3 ms·

The GDPR isn't as good as you think it is. It's going to turn into one of those laws where small software startups / or normal small businesses are just going

The GDPR isn't as good as you think it is. It's going to turn into one of those laws where small software startups / or normal small businesses are just going to be in constant violation, because the amount of resources required to do it properly requires a team of 5 or 10 expensive software engineers. It's going to be a great way to nip small companies in the bud and consolidate this kind of stuff into bigger companies. It gets even worse with it's extraterritoriality, because you can still be under it if your dealing with a person who lies that they are an EU citizen and they are using your service in your own non EU country as a resident of the non EU country. It's like data FATCA. And there are other loopy catch 22 ambiguities, like if you want to delete someone from your audit log, do you delete their personal info (which is fairly expansive definition under GDPR) from the audit log too? Then how can you show you deleted the person's info if they are also deleted from your audit log? Read this to see more from the small company side and how much of a mess it is: https://www.brentozar.com/archive/2017/12/gdpr-stopped-selling-stuff-europe/ https://www.brentozar.com/archive/2017/12/gdpr-stopped-selli... Think of this theoretical situation. If your an EU citizen vacationing in a developing nation who has a medical emergency, could that hospital just decide to reject you because the hassle & cost of dealing with GDPR is too great? Remember, it's a developing nation, they can choose to just refuse service to you. Kind of like how a lot of americans get rejected by non US banks because dealing with FATCA is just too much of a pain ass today?

Xylakant 9y ago
You might have noted that I have refrained from giving an opinion on how good or bad I think that the GDPR is. I just pointed out that it does not at all apply to the case that the GP pretended to have a problem with. By all means, there's enough to criticize about the GDPR, but do it with an argument that has merits, but not by attacking a strawman. (Your hypothetical case is a strawman, too, since the hospital doesn’t do business in the EU and is most likely required to keep records by law, which is a specific exemption clause)
porker 9y ago
> Read this to see more from the small company side and how much of a mess it is: > https://www.brentozar.com/archive/2017/12/gdpr-stopped-selling-stuff-europe/ https://www.brentozar.com/archive/2017/12/gdpr-stopped-selli... I read his post, and wonder if the 'attorneys' he consulted are specialists in EU law, or were his standard ones. There's a lot of FUD around GDPR but the guidance is getting better, and people assume it's being 'policed' when the UK's body (the ICO) is more about guiding into best practices than punishment. The comments (esp around medical records) suggest ignorance of how it's working. Source: reading the GDPR and accompanying notes from the ICO; discussions with a large company's GDPR advisor, who was involved in drafting the legislation. Disclaimer: this is not legal advice, I am not a lawyer, and you are an idiot if you act on anything I say.
smu 9y ago
I'm pretty sure the hospital in the developing nation doesn't sell in the EU, so they don't need to comply. Phew, crisis averted!

Xylakant 9y ago

You might have noted that I have refrained from giving an opinion on how good or bad I think that the GDPR is. I just pointed out that it does not at all apply to the case that the GP pretended to have a problem with. By all means, there's enough to criticize about the GDPR, but do it with an argument that has merits, but not by attacking a strawman. (Your hypothetical case is a strawman, too, since the hospital doesn’t do business in the EU and is most likely required to keep records by law, which is a specific exemption clause)

porker 9y ago

> Read this to see more from the small company side and how much of a mess it is: > https://www.brentozar.com/archive/2017/12/gdpr-stopped-selling-stuff-europe/ https://www.brentozar.com/archive/2017/12/gdpr-stopped-selli... I read his post, and wonder if the 'attorneys' he consulted are specialists in EU law, or were his standard ones. There's a lot of FUD around GDPR but the guidance is getting better, and people assume it's being 'policed' when the UK's body (the ICO) is more about guiding into best practices than punishment. The comments (esp around medical records) suggest ignorance of how it's working. Source: reading the GDPR and accompanying notes from the ICO; discussions with a large company's GDPR advisor, who was involved in drafting the legislation. Disclaimer: this is not legal advice, I am not a lawyer, and you are an idiot if you act on anything I say.

smu 9y ago

I'm pretty sure the hospital in the developing nation doesn't sell in the EU, so they don't need to comply. Phew, crisis averted!