[JumpCrisscross]

> technically, the state is always judge, jury and executioner

Pardon me, I meant to say "prosecutor, judge, jury and executioner." In jury trials, the jury is the jury. Not the government. And in American civil cases, the prosecutor is a private citizen's attorneys. Not the state.

GDPR's structure is highly state-reliant. It's analogous to securities regulation in the United States. Any complaint triggers an investigation by the state, with the state able to bring and decide on charges and fines.

If you trust your government, this isn't a big deal. If you don't trust your government, it is horrific.

[xxpor]

> And in American civil cases, the prosecutor is a private citizen's attorneys. Not the state.

That's not entirely true, for example SEC enforcement is usually a civil action.

[JumpCrisscross]

> That's not entirely true, for example SEC enforcement is usually a civil action

You are correct, I spoke too broadly.

Ironically, when discussing GDPR's regulatory structure, American securities law is my analogy. It's a high-cost structure. It deters new entrants and encourages bureaucracy. The cost is worth it, with securities, because the risks are so great.

GDPR is one way to do privacy regulation. From my American perspective, it's the wrong way because it implicitly trusts the government to act justly. But its results shouldn't detract from other fights to install reasonable privacy regulations.

[Mirioron]

And you should never trust your government.