5 ms·

Or you are an early-stage startup with just a couple founders trying to do everything.

setquk 9y ago
Incidentally the minimum viable products that the early stage startups with two founders are kicking off are the ones that are most likely to put your data at risk. This is fair and just.
detaro 9y ago
What exactly about being a startup makes this a lot harder? I'd expect a startup would in many cases have a fairly easy time answering requests like this, since it won't have built years worth of legacy systems, half-abandoned projects, weird cross-department data accesses etc that could catch a large company here. You'll likely have fairly centralized storage and a reasonable number of service providers you use for specific purposes. + the typical startup has more or less the same relationship with every customer, so it should be fairly easily repeatable once you've documented it once. For the few small companies I've worked for, this would have been a bit of work once (document the dataflows), and then a fairly easy set of queries to be repeated each time.
- montrose 9y ago
  Having fewer people. The task may only be 1/100 as hard for a startup as for Google, but there are 1/10,000 as many people to perform it. If so, the burden on the startup is 100x greater than on Google.
- gingerlime 9y ago
  It's not just about answering the questions. It's also about answering them in a legal-safe way that won't put you in more trouble than not answering them at all. And any small variation in the questions can require someone with legal experience just checking this, which costs money. To add to a sibling comment, Google can afford a big enough legal department for estimated 0.00000x% of their turnover that deals exclusively with these. For smaller organizations, this becomes more like 0.x% of turnover... Not to mention the distraction and plain overhead when you're juggling so many other things.
  - jopsen 9y ago
    > It's also about answering them in a legal-safe way that won't put you in more trouble than not answering them at all By that logic don't you need a lawyer to handle all customer support interaction? Couldn't you get sued to fraud if you fail to document purchases in a legal-safe way?
- rstephenson2 9y ago
  If you work with data security departments at large companies, you get these types of questionnaires all the time already. And every single question has been answered a dozen times before, but each new request's questions have subtle nuances such that it's impossible to build up a FAQ comprehensive enough that a non-technical person could copy-and-paste answers in a legally safe way. You'd think it would be possible, it just isn't. The part that's not clear about the GDPR is whether you're obligated to manually answer any data-related question a user has, or if you can just post a comprehensive FAQ + data export / account deletion tool, and auto-respond to GDPR requests with links to those.
- tedivm 9y ago
  Looking this over, and looking at the startups I've either worked for or applied at, I really don't see how it would take more than a couple of hours to fill out the bulk of this form (the parts that would be reusable for every request after it), and then a couple of database queries for the specific data for the user.
Silhouette 9y ago
Or just one of the almost-all companies that never grows beyond a handful of staff, for that matter. People talk about regulatory matters like the GDPR as if all businesses grow to become large, but here in the UK for example, only about 1 in 25 businesses has more than 10 staff.
bogomipz 9y ago
Why would this be harder? Wouldn't such an early state startup with two people likely have much much fewer users and by extension actual GDPR requests?
- sanderjd 9y ago
  The entire reason the tech startup thing works (to the extent that it does) is leverage: each employee serves a very large multiple of users. Anything that changes that calculation has the potential to eliminate the value proposition.
  - bogomipz 9y ago
    The context is an "early-stage startup with just a couple founders." It's unlikely that the number of requests of the type referenced in this article would be sufficiently large enough at that stage that it wouild "eliminate the value proposition."
geofft 9y ago
Early-stage startups with just a couple of founders who are too overworked to give a good answer about data protection are probably too overworked to actually protect the data itself, law or no law. We generally don't think it's reasonable for an early-stage startup to be too overworked to get their security right - you still have to write secure code, patch your servers, set up HTTPS, etc. Why is this different?
- gingerlime 9y ago
  > you still have to write secure code, patch your servers, set up HTTPS, etc. Why is this different? It's very different. Here you're requested to answer fairly detailed and potentially tripping questions with potential legal implications on your business. This has little with how you secure things technically. It's all about jumping through some bureaucratic hoops, and wasting your time doing it. Answering those questions won't in any way, shape or form improve the security of your business. It's pure distraction.
  - rdiddly 9y ago
    It's not designed to help you. Improving the security is your job. It's designed to reveal, through your answers, whether you're doing it right or not.
  - avianlyric 9y ago
    I think the legal implications people talk about are overwrought. Regulators are more interested in chasing down people who open flaunt the law, rather than repressing startups that can’t cross and dot their legal t and i’s. My personal experience with the ICO has shown their quite lenient to mistakes, if you can show that you’re your honest best, and getting better. No point crushing companies that are trying, better of getting the ones that just don’t care.
    - gingerlime 9y ago
      I certainly hope so. I'm not sure about Germany though. I have a feeling they're much more sticking to the rules (My company is based in Germany, but I'm not German, so it's kind of an outsider's observation). But it's not even just about getting to a point of getting fined or under some kind of investigation or audit. It can be all those clever customers who would use some automated service or a template, just to waste your time ... At least that's what the original post is about, but I hope it won't be too common.
discoursism 9y ago
Hopefully if you are a company that small, you haven't had time to develop multiple data warehouses. You can write up a script to query your single warehouse to get the necessary data. You won't create a unique response for each letter, except for filling in all the user's personal information. Instead, you'll write a letter like: Here is a listing of everything you have a right to know about our company and processes under GDPR: <huge info dump> Here is all of the personal data we have about you: <very long CSV file> Ideally, the most time-consuming part of responding, after the first such letter, will be verifying the user's identity.
lagadu 9y ago
Just because you're an early-stage startup (or virtually any entity really) you're entitled to not protect my data?
jopsen 9y ago
> Or you are an early-stage startup with just a couple founders trying to do everything. Then limit what you record. What do you need to store that isn't visible from peoples user profile when logged in?

