9 ms·

GDPR: Why We Stopped Selling Stuff to Europe

53 points by chx 9y ago

locust101 9y ago
Basically companies like facebook and google have abused the data collection and public trust so bad that EU had to come up with these absurd fines just so those behemoths would pay attention. Also is there a reason why it is a maximum of x and 2% of revenue? Shouldn't 2% of revenue big enough for a company to be scared?
- erk__ 9y ago
  You also want smaller companies to comply, where 2% is maybe too little for them to care, as it would cost more to comply with GDPR.
  - valuearb 9y ago
    2% of revenue is a huge fine for any profitable business.
    - BrentOzar 9y ago
      > 2% of revenue is a huge fine for any profitable business. Not necessarily. In a business like ours (online training) where any additional new customers basically flow through to the bottom line, if I got 20% of my revenue from the EU, and I had to pay a 2% fine now and then, it wouldn't be terrible. I can see how some slimy businesses would say, "I'm not even going to bother complying - I'll just keep taking revenue off the table and paying the small fees."
      - valuearb 9y ago
        Sure, if your profit margins were 50% on EU revenues, it wouldn’t be a big deal to pay 2% of the max fine. Or if your startup doesn’t have revenues, you could get off scot free. But most profitable businesses are going to have profit margins in the 10-20% range, and that fine is considerable. And if the EU applies it to the last 5 years revenues, they could wipe out a years profit. For example, Apple probably has close to $100B in annual EU revenue, $2B is a huge incentive to invest in doing this right. But if your EU business is $1M, $20,000 is probably a fraction of your cost of implementation. The law would have been far better if it specifically limited fine levels by size of company. IE < 1M in sales, 1M to 10M, 10M-100M, 100M-1B, 1B+.
        nolite 9y ago
        It’s on worldwide revenues, not EU revenues
        valuearb 9y ago
        Ouch, that's amazingly short-sighted.
  - UncleEntity 9y ago
    > up to €10 million or 2% of your company’s annual revenue, whichever is higher They might care about a €10 million fine if they only have, say, €2 million in annual revenue. I remember when I first heard about this thinking "why even bother doing business in the EU?" --edit-- Which is exactly what you were saying in retrospect...
- BrentOzar 9y ago
  > Also is there a reason why it is a maximum of x and 2% of revenue? Shouldn't 2% of revenue big enough for a company to be scared? Nah, if it was 2% of our revenue, I'd be much more likely to take the gamble. I'd be willing to invest a little in our staffing & infrastructure to take that risk. I want to do the right thing - but that multi-million-euro penalty means the risk/reward equation just doesn't make sense. We'd never bring in enough revenue to pay off the hit from one angry judge determined to make an example out of us.
- londons_explore 9y ago
  Google was mostly compliant with the GDPR already. When you delete your account on Google, it really does delete all data from all services and all backup records etc. They implemented it like 3 or 4 years ago. Yes, it was a lot of work for a lot of engineers. Arguably, it's much harder for smaller companies to comply.
  - peoplewindow 9y ago
    GDPR classifies any sort of cookie as PII. So you can request deletion of data that's the result of logged out queries, in theory. Also the Google tool deletes your account data. It does not delete all things that are conceivably personal data. For example if you commented on or edited a shared Google Doc and then delete your account I'm not sure the comments are deleted too. So it's not quite that simple. The law is so broad you could conceivably also demand that Gmail deletes any email you sent to it under your own name, out of other people's inboxes.
meredydd 9y ago
Data protection rules are this century's equivalent of pollution regulation. The online ecosystem has trashed the global commons with huge amounts of everyone's personal data, with no meaningful control or consent to how it is used, and now it needs to be cleaned up. There are companies that will go out of business, or have to pivot heavily, as a result of GDPR. If this doesn't happen, it's is not doing its job. More mainstream companies will grumble about this, just like they do about environmental regulations now. But, then as now, we've done the experiment. As an industry, we were left to self-regulate for 2.5 decades, and look what we did. I am not looking forward to finishing our GDPR compliance. Anvil doesn't rely on personal data for its business model, so it's not a big deal, just a bit tedious - it's a textbook frictional loss from regulation. But I am looking forward to living in a world where everyone has to comply.
