12 ms·

The GDPR applies as much to a startup or side business as it does to Facebook and Google. A letter like this would be a hugely disproportionate burden to a sma

The GDPR applies as much to a startup or side business as it does to Facebook and Google. A letter like this would be a hugely disproportionate burden to a small business like that. It would take many hours, if not days, to reply properly to all of those points, even for a business that is doing nothing shady or unusual. You can't just write "automate it" as if that has no cost.

harshreality 9y ago
What's an example of a start-up collecting personal information, using it in a complex way that can't be summarized in a few paragraphs, but being unfairly burdened by this? If a start-up is doing things with personal data so that answering those questions takes more than a few paragraphs, isn't the start-up pretty much a personal-information-processing business, and doesn't it deserve to have the burden? Doubly so because start-ups often leave security considerations for later; any personal information they collect or share may not even meet the minimal industry standards and expectations of larger companies (not that such informal standards are adequate—those larger companies are often incompetent themselves).
- Silhouette 9y ago
  What's an example of a start-up collecting personal information, using it in a complex way that can't be summarized in a few paragraphs, but being unfairly burdened by this? It doesn't have to be doing any of that. Just the time and money to have a lawyer review this letter and identify the actual obligations is already a significant burden. For example, notice that just replying with everything requested here would in itself potentially breach data protection law.
  - akshatpradhan 9y ago
    All you’re telling me is that your Agile Startup doesnt have: 1) an updated Asset Inventory 2) a Data Classification Scheme 3) Data Labeling Policy & Procedure Those are basic components of an InfoSec 101 course taught by Community Colleges and the top basic items GDPR is wanting.
    - Silhouette 9y ago
      The GDPR is an EU regulation, but you appear to be adopting some US(?) based conventions and terminology, and then posting a string of buzzwords that have little if any connection to the subject at hand. Also, are you seriously suggesting that in response to a formal legal communication it's a good idea to reply without having input from a lawyer?
      - discoursism 9y ago
        You probably need a lawyer to help you write the document the first time, and to update it when you make new partnerships or develop major new pipelines for data. You probably don't need a lawyer every time you receive such a letter.
        Silhouette 9y ago
        You probably don't need a lawyer every time you receive such a letter. For routine enquiries, maybe not. For a letter like this, from someone who is clearly intending to trip you up and cause trouble, our lawyer is the first call I'm making, every time. And that initial conversation is already going to cost me hundreds of pounds and a half-day of work, even if I already have reasonable answers to anything we are actually required to respond with under the GDPR here.
        discoursism 9y ago
        > For a letter like this . . . our lawyer is the first call I'm making /shrug It's your money. You could do that, or you could even light it on fire if you wish. It's no skin off my back. If your company is profitable enough to eat this self-imposed overhead, then its owners will just make less money. If it's not, then leaner competitors will replace it. I'm fine with either outcome.
        Silhouette 9y ago
        In this area, we have no idea which overheads are actually going to prove justified and which are just throwing money away. That's one of my main points here. As I've argued several times on HN recently, a big part of the problem is that if you're running a small business that isn't handling large amounts of personal data but obviously is going to be subject to the GDPR like everyone else, there is no clear indication of what you have to do to be considered reasonably compliant. The GDPR itself is very heavy and has little in the way of moderation for small-scale data controllers/processors, so in practice it's going to come down to interpretation by regulators (and potentially anyone who has rights under the GDPR and wants to make trouble, as in the example we're discussing). If you don't do enough, you potentially face even greater overheads due to formal audits, financial penalties, etc. If you do too much, then as you rightly point out, you leave yourself at a disadvantage compared to competition who don't do as much (and this remains the case even if that competition is knowingly breaking the law as a result, and that in turn doesn't matter if they face no meaningful penalties for it).
