17 ms·

What's an example of a start-up collecting personal information, using it in a complex way that can't be summarized in a few paragraphs, but being unfairly burd

What's an example of a start-up collecting personal information, using it in a complex way that can't be summarized in a few paragraphs, but being unfairly burdened by this? If a start-up is doing things with personal data so that answering those questions takes more than a few paragraphs, isn't the start-up pretty much a personal-information-processing business, and doesn't it deserve to have the burden? Doubly so because start-ups often leave security considerations for later; any personal information they collect or share may not even meet the minimal industry standards and expectations of larger companies (not that such informal standards are adequate—those larger companies are often incompetent themselves).

Silhouette 9y ago
What's an example of a start-up collecting personal information, using it in a complex way that can't be summarized in a few paragraphs, but being unfairly burdened by this? It doesn't have to be doing any of that. Just the time and money to have a lawyer review this letter and identify the actual obligations is already a significant burden. For example, notice that just replying with everything requested here would in itself potentially breach data protection law.
- akshatpradhan 9y ago
  All you’re telling me is that your Agile Startup doesnt have: 1) an updated Asset Inventory 2) a Data Classification Scheme 3) Data Labeling Policy & Procedure Those are basic components of an InfoSec 101 course taught by Community Colleges and the top basic items GDPR is wanting.
  - Silhouette 9y ago
    The GDPR is an EU regulation, but you appear to be adopting some US(?) based conventions and terminology, and then posting a string of buzzwords that have little if any connection to the subject at hand. Also, are you seriously suggesting that in response to a formal legal communication it's a good idea to reply without having input from a lawyer?
    - discoursism 9y ago
      You probably need a lawyer to help you write the document the first time, and to update it when you make new partnerships or develop major new pipelines for data. You probably don't need a lawyer every time you receive such a letter.
      - Silhouette 9y ago
        You probably don't need a lawyer every time you receive such a letter. For routine enquiries, maybe not. For a letter like this, from someone who is clearly intending to trip you up and cause trouble, our lawyer is the first call I'm making, every time. And that initial conversation is already going to cost me hundreds of pounds and a half-day of work, even if I already have reasonable answers to anything we are actually required to respond with under the GDPR here.
        discoursism 9y ago
        > For a letter like this . . . our lawyer is the first call I'm making /shrug It's your money. You could do that, or you could even light it on fire if you wish. It's no skin off my back. If your company is profitable enough to eat this self-imposed overhead, then its owners will just make less money. If it's not, then leaner competitors will replace it. I'm fine with either outcome.
        Silhouette 9y ago
        In this area, we have no idea which overheads are actually going to prove justified and which are just throwing money away. That's one of my main points here. As I've argued several times on HN recently, a big part of the problem is that if you're running a small business that isn't handling large amounts of personal data but obviously is going to be subject to the GDPR like everyone else, there is no clear indication of what you have to do to be considered reasonably compliant. The GDPR itself is very heavy and has little in the way of moderation for small-scale data controllers/processors, so in practice it's going to come down to interpretation by regulators (and potentially anyone who has rights under the GDPR and wants to make trouble, as in the example we're discussing). If you don't do enough, you potentially face even greater overheads due to formal audits, financial penalties, etc. If you do too much, then as you rightly point out, you leave yourself at a disadvantage compared to competition who don't do as much (and this remains the case even if that competition is knowingly breaking the law as a result, and that in turn doesn't matter if they face no meaningful penalties for it).
  - eximius 9y ago
    Yes, I can just imagine this is the first thing I'd do when starting a business. /s
    - ncallaway 9y ago
      Okay, that's fair. Don't do those things when you start a business. But, then, don't have your business collect and process data on individuals.
      - delecti 9y ago
        > Don't do those things when you start a business. > But, then, don't have your business collect and process data on individuals. Aren't those two statements together effectively equivalent to "don't ever start certain kinds of businesses"?
