X-mess

Count Dracula gulped down one last mouthful and laid the body carefully on the bench. Several drops of blood rolled down his fangs and left an untidy smear on his cape. Dracula winced. He had one more item on his to-do list this year — a visit to an official institution. So he would rather not have any stains to compromise him. At least the fabric was black.

Dracula took off his cape and flung it over his arm. He pulled a scroll from his sleeve and broke into a brisk walk towards a building with a sign that read “EU Commission for Imaginary Creatures.”

A man behind a desk tore his gaze from the papers and looked up at Dracula.

“GDPR, you say?” He struck a mocking tone: “‘Santa Claus collects the personal data of innocent children for unknown purposes, stores such data, puts kids through behavior profiling, and worse … ‘ You think you’re being original?” he added in his normal voice.

“But … the data … ” the count mumbled.

“Come on, we’ve been getting this crap about GDPR and Santa since the day they announced it. Everyone and his mother has already whined about it.” The EU Commissioner pulled open a desk drawer containing a sizable pile of papers and flicked Dracula’s complaint on top of it.

He consulted his laptop briefly, pulled it shut, and picked it up.

“He collects data. Let me show you something. Purely out of respect for your ancient lineage.”

The two of them walked to a storage room. The EU Commissioner threw the door open and gestured to the count to enter.

The room housed racks of shelves full of colored folders. Many of them looked old, and they were labeled in various languages. The Commissioner approached the first long rack, receding somewhere into infinity, and gave it a light slap with his hand:

“Unlawful entry. Violation of residence immunity. Mostly through the chimney. Even in homes with no chimney. Some of these files come from places whose very existence is kept secret for reasons of national security.”

He took a few more steps and pointed at another rack, a smaller one, and ticked off on his fingers: “Violation of airspace. Flights without transponders. Unauthorized flights.”

The Commissioner jabbed with his finger at a shelf of bright green folders:

“These ones are complaints by the bleeding hearts. Abuse of animals. He coerces deer into flying, you know. And they demand medical care for Rudolph; that red nose doesn’t look healthy.”

Dracula felt a bit less sure of himself. He kept glancing at the endless shelves of files. The Commissioner was clearly having a good time. He stopped at one of the racks, pulled out a folder, opened it, and read aloud: “‘Be it known that Claus is the German form of the name Nicholas. How is it permissible today, in 1944, to have a German dropping into the homes of British army officers … ?'”

He replaced the folder and took another one from a nearby shelf: “Oh, here’s my favorite one! From the Cold War era! ‘Have you ever wondered why Santa Claus always wears RED?! The agents of communism, flying over our heads, are undermining our principles. Meanwhile, Moscow’s largest toy store is located on Dzerzhinsky Square, formerly Lubyanka, next-door to KGB headquarters! Where does he get those gifts, anyway?'”

“But that’s all history,” attempted Dracula. “That’s not the point at all. In the age of digital revolution …”

“Digital age? You want to talk about the digital age? You got it!” The Commissioner wrenched open his laptop, set it on one of the shelves, and opened a document. “Here, read!”

Dracula peered at the text: I work for a super-secret organization I am not authorized to disclose. I often work at home with super-secret information, the nature of which is classified. My computer stays on overnight, even on Christmas. Therefore, I am certain that Santa Claus had the opportunity to access the source code, the purpose of which I cannot reveal. Moreover, he might have handed this code over to people who pose a threat to our national security.

“Well, that sounds stupid,” ventured Dracula.

“Stupid? That’s not the worst one. This one here is truly idiotic, though!” The Commissioner opened another file, a scanned copy of a handwritten page with a clumsy signature:

Be it known to you that Santa Claus has a Russian Federation citizen’s ID under the name Ded Moroz. Thus, using corporate parties for cover, penetrates the offices of IT security companies. Moreover, we are certain that he can get unauthorized access to the data of these companies’ clients and pass such data on to third parties.

Anonymous ex-workshop elves

“So you are hardly unique, my dear Count,” smiled the Commissioner, closing his laptop. “The reasons vary, but deep down, the complaints are all the same — you’re looking to spoil the holiday. But even if I wanted to — which I certainly don’t — I still wouldn’t be able to nail Santa to the wall. He has a huge network of impersonators operating around the world. And as soon as somebody brings forward a specific charge, it turns out that the act was perpetrated by a totally different person dressed as Santa Claus. GDPR? Nice try. Do you have any idea what modern kids write to Santa? Here, read.” The Commissioner handed Dracula a paper covered with a child’s handwriting.

Dear Santa, On behalf of myself, as well as in the name and on behalf of my four-year-old brother Marcus, I authorize you to collect, process, and store our personal data for the purpose of selection and delivery of Christmas gifts. Notarized copies of this permission signed by our parents, acting as our legal representatives, are enclosed. Please bring a hoverboard for me and a fishing rod or Legos for my brother.

Amanda, age 7

Dracula’s face darkened.

“Where did you get this letter? Are you interfering with private correspondence? Is this legal?” he snapped.

“You think you’re so smart?!” The Commissioner’s face turned red. “Privacy of correspondence! GDPR! You don’t have a clue how GDPR works, do you? You drink blood, right? But did you know that blood contains DNA? And DNA is genetic PII listed under Special Categories of Personal Data. And not only do you collect it, thereby acting as a data controller, you also store and maybe even process it!”

“I don’t process it! I don’t even profile it by taste!” the count cried out in terror, instinctively thrusting out his arm, still draped with the cape, in defense.

“And what is this?!” roared the EU Commissioner, pointing in the direction of the streaks of blood. “A data leak?! Have you even notified the supervisory authority and the data subject?” Just then, his forgotten laptop chimed a new e-mail notification, subject: Forensics report. But what attracted the count’s attention was the first sentence: Dear Commissioner Van Helsing.

“You!” scornfully hissed Dracula. “I should have known! Your wooden stakes and garlic didn’t work on me last time, and they won’t work today!”

“Oh, this time I have something far more deadly. Let’s see how you handle GDPR data-breach penalties. That’s €10 million or 2% of your global annual turnover from the previous financial year, whichever is greater, to start with … ” Van Helsing replied.