10 ms·

If this kind of request is a "nightmare" or too much of a burden, they should automate it. "We put lots of engineering effort into mining your personal data an

If this kind of request is a "nightmare" or too much of a burden, they should automate it. "We put lots of engineering effort into mining your personal data and selling bits to other people, but we can't be bothered to put any engineering effort into disclosing on your profile or account-settings page what we're doing with your data." A lot of the questions are answerable generically (no differences between users). You can't tell me that writing a data privacy FAQ with those answers in clear, simple language, once, with a link on every page and on users' profiles, is an excessive burden. These companies just don't want to have even that minimal burden and process to ensure that changes in usage of personal data get documented and updated on such a faq.

Silhouette 9y ago
The GDPR applies as much to a startup or side business as it does to Facebook and Google. A letter like this would be a hugely disproportionate burden to a small business like that. It would take many hours, if not days, to reply properly to all of those points, even for a business that is doing nothing shady or unusual. You can't just write "automate it" as if that has no cost.
- harshreality 9y ago
  What's an example of a start-up collecting personal information, using it in a complex way that can't be summarized in a few paragraphs, but being unfairly burdened by this? If a start-up is doing things with personal data so that answering those questions takes more than a few paragraphs, isn't the start-up pretty much a personal-information-processing business, and doesn't it deserve to have the burden? Doubly so because start-ups often leave security considerations for later; any personal information they collect or share may not even meet the minimal industry standards and expectations of larger companies (not that such informal standards are adequate—those larger companies are often incompetent themselves).
  - Silhouette 9y ago
    What's an example of a start-up collecting personal information, using it in a complex way that can't be summarized in a few paragraphs, but being unfairly burdened by this? It doesn't have to be doing any of that. Just the time and money to have a lawyer review this letter and identify the actual obligations is already a significant burden. For example, notice that just replying with everything requested here would in itself potentially breach data protection law.
    - akshatpradhan 9y ago
      All you’re telling me is that your Agile Startup doesnt have: 1) an updated Asset Inventory 2) a Data Classification Scheme 3) Data Labeling Policy & Procedure Those are basic components of an InfoSec 101 course taught by Community Colleges and the top basic items GDPR is wanting.
      - Silhouette 9y ago
        The GDPR is an EU regulation, but you appear to be adopting some US(?) based conventions and terminology, and then posting a string of buzzwords that have little if any connection to the subject at hand. Also, are you seriously suggesting that in response to a formal legal communication it's a good idea to reply without having input from a lawyer?
        discoursism 9y ago
        You probably need a lawyer to help you write the document the first time, and to update it when you make new partnerships or develop major new pipelines for data. You probably don't need a lawyer every time you receive such a letter.
        Silhouette 9y ago
        You probably don't need a lawyer every time you receive such a letter. For routine enquiries, maybe not. For a letter like this, from someone who is clearly intending to trip you up and cause trouble, our lawyer is the first call I'm making, every time. And that initial conversation is already going to cost me hundreds of pounds and a half-day of work, even if I already have reasonable answers to anything we are actually required to respond with under the GDPR here.
- SllX 9y ago
  I just read through this "Nightmare Letter" and while the cost is definitely non-zero, a conscientious startup will have the same answer for each user for almost every single point and can have a boilerplate response ready to go in those cases. Where it gets complicated, i.e. where they buy your data from 3rd parties, I don't have a lot of sympathy for any of the complications involved. Most of the rest can be automated, not for a non-zero cost, but for a relatively low one if a startup goes in with these questions in mind, prepared to answer them when they come up.
  - Silhouette 9y ago