        toomuchtodo 9y ago
        That’s the goal. My data is my data, not the fundemental requirement of some businesses.
        delecti 9y ago
        I certainly respect your desire for no businesses to have certain pieces of of your personal data, but there's a difference between "I don't want to be a customer of certain kinds of businesses" and "such businesses shouldn't exist at all". And beside that, regulations that effectively result in prohibiting certain kinds of businesses even though they don't explicitly do so are bad regulations IMO.
        toomuchtodo 9y ago
        I understand your sentiment, but we’ve swung so far towards the unrelenting abuse of consumer data, I’m supportive of regulation through any means necessary. To your point, if a business is not explicitly banned, but banned because of regulation about what that business can do, that’s exactly the sort of regulation we want. We don’t dictate your business specifically, just what you can and can’t do with the data. If you can operate within those regulations, congrats!
- DanBC 9y ago
  Why are you getting lawyers to review the letter?
  - TomMarius 9y ago
    Because it's hard to correctly understand. That's the point of the letter, it's called nightmare letter because it was specifically crafted to be as confusing and hard to understand as possible.
    - nopriorarrests 9y ago
      I think it's very clear written. It's a nightmare letter because it ticks all the boxes, so to speak -- author asks all possible GDPR-related questions he can ask and business is legally required to respond to.
    - DanBC 9y ago
      It's not hard to understand. It's only hard to understand if you've built your business around slurping people's data and using it without consent - something that's already mostly illegal in the EU. A lot of GDPR is not new. It's just clarification of existing law.
      - TomMarius 9y ago
        Not true. You're right in case of Germany and some other western countries, but it's completely new for most countries, especially to the east.
- GordonS 9y ago
  A lawyer? Don't you think that's just a tad excessive?
  - Silhouette 9y ago
    Maybe for routine requests, but not when you get a letter on a legal matter from someone who is clearly looking to cause trouble.
    - mrguyorama 9y ago
      Making sure your company isn't screwing me over by throwing my personal information around willy-nilly isn't "looking for trouble"
      - Silhouette 9y ago
        Perhaps, but making sure a company isn't screwing you over by throwing your personal information around willy-nilly doesn't require opening with a direct threat and then listing 40 or so different demands for information, several of which are technicalities which have little relevance to determining whether or not the data is really being handled safely and responsibly anyway. A normal person who really was worried about how their data was being used would probably write a polite letter asking what data was being stored, how it was being used, and maybe a couple of supplementary points if they had particular concerns or perhaps had heard a warning about some specific practice that could be dangerous.
        mrguyorama 9y ago
        Why do companies deserve the benefit of the doubt anymore?
sgustard 9y ago
Take the simple and common case of a startup storing personal data on an AWS-hosted service. Can you account for who at Amazon has access to that AWS instance, how many physical copies of the data may exist in Amazon's data centers, how you can assure that deleted data is really deleted, and so on?
- kbenson 9y ago
  If you're using AWS for your business/startup to store customer information and you don't have good answers for this already, then you aren't doing your due diligence. To be clear, many businesses may not have good answers right now. Their response should not be "this is too much of a burden" but instead "wow, we really need to find this out ASAP".
- minaguib 9y ago
  This one's on the easy side. The company is the controller of the data, and Amazon is the processor. Here's Amazon's declaration and stance, stating they are GDPR-compliant both as a company (when they are the controller - of their direct customers' data), as well as then they are a processor (infra for use by others who control private data): https://aws.amazon.com/compliance/gdpr-center/ https://aws.amazon.com/compliance/gdpr-center/ There's generally no need for a controller who relays data to a processor to understand the intricacies of the implementation on the processor's side (is deleted data really deleted ?) - what's more important is the processor's self-declaration for GDPR compliance. The above is my personal $0.02 as I've been spending quite some time getting into GDPR recently. IANAL

