13 ms·

The GDPR isn't actually as bad as people claim. The law is actually pretty reasonable. It is the result of years of discussion and deliberation. In fact, privac

by lima 9y ago

The GDPR isn't actually as bad as people claim. The law is actually pretty reasonable. It is the result of years of discussion and deliberation. In fact, privacy watchdogs are complaining that it doesn't go far enough - it leaves plenty of holes. Most of the GDPR is about informed consent, having a valid reason for processing personal data and individual rights. Facebook will do just fine, they had years to prepare and an army of lawyers. It will force them to be more transparent, which is a good thing. Many EU member states like Germany already had very similar laws in place (like the BDSG), the GDPR unifies and standardizes them. Here's an excellent introduction: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-the-general-da...

waytogo 9y ago
> Facebook will do just fine, they had years to prepare and an army of lawyers. They won't do fine. Don't want to go into details but their actual products/required architectures for their products just can't be GDPR compliant. And they didn't prepare anything. You confuse them with Google--they prepared GDPR but FB? Btw, one of GDPR's key motivation was to take FB down.
- ionforce 9y ago
  > one of GDPR's key motivation was to take FB down. Do you have a citation for this claim?
  - waytogo 9y ago
    It's the modern version of a trade war between the US and the EU which targets massive online monopolies which the EU doesn't have.
    - Crontab 9y ago
      That is an opinion - it doesn't prove your claim.
- stochastic_monk 9y ago
  Without a citation, I doubt this claim and wonder if you have any personal investment in or relation to Facebook or a similar company whose profit is generated by selling or buying personal data.
  - x0x0 9y ago
    No, but I have to comply with the GDPR. The first thing to understand about the GDPR is much of it is quite vague, and is essentially a framework for rule making for 30+ privacy regulators. See eg legitimate interests where you are supposed to conduct a balancing test between competing interests with very limited guidance on what a reasonable balancing test is. Second, these lazy morons haven't issued final guidance approximately three months out from the deadline. Now, there is some guidance, but there's no hard cap on the distance between working and final guidance. How they expect companies to comply with that is obvious: they don't, and will use the opportunity to fine them. The ICO has been quite explicit about this; I don't have quotes on this laptop but one of their senior staff basically said that grace periods are not part of their regulatory strategy. Grace periods are apparently only for the regulators. And that's the ICO, one of the more reasonable regulators! The french regulators, who aren't particularly reasonable, are no doubt anticipating the influx of cash. So if you're a company that is relying on some mix of legitimate interests and consent to service your customers, market, and perform outbound, it's very difficult to understand what the rules are. And this is worse if you are an American company and therefore probably don't have a lead regulator and will have to attempt to comply with the (almost certainly) conflicting rules as decided upon by every privacy regulator instead of just one. Much of the GDPR is quite reasonable (besides the DPOs, ie employment program for EU lawyers) -- privacy dashboards, the ability to delete data, SARs, etc. But it's wildly unreasonable to not have final regulations in place.
    - stochastic_monk 9y ago
      I agree that it should be better executed, but I’m glad efforts for consumer protection are being made at all. Thank you for your thorough explanation.
- blibble 9y ago
  > Btw, one of GDPR's key motivation was to take FB down. this all seems very similar to the new VAT scheme, in that it was designed to target a foreign giant (Amazon), which was barely affected as a result, and instead ended up hurting the competitiveness of the EU's own small businesses the EU Commission's response to small business concerns about that new VAT scheme? "we'll allocate some time to talk about that in 5 years" fantastic
  - jimnotgym 9y ago
    Can you elaborate on which scheme you mean please?
    - blibble 9y ago
      https://www.theguardian.com/small-business-network/2014/nov/25/new-eu-vat-regulations-threaten-micro-businesses https://www.theguardian.com/small-business-network/2014/nov/... and https://www.theguardian.com/small-business-network/2015/sep/14/eu-propose-vat-exemption-small-businesses-protests https://www.theguardian.com/small-business-network/2015/sep/... my solution was to stop selling into the EU, though amusingly once the UK leaves the EU I'll be able to start again (by just ignoring the EU's VAT rules)
      - jimnotgym 9y ago