  - DanBC 9y ago
    Why are you getting lawyers to review the letter?
    - TomMarius 9y ago
      Because it's hard to correctly understand. That's the point of the letter, it's called nightmare letter because it was specifically crafted to be as confusing and hard to understand as possible.
      - nopriorarrests 9y ago
        I think it's very clear written. It's a nightmare letter because it ticks all the boxes, so to speak -- author asks all possible GDPR-related questions he can ask and business is legally required to respond to.
      - DanBC 9y ago
        It's not hard to understand. It's only hard to understand if you've built your business around slurping people's data and using it without consent - something that's already mostly illegal in the EU. A lot of GDPR is not new. It's just clarification of existing law.
        TomMarius 9y ago
        Not true. You're right in case of Germany and some other western countries, but it's completely new for most countries, especially to the east.
  - GordonS 9y ago
    A lawyer? Don't you think that's just a tad excessive?
    - Silhouette 9y ago
      Maybe for routine requests, but not when you get a letter on a legal matter from someone who is clearly looking to cause trouble.
      - mrguyorama 9y ago
        Making sure your company isn't screwing me over by throwing my personal information around willy-nilly isn't "looking for trouble"
        Silhouette 9y ago
        Perhaps, but making sure a company isn't screwing you over by throwing your personal information around willy-nilly doesn't require opening with a direct threat and then listing 40 or so different demands for information, several of which are technicalities which have little relevance to determining whether or not the data is really being handled safely and responsibly anyway. A normal person who really was worried about how their data was being used would probably write a polite letter asking what data was being stored, how it was being used, and maybe a couple of supplementary points if they had particular concerns or perhaps had heard a warning about some specific practice that could be dangerous.
        mrguyorama 9y ago
        Why do companies deserve the benefit of the doubt anymore?
- sgustard 9y ago
  Take the simple and common case of a startup storing personal data on an AWS-hosted service. Can you account for who at Amazon has access to that AWS instance, how many physical copies of the data may exist in Amazon's data centers, how you can assure that deleted data is really deleted, and so on?
  - kbenson 9y ago
    If you're using AWS for your business/startup to store customer information and you don't have good answers for this already, then you aren't doing your due diligence. To be clear, many businesses may not have good answers right now. Their response should not be "this is too much of a burden" but instead "wow, we really need to find this out ASAP".
  - minaguib 9y ago
    This one's on the easy side. The company is the controller of the data, and Amazon is the processor. Here's Amazon's declaration and stance, stating they are GDPR-compliant both as a company (when they are the controller - of their direct customers' data), as well as then they are a processor (infra for use by others who control private data): https://aws.amazon.com/compliance/gdpr-center/ https://aws.amazon.com/compliance/gdpr-center/ There's generally no need for a controller who relays data to a processor to understand the intricacies of the implementation on the processor's side (is deleted data really deleted ?) - what's more important is the processor's self-declaration for GDPR compliance. The above is my personal $0.02 as I've been spending quite some time getting into GDPR recently. IANAL
SllX 9y ago
I just read through this "Nightmare Letter" and while the cost is definitely non-zero, a conscientious startup will have the same answer for each user for almost every single point and can have a boilerplate response ready to go in those cases. Where it gets complicated, i.e. where they buy your data from 3rd parties, I don't have a lot of sympathy for any of the complications involved. Most of the rest can be automated, not for a non-zero cost, but for a relatively low one if a startup goes in with these questions in mind, prepared to answer them when they come up.
- Silhouette 9y ago