- meredydd 9y ago
  PS: This is GDPR, not the EU VAT thing (also referred to by the OP). The former is painful but necessary; the latter is a straight-up unmanageable mess created by people with no understanding of the Internet. This is not a monolithic "all regulation good"/"all regulation bad" thing.
- peoplewindow 9y ago
  There is a third option beyond go bankrupt or pivot, as this story shows very clearly - cease trading with the EU or citizens of its member states entirely. Like the effect of FATCA but in reverse. That's the decision this small training firm has taken. It's a loss of 5% of revenue, they say. That's not bankruptcy or pivoting. This seems to be the unsurprising outcome of the EU's modern "obey us or we crush you" mentality. The UK is walking away. This small company is walking away. Apparently Microsoft is at least thinking about it for some products (the connect site is back now but looks semi abandoned). How many others will look at this and conclude the risks are too high to justify the costs? GDPR does not seem like a well thought out law. I have always been satisfied with my ability to delete things from the cloud. If I end up being banned from useful services because the costs of complying with the EU's very transparent attempts to bulk up their budget by repeatedly fining tech firms, I will not be happy.
sly010 9y ago
Naive question: If there are no such laws in the US, can one just simply store ALL personal data in Iceland?
- erk__ 9y ago
  How would that fix the problem you still can't save data from users from the EU.
  - tonyarkles 9y ago
    That's exactly it. GDPR doesn't particularly care where you're storing the data, nor whether you have a "European presence". If you're storing data on people from the EU, from the EU's perspective, you're required to follow GDPR. From an enforcement point of view... if you have no EU presence, it'll probably be pretty hard for them to actually collect on the fines they levy, but as a director, travelling to Europe could be problematic. It's not entirely clear here, but it looks like there's a possibility of directors being held personally liable.
    - 086421357909764 9y ago
      In fact, the EU considers all citizens of the world to fall under their legal protections. That is, you don't have to be a EU citizen to have the same legal rights.
      - sitkack 9y ago
        Technically this is true for the US as well. We just like to pretend there is a distinction.
    - valuearb 9y ago
      It’s a terrifying overreach. The law is so vague many can be considered to be in violation without even realizing it. Far too many to even prosecute. But a politically active EU bureaucrat can just pick out key offenders to squeeze for publicity, piliticsl contributions, or even bribes.
BrentOzar 9y ago
Whoa, didn't expect this to hit HN. I'm here if anybody has questions. (Author)
- magnetic 9y ago
  How can you prevent EU users from using your service (it seems that's where you are headed)? I can think of IP geofiltering if you have a web service, perhaps blacklisting some countries in the AppStores if you publish an app... but people can travel & VPN somehow. Will part of the registration be "Are you a EU citizen?" And if EU people work around your safeguards and manage to register, are you still liable?
  - BrentOzar 9y ago
    > How can you prevent EU users from using your service The first step is disallowing EU-VAT-eligible folks from purchasing. The plugin I mention in the post is really good for that - it looks at a variety of factors including the user's billing address for their credit card, for example. It's still totally possible that an EU citizen could be on Chinese soil, using an American's credit card, while using an Australian VPN. That means the next part of the registration will be a terms & conditions checkbox saying the GDPR doesn't apply to me. (We're working with our attorney on that language.) At that point, if someone still registers, AND they later ask for the right to erasure, we'll still do our best to delete their data. But if they try to go to the EU and complain, we'll be on much better legal ground to say, "Look, they lied to us from the get-go, and we can prove it." Nothing's certain - just trying to mitigate our risks as cheaply as possible.
Radim 9y ago
Automating PII detection & audits is a hard problem! Especially across sundry data storages and formats. Compliance firms typically provide a high-level paper trail, but what happens when you don't even know where the PII data is, like the OP says? What if you need to answer concrete individual Subject Access Requests? So, as a technology company, we've attempted to solve parts of it with technology. We really hope to make that pesky "PII stuff" detection and auditing easier for companies: https://pii-tools.com https://pii-tools.com (in private beta, feedback welcome)
