4 ms·

Eh... that's the voice of one regulator and you never know who may decide to be more draconian with the regulations. My suggestion is to read it yourself and th

Eh... that's the voice of one regulator and you never know who may decide to be more draconian with the regulations. My suggestion is to read it yourself and think carefully about the various data protection and portability requirements. IMO, all it takes is a small band of trolls who want to harm your company to start to cause problems. Here's a clear way to read through it: https://www.privacy-regulation.eu/en/index.htm https://www.privacy-regulation.eu/en/index.htm

bsder 9y ago
One thing I don't know is: Is this a law? Is there judicial oversight? Is there judicial approval first? If this is something that a motivated executive can apply unilaterally, it's bad. If this is something that can only be applied after a judicial system rules on compliance and gives you the opportunity to fix the issue, then it's probably okay.
- tyfon 9y ago
  GDPR has been in "preview mode" for two years but it is currently the law in many countries. It will start being enforced in May so you already have had two years to fix the issue if I read you correctly.
  - closeparen 9y ago
    Extraterritoriality is new. Most websites are probably not in the business of complying with the law in random EU countries where they have no legal or logistical presence. HN, for example, doesn’t.
    - cinquemb 9y ago
      Well, let's not pretend that it will stop EU countries from trying to engage in this glorified rent seeking exercise cum morality play against companies everywhere.
      - the_mitsuhiko 9y ago
        Which cases do you have in mind where that happened?
        cinquemb 9y ago
        The case where CNIL told my company to do remove information we had collected on our site. We are not based in the EU nor have any assets they can exert any influence over in the EU. We promptly ignored the request. But did have some private words we exchanged amongst ourselves at the futility of such request.
        the_mitsuhiko 9y ago
        It doesn’t matter if you are based in the EU or not. You are already required to register for VAT as a non EU company and that’s one of the many ways in. Privacy Shield is another.
        cinquemb 9y ago
        >nor have any assets they can exert any influence over in the EU.
        the_mitsuhiko 9y ago
        You are still legally required. Pretending that it’s okay to ignore your legal obligations because you think they have no leverage does not seem like a sensible thing to do. Neither morally nor legally unless you are willing to write off the EU market.
        cinquemb 9y ago
        As a non EU person or company with no legal assets in the EU, even if you or any EU institution says this, there are no repercussions from us continuing to engage in the activities (collecting data people put willing into the open) because there is no ability for the EU to enforce these laws upon us, short of arresting us outside of EU's borders. In order to stop us technically, the EU must pass laws that disallow their citizens to give information to platforms of various forms that could be used in various ways to amass data upon them as well as against allowing their citizens from accessing such information on sites like ours that mine crypto based on the time they spend on the site engaging with such information. >are willing to write off the EU market. We don't discriminate against our site visitors; we want to collect, correlate, cross-reference, and process it all and put it into the public to be used however people everywhere see fit, just like governments do today!
    - pjc50 9y ago
      I'm as Remain as the next person but I think extraterritoriality is a really bad idea whatever the circumstances. But it's not as if this is the first instance of extraterritorial law, and it's not like the US doesn't tend to assume its law applies everywhere too (e.g. gambling). To me it seems to have parallels with tax law and AML. If it's not extraterritorial, a big business of tax havens and money laundering springs up. The extraterritorial GDPR rules are there to prevent "data laundering" similarly.
geocar 9y ago
> IMO, all it takes is a small band of trolls who want to harm your company to start to cause problems. I suspect strongly the courts will use their energy to go after the biggest most flagrant violators of European law first: the equifaxes, facebooks, googles, and so on. The fines are there for those companies who continue to have a flagrant disregard for IT security practices, or who try to make personal data their business by trying to trick the subject instead of offering real value in trade. If you’re not trying to play legal chicken with privacy law, you know what personal data you have and protect it like your business depends on it, then you’re probably going to be fine. And unless you’re a lawyer or familiar with how European courts do things, I think a more plain language guide is better: https://ico.org.uk/for-organisations/guide-to-data-protection/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- woolvalley 9y ago
  The facebooks and googles can afford to follow GDPR. If you know some people that work there, you'll realize there have been multi-year efforts to become GDPR compliant in those companies. It's the small companies who literally can't afford the staff to properly implement the GDPR. It looks like it's turning into a regulatory barrier that protects the big guys and scares the small guys away. There is nothing in the GDPR that says: "if your a small < 5 person corp not in europe that isn't a subsidary of another corporation, then the GDPR does not apply (ie: Joe's blog, Sue's landscaping)". Or "If your revenues & employee counts are within this band, then the maximum fine can only be applied on a percentage basis and not millions.". IF these regulators really didn't want to scare away the small guys, they would of put that into the law. "Don't worry, the european courts are nice people" is not a strong enough guarantee for most people and corporations.
  - geocar 9y ago
    “Following the GDPR” is easy for most companies because the amount of personal data they keep and have at risk is extremely low. The ICO has some great guidance for them: https://ico.org.uk/for-organisations/business/ https://ico.org.uk/for-organisations/business/ > “Don't worry, the european courts are nice people" is not a strong enough guarantee for most people and corporations. The GDPR is already law and people, and corporations are still here. That’s how courts work in Europe. They can fine you for hurting consumers or putting them at risk even if the specific actions you’re taking aren’t necessarily coded and specified. As an American living here I understand how strange that can seem, but the advantage is that companies getting prepared for the GDPR are treating the personal data they keep as a liability instead of treating it as an asset.