  a conscientious startup ... can have a boilerplate response ready to go in those cases I have businesses that don't do anything shady at all with personal data, and I'd like to think we're conscientious about handling what we do have. We follow general good practice in terms of encryption, hashing passwords, and so on. We've never had any sort of request for information under existing data protection rules, nor complaints under any other regulatory regime for that matter. So, how much time and money should we spend putting together that boilerplate, just to tick a legal box? How much of the documentation formally required under the GDPR should we actually write, given that on the evidence of several years of trading so far it has literally no value to anyone? How much should we spend on things like getting lawyers to review the contracts we have with the small number of outside services we do use, which might have access to some personal data in connection with the services they provide for us, and how often? If you actually follow the letter of the law here, the costs of compliance would be astronomical by small business standards. There is little proportionately built into the GDPR itself, so we are reliant on regulators to introduce it, and that's not a good position to be in either legally or practically.
  - gingerlime 9y ago
    That's what bothers me the most about the GDPR. There's total lack of proportionality. Here's how the potential fines are defined: Under GDPR organizations in breach of GDPR can be fined up to 4% of annual global turnover or €20 Million (whichever is greater). whichever is greater... So since my company's turnover is order of magnitude less than €20 Million, I guess this means we can get totally buried??
nerdponx 9y ago
I imagine most small companies would have you as a single joining key in a MySQL database somewhere. Most of those answers would be the same for every customer anyway.
maxxxxx 9y ago
This looks like a fantastic opportunity for startups to help automating the process.
- hedora 9y ago
  I’d pay for a browser plugin that sent this to every company that attempted to set a third party cookie on my browser, but I don’t live in Europe and doubt that’s what you meant. ;-)
- wyager 9y ago
  After this whole process of ineffectual, burdensome regulation followed by inconvenient, expensive, mediocre regulatory automation, how much better off is society?
  - maxxxxx 9y ago
    Are you sarcastic or do you mean it?
  - akshatpradhan 9y ago
    You’re saying the following from GDPR doesn’t help? * Data Classifications * Privacy Impact Assessmemts * Breach Escalations * Access Controls That’s more like Security 101 Basics to me.
  - lagadu 9y ago
    > how much better off is society? We should ask that to the dozens of millions of Americans who have their private data for sale even as I type this after the Equifax breach. Bonus: we can literally buy it and use that data to contact them directly and ask :)
    - wyager 9y ago
      Are you willing to bet money on there being no data breaches from GPDR compliant companies in the next N years?
- ThePhysicist 9y ago
ThePhysicist 9y ago
I don't know, would it really be so complicated for most businesses? Taking my former SaaS business as an exmaple, I would have needed to gather the required information from two sources basically: - Our database (containing user data like login, e-mail etc.) - Our third-party SaaS providers such as Mailchimp (e-mail address and name), Mailjet (no personal data stored directly there) and Stripe (transaction history). Automatically pulling together the necessary information from these sources and sending it to the user seems totally doable and not overly complex. In general, I think the whole idea behind these rights is to incentivize companies to implement well-documented and automated processes for dealing with user data, and to keep the data in as few places as possible. BTW I'd be very interested to hear from people running startups how they process user data and how many different data stores / services they use to manage that data!
- Silhouette 9y ago
  In general, I think the whole idea behind these rights is to incentivize companies to implement well-documented and automated processes for dealing with user data, and to keep the data in as few places as possible. That in itself is reasonable, but it lacks the proportionality aspect that is so important. My own objections to the GDPR aren't about the spirit in which it's intended; while you might not guess it from my comments on HN today, I'm generally a very strong advocate of privacy safeguards. Instead, my concern is the amount of additional red tape and ambiguous obligations that the GDPR appears to be introducing for what ought to come down to simple questions like whether you are using personal data only for legitimate purposes and you are storing it safely, which plenty of us already were anyway.
  - sbov 9y ago
    I'm kinda in your boat. IMHO, GDPR needed something for small businesses. If you're doing reasonable, expected stuff with your small businesses and you reply as such to the example letter, there should be no need to use a lawyer. And it should be codified in the law, rather than relying on prosecutorial discretion. There should be a distinct "If you adopt these reasonable policies, you are legally in compliance with GDPR".
  - 9y ago