moreira 9y ago
> You wouldn’t think that would be a big deal – but you’d be surprised. For example, students send us information about their databases all the time as part of asking questions – and they often send it unsolicited, through unencrypted email channels. That information ends up all over the place: our mail server, our desktops, phones, laptops, search indexes, etc. I’m not really worried about us maintaining the confidentiality of that data, but now we’d have to add in new audit-able tracking. That’s a good thing! Is it really that much to ask that when someone holds your data, that you can ask them to delete it and be assured that it’s gone for good? Apparently, for them, it is. And I’m sure it’ll be for a number of other businesses (and their competitors will just take their place, no big deal). But I’m looking forward to a world where unrestrained data collection and handling is no longer tolerated.
- BrentOzar 9y ago
  > Is it really that much to ask that when someone holds your data, that you can ask them to delete it and be assured that it’s gone for good? That doesn't give you the right to send someone your private data, in a channel they didn't ask for it, and demand that they secure that channel. This is the tough part about being a training company online: students send in questions with their personal data, unsolicited, via channels I simply can't secure. Your PII doesn't belong in email. > But I’m looking forward to a world where unrestrained data collection and handling is no longer tolerated. Read the post. It's not about what we collect - it's about what people send us voluntarily. That's the part that I'm most worried about. If I have no business relationship with those people, and they're just sending us personally identifiable data for no reason, I'm a lot more comfortable defending that in court. But if we have a business relationship where they're paying for our advice, and then they start sending more and more data, that's where I'm on shaky ground.
  - moreira 9y ago
    I am absolutely not criticizing your decision; you’re perfectly within your rights to refuse to deal with all the rigamarole of GDPR compliance. It’s easier and only 5% of your revenue, so why even bother. And I completely understand the issue of people sending unsolicited data. I’m sorry that my comment came across as though I was targeting you specifically. I’m just excited for a world where data is no longer a “yeah let’s just store everything with no thought”, and instead is a hot potato that you keep a trail of and want to get rid of as quickly as possible. What a difference that’ll be from the situation we have today. This article is just highlighting how just accepting random data puts businesses “on shaky ground” as you said. The GDPR will require everyone to be a lot more thoughtful about their data retention policies, and that’s just great.
shock 9y ago
It doesn't seem like it now, but this is just a storm in a teapot. All of the necessary bits to comply with the GDPR will be commoditized sooner or later. I'm betting on sooner. This also presents a business opportunity to provide those bits. I do appreciate the fact that it's a nuisance at best and significant costs at worst to be compliant to GDPR. Only in time we will be able to tell if it was worth it or not. Maybe the US model of free-for-all access to user data will work better, maybe the EU model will...I don't think anyone can say for certain now. If anyone does know with a high degree of certainty which will, it's time to place the bets.
- BrentOzar 9y ago
  > All of the necessary bits to comply with the GDPR will be commoditized sooner or later. And the court cases will go through, and everybody will have a better idea of what the "right" things to do will be clear. I totally agree - and I summed that up in my post. Problem is, that's a future - it ain't today.
- magnetic 9y ago
  > I do appreciate the fact that it's a nuisance at best and significant costs at worst to be compliant to GDPR. I don't know that it's that simple. What happens when you have conflicting requirements, for example (I'm making them up) EU requiring you to delete PII within a period of time and US/Homeland Security/IRS requiring you to keep the (meta)data for some period of time? There may be conflicting requirements that have nothing to do with technology & costs.
magnetic 9y ago
Can a EU citizen call AT&T/Verizon and ask them to delete all records of their calls? Would the call logs also disappear from "the other side of the call"?