bsder 9y ago

One thing I don't know is: Is this a law? Is there judicial oversight? Is there judicial approval first? If this is something that a motivated executive can apply unilaterally, it's bad. If this is something that can only be applied after a judicial system rules on compliance and gives you the opportunity to fix the issue, then it's probably okay.

tyfon 9y ago
GDPR has been in "preview mode" for two years but it is currently the law in many countries. It will start being enforced in May so you already have had two years to fix the issue if I read you correctly.
- closeparen 9y ago
  Extraterritoriality is new. Most websites are probably not in the business of complying with the law in random EU countries where they have no legal or logistical presence. HN, for example, doesn’t.
  - cinquemb 9y ago
    Well, let's not pretend that it will stop EU countries from trying to engage in this glorified rent seeking exercise cum morality play against companies everywhere.
    - the_mitsuhiko 9y ago
      Which cases do you have in mind where that happened?
      - cinquemb 9y ago
        The case where CNIL told my company to do remove information we had collected on our site. We are not based in the EU nor have any assets they can exert any influence over in the EU. We promptly ignored the request. But did have some private words we exchanged amongst ourselves at the futility of such request.
        the_mitsuhiko 9y ago
        It doesn’t matter if you are based in the EU or not. You are already required to register for VAT as a non EU company and that’s one of the many ways in. Privacy Shield is another.
        cinquemb 9y ago
        >nor have any assets they can exert any influence over in the EU.
        the_mitsuhiko 9y ago
        You are still legally required. Pretending that it’s okay to ignore your legal obligations because you think they have no leverage does not seem like a sensible thing to do. Neither morally nor legally unless you are willing to write off the EU market.
        cinquemb 9y ago
        As a non EU person or company with no legal assets in the EU, even if you or any EU institution says this, there are no repercussions from us continuing to engage in the activities (collecting data people put willing into the open) because there is no ability for the EU to enforce these laws upon us, short of arresting us outside of EU's borders. In order to stop us technically, the EU must pass laws that disallow their citizens to give information to platforms of various forms that could be used in various ways to amass data upon them as well as against allowing their citizens from accessing such information on sites like ours that mine crypto based on the time they spend on the site engaging with such information. >are willing to write off the EU market. We don't discriminate against our site visitors; we want to collect, correlate, cross-reference, and process it all and put it into the public to be used however people everywhere see fit, just like governments do today!
  - pjc50 9y ago
    I'm as Remain as the next person but I think extraterritoriality is a really bad idea whatever the circumstances. But it's not as if this is the first instance of extraterritorial law, and it's not like the US doesn't tend to assume its law applies everywhere too (e.g. gambling). To me it seems to have parallels with tax law and AML. If it's not extraterritorial, a big business of tax havens and money laundering springs up. The extraterritorial GDPR rules are there to prevent "data laundering" similarly.

geocar 9y ago

> IMO, all it takes is a small band of trolls who want to harm your company to start to cause problems. I suspect strongly the courts will use their energy to go after the biggest most flagrant violators of European law first: the equifaxes, facebooks, googles, and so on. The fines are there for those companies who continue to have a flagrant disregard for IT security practices, or who try to make personal data their business by trying to trick the subject instead of offering real value in trade. If you’re not trying to play legal chicken with privacy law, you know what personal data you have and protect it like your business depends on it, then you’re probably going to be fine. And unless you’re a lawyer or familiar with how European courts do things, I think a more plain language guide is better: https://ico.org.uk/for-organisations/guide-to-data-protection/ https://ico.org.uk/for-organisations/guide-to-data-protectio...

woolvalley 9y ago
The facebooks and googles can afford to follow GDPR. If you know some people that work there, you'll realize there have been multi-year efforts to become GDPR compliant in those companies. It's the small companies who literally can't afford the staff to properly implement the GDPR. It looks like it's turning into a regulatory barrier that protects the big guys and scares the small guys away. There is nothing in the GDPR that says: "if your a small < 5 person corp not in europe that isn't a subsidary of another corporation, then the GDPR does not apply (ie: Joe's blog, Sue's landscaping)". Or "If your revenues & employee counts are within this band, then the maximum fine can only be applied on a percentage basis and not millions.". IF these regulators really didn't want to scare away the small guys, they would of put that into the law. "Don't worry, the european courts are nice people" is not a strong enough guarantee for most people and corporations.
- geocar 9y ago
  “Following the GDPR” is easy for most companies because the amount of personal data they keep and have at risk is extremely low. The ICO has some great guidance for them: https://ico.org.uk/for-organisations/business/ https://ico.org.uk/for-organisations/business/ > “Don't worry, the european courts are nice people" is not a strong enough guarantee for most people and corporations. The GDPR is already law and people, and corporations are still here. That’s how courts work in Europe. They can fine you for hurting consumers or putting them at risk even if the specific actions you’re taking aren’t necessarily coded and specified. As an American living here I understand how strange that can seem, but the advantage is that companies getting prepared for the GDPR are treating the personal data they keep as a liability instead of treating it as an asset.