        I knew about that but I was thrown by this > new VAT scheme whereas this is from 2015. I was confused by language where you described it as a law to target Amazon. Now I see that was just an opinion. > my solution was to stop selling into the EU Interesting business decision. Was the cost of compliance that high, or was your revenue that trivial? > though amusingly once the UK leaves the EU I'll be able to start again (by just ignoring the EU's VAT rules) Well I was having a conversation with one of the UK's foremost VAT specialists on Friday, from one of the UK big 4 accountancy firms. He was very clear that the general opinion is that the UK will align with the EU for VAT. This was a response to my question about the catastrophic cashflow impact that losing the VAT rules on imports would have to UK businesses. He told me not to worry, as VAT alignment was simply a necessity.
- dang 9y ago
  A grandiose claim offering nothing better than "don't want to go into details" counts as unsubstantive and flamebait, two qualities that are deprecated here. In the future, could you please either make a comment like this substantive, or just not post? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - waytogo 9y ago
    Dang, no need to get aggressive. I was on mobile and had not the time explain why all products around Facebook—which need to collect user's behavioural data to target ads etc.—can't ever get compliant with the strict GDPR. I guess you are not informed about GDPR. If you were my prior message with a "don't want to go into details" would be have been super clear. So, this is a misunderstanding and again your aggressive tone is for somebody who is representing YC just sad. Besides, thanks that you gave my profile more gravity when posting comments. Now my comments drop so quickly (first seconds after posting) and people with 0 karma move above me. Great way to deal with different opinions, Dang.
peoplewindow 9y ago
How is the law reasonable? It's not even clear what is allowed under it and what isn't. The EU refuses to clarify anything, the only time any decision will be made is by courts, if there's an actual dispute in progress. The rules are so vague that any firm could be argued to be in violation. And the EU acts as judge, jury and executioner. It looks like a way to tax the SV tech firms without needing a treaty change. After all there's no practical difference between a tax and a law that everyone is guaranteed to always be in violation of that has huge fines attached. The money all goes straight into EU central coffers.
- throwawaymaroon 9y ago
  It's about time things started being unfair to corporations the same way they're unfair towards individuals.
- Xylakant 9y ago
  “And the EU acts as judge, jury and executioner.” That’s true only if you regard he EU as a single entity. Laws made via the EU will be turned into national law, and independent judges will judge all cases, up to the EU high court. By the same right you could call the US judge, jury and executioner on all laws and rules made and enforced by the US government (FACTA anyone?)
  - peoplewindow 9y ago
    No. That's not how the EU works. That's how a national government would work but not the EU. The GDPR is not a directive so it does not have to be translated into national law. It is directly binding and applies immediately everywhere. Fines have to be paid up front, before appeals are exhausted. Appeals can of course take years. The EU courts have judges appointed by the same people who control the rest of the EU, and are ideologically aligned as such. They have a long history of legislating from the bench and making shocking and nonsensical decisions: consider the case where they simply voided the UK's opt out of new human rights related legislation, despite a very clear paragraph in the treaties saying they did not apply to the UK. The court simply decided it didn't like that bit of the treaty and so it did not apply. I do not regard the ECJ as a robust court. It will rule in whatever way is most favourable to the European project.
jbigelow76 9y ago
>Facebook will do just fine, they had years to prepare and an army of lawyers. Microsoft had years to prepare and an army of lawyers too.
- redbergy 9y ago
  And they're doing just fine now... I don't get the point?
  - jbigelow76 9y ago
    If somebody says "X has money and an army of lawyers" the implication is they are going to beat the case, Microsoft didn't, they were slapped with the largest fine ever at the time ($794 million USD). They are fine despite the inability of lawyers and prep time to deliver victory, not because of it. No guarantees FB will fare better (or worse).
    - lima 9y ago
      Parent claims that Facebook will not "ever be compliant" and "in the worst case the withdraw from these markets".
      - wirrbel 9y ago
        the whole EU? Too big to withdraw from.
        BookmarkSaver 9y ago
        Which is the whole point of the subsequent thread. FB is not just gonna ditch EU, nor are they going to be destroyed by a new regulation.
        petre 9y ago