harshreality 9y ago

What's an example of a start-up collecting personal information, using it in a complex way that can't be summarized in a few paragraphs, but being unfairly burdened by this? If a start-up is doing things with personal data so that answering those questions takes more than a few paragraphs, isn't the start-up pretty much a personal-information-processing business, and doesn't it deserve to have the burden? Doubly so because start-ups often leave security considerations for later; any personal information they collect or share may not even meet the minimal industry standards and expectations of larger companies (not that such informal standards are adequate—those larger companies are often incompetent themselves).

Silhouette 9y ago
What's an example of a start-up collecting personal information, using it in a complex way that can't be summarized in a few paragraphs, but being unfairly burdened by this? It doesn't have to be doing any of that. Just the time and money to have a lawyer review this letter and identify the actual obligations is already a significant burden. For example, notice that just replying with everything requested here would in itself potentially breach data protection law.
- akshatpradhan 9y ago
  All you’re telling me is that your Agile Startup doesnt have: 1) an updated Asset Inventory 2) a Data Classification Scheme 3) Data Labeling Policy & Procedure Those are basic components of an InfoSec 101 course taught by Community Colleges and the top basic items GDPR is wanting.
  - Silhouette 9y ago
    The GDPR is an EU regulation, but you appear to be adopting some US(?) based conventions and terminology, and then posting a string of buzzwords that have little if any connection to the subject at hand. Also, are you seriously suggesting that in response to a formal legal communication it's a good idea to reply without having input from a lawyer?
    - discoursism 9y ago
      You probably need a lawyer to help you write the document the first time, and to update it when you make new partnerships or develop major new pipelines for data. You probably don't need a lawyer every time you receive such a letter.
      - Silhouette 9y ago
        You probably don't need a lawyer every time you receive such a letter. For routine enquiries, maybe not. For a letter like this, from someone who is clearly intending to trip you up and cause trouble, our lawyer is the first call I'm making, every time. And that initial conversation is already going to cost me hundreds of pounds and a half-day of work, even if I already have reasonable answers to anything we are actually required to respond with under the GDPR here.
        discoursism 9y ago
        > For a letter like this . . . our lawyer is the first call I'm making /shrug It's your money. You could do that, or you could even light it on fire if you wish. It's no skin off my back. If your company is profitable enough to eat this self-imposed overhead, then its owners will just make less money. If it's not, then leaner competitors will replace it. I'm fine with either outcome.
        Silhouette 9y ago
        In this area, we have no idea which overheads are actually going to prove justified and which are just throwing money away. That's one of my main points here. As I've argued several times on HN recently, a big part of the problem is that if you're running a small business that isn't handling large amounts of personal data but obviously is going to be subject to the GDPR like everyone else, there is no clear indication of what you have to do to be considered reasonably compliant. The GDPR itself is very heavy and has little in the way of moderation for small-scale data controllers/processors, so in practice it's going to come down to interpretation by regulators (and potentially anyone who has rights under the GDPR and wants to make trouble, as in the example we're discussing). If you don't do enough, you potentially face even greater overheads due to formal audits, financial penalties, etc. If you do too much, then as you rightly point out, you leave yourself at a disadvantage compared to competition who don't do as much (and this remains the case even if that competition is knowingly breaking the law as a result, and that in turn doesn't matter if they face no meaningful penalties for it).
- DanBC 9y ago
  Why are you getting lawyers to review the letter?
  - TomMarius 9y ago
    Because it's hard to correctly understand. That's the point of the letter, it's called nightmare letter because it was specifically crafted to be as confusing and hard to understand as possible.
    - nopriorarrests 9y ago
      I think it's very clear written. It's a nightmare letter because it ticks all the boxes, so to speak -- author asks all possible GDPR-related questions he can ask and business is legally required to respond to.
    - DanBC 9y ago
      It's not hard to understand. It's only hard to understand if you've built your business around slurping people's data and using it without consent - something that's already mostly illegal in the EU. A lot of GDPR is not new. It's just clarification of existing law.
      - TomMarius 9y ago
        Not true. You're right in case of Germany and some other western countries, but it's completely new for most countries, especially to the east.
- GordonS 9y ago
  A lawyer? Don't you think that's just a tad excessive?
  - Silhouette 9y ago
    Maybe for routine requests, but not when you get a letter on a legal matter from someone who is clearly looking to cause trouble.
    - mrguyorama 9y ago
      Making sure your company isn't screwing me over by throwing my personal information around willy-nilly isn't "looking for trouble"
      - Silhouette 9y ago
        Perhaps, but making sure a company isn't screwing you over by throwing your personal information around willy-nilly doesn't require opening with a direct threat and then listing 40 or so different demands for information, several of which are technicalities which have little relevance to determining whether or not the data is really being handled safely and responsibly anyway. A normal person who really was worried about how their data was being used would probably write a polite letter asking what data was being stored, how it was being used, and maybe a couple of supplementary points if they had particular concerns or perhaps had heard a warning about some specific practice that could be dangerous.
        mrguyorama 9y ago
        Why do companies deserve the benefit of the doubt anymore?
sgustard 9y ago
Take the simple and common case of a startup storing personal data on an AWS-hosted service. Can you account for who at Amazon has access to that AWS instance, how many physical copies of the data may exist in Amazon's data centers, how you can assure that deleted data is really deleted, and so on?
- kbenson 9y ago
  If you're using AWS for your business/startup to store customer information and you don't have good answers for this already, then you aren't doing your due diligence. To be clear, many businesses may not have good answers right now. Their response should not be "this is too much of a burden" but instead "wow, we really need to find this out ASAP".
- minaguib 9y ago
  This one's on the easy side. The company is the controller of the data, and Amazon is the processor. Here's Amazon's declaration and stance, stating they are GDPR-compliant both as a company (when they are the controller - of their direct customers' data), as well as then they are a processor (infra for use by others who control private data): https://aws.amazon.com/compliance/gdpr-center/ https://aws.amazon.com/compliance/gdpr-center/ There's generally no need for a controller who relays data to a processor to understand the intricacies of the implementation on the processor's side (is deleted data really deleted ?) - what's more important is the processor's self-declaration for GDPR compliance. The above is my personal $0.02 as I've been spending quite some time getting into GDPR recently. IANAL

SllX 9y ago

I just read through this "Nightmare Letter" and while the cost is definitely non-zero, a conscientious startup will have the same answer for each user for almost every single point and can have a boilerplate response ready to go in those cases. Where it gets complicated, i.e. where they buy your data from 3rd parties, I don't have a lot of sympathy for any of the complications involved. Most of the rest can be automated, not for a non-zero cost, but for a relatively low one if a startup goes in with these questions in mind, prepared to answer them when they come up.