53 points by chx 9y ago

Basically companies like facebook and google have abused the data collection and public trust so bad that EU had to come up with these absurd fines just so those behemoths would pay attention. Also is there a reason why it is a maximum of x and 2% of revenue? Shouldn't 2% of revenue big enough for a company to be scared?

erk__ 9y ago
You also want smaller companies to comply, where 2% is maybe too little for them to care, as it would cost more to comply with GDPR.
- valuearb 9y ago
  2% of revenue is a huge fine for any profitable business.
  - BrentOzar 9y ago
    > 2% of revenue is a huge fine for any profitable business. Not necessarily. In a business like ours (online training) where any additional new customers basically flow through to the bottom line, if I got 20% of my revenue from the EU, and I had to pay a 2% fine now and then, it wouldn't be terrible. I can see how some slimy businesses would say, "I'm not even going to bother complying - I'll just keep taking revenue off the table and paying the small fees."
    - valuearb 9y ago
      Sure, if your profit margins were 50% on EU revenues, it wouldn’t be a big deal to pay 2% of the max fine. Or if your startup doesn’t have revenues, you could get off scot free. But most profitable businesses are going to have profit margins in the 10-20% range, and that fine is considerable. And if the EU applies it to the last 5 years revenues, they could wipe out a years profit. For example, Apple probably has close to $100B in annual EU revenue, $2B is a huge incentive to invest in doing this right. But if your EU business is $1M, $20,000 is probably a fraction of your cost of implementation. The law would have been far better if it specifically limited fine levels by size of company. IE < 1M in sales, 1M to 10M, 10M-100M, 100M-1B, 1B+.
      - nolite 9y ago
        It’s on worldwide revenues, not EU revenues
        valuearb 9y ago
        Ouch, that's amazingly short-sighted.
- UncleEntity 9y ago
  > up to €10 million or 2% of your company’s annual revenue, whichever is higher They might care about a €10 million fine if they only have, say, €2 million in annual revenue. I remember when I first heard about this thinking "why even bother doing business in the EU?" --edit-- Which is exactly what you were saying in retrospect...
BrentOzar 9y ago
> Also is there a reason why it is a maximum of x and 2% of revenue? Shouldn't 2% of revenue big enough for a company to be scared? Nah, if it was 2% of our revenue, I'd be much more likely to take the gamble. I'd be willing to invest a little in our staffing & infrastructure to take that risk. I want to do the right thing - but that multi-million-euro penalty means the risk/reward equation just doesn't make sense. We'd never bring in enough revenue to pay off the hit from one angry judge determined to make an example out of us.
londons_explore 9y ago
Google was mostly compliant with the GDPR already. When you delete your account on Google, it really does delete all data from all services and all backup records etc. They implemented it like 3 or 4 years ago. Yes, it was a lot of work for a lot of engineers. Arguably, it's much harder for smaller companies to comply.
- peoplewindow 9y ago
  GDPR classifies any sort of cookie as PII. So you can request deletion of data that's the result of logged out queries, in theory. Also the Google tool deletes your account data. It does not delete all things that are conceivably personal data. For example if you commented on or edited a shared Google Doc and then delete your account I'm not sure the comments are deleted too. So it's not quite that simple. The law is so broad you could conceivably also demand that Gmail deletes any email you sent to it under your own name, out of other people's inboxes.

meredydd 9y ago

Data protection rules are this century's equivalent of pollution regulation. The online ecosystem has trashed the global commons with huge amounts of everyone's personal data, with no meaningful control or consent to how it is used, and now it needs to be cleaned up. There are companies that will go out of business, or have to pivot heavily, as a result of GDPR. If this doesn't happen, it's is not doing its job. More mainstream companies will grumble about this, just like they do about environmental regulations now. But, then as now, we've done the experiment. As an industry, we were left to self-regulate for 2.5 decades, and look what we did. I am not looking forward to finishing our GDPR compliance. Anvil doesn't rely on personal data for its business model, so it's not a big deal, just a bit tedious - it's a textbook frictional loss from regulation. But I am looking forward to living in a world where everyone has to comply.

