7 ms·

I just read through this "Nightmare Letter" and while the cost is definitely non-zero, a conscientious startup will have the same answer for each user for almos

by SllX 9y ago

I just read through this "Nightmare Letter" and while the cost is definitely non-zero, a conscientious startup will have the same answer for each user for almost every single point and can have a boilerplate response ready to go in those cases. Where it gets complicated, i.e. where they buy your data from 3rd parties, I don't have a lot of sympathy for any of the complications involved. Most of the rest can be automated, not for a non-zero cost, but for a relatively low one if a startup goes in with these questions in mind, prepared to answer them when they come up.

Silhouette 9y ago
a conscientious startup ... can have a boilerplate response ready to go in those cases I have businesses that don't do anything shady at all with personal data, and I'd like to think we're conscientious about handling what we do have. We follow general good practice in terms of encryption, hashing passwords, and so on. We've never had any sort of request for information under existing data protection rules, nor complaints under any other regulatory regime for that matter. So, how much time and money should we spend putting together that boilerplate, just to tick a legal box? How much of the documentation formally required under the GDPR should we actually write, given that on the evidence of several years of trading so far it has literally no value to anyone? How much should we spend on things like getting lawyers to review the contracts we have with the small number of outside services we do use, which might have access to some personal data in connection with the services they provide for us, and how often? If you actually follow the letter of the law here, the costs of compliance would be astronomical by small business standards. There is little proportionately built into the GDPR itself, so we are reliant on regulators to introduce it, and that's not a good position to be in either legally or practically.
- gingerlime 9y ago
  That's what bothers me the most about the GDPR. There's total lack of proportionality. Here's how the potential fines are defined: Under GDPR organizations in breach of GDPR can be fined up to 4% of annual global turnover or €20 Million (whichever is greater). whichever is greater... So since my company's turnover is order of magnitude less than €20 Million, I guess this means we can get totally buried??
  - icebraining 9y ago
    Yes, so what? Did you know that as an individual, you can literally be imprisoned for decades for violating the law? Why is it so shocking that a company that violates the law can be forced into bankruptcy? The key term there, of course, is "up to". You don't get fined the maximum amount for the smallest violation. It's a range, depending on the severity of the violation, and probably whether there was gross negligence and/or maliciousness.
    - kodablah 9y ago
      There are sentence maximums for different crimes for a reason, and often people are unjustly sentenced to the maximum level. With your analogy we should just have the option to sentence everyone to life for any transgression and then just tell everyone "but they won't". I don't understand why this is constantly handwaved away with statements that claim to tell the future. If you are correct that the violations aren't as large in some cases, that can codify it a bit better than "trust us".
      - icebraining 9y ago
        What makes you say they aren't codified better than that?
      - lagadu 9y ago
        To reverse your argument: without data protection laws we're just trusting corporations that they won't commit any transgression. Your "worst case" description is exactly the current scenario that we have in place being practiced by corporations who have your private data: all you have from them is "trust us".
  - kodablah 9y ago
    Depends on who you ask. Those who trust government will tell you that you can count on the subjective enforcement not to go after you as much, and of course the good ol "don't break the law and you have nothing to worry about". The rest of us that understand government incompetence/corruption and risk mitigation would tell you that you have to weigh whether these risks are real enough to you. I would tell a non-growth-focused early stage company uninterested in locale variety with limited resources (e.g. bootstrapped company in beta) to avoid EU customers since there are only downsides.
- DanBC 9y ago
  If you can't already answer these questions you're probably already breaking EU law. There's been a round of companies "reconfiming" email lists "because GDPR" - but if those companies can't show clear opt-in before sending email they're already in breach of PECR.
- SllX 9y ago
  How much personal info that you have, do you actually need? I don't know your business, and I don't particularly want to, but this is a good opportunity to review how much of the data you retain you even should be retaining. If the amount is anything substantial, more than contact information and whatever data customers might choose to be hosting with you, then you are exactly the right target for GDPR and you should be spending whatever amount you deem necessary to avoid the fines. It's harsh, but it is true that software and service companies in general, maybe not you, maybe not your company, are far too lax with personal info, and so now legislative bodies like the EU are choosing to address that issue, and the easiest way to be in compliance is to not have anymore customer data than you actually need so when you do get hit with a letter like the one linked here, you have a much easier time responding. Will this strangle some businesses? Even prevent some from even getting started? Undoubtedly, but that is a trade-off I'm willing to accept in this world where every incentive is stacked against the integrity of my privacy.
  - Silhouette 9y ago
    Well, speaking just for my own businesses, we've always minimised how much personal data we use, and all the processing we do is for good reasons that are directly related to what we're offering as a service. This wasn't due to any legal obligations, just basic good practice in terms of security and what I consider an ethical stance regarding the privacy of our customers. I suppose this is why I'm so frustrated by this whole issue. I have a lot of sympathy for your argument that some businesses exploit personal data in ways we might well agree are abusive, and that something needed to be done to curb that. But as someone who does try to do the right thing both ethically and legally, this is just another set of regulations that is going to cause compliance overheads for my own businesses while offering little if any real benefit to anyone in our case. Meanwhile, if the risk of significant enforcement action against smaller businesses really is low, the door is open for competitors to take their chances and gain an advantage over us, particularly if they're not in the EU themselves. So it also seems to be a case of no good deed going unpunished.
    - SllX 9y ago
      I'm sympathetic if your practices are already good, but the balance of power between an individual and a corporation is too far on the side of corporations as things stand. This levels things out for individuals who otherwise have to depend entirely on the goodwill of corporations. That includes you, the individual as well, and I hope it works out for you the corporation.
indymike 9y ago
A conscientious startup would probably not start up under these conditions. Every regulation that creates risk reduces the number of people willing to invest and enter the market.
- lagadu 9y ago
  You could say that having to follow tax regulations also reduces the number of people willing to enter any market. Should we also drop requirements for pharmaceutical companies to do their thing? I'm 100% certain we'd have thousands of new "pharmas" popping up within a short amount of time. Obviously this is a silly simile but the point remains: certain types of business have certain regulations, in this case if a business relies on keeping your private data then they have to follow the appropriate regulations, like most other fields.
  - indymike 9y ago
    How many cures have not been discovered because of the cost of regulation? Does every regulation save lives? Please. There is a balance between serving the public interest (safety and feel good theatrics like GDPR) and what is actually the public's interest (cure to cancer, the internet, etc...).
    - chopin 9y ago
      We had bad pharmaceuticals despite regulation. As well, there are many promising (tested on few individuals) pharmaceuticals which did not survive broad clinical trials.