        They got out of China which is also quite big. I just wonder what would replace it if they withdraw.
BjoernKW 9y ago
The problem with the GDPR isn't that it is too far-reaching. The problem is that it isn't clear what companies have to do to comply with the new regulation. Large companies will simply pay their lawyers to deal with this. Small companies basically will have to do their best and hope they don't get sued.
rock_hard 9y ago
As I wrote already in another comment: all these regulations will end up doing is strengthen the market position of the established players and cripple any competition from new incumbents :( It’s the end of an era...not too long ago anyone could compete with the big players...soon nobody will
- Barrin92 9y ago
  given the feedback loop of social networks there wasn't much of a reason for viable competitors to emerge in the first place. The lack of competitors here is structural, not everything is an issue of 'we must remove the red tape!' That would do nothing because nobody is voluntarily going to switch away from an established social network monopolist. It's a nash equilibrium of sorts.
  - rock_hard 9y ago
    People keep saying that...yet FB succeeded with MySpace in the market. Same with Instagram, WhatsApp and Snapchat.
    - Barrin92 9y ago
      Myspace was pretty much dead the moment facebook arrived. It's true that companies like Facebook can be replaced, but they almost never coexist or directly compete. Chat services usually split geographically. Wechat in China, Whatsapp outside of the US, snapchat in the US. Anecdotally I know very few people who simultaneously use multiple messenger apps or switch around a lot. (For the reason outlined in the post before, you lose your network).
      - rock_hard 9y ago
        Anecdotally I know a lot of people who use IG, FB, WhatsApp and Snapchat along side just fine though. Lets use some math to answer this: 2 billion Smartphones users 2 billion Facebook users (Smartphone mostly) 1 billion Instagram users (Smartphone only) 1 billion WhatsApp users (Smartphone mostly) So just looking at these numbers there must be a huge overlap in usage
Sylos 9y ago
GDPR is reasonable. How Facebook handles user data is not. I'm sure, they'll mostly ignore the law at first, and if they get sued, they'll claim having a legitimate interest [1], but that will be their strategy, because actually complying with the law voluntarily would likely cost them more. And yes, especially Germany already had a very similar law in place, but Facebook did not actually need to keep to it most of the time, because they were operating from Ireland. GDPR does not care where you're operating from. The fines would have also not been much more than operational costs for Facebook (the highest fine placed in Germany for privacy violations so far is at 300,000€). [1] section 1 f): https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
- AstralStorm 9y ago
  Ignoring the court order of which they were duly informed and which contains time to comply is a felony. Including a huge fine in this case, which will likely be calculated per German user. Think something closer to 30 M€.
  - Sylos 9y ago
    With "ignore the law", I meant not (fully) implementing the requirements that the GDPR imposes. If a judge actually rules that they did not properly implement the GDPR requirements, then yeah, they will correct that. But until someone sues them and that court case concludes, there's going to be a lot of time, in which they can probably make enough money by not properly implementing the GDPR requirements to easily recover however high that fine is in the end.
tripzilch 9y ago
> The GDPR isn't actually as bad as people claim. The law is actually pretty reasonable. It is the result of years of discussion and deliberation. In fact, privacy watchdogs are complaining that it doesn't go far enough - it leaves plenty of holes. I'm feeling a huge cultural gap in the discussions in this thread. Americans seem to have a different tolerance for privacy abuse and draw the line elsewhere. And I suppose that's okay, live and let live etc. However, so far it's really been mainly US tech companies pushing their views on privacy (read: less of it) in the EU market (kind of poisoning the field for EU companies as well, because obviously you can make more profit that way). I don't see the (EU) public making a huge fuss about EU businesses taken to court over privacy violations (which happens), because we see it as justice as usual. Now that the EU(/Germany) pushes back against a huge US corporation (ok multinational, technically), it's considered really harsh, from a US point of view. Some arguments going even as far as attacking our legal system (which is a bit much, coming from the US, IMHO. Americans themselves flat out admit justice is a matter of financial resources and consider that justice as usual). Apparently we have different values. Personally, I agree it doesn't go far enough even though I'm very happy with the German ruling and hope other countries will follow suit.

