governments should form a consortium to unify such PII storage types, so the PII can be kept in one or few user-chosen *special provider* storages. Typically those would be Google, Apple, Amazon, Microsoft, but could be other providers certified for well managed security and to stimulate competition. Existing solutions such as Google Drive, S3 etc can be the basis for the service.

Non-provider businesses will not store PII, only basic identifiers, like business-related account number, email and phone number. Each business has to register to access PII super-storage with access logged and users notified on each access. Businesses will pay reasonable fees for each access, which will be a monetary motivator to limit excessive usage, but also will pay for service maintenance. Any business can upload necessary additional data to the storage, but cannot access it later without user authorization. Users will be able to authorize over the smartphone. Documents can have hashes and time stamp to avoid content manipulation.

Identify theft can be eliminated by immediate comparison of personal IDs across consortium providers. For example, instantly alerting if someone uses your passport photo to open an account in your name. Well, intelligence services might dislike the idea for impossibility to issue fake IDs.

That's a very brave proposal, AC. First it concentrates everyone's PII into the Big Tech oligopoly and gives them all the data they need for their advertising business that nobody else has. Second none of the corporations you propose are based in the EU and so they are beholden only by Safe Harbour, Privacy Shield, Privacy Figleaf or whatever it's called this year.

If someone wanted to try and render GDPR worthless and make everyone in the EU more dependent on US cloud, that would probably be the way they would go about it, so this proposal should be stored in the round filing cabinet.

The data has already got concentrated by Big Tech. In the proposed system they will be obliged to access the data on same basis as everyone else, log, request permission, alert the user. The proposed services can be separate from Big Tech main business by law, with data localized per country. As for dependence on US cloud - when will EU cloud get sufficiently competitive, like Airbus? Besides any EU cloud provider can join the consortium. The consortium itself is about common standards, not to reinvent the wheel.

user-chosen *special provider* storages. Typically those would be Google, Apple, Amazon, Microsoft

I wouldn't trust any of them to be the digital me that this implies, no more than would I trust anyone else who offered themselves to play the same role.

" Past research suggests that the privacy afforded consumers under GDPR is mostly beneficial, but can be detrimental when a monopoly is involved. "

Judging by the abstract, the paper ('Privacy Rights and Data Security: GDPR and Personal Data Markets') considers privacy breaches as equating to data leaks. This is the most common (and excessively narrow) interpretation of privacy to be applied to the Regulation. But the Regulation clearly expresses that privacy means data subject control over the processing of their data, so its definition is much wider -- including, for example, the right to object to specific processing on the basis of ethical grounds. So in principle if I object ethically to some social media platform I have a right under the Regulation to complain against any business that passes my personal data to it without giving me a prior opt-out, or to object to a business profiling my activities without my consent. Unfortunately, businesses have in general ignored this, and regulators have tended to refuse to act when alerted to such breaches of broader data subject rights . Consequently the Regulation has effectively been neutered as a real protection almost from day one because nobody has taken seriously the fact that the GDPR is human rights law relating to data, not data law.

Good point.

In my experience implementing GDPR does have a cost for any company which wasn't taking privacy very seriously but once it's there it costs virtually nothing. Of course any company starting in recent years should have been designed with GDPR in mind from day one which means it should effectively be free. In fact if GDPR means storing less and then less processing on the data you haven't got then it might actually be cheaper in the long run...

Seatbelts and airbags also cost money but I wouldn't want to be without them now that I've got them.

"Europe's General Data Protection Regulation (GDPR) has led European firms to store and process less data".

This is a good thing, companies should not be endlessly hoarding personal data. Same with the "pay or OK" dilemma. It's not a dilemma, the GDPR is working as intended to protect data subjects.

If a business cannot exist without the unlawful and unethical exploitation of data subjects then in the public interest is should close.

Shareholders should not be the number one consideration in evey matter regarding business. If they lose out for investing in an unlawful unethical business then they should lose their money.

The cost savings appear to assume that there was no benefit to holding the information. Doesn't sound likely.

The missing cost is having to monitor all of this to ensure compliance.

Don't forget the cost of not complying. The more data is held the more there is to lose in the case of a leak.

We should be well past the stage where the cost to the leaker is a year or five years or whatever of "monitoring" by some business which is itself a data hoarder. If the leaked data enables bank fraud the leaker should pay the losses. If every data subject has to spend hours or days rearranging their affairs they should be paid a fairly generous sum for their time doing that. If someone loses their house or their livelihood as a result of the leak that should also be made good. At present these costs are likely to fall on the data subject. They should fall on the leaker, together with any legal costs the data subject incurs in claiming them. In principle companies should be looking at the prospect of being wiped out by a leak. In practice they'd probably insure but the insurers would undoubtedly take a close look at the risks they were insuring and charge accordingly.

TL;DR PII should be regarded as potentially toxic waste. The more you hold the more you have to spend onf containment.

So you make "doing business" 20% more expensive in an attempt to reduce competition from the big American companies... how's that working out?

Or alternatively, this is about privacy and encouraging users to have control and receive value for their data... again, how's that working out?

This has basically shifted revenue over to an entire class of compliance officers and consultants that spend most of their time trying to reduce functionality.

1.7 million for an SMB? Just wait until they add in compliance for AI regulations.

So you're saying the data subjects should bear the cost of the businesses careless losses of hoarded data?