    a conscientious startup ... can have a boilerplate response ready to go in those cases I have businesses that don't do anything shady at all with personal data, and I'd like to think we're conscientious about handling what we do have. We follow general good practice in terms of encryption, hashing passwords, and so on. We've never had any sort of request for information under existing data protection rules, nor complaints under any other regulatory regime for that matter. So, how much time and money should we spend putting together that boilerplate, just to tick a legal box? How much of the documentation formally required under the GDPR should we actually write, given that on the evidence of several years of trading so far it has literally no value to anyone? How much should we spend on things like getting lawyers to review the contracts we have with the small number of outside services we do use, which might have access to some personal data in connection with the services they provide for us, and how often? If you actually follow the letter of the law here, the costs of compliance would be astronomical by small business standards. There is little proportionately built into the GDPR itself, so we are reliant on regulators to introduce it, and that's not a good position to be in either legally or practically.
    - gingerlime 9y ago
      That's what bothers me the most about the GDPR. There's total lack of proportionality. Here's how the potential fines are defined: Under GDPR organizations in breach of GDPR can be fined up to 4% of annual global turnover or €20 Million (whichever is greater). whichever is greater... So since my company's turnover is order of magnitude less than €20 Million, I guess this means we can get totally buried??
- nerdponx 9y ago
  I imagine most small companies would have you as a single joining key in a MySQL database somewhere. Most of those answers would be the same for every customer anyway.
- maxxxxx 9y ago
  This looks like a fantastic opportunity for startups to help automating the process.
  - hedora 9y ago
    I’d pay for a browser plugin that sent this to every company that attempted to set a third party cookie on my browser, but I don’t live in Europe and doubt that’s what you meant. ;-)
  - wyager 9y ago
    After this whole process of ineffectual, burdensome regulation followed by inconvenient, expensive, mediocre regulatory automation, how much better off is society?
    - maxxxxx 9y ago
      Are you sarcastic or do you mean it?
    - akshatpradhan 9y ago
      You’re saying the following from GDPR doesn’t help? * Data Classifications * Privacy Impact Assessmemts * Breach Escalations * Access Controls That’s more like Security 101 Basics to me.
    - lagadu 9y ago
      > how much better off is society? We should ask that to the dozens of millions of Americans who have their private data for sale even as I type this after the Equifax breach. Bonus: we can literally buy it and use that data to contact them directly and ask :)
      - wyager 9y ago
        Are you willing to bet money on there being no data breaches from GPDR compliant companies in the next N years?
  - ThePhysicist 9y ago
- ThePhysicist 9y ago
  I don't know, would it really be so complicated for most businesses? Taking my former SaaS business as an exmaple, I would have needed to gather the required information from two sources basically: - Our database (containing user data like login, e-mail etc.) - Our third-party SaaS providers such as Mailchimp (e-mail address and name), Mailjet (no personal data stored directly there) and Stripe (transaction history). Automatically pulling together the necessary information from these sources and sending it to the user seems totally doable and not overly complex. In general, I think the whole idea behind these rights is to incentivize companies to implement well-documented and automated processes for dealing with user data, and to keep the data in as few places as possible. BTW I'd be very interested to hear from people running startups how they process user data and how many different data stores / services they use to manage that data!
  - Silhouette 9y ago
    In general, I think the whole idea behind these rights is to incentivize companies to implement well-documented and automated processes for dealing with user data, and to keep the data in as few places as possible. That in itself is reasonable, but it lacks the proportionality aspect that is so important. My own objections to the GDPR aren't about the spirit in which it's intended; while you might not guess it from my comments on HN today, I'm generally a very strong advocate of privacy safeguards. Instead, my concern is the amount of additional red tape and ambiguous obligations that the GDPR appears to be introducing for what ought to come down to simple questions like whether you are using personal data only for legitimate purposes and you are storing it safely, which plenty of us already were anyway.
    - sbov 9y ago
      I'm kinda in your boat. IMHO, GDPR needed something for small businesses. If you're doing reasonable, expected stuff with your small businesses and you reply as such to the example letter, there should be no need to use a lawyer. And it should be codified in the law, rather than relying on prosecutorial discretion. There should be a distinct "If you adopt these reasonable policies, you are legally in compliance with GDPR".
    - 9y ago