by lima 9y ago

waytogo 9y ago

> Facebook will do just fine, they had years to prepare and an army of lawyers. They won't do fine. Don't want to go into details but their actual products/required architectures for their products just can't be GDPR compliant. And they didn't prepare anything. You confuse them with Google--they prepared GDPR but FB? Btw, one of GDPR's key motivation was to take FB down.

ionforce 9y ago
> one of GDPR's key motivation was to take FB down. Do you have a citation for this claim?
- waytogo 9y ago
  It's the modern version of a trade war between the US and the EU which targets massive online monopolies which the EU doesn't have.
  - Crontab 9y ago
    That is an opinion - it doesn't prove your claim.
stochastic_monk 9y ago
Without a citation, I doubt this claim and wonder if you have any personal investment in or relation to Facebook or a similar company whose profit is generated by selling or buying personal data.
- x0x0 9y ago
  No, but I have to comply with the GDPR. The first thing to understand about the GDPR is much of it is quite vague, and is essentially a framework for rule making for 30+ privacy regulators. See eg legitimate interests where you are supposed to conduct a balancing test between competing interests with very limited guidance on what a reasonable balancing test is. Second, these lazy morons haven't issued final guidance approximately three months out from the deadline. Now, there is some guidance, but there's no hard cap on the distance between working and final guidance. How they expect companies to comply with that is obvious: they don't, and will use the opportunity to fine them. The ICO has been quite explicit about this; I don't have quotes on this laptop but one of their senior staff basically said that grace periods are not part of their regulatory strategy. Grace periods are apparently only for the regulators. And that's the ICO, one of the more reasonable regulators! The french regulators, who aren't particularly reasonable, are no doubt anticipating the influx of cash. So if you're a company that is relying on some mix of legitimate interests and consent to service your customers, market, and perform outbound, it's very difficult to understand what the rules are. And this is worse if you are an American company and therefore probably don't have a lead regulator and will have to attempt to comply with the (almost certainly) conflicting rules as decided upon by every privacy regulator instead of just one. Much of the GDPR is quite reasonable (besides the DPOs, ie employment program for EU lawyers) -- privacy dashboards, the ability to delete data, SARs, etc. But it's wildly unreasonable to not have final regulations in place.
  - stochastic_monk 9y ago
    I agree that it should be better executed, but I’m glad efforts for consumer protection are being made at all. Thank you for your thorough explanation.
blibble 9y ago
> Btw, one of GDPR's key motivation was to take FB down. this all seems very similar to the new VAT scheme, in that it was designed to target a foreign giant (Amazon), which was barely affected as a result, and instead ended up hurting the competitiveness of the EU's own small businesses the EU Commission's response to small business concerns about that new VAT scheme? "we'll allocate some time to talk about that in 5 years" fantastic
- jimnotgym 9y ago
  Can you elaborate on which scheme you mean please?
  - blibble 9y ago
    https://www.theguardian.com/small-business-network/2014/nov/25/new-eu-vat-regulations-threaten-micro-businesses https://www.theguardian.com/small-business-network/2014/nov/... and https://www.theguardian.com/small-business-network/2015/sep/14/eu-propose-vat-exemption-small-businesses-protests https://www.theguardian.com/small-business-network/2015/sep/... my solution was to stop selling into the EU, though amusingly once the UK leaves the EU I'll be able to start again (by just ignoring the EU's VAT rules)
    - jimnotgym 9y ago
      I knew about that but I was thrown by this > new VAT scheme whereas this is from 2015. I was confused by language where you described it as a law to target Amazon. Now I see that was just an opinion. > my solution was to stop selling into the EU Interesting business decision. Was the cost of compliance that high, or was your revenue that trivial? > though amusingly once the UK leaves the EU I'll be able to start again (by just ignoring the EU's VAT rules) Well I was having a conversation with one of the UK's foremost VAT specialists on Friday, from one of the UK big 4 accountancy firms. He was very clear that the general opinion is that the UK will align with the EU for VAT. This was a response to my question about the catastrophic cashflow impact that losing the VAT rules on imports would have to UK businesses. He told me not to worry, as VAT alignment was simply a necessity.
dang 9y ago
A grandiose claim offering nothing better than "don't want to go into details" counts as unsubstantive and flamebait, two qualities that are deprecated here. In the future, could you please either make a comment like this substantive, or just not post? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- waytogo 9y ago
  Dang, no need to get aggressive. I was on mobile and had not the time explain why all products around Facebook—which need to collect user's behavioural data to target ads etc.—can't ever get compliant with the strict GDPR. I guess you are not informed about GDPR. If you were my prior message with a "don't want to go into details" would be have been super clear. So, this is a misunderstanding and again your aggressive tone is for somebody who is representing YC just sad. Besides, thanks that you gave my profile more gravity when posting comments. Now my comments drop so quickly (first seconds after posting) and people with 0 karma move above me. Great way to deal with different opinions, Dang.