Silhouette 9y ago
a conscientious startup ... can have a boilerplate response ready to go in those cases I have businesses that don't do anything shady at all with personal data, and I'd like to think we're conscientious about handling what we do have. We follow general good practice in terms of encryption, hashing passwords, and so on. We've never had any sort of request for information under existing data protection rules, nor complaints under any other regulatory regime for that matter. So, how much time and money should we spend putting together that boilerplate, just to tick a legal box? How much of the documentation formally required under the GDPR should we actually write, given that on the evidence of several years of trading so far it has literally no value to anyone? How much should we spend on things like getting lawyers to review the contracts we have with the small number of outside services we do use, which might have access to some personal data in connection with the services they provide for us, and how often? If you actually follow the letter of the law here, the costs of compliance would be astronomical by small business standards. There is little proportionately built into the GDPR itself, so we are reliant on regulators to introduce it, and that's not a good position to be in either legally or practically.
- gingerlime 9y ago
  That's what bothers me the most about the GDPR. There's total lack of proportionality. Here's how the potential fines are defined: Under GDPR organizations in breach of GDPR can be fined up to 4% of annual global turnover or €20 Million (whichever is greater). whichever is greater... So since my company's turnover is order of magnitude less than €20 Million, I guess this means we can get totally buried??

nerdponx 9y ago

I imagine most small companies would have you as a single joining key in a MySQL database somewhere. Most of those answers would be the same for every customer anyway.

maxxxxx 9y ago

This looks like a fantastic opportunity for startups to help automating the process.

hedora 9y ago
I’d pay for a browser plugin that sent this to every company that attempted to set a third party cookie on my browser, but I don’t live in Europe and doubt that’s what you meant. ;-)
wyager 9y ago
After this whole process of ineffectual, burdensome regulation followed by inconvenient, expensive, mediocre regulatory automation, how much better off is society?
- maxxxxx 9y ago
  Are you sarcastic or do you mean it?
- akshatpradhan 9y ago
  You’re saying the following from GDPR doesn’t help? * Data Classifications * Privacy Impact Assessmemts * Breach Escalations * Access Controls That’s more like Security 101 Basics to me.
- lagadu 9y ago
  > how much better off is society? We should ask that to the dozens of millions of Americans who have their private data for sale even as I type this after the Equifax breach. Bonus: we can literally buy it and use that data to contact them directly and ask :)
  - wyager 9y ago
    Are you willing to bet money on there being no data breaches from GPDR compliant companies in the next N years?
ThePhysicist 9y ago

ThePhysicist 9y ago

I don't know, would it really be so complicated for most businesses? Taking my former SaaS business as an exmaple, I would have needed to gather the required information from two sources basically: - Our database (containing user data like login, e-mail etc.) - Our third-party SaaS providers such as Mailchimp (e-mail address and name), Mailjet (no personal data stored directly there) and Stripe (transaction history). Automatically pulling together the necessary information from these sources and sending it to the user seems totally doable and not overly complex. In general, I think the whole idea behind these rights is to incentivize companies to implement well-documented and automated processes for dealing with user data, and to keep the data in as few places as possible. BTW I'd be very interested to hear from people running startups how they process user data and how many different data stores / services they use to manage that data!

Silhouette 9y ago
In general, I think the whole idea behind these rights is to incentivize companies to implement well-documented and automated processes for dealing with user data, and to keep the data in as few places as possible. That in itself is reasonable, but it lacks the proportionality aspect that is so important. My own objections to the GDPR aren't about the spirit in which it's intended; while you might not guess it from my comments on HN today, I'm generally a very strong advocate of privacy safeguards. Instead, my concern is the amount of additional red tape and ambiguous obligations that the GDPR appears to be introducing for what ought to come down to simple questions like whether you are using personal data only for legitimate purposes and you are storing it safely, which plenty of us already were anyway.
- sbov 9y ago
  I'm kinda in your boat. IMHO, GDPR needed something for small businesses. If you're doing reasonable, expected stuff with your small businesses and you reply as such to the example letter, there should be no need to use a lawyer. And it should be codified in the law, rather than relying on prosecutorial discretion. There should be a distinct "If you adopt these reasonable policies, you are legally in compliance with GDPR".
- 9y ago