Incidentally the minimum viable products that the early stage startups with two founders are kicking off are the ones that are most likely to put your data at risk. This is fair and just.

detaro 9y ago

What exactly about being a startup makes this a lot harder? I'd expect a startup would in many cases have a fairly easy time answering requests like this, since it won't have built years worth of legacy systems, half-abandoned projects, weird cross-department data accesses etc that could catch a large company here. You'll likely have fairly centralized storage and a reasonable number of service providers you use for specific purposes. + the typical startup has more or less the same relationship with every customer, so it should be fairly easily repeatable once you've documented it once. For the few small companies I've worked for, this would have been a bit of work once (document the dataflows), and then a fairly easy set of queries to be repeated each time.

montrose 9y ago
Having fewer people. The task may only be 1/100 as hard for a startup as for Google, but there are 1/10,000 as many people to perform it. If so, the burden on the startup is 100x greater than on Google.
gingerlime 9y ago
It's not just about answering the questions. It's also about answering them in a legal-safe way that won't put you in more trouble than not answering them at all. And any small variation in the questions can require someone with legal experience just checking this, which costs money. To add to a sibling comment, Google can afford a big enough legal department for estimated 0.00000x% of their turnover that deals exclusively with these. For smaller organizations, this becomes more like 0.x% of turnover... Not to mention the distraction and plain overhead when you're juggling so many other things.
- jopsen 9y ago
  > It's also about answering them in a legal-safe way that won't put you in more trouble than not answering them at all By that logic don't you need a lawyer to handle all customer support interaction? Couldn't you get sued to fraud if you fail to document purchases in a legal-safe way?
rstephenson2 9y ago
If you work with data security departments at large companies, you get these types of questionnaires all the time already. And every single question has been answered a dozen times before, but each new request's questions have subtle nuances such that it's impossible to build up a FAQ comprehensive enough that a non-technical person could copy-and-paste answers in a legally safe way. You'd think it would be possible, it just isn't. The part that's not clear about the GDPR is whether you're obligated to manually answer any data-related question a user has, or if you can just post a comprehensive FAQ + data export / account deletion tool, and auto-respond to GDPR requests with links to those.
tedivm 9y ago
Looking this over, and looking at the startups I've either worked for or applied at, I really don't see how it would take more than a couple of hours to fill out the bulk of this form (the parts that would be reusable for every request after it), and then a couple of database queries for the specific data for the user.

Silhouette 9y ago

Or just one of the almost-all companies that never grows beyond a handful of staff, for that matter. People talk about regulatory matters like the GDPR as if all businesses grow to become large, but here in the UK for example, only about 1 in 25 businesses has more than 10 staff.

bogomipz 9y ago

Why would this be harder? Wouldn't such an early state startup with two people likely have much much fewer users and by extension actual GDPR requests?

sanderjd 9y ago
The entire reason the tech startup thing works (to the extent that it does) is leverage: each employee serves a very large multiple of users. Anything that changes that calculation has the potential to eliminate the value proposition.
- bogomipz 9y ago
  The context is an "early-stage startup with just a couple founders." It's unlikely that the number of requests of the type referenced in this article would be sufficiently large enough at that stage that it wouild "eliminate the value proposition."

geofft 9y ago

Early-stage startups with just a couple of founders who are too overworked to give a good answer about data protection are probably too overworked to actually protect the data itself, law or no law. We generally don't think it's reasonable for an early-stage startup to be too overworked to get their security right - you still have to write secure code, patch your servers, set up HTTPS, etc. Why is this different?

gingerlime 9y ago
> you still have to write secure code, patch your servers, set up HTTPS, etc. Why is this different? It's very different. Here you're requested to answer fairly detailed and potentially tripping questions with potential legal implications on your business. This has little with how you secure things technically. It's all about jumping through some bureaucratic hoops, and wasting your time doing it. Answering those questions won't in any way, shape or form improve the security of your business. It's pure distraction.
- rdiddly 9y ago
  It's not designed to help you. Improving the security is your job. It's designed to reveal, through your answers, whether you're doing it right or not.
- avianlyric 9y ago
  I think the legal implications people talk about are overwrought. Regulators are more interested in chasing down people who open flaunt the law, rather than repressing startups that can’t cross and dot their legal t and i’s. My personal experience with the ICO has shown their quite lenient to mistakes, if you can show that you’re your honest best, and getting better. No point crushing companies that are trying, better of getting the ones that just don’t care.
  - gingerlime 9y ago
    I certainly hope so. I'm not sure about Germany though. I have a feeling they're much more sticking to the rules (My company is based in Germany, but I'm not German, so it's kind of an outsider's observation). But it's not even just about getting to a point of getting fined or under some kind of investigation or audit. It can be all those clever customers who would use some automated service or a template, just to waste your time ... At least that's what the original post is about, but I hope it won't be too common.

discoursism 9y ago

Hopefully if you are a company that small, you haven't had time to develop multiple data warehouses. You can write up a script to query your single warehouse to get the necessary data. You won't create a unique response for each letter, except for filling in all the user's personal information. Instead, you'll write a letter like: Here is a listing of everything you have a right to know about our company and processes under GDPR: <huge info dump> Here is all of the personal data we have about you: <very long CSV file> Ideally, the most time-consuming part of responding, after the first such letter, will be verifying the user's identity.

lagadu 9y ago

Just because you're an early-stage startup (or virtually any entity really) you're entitled to not protect my data?

jopsen 9y ago

> Or you are an early-stage startup with just a couple founders trying to do everything. Then limit what you record. What do you need to store that isn't visible from peoples user profile when logged in?