peoplewindow 9y ago

How is the law reasonable? It's not even clear what is allowed under it and what isn't. The EU refuses to clarify anything, the only time any decision will be made is by courts, if there's an actual dispute in progress. The rules are so vague that any firm could be argued to be in violation. And the EU acts as judge, jury and executioner. It looks like a way to tax the SV tech firms without needing a treaty change. After all there's no practical difference between a tax and a law that everyone is guaranteed to always be in violation of that has huge fines attached. The money all goes straight into EU central coffers.

throwawaymaroon 9y ago
It's about time things started being unfair to corporations the same way they're unfair towards individuals.
Xylakant 9y ago
“And the EU acts as judge, jury and executioner.” That’s true only if you regard he EU as a single entity. Laws made via the EU will be turned into national law, and independent judges will judge all cases, up to the EU high court. By the same right you could call the US judge, jury and executioner on all laws and rules made and enforced by the US government (FACTA anyone?)
- peoplewindow 9y ago
  No. That's not how the EU works. That's how a national government would work but not the EU. The GDPR is not a directive so it does not have to be translated into national law. It is directly binding and applies immediately everywhere. Fines have to be paid up front, before appeals are exhausted. Appeals can of course take years. The EU courts have judges appointed by the same people who control the rest of the EU, and are ideologically aligned as such. They have a long history of legislating from the bench and making shocking and nonsensical decisions: consider the case where they simply voided the UK's opt out of new human rights related legislation, despite a very clear paragraph in the treaties saying they did not apply to the UK. The court simply decided it didn't like that bit of the treaty and so it did not apply. I do not regard the ECJ as a robust court. It will rule in whatever way is most favourable to the European project.

jbigelow76 9y ago

>Facebook will do just fine, they had years to prepare and an army of lawyers. Microsoft had years to prepare and an army of lawyers too.

redbergy 9y ago
And they're doing just fine now... I don't get the point?
- jbigelow76 9y ago
  If somebody says "X has money and an army of lawyers" the implication is they are going to beat the case, Microsoft didn't, they were slapped with the largest fine ever at the time ($794 million USD). They are fine despite the inability of lawyers and prep time to deliver victory, not because of it. No guarantees FB will fare better (or worse).
  - lima 9y ago
    Parent claims that Facebook will not "ever be compliant" and "in the worst case the withdraw from these markets".
    - wirrbel 9y ago
      the whole EU? Too big to withdraw from.
      - BookmarkSaver 9y ago
        Which is the whole point of the subsequent thread. FB is not just gonna ditch EU, nor are they going to be destroyed by a new regulation.
      - petre 9y ago
        They got out of China which is also quite big. I just wonder what would replace it if they withdraw.

