GDPR and the Cult of HR

The General Data Protection Regulation.

Or, as it’s known in Human Resources departments across Britain, our Magna Carta. A sacred scroll, ensuring that no one may ever again receive a birthday email from Accounts. GDPR was supposed to protect our privacy. What it’s actually done is unleash an army. An army of smiling compliance clerics, armed with clipboards, clip-on microphones, and a kind of deathless zeal. These are the people who say 'touch base offline. People who use the word stakeholder to describe their own children. People who 'circle back.

Do you know what GDPR really stands for? Grand Delusion of Paperwork and Repression. Because if you’ve ever tried to unsubscribe from anything since 2018, you’ll know the truth. You click unsubscribe, and a little form pops up, asking why you’re leaving.

Too many emails?

Yes.

Content not relevant?

Yes.

Prefer to die alone in a forest than receive

another survey about brand alignment? Yes.

And then you get another email. Confirming your unsubscription. From the email list.

About unsubscribing.

That’s not consent.

That’s harassment in a spreadsheet.

Now. HR.

Human Resources.

Two words that, when combined, mean we’ve stopped pretending to care.

You’re not a person, Dave. You’re a resource.

Like coal.

Or lard.

Or printer toner.

And the HR people, they’re not human either. They’re Data Shepherds. Pastors of the spreadsheet. Their natural habitat is the breakout area. You’ve seen them. Hovering around beanbags like drones at a wellness retreat. They use language like 'leveraging synergies to enable cross-functional ideation.' Or 'embedding

authenticity into our brand narrative.'

You say, do you mean telling the truth? They say, no, we mean embedding authenticity into our

brand narrative. They speak in this strange, corporate Esperanto. Half Latin, half nonsense. They don’t communicate. They emit values. They tell you, don’t worry, GDPR is here to protect you. You say, really? Because I just got a 37-page PDF asking me to consent to being in the staff photo. You tick no. They take the photo anyway. But you’re blurred out like a sex criminal in a Channel 5 documentary.

I got told off recently. I was filming a workshop. For my own notes. Not to share, not to broadcast, just to remember what had been said. Apparently that’s not allowed now. GDPR. They said, you can’t film without the informed consent of all participants. And I said, well, I’m a

participant. And they said, yes, but you can’t consent to yourself.

You can’t consent to yourself.

That’s not law.

That’s theology.

That’s the Book of Data Protection.

Chapter One, Thou Shalt Not Remember.

Because apparently, now, your own memory is a potential breach. Your brain, a non-compliant recording device.

And it’s true. In the modern world, everything you see, everything you hear, everything you are, belongs to someone else’s privacy policy.

So I said, okay, I won’t film. And they said, you also can’t take notes if they include identifiable information.

Identifiable information.

Like what?

Like their name.

So I’m sitting there, trying to learn, but everyone’s anonymised. They’re just initials now. M and L

and P. I’m not in a workshop. I’m in witness protection.

And you start to realise, GDPR isn’t about privacy anymore. It’s about control. It’s about making sure no one ever remembers anything without permission. It’s the bureaucratic domestication of

memory.

You used to be able to tell a story. Now you have to send a Consent to Narrative form. You used to

be able to recall an event. Now you need to run it past Legal.

Soon they’ll say, sorry, you can’t think that. You didn’t opt in to the thought-sharing agreement.

And HR will nod. They’ll say, yes, we’ve updated the Mindset Policy. You’ll have to tick a box in your dreams.

And here’s the thing. They don’t go after the big ones. They never go after Palantir, or Google, or Meta. They don’t go after the people vacuuming up the world’s data through every pixel and pulse.

No. They go after small fry like me. Someone trying to film a workshop on their phone to remember what a man in a fleece said about grant applications. They’ll stop me recording my own thoughts, but not the thousands of security cameras I walk past

on the way there. They’ll say, you can’t film yourself, then wave you through a corridor of surveillance, watched by cameras that never asked for consent. It’s not about privacy. It’s about hierarchy. The big boys get the servers. You get a warning email.

I was recently at an HR Conference. Don’t ask why. I thought it was a cry for help. They had a keynote speaker called The Empathy Ninja. A woman in a kimono talking about mindful data flow. She said, GDPR isn’t just compliance, it’s compassion.

Compassion.

Compassion is not sending me an email that begins Dear Valued Individual.

Compassion is not a checkbox.

And they love their acronyms. HR, GDPR, KPI, ROI, DEI. It’s like the alphabet’s been taken hostage. But beneath it all there’s this strange, creeping moral tone. Like we’ve turned privacy into a virtue signal.

They say, we take your data seriously. Like you’ve handed them your newborn. No, you’ve just typed your postcode into a pizza website.

You know who doesn’t care about GDPR? The people it’s supposedly protecting.

My dad. He would have given his National Insurance number to anyone who asked, just to have someone to talk to. He’s out there telling the window cleaner his date of birth. Because he was lonely, not because he’s been phished.

Meanwhile the HR people are encrypting everything. Encrypting their feelings. Encrypting their colleagues’ birthdays.

They say, sorry, we can’t tell you who in the office has died. GDPR.

So you’re left sending condolences to everyone. Just in case.

That’s the thing about HR and GDPR. It’s the same ideology. The belief that control equals care.

That by writing down every possible human emotion in a policy document, you’ve somehow

understood it.

GDPR didn’t make us safer. It just made us complicit. We tick boxes now instead of having morals.

We sign disclaimers instead of trusting each other.

And HR took that spirit and turned it into a PowerPoint deck.

Respect. Integrity. Inclusion.

All bullet-pointed. All trademarked. All meaningless.

In the future, when the last human conversation has been replaced by a chatbot asking for consent,

HR will still be there. Standing in the ruins of civilisation. Emailing the cockroaches a Privacy Policy.

And they’ll sign it. Because they have to.

And somewhere, in a shared Google Drive, a compliance officer will whisper, “Job done.”

And I’ll still be there, trying to film the end of the world for my own records. And they’ll tell me off for

that too.

From now on, I’ll use my own brand of GDPR.

No more open workshops.

From now on, people can apply to work with me.

I’ll audition them.

I’ll grill them.

And I’ll reject them, for reasons I won’t disclose,

for their own protection.

GDPR. Protecting you. From yourself.