4 ms·

So nice to see progress in privacy but please someone explains how GDPR will help EU startups! GDPR is inevitably going to hinder any new company forced to abi

So nice to see progress in privacy but please someone explains how GDPR will help EU startups! GDPR is inevitably going to hinder any new company forced to abide by it. So the next Uber/Wechat will first flourish in US/China/Russia and then come to the EU, not the other way around. Entrepreneurs / investors also want their time & money to be used to build value first rather than solve yet another accidental complexity that is irrelevant until your revenue model is proven. What am I missing? Is GDPR implementation cost marginal?

_o_ 9y ago
It is very costly for existing (!) companies, for startups it comes with fraction of cost, if taken into account from first line of code, from first create table. In few years it will be normal.
kelnos 9y ago
I wouldn't say marginal, but it is a lot easier to implement GDPR if you do it up-front, from day one. If you start off with a policy of just not collecting or storing information unless you've made a conscious decision that you really do need it, that's a huge start. From there, you your main obligations are to ensure that any personal data you do collect can be deleted at a reasonably granular level, and that you document your policies around data storage. Is it free? No. But if you're spending a significant amount of time on it as a new startup building from scratch, something is very wrong. And hell, if you started a company recently, you were given the chance to catch up to the incumbents in your market while they've slowed down to retrofit all their systems for GDPR compliance. ;)
- number6 9y ago
  The GDPR is not that far from existing laws in the EU. So EU company have a headstart
- freeone3000 9y ago
  Besides implementation costs, you're simply leaving money on the table. You can make lots of profit by selling user's tertiary preference data, often enough to buoy for a few months. It's ridiculous that some Europeans are forcing us to give up money for some fee-fees.
  - SahAssar 9y ago
    I'm pretty happy about that, and I think most other consumers are too.
  - s73v3r_ 9y ago
    I think it's ridiculous that you would disrespect your users like that.
agar 9y ago
Let's say you're a business in the EU that needs a sales management system. In it, you store personal data of your clients. You are considered a "controller"; the SaaS sales management system (that will store this data for you) is considered a "processor." GDPR states that to remain compliant, Controllers must only use GDPR-compliant Processors.[1] Assuming that EU startups will take GDPR more seriously than non-EU companies (a safe assumption judging from the posts here on HN), non-tech EU companies (Controllers) will tend to gravitate towards EU tech companies (Processors) to ensure they remain compliant. It is non-EU (primarily US) tech companies' game to lose. If US tech companies get a reputation for not caring about GDPR, there could be a real sea-change in EU buying behavior. [1] Article 28, paragraph 1: "Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject."
- Xylakant 9y ago
  > Assuming that EU startups will take GDPR more seriously than non-EU companies It’s also easier in terms of jurisdiction. A non-EU company might just pretend they’re compliant but your legal options in case they’re not are somewhat limited.
s73v3r_ 9y ago
"So nice to see progress in privacy but please someone explains how GDPR will help EU startups!" Why does everything have to help startups? "GDPR is inevitably going to hinder any new company forced to abide by it." I disagree. You simply shouldn't be collecting that data in most instances anyway. And if you truly do need it, you should have been asking permission before. Somehow we got it into our heads that it was perfectly acceptable to just take things without asking. I'm fairly certain I learned not to do this in Kindergarten. "Entrepreneurs / investors also want their time & money to be used to build value first rather than solve yet another accidental complexity that is irrelevant until your revenue model is proven." The GDPR has no impact on this, unless the only way you can create "value" is by disrespecting your users. You can still build value the old fashioned way, by providing something of use to your users.

_o_ 9y ago

It is very costly for existing (!) companies, for startups it comes with fraction of cost, if taken into account from first line of code, from first create table. In few years it will be normal.

kelnos 9y ago

I wouldn't say marginal, but it is a lot easier to implement GDPR if you do it up-front, from day one. If you start off with a policy of just not collecting or storing information unless you've made a conscious decision that you really do need it, that's a huge start. From there, you your main obligations are to ensure that any personal data you do collect can be deleted at a reasonably granular level, and that you document your policies around data storage. Is it free? No. But if you're spending a significant amount of time on it as a new startup building from scratch, something is very wrong. And hell, if you started a company recently, you were given the chance to catch up to the incumbents in your market while they've slowed down to retrofit all their systems for GDPR compliance. ;)

number6 9y ago
The GDPR is not that far from existing laws in the EU. So EU company have a headstart
freeone3000 9y ago
Besides implementation costs, you're simply leaving money on the table. You can make lots of profit by selling user's tertiary preference data, often enough to buoy for a few months. It's ridiculous that some Europeans are forcing us to give up money for some fee-fees.
- SahAssar 9y ago
  I'm pretty happy about that, and I think most other consumers are too.
- s73v3r_ 9y ago
  I think it's ridiculous that you would disrespect your users like that.

agar 9y ago

Let's say you're a business in the EU that needs a sales management system. In it, you store personal data of your clients. You are considered a "controller"; the SaaS sales management system (that will store this data for you) is considered a "processor." GDPR states that to remain compliant, Controllers must only use GDPR-compliant Processors.[1] Assuming that EU startups will take GDPR more seriously than non-EU companies (a safe assumption judging from the posts here on HN), non-tech EU companies (Controllers) will tend to gravitate towards EU tech companies (Processors) to ensure they remain compliant. It is non-EU (primarily US) tech companies' game to lose. If US tech companies get a reputation for not caring about GDPR, there could be a real sea-change in EU buying behavior. [1] Article 28, paragraph 1: "Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject."

Xylakant 9y ago
> Assuming that EU startups will take GDPR more seriously than non-EU companies It’s also easier in terms of jurisdiction. A non-EU company might just pretend they’re compliant but your legal options in case they’re not are somewhat limited.

s73v3r_ 9y ago

"So nice to see progress in privacy but please someone explains how GDPR will help EU startups!" Why does everything have to help startups? "GDPR is inevitably going to hinder any new company forced to abide by it." I disagree. You simply shouldn't be collecting that data in most instances anyway. And if you truly do need it, you should have been asking permission before. Somehow we got it into our heads that it was perfectly acceptable to just take things without asking. I'm fairly certain I learned not to do this in Kindergarten. "Entrepreneurs / investors also want their time & money to be used to build value first rather than solve yet another accidental complexity that is irrelevant until your revenue model is proven." The GDPR has no impact on this, unless the only way you can create "value" is by disrespecting your users. You can still build value the old fashioned way, by providing something of use to your users.