meredydd 9y ago
PS: This is GDPR, not the EU VAT thing (also referred to by the OP). The former is painful but necessary; the latter is a straight-up unmanageable mess created by people with no understanding of the Internet. This is not a monolithic "all regulation good"/"all regulation bad" thing.
peoplewindow 9y ago
There is a third option beyond go bankrupt or pivot, as this story shows very clearly - cease trading with the EU or citizens of its member states entirely. Like the effect of FATCA but in reverse. That's the decision this small training firm has taken. It's a loss of 5% of revenue, they say. That's not bankruptcy or pivoting. This seems to be the unsurprising outcome of the EU's modern "obey us or we crush you" mentality. The UK is walking away. This small company is walking away. Apparently Microsoft is at least thinking about it for some products (the connect site is back now but looks semi abandoned). How many others will look at this and conclude the risks are too high to justify the costs? GDPR does not seem like a well thought out law. I have always been satisfied with my ability to delete things from the cloud. If I end up being banned from useful services because the costs of complying with the EU's very transparent attempts to bulk up their budget by repeatedly fining tech firms, I will not be happy.

sly010 9y ago

Naive question: If there are no such laws in the US, can one just simply store ALL personal data in Iceland?

erk__ 9y ago
How would that fix the problem you still can't save data from users from the EU.
- tonyarkles 9y ago
  That's exactly it. GDPR doesn't particularly care where you're storing the data, nor whether you have a "European presence". If you're storing data on people from the EU, from the EU's perspective, you're required to follow GDPR. From an enforcement point of view... if you have no EU presence, it'll probably be pretty hard for them to actually collect on the fines they levy, but as a director, travelling to Europe could be problematic. It's not entirely clear here, but it looks like there's a possibility of directors being held personally liable.
  - 086421357909764 9y ago
    In fact, the EU considers all citizens of the world to fall under their legal protections. That is, you don't have to be a EU citizen to have the same legal rights.
    - sitkack 9y ago
      Technically this is true for the US as well. We just like to pretend there is a distinction.
  - valuearb 9y ago
    It’s a terrifying overreach. The law is so vague many can be considered to be in violation without even realizing it. Far too many to even prosecute. But a politically active EU bureaucrat can just pick out key offenders to squeeze for publicity, piliticsl contributions, or even bribes.

BrentOzar 9y ago

Whoa, didn't expect this to hit HN. I'm here if anybody has questions. (Author)

magnetic 9y ago
How can you prevent EU users from using your service (it seems that's where you are headed)? I can think of IP geofiltering if you have a web service, perhaps blacklisting some countries in the AppStores if you publish an app... but people can travel & VPN somehow. Will part of the registration be "Are you a EU citizen?" And if EU people work around your safeguards and manage to register, are you still liable?
- BrentOzar 9y ago
  > How can you prevent EU users from using your service The first step is disallowing EU-VAT-eligible folks from purchasing. The plugin I mention in the post is really good for that - it looks at a variety of factors including the user's billing address for their credit card, for example. It's still totally possible that an EU citizen could be on Chinese soil, using an American's credit card, while using an Australian VPN. That means the next part of the registration will be a terms & conditions checkbox saying the GDPR doesn't apply to me. (We're working with our attorney on that language.) At that point, if someone still registers, AND they later ask for the right to erasure, we'll still do our best to delete their data. But if they try to go to the EU and complain, we'll be on much better legal ground to say, "Look, they lied to us from the get-go, and we can prove it." Nothing's certain - just trying to mitigate our risks as cheaply as possible.