Silhouette 9y ago

The GDPR applies as much to a startup or side business as it does to Facebook and Google. A letter like this would be a hugely disproportionate burden to a small business like that. It would take many hours, if not days, to reply properly to all of those points, even for a business that is doing nothing shady or unusual. You can't just write "automate it" as if that has no cost.

harshreality 9y ago
What's an example of a start-up collecting personal information, using it in a complex way that can't be summarized in a few paragraphs, but being unfairly burdened by this? If a start-up is doing things with personal data so that answering those questions takes more than a few paragraphs, isn't the start-up pretty much a personal-information-processing business, and doesn't it deserve to have the burden? Doubly so because start-ups often leave security considerations for later; any personal information they collect or share may not even meet the minimal industry standards and expectations of larger companies (not that such informal standards are adequate—those larger companies are often incompetent themselves).
- Silhouette 9y ago
  What's an example of a start-up collecting personal information, using it in a complex way that can't be summarized in a few paragraphs, but being unfairly burdened by this? It doesn't have to be doing any of that. Just the time and money to have a lawyer review this letter and identify the actual obligations is already a significant burden. For example, notice that just replying with everything requested here would in itself potentially breach data protection law.
  - akshatpradhan 9y ago
    All you’re telling me is that your Agile Startup doesnt have: 1) an updated Asset Inventory 2) a Data Classification Scheme 3) Data Labeling Policy & Procedure Those are basic components of an InfoSec 101 course taught by Community Colleges and the top basic items GDPR is wanting.
    - Silhouette 9y ago
      The GDPR is an EU regulation, but you appear to be adopting some US(?) based conventions and terminology, and then posting a string of buzzwords that have little if any connection to the subject at hand. Also, are you seriously suggesting that in response to a formal legal communication it's a good idea to reply without having input from a lawyer?
      - discoursism 9y ago
        You probably need a lawyer to help you write the document the first time, and to update it when you make new partnerships or develop major new pipelines for data. You probably don't need a lawyer every time you receive such a letter.
        Silhouette 9y ago
        You probably don't need a lawyer every time you receive such a letter. For routine enquiries, maybe not. For a letter like this, from someone who is clearly intending to trip you up and cause trouble, our lawyer is the first call I'm making, every time. And that initial conversation is already going to cost me hundreds of pounds and a half-day of work, even if I already have reasonable answers to anything we are actually required to respond with under the GDPR here.
SllX 9y ago
I just read through this "Nightmare Letter" and while the cost is definitely non-zero, a conscientious startup will have the same answer for each user for almost every single point and can have a boilerplate response ready to go in those cases. Where it gets complicated, i.e. where they buy your data from 3rd parties, I don't have a lot of sympathy for any of the complications involved. Most of the rest can be automated, not for a non-zero cost, but for a relatively low one if a startup goes in with these questions in mind, prepared to answer them when they come up.
- Silhouette 9y ago
  a conscientious startup ... can have a boilerplate response ready to go in those cases I have businesses that don't do anything shady at all with personal data, and I'd like to think we're conscientious about handling what we do have. We follow general good practice in terms of encryption, hashing passwords, and so on. We've never had any sort of request for information under existing data protection rules, nor complaints under any other regulatory regime for that matter. So, how much time and money should we spend putting together that boilerplate, just to tick a legal box? How much of the documentation formally required under the GDPR should we actually write, given that on the evidence of several years of trading so far it has literally no value to anyone? How much should we spend on things like getting lawyers to review the contracts we have with the small number of outside services we do use, which might have access to some personal data in connection with the services they provide for us, and how often? If you actually follow the letter of the law here, the costs of compliance would be astronomical by small business standards. There is little proportionately built into the GDPR itself, so we are reliant on regulators to introduce it, and that's not a good position to be in either legally or practically.
  - gingerlime 9y ago
    That's what bothers me the most about the GDPR. There's total lack of proportionality. Here's how the potential fines are defined: Under GDPR organizations in breach of GDPR can be fined up to 4% of annual global turnover or €20 Million (whichever is greater). whichever is greater... So since my company's turnover is order of magnitude less than €20 Million, I guess this means we can get totally buried??
nerdponx 9y ago
I imagine most small companies would have you as a single joining key in a MySQL database somewhere. Most of those answers would be the same for every customer anyway.
maxxxxx 9y ago
This looks like a fantastic opportunity for startups to help automating the process.
- hedora 9y ago
  I’d pay for a browser plugin that sent this to every company that attempted to set a third party cookie on my browser, but I don’t live in Europe and doubt that’s what you meant. ;-)
- wyager 9y ago
  After this whole process of ineffectual, burdensome regulation followed by inconvenient, expensive, mediocre regulatory automation, how much better off is society?
  - maxxxxx 9y ago
    Are you sarcastic or do you mean it?
  - akshatpradhan 9y ago
    You’re saying the following from GDPR doesn’t help? * Data Classifications * Privacy Impact Assessmemts * Breach Escalations * Access Controls That’s more like Security 101 Basics to me.
  - lagadu 9y ago
    > how much better off is society? We should ask that to the dozens of millions of Americans who have their private data for sale even as I type this after the Equifax breach. Bonus: we can literally buy it and use that data to contact them directly and ask :)
    - wyager 9y ago
      Are you willing to bet money on there being no data breaches from GPDR compliant companies in the next N years?
- ThePhysicist 9y ago
ThePhysicist 9y ago
I don't know, would it really be so complicated for most businesses? Taking my former SaaS business as an exmaple, I would have needed to gather the required information from two sources basically: - Our database (containing user data like login, e-mail etc.) - Our third-party SaaS providers such as Mailchimp (e-mail address and name), Mailjet (no personal data stored directly there) and Stripe (transaction history). Automatically pulling together the necessary information from these sources and sending it to the user seems totally doable and not overly complex. In general, I think the whole idea behind these rights is to incentivize companies to implement well-documented and automated processes for dealing with user data, and to keep the data in as few places as possible. BTW I'd be very interested to hear from people running startups how they process user data and how many different data stores / services they use to manage that data!
- Silhouette 9y ago
  In general, I think the whole idea behind these rights is to incentivize companies to implement well-documented and automated processes for dealing with user data, and to keep the data in as few places as possible. That in itself is reasonable, but it lacks the proportionality aspect that is so important. My own objections to the GDPR aren't about the spirit in which it's intended; while you might not guess it from my comments on HN today, I'm generally a very strong advocate of privacy safeguards. Instead, my concern is the amount of additional red tape and ambiguous obligations that the GDPR appears to be introducing for what ought to come down to simple questions like whether you are using personal data only for legitimate purposes and you are storing it safely, which plenty of us already were anyway.
  - sbov 9y ago
    I'm kinda in your boat. IMHO, GDPR needed something for small businesses. If you're doing reasonable, expected stuff with your small businesses and you reply as such to the example letter, there should be no need to use a lawyer. And it should be codified in the law, rather than relying on prosecutorial discretion. There should be a distinct "If you adopt these reasonable policies, you are legally in compliance with GDPR".
  - 9y ago