BjoernKW 9y ago

The problem with the GDPR isn't that it is too far-reaching. The problem is that it isn't clear what companies have to do to comply with the new regulation. Large companies will simply pay their lawyers to deal with this. Small companies basically will have to do their best and hope they don't get sued.

rock_hard 9y ago

As I wrote already in another comment: all these regulations will end up doing is strengthen the market position of the established players and cripple any competition from new incumbents :( It’s the end of an era...not too long ago anyone could compete with the big players...soon nobody will

Barrin92 9y ago
given the feedback loop of social networks there wasn't much of a reason for viable competitors to emerge in the first place. The lack of competitors here is structural, not everything is an issue of 'we must remove the red tape!' That would do nothing because nobody is voluntarily going to switch away from an established social network monopolist. It's a nash equilibrium of sorts.
- rock_hard 9y ago
  People keep saying that...yet FB succeeded with MySpace in the market. Same with Instagram, WhatsApp and Snapchat.
  - Barrin92 9y ago
    Myspace was pretty much dead the moment facebook arrived. It's true that companies like Facebook can be replaced, but they almost never coexist or directly compete. Chat services usually split geographically. Wechat in China, Whatsapp outside of the US, snapchat in the US. Anecdotally I know very few people who simultaneously use multiple messenger apps or switch around a lot. (For the reason outlined in the post before, you lose your network).
    - rock_hard 9y ago
      Anecdotally I know a lot of people who use IG, FB, WhatsApp and Snapchat along side just fine though. Lets use some math to answer this: 2 billion Smartphones users 2 billion Facebook users (Smartphone mostly) 1 billion Instagram users (Smartphone only) 1 billion WhatsApp users (Smartphone mostly) So just looking at these numbers there must be a huge overlap in usage

Sylos 9y ago

GDPR is reasonable. How Facebook handles user data is not. I'm sure, they'll mostly ignore the law at first, and if they get sued, they'll claim having a legitimate interest [1], but that will be their strategy, because actually complying with the law voluntarily would likely cost them more. And yes, especially Germany already had a very similar law in place, but Facebook did not actually need to keep to it most of the time, because they were operating from Ireland. GDPR does not care where you're operating from. The fines would have also not been much more than operational costs for Facebook (the highest fine placed in Germany for privacy violations so far is at 300,000€). [1] section 1 f): https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/

AstralStorm 9y ago
Ignoring the court order of which they were duly informed and which contains time to comply is a felony. Including a huge fine in this case, which will likely be calculated per German user. Think something closer to 30 M€.
- Sylos 9y ago
  With "ignore the law", I meant not (fully) implementing the requirements that the GDPR imposes. If a judge actually rules that they did not properly implement the GDPR requirements, then yeah, they will correct that. But until someone sues them and that court case concludes, there's going to be a lot of time, in which they can probably make enough money by not properly implementing the GDPR requirements to easily recover however high that fine is in the end.

tripzilch 9y ago

> The GDPR isn't actually as bad as people claim. The law is actually pretty reasonable. It is the result of years of discussion and deliberation. In fact, privacy watchdogs are complaining that it doesn't go far enough - it leaves plenty of holes. I'm feeling a huge cultural gap in the discussions in this thread. Americans seem to have a different tolerance for privacy abuse and draw the line elsewhere. And I suppose that's okay, live and let live etc. However, so far it's really been mainly US tech companies pushing their views on privacy (read: less of it) in the EU market (kind of poisoning the field for EU companies as well, because obviously you can make more profit that way). I don't see the (EU) public making a huge fuss about EU businesses taken to court over privacy violations (which happens), because we see it as justice as usual. Now that the EU(/Germany) pushes back against a huge US corporation (ok multinational, technically), it's considered really harsh, from a US point of view. Some arguments going even as far as attacking our legal system (which is a bit much, coming from the US, IMHO. Americans themselves flat out admit justice is a matter of financial resources and consider that justice as usual). Apparently we have different values. Personally, I agree it doesn't go far enough even though I'm very happy with the German ruling and hope other countries will follow suit.