Silhouette 9y ago

What's an example of a start-up collecting personal information, using it in a complex way that can't be summarized in a few paragraphs, but being unfairly burdened by this? It doesn't have to be doing any of that. Just the time and money to have a lawyer review this letter and identify the actual obligations is already a significant burden. For example, notice that just replying with everything requested here would in itself potentially breach data protection law.

akshatpradhan 9y ago
All you’re telling me is that your Agile Startup doesnt have: 1) an updated Asset Inventory 2) a Data Classification Scheme 3) Data Labeling Policy & Procedure Those are basic components of an InfoSec 101 course taught by Community Colleges and the top basic items GDPR is wanting.
- Silhouette 9y ago
  The GDPR is an EU regulation, but you appear to be adopting some US(?) based conventions and terminology, and then posting a string of buzzwords that have little if any connection to the subject at hand. Also, are you seriously suggesting that in response to a formal legal communication it's a good idea to reply without having input from a lawyer?
  - discoursism 9y ago
    You probably need a lawyer to help you write the document the first time, and to update it when you make new partnerships or develop major new pipelines for data. You probably don't need a lawyer every time you receive such a letter.
    - Silhouette 9y ago
      You probably don't need a lawyer every time you receive such a letter. For routine enquiries, maybe not. For a letter like this, from someone who is clearly intending to trip you up and cause trouble, our lawyer is the first call I'm making, every time. And that initial conversation is already going to cost me hundreds of pounds and a half-day of work, even if I already have reasonable answers to anything we are actually required to respond with under the GDPR here.
      - discoursism 9y ago
        > For a letter like this . . . our lawyer is the first call I'm making /shrug It's your money. You could do that, or you could even light it on fire if you wish. It's no skin off my back. If your company is profitable enough to eat this self-imposed overhead, then its owners will just make less money. If it's not, then leaner competitors will replace it. I'm fine with either outcome.
        Silhouette 9y ago
        In this area, we have no idea which overheads are actually going to prove justified and which are just throwing money away. That's one of my main points here. As I've argued several times on HN recently, a big part of the problem is that if you're running a small business that isn't handling large amounts of personal data but obviously is going to be subject to the GDPR like everyone else, there is no clear indication of what you have to do to be considered reasonably compliant. The GDPR itself is very heavy and has little in the way of moderation for small-scale data controllers/processors, so in practice it's going to come down to interpretation by regulators (and potentially anyone who has rights under the GDPR and wants to make trouble, as in the example we're discussing). If you don't do enough, you potentially face even greater overheads due to formal audits, financial penalties, etc. If you do too much, then as you rightly point out, you leave yourself at a disadvantage compared to competition who don't do as much (and this remains the case even if that competition is knowingly breaking the law as a result, and that in turn doesn't matter if they face no meaningful penalties for it).
- eximius 9y ago
  Yes, I can just imagine this is the first thing I'd do when starting a business. /s
  - ncallaway 9y ago
    Okay, that's fair. Don't do those things when you start a business. But, then, don't have your business collect and process data on individuals.
    - delecti 9y ago
      > Don't do those things when you start a business. > But, then, don't have your business collect and process data on individuals. Aren't those two statements together effectively equivalent to "don't ever start certain kinds of businesses"?
      - toomuchtodo 9y ago
        That’s the goal. My data is my data, not the fundemental requirement of some businesses.
        delecti 9y ago
        I certainly respect your desire for no businesses to have certain pieces of of your personal data, but there's a difference between "I don't want to be a customer of certain kinds of businesses" and "such businesses shouldn't exist at all". And beside that, regulations that effectively result in prohibiting certain kinds of businesses even though they don't explicitly do so are bad regulations IMO.
        toomuchtodo 9y ago
        I understand your sentiment, but we’ve swung so far towards the unrelenting abuse of consumer data, I’m supportive of regulation through any means necessary. To your point, if a business is not explicitly banned, but banned because of regulation about what that business can do, that’s exactly the sort of regulation we want. We don’t dictate your business specifically, just what you can and can’t do with the data. If you can operate within those regulations, congrats!
DanBC 9y ago
Why are you getting lawyers to review the letter?
- TomMarius 9y ago
  Because it's hard to correctly understand. That's the point of the letter, it's called nightmare letter because it was specifically crafted to be as confusing and hard to understand as possible.
  - nopriorarrests 9y ago
    I think it's very clear written. It's a nightmare letter because it ticks all the boxes, so to speak -- author asks all possible GDPR-related questions he can ask and business is legally required to respond to.
  - DanBC 9y ago
    It's not hard to understand. It's only hard to understand if you've built your business around slurping people's data and using it without consent - something that's already mostly illegal in the EU. A lot of GDPR is not new. It's just clarification of existing law.
    - TomMarius 9y ago
      Not true. You're right in case of Germany and some other western countries, but it's completely new for most countries, especially to the east.
GordonS 9y ago
A lawyer? Don't you think that's just a tad excessive?
- Silhouette 9y ago
  Maybe for routine requests, but not when you get a letter on a legal matter from someone who is clearly looking to cause trouble.
  - mrguyorama 9y ago
    Making sure your company isn't screwing me over by throwing my personal information around willy-nilly isn't "looking for trouble"
    - Silhouette 9y ago
      Perhaps, but making sure a company isn't screwing you over by throwing your personal information around willy-nilly doesn't require opening with a direct threat and then listing 40 or so different demands for information, several of which are technicalities which have little relevance to determining whether or not the data is really being handled safely and responsibly anyway. A normal person who really was worried about how their data was being used would probably write a polite letter asking what data was being stored, how it was being used, and maybe a couple of supplementary points if they had particular concerns or perhaps had heard a warning about some specific practice that could be dangerous.
      - mrguyorama 9y ago
        Why do companies deserve the benefit of the doubt anymore?

sgustard 9y ago

Take the simple and common case of a startup storing personal data on an AWS-hosted service. Can you account for who at Amazon has access to that AWS instance, how many physical copies of the data may exist in Amazon's data centers, how you can assure that deleted data is really deleted, and so on?

kbenson 9y ago
If you're using AWS for your business/startup to store customer information and you don't have good answers for this already, then you aren't doing your due diligence. To be clear, many businesses may not have good answers right now. Their response should not be "this is too much of a burden" but instead "wow, we really need to find this out ASAP".
minaguib 9y ago
This one's on the easy side. The company is the controller of the data, and Amazon is the processor. Here's Amazon's declaration and stance, stating they are GDPR-compliant both as a company (when they are the controller - of their direct customers' data), as well as then they are a processor (infra for use by others who control private data): https://aws.amazon.com/compliance/gdpr-center/ https://aws.amazon.com/compliance/gdpr-center/ There's generally no need for a controller who relays data to a processor to understand the intricacies of the implementation on the processor's side (is deleted data really deleted ?) - what's more important is the processor's self-declaration for GDPR compliance. The above is my personal $0.02 as I've been spending quite some time getting into GDPR recently. IANAL