Radim 9y ago

Automating PII detection & audits is a hard problem! Especially across sundry data storages and formats. Compliance firms typically provide a high-level paper trail, but what happens when you don't even know where the PII data is, like the OP says? What if you need to answer concrete individual Subject Access Requests? So, as a technology company, we've attempted to solve parts of it with technology. We really hope to make that pesky "PII stuff" detection and auditing easier for companies: https://pii-tools.com https://pii-tools.com (in private beta, feedback welcome)

moreira 9y ago

> You wouldn’t think that would be a big deal – but you’d be surprised. For example, students send us information about their databases all the time as part of asking questions – and they often send it unsolicited, through unencrypted email channels. That information ends up all over the place: our mail server, our desktops, phones, laptops, search indexes, etc. I’m not really worried about us maintaining the confidentiality of that data, but now we’d have to add in new audit-able tracking. That’s a good thing! Is it really that much to ask that when someone holds your data, that you can ask them to delete it and be assured that it’s gone for good? Apparently, for them, it is. And I’m sure it’ll be for a number of other businesses (and their competitors will just take their place, no big deal). But I’m looking forward to a world where unrestrained data collection and handling is no longer tolerated.

BrentOzar 9y ago
> Is it really that much to ask that when someone holds your data, that you can ask them to delete it and be assured that it’s gone for good? That doesn't give you the right to send someone your private data, in a channel they didn't ask for it, and demand that they secure that channel. This is the tough part about being a training company online: students send in questions with their personal data, unsolicited, via channels I simply can't secure. Your PII doesn't belong in email. > But I’m looking forward to a world where unrestrained data collection and handling is no longer tolerated. Read the post. It's not about what we collect - it's about what people send us voluntarily. That's the part that I'm most worried about. If I have no business relationship with those people, and they're just sending us personally identifiable data for no reason, I'm a lot more comfortable defending that in court. But if we have a business relationship where they're paying for our advice, and then they start sending more and more data, that's where I'm on shaky ground.
- moreira 9y ago
  I am absolutely not criticizing your decision; you’re perfectly within your rights to refuse to deal with all the rigamarole of GDPR compliance. It’s easier and only 5% of your revenue, so why even bother. And I completely understand the issue of people sending unsolicited data. I’m sorry that my comment came across as though I was targeting you specifically. I’m just excited for a world where data is no longer a “yeah let’s just store everything with no thought”, and instead is a hot potato that you keep a trail of and want to get rid of as quickly as possible. What a difference that’ll be from the situation we have today. This article is just highlighting how just accepting random data puts businesses “on shaky ground” as you said. The GDPR will require everyone to be a lot more thoughtful about their data retention policies, and that’s just great.

shock 9y ago

It doesn't seem like it now, but this is just a storm in a teapot. All of the necessary bits to comply with the GDPR will be commoditized sooner or later. I'm betting on sooner. This also presents a business opportunity to provide those bits. I do appreciate the fact that it's a nuisance at best and significant costs at worst to be compliant to GDPR. Only in time we will be able to tell if it was worth it or not. Maybe the US model of free-for-all access to user data will work better, maybe the EU model will...I don't think anyone can say for certain now. If anyone does know with a high degree of certainty which will, it's time to place the bets.

BrentOzar 9y ago
> All of the necessary bits to comply with the GDPR will be commoditized sooner or later. And the court cases will go through, and everybody will have a better idea of what the "right" things to do will be clear. I totally agree - and I summed that up in my post. Problem is, that's a future - it ain't today.
magnetic 9y ago
> I do appreciate the fact that it's a nuisance at best and significant costs at worst to be compliant to GDPR. I don't know that it's that simple. What happens when you have conflicting requirements, for example (I'm making them up) EU requiring you to delete PII within a period of time and US/Homeland Security/IRS requiring you to keep the (meta)data for some period of time? There may be conflicting requirements that have nothing to do with technology & costs.

magnetic 9y ago

Can a EU citizen call AT&T/Verizon and ask them to delete all records of their calls? Would the call logs also disappear from "the other side of the call"?