# The Seven Sins of Personal-Data Processing Systems under GDPR

**Authors:** Supreeth Shastri, Melissa Wasserman, Vijay Chidambaram  
**arXiv:** [1903.09305](https://arxiv.org/abs/1903.09305)  
**Date:** 2019-03-08  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/1903.09305v2/

## Key points

- Authors: Supreeth Shastri, Melissa Wasserman, and Vijay Chidambaram
- Topic: Privacy and security breaches in personal-data processing systems under GDPR
- Introduction of GDPR by the European Union in 2018 to address privacy concerns
- Approach to GDPR from a system design perspective
- Highlighted clashes between GDPR regulations and modern system design, architecture, and operation:
- Storing data indefinitely
- Reusing data without discretion
- Fostering walled gardens and black markets for data exchange
- Engaging in risk-agnostic data processing practices
- Concealing data breaches from stakeholders
- Making decisions lacking transparency or explanation
- Treating security as a secondary priority
- Struggle between GDPR requirements and contemporary system evolution
- Need for comprehensive solutions for GDPR compliance rather than mere patching of issues

## Summary

In their paper titled "The Seven Sins of Personal-Data Processing Systems under GDPR," authors Supreeth Shastri, Melissa Wasserman, and Vijay Chidambaram delve into the pressing issue of privacy and security breaches that have plagued our society in recent years. The European Union introduced the General Data Protection Regulation (GDPR) in 2018 to address this growing concern. The authors approach GDPR from a system design perspective and highlight how its regulations clash with the design, architecture, and operation of modern systems. These include storing data indefinitely, reusing data without discretion, fostering walled gardens and black markets for data exchange, engaging in risk-agnostic data processing practices, concealing data breaches from stakeholders, making decisions that lack transparency or explanation, and treating security as a secondary priority. The findings of the study underscore a fundamental struggle between the stringent requirements set forth by GDPR and the evolutionary trajectory of contemporary systems. The authors argue that achieving compliance with GDPR demands comprehensive solutions built from the ground up; anything less would be akin to merely patching a leaky faucet on a sinking ship. This nuanced exploration sheds light on the intricate challenges faced by organizations striving to align their operations with GDPR standards while navigating the complexities of modern technological landscapes.