by SllX 9y ago

Silhouette 9y ago

a conscientious startup ... can have a boilerplate response ready to go in those cases I have businesses that don't do anything shady at all with personal data, and I'd like to think we're conscientious about handling what we do have. We follow general good practice in terms of encryption, hashing passwords, and so on. We've never had any sort of request for information under existing data protection rules, nor complaints under any other regulatory regime for that matter. So, how much time and money should we spend putting together that boilerplate, just to tick a legal box? How much of the documentation formally required under the GDPR should we actually write, given that on the evidence of several years of trading so far it has literally no value to anyone? How much should we spend on things like getting lawyers to review the contracts we have with the small number of outside services we do use, which might have access to some personal data in connection with the services they provide for us, and how often? If you actually follow the letter of the law here, the costs of compliance would be astronomical by small business standards. There is little proportionately built into the GDPR itself, so we are reliant on regulators to introduce it, and that's not a good position to be in either legally or practically.

gingerlime 9y ago
That's what bothers me the most about the GDPR. There's total lack of proportionality. Here's how the potential fines are defined: Under GDPR organizations in breach of GDPR can be fined up to 4% of annual global turnover or €20 Million (whichever is greater). whichever is greater... So since my company's turnover is order of magnitude less than €20 Million, I guess this means we can get totally buried??
- icebraining 9y ago
  Yes, so what? Did you know that as an individual, you can literally be imprisoned for decades for violating the law? Why is it so shocking that a company that violates the law can be forced into bankruptcy? The key term there, of course, is "up to". You don't get fined the maximum amount for the smallest violation. It's a range, depending on the severity of the violation, and probably whether there was gross negligence and/or maliciousness.
  - kodablah 9y ago
    There are sentence maximums for different crimes for a reason, and often people are unjustly sentenced to the maximum level. With your analogy we should just have the option to sentence everyone to life for any transgression and then just tell everyone "but they won't". I don't understand why this is constantly handwaved away with statements that claim to tell the future. If you are correct that the violations aren't as large in some cases, that can codify it a bit better than "trust us".
    - icebraining 9y ago
      What makes you say they aren't codified better than that?
    - lagadu 9y ago
      To reverse your argument: without data protection laws we're just trusting corporations that they won't commit any transgression. Your "worst case" description is exactly the current scenario that we have in place being practiced by corporations who have your private data: all you have from them is "trust us".
- kodablah 9y ago
  Depends on who you ask. Those who trust government will tell you that you can count on the subjective enforcement not to go after you as much, and of course the good ol "don't break the law and you have nothing to worry about". The rest of us that understand government incompetence/corruption and risk mitigation would tell you that you have to weigh whether these risks are real enough to you. I would tell a non-growth-focused early stage company uninterested in locale variety with limited resources (e.g. bootstrapped company in beta) to avoid EU customers since there are only downsides.
DanBC 9y ago
If you can't already answer these questions you're probably already breaking EU law. There's been a round of companies "reconfiming" email lists "because GDPR" - but if those companies can't show clear opt-in before sending email they're already in breach of PECR.
SllX 9y ago
How much personal info that you have, do you actually need? I don't know your business, and I don't particularly want to, but this is a good opportunity to review how much of the data you retain you even should be retaining. If the amount is anything substantial, more than contact information and whatever data customers might choose to be hosting with you, then you are exactly the right target for GDPR and you should be spending whatever amount you deem necessary to avoid the fines. It's harsh, but it is true that software and service companies in general, maybe not you, maybe not your company, are far too lax with personal info, and so now legislative bodies like the EU are choosing to address that issue, and the easiest way to be in compliance is to not have anymore customer data than you actually need so when you do get hit with a letter like the one linked here, you have a much easier time responding. Will this strangle some businesses? Even prevent some from even getting started? Undoubtedly, but that is a trade-off I'm willing to accept in this world where every incentive is stacked against the integrity of my privacy.
- Silhouette 9y ago
  Well, speaking just for my own businesses, we've always minimised how much personal data we use, and all the processing we do is for good reasons that are directly related to what we're offering as a service. This wasn't due to any legal obligations, just basic good practice in terms of security and what I consider an ethical stance regarding the privacy of our customers. I suppose this is why I'm so frustrated by this whole issue. I have a lot of sympathy for your argument that some businesses exploit personal data in ways we might well agree are abusive, and that something needed to be done to curb that. But as someone who does try to do the right thing both ethically and legally, this is just another set of regulations that is going to cause compliance overheads for my own businesses while offering little if any real benefit to anyone in our case. Meanwhile, if the risk of significant enforcement action against smaller businesses really is low, the door is open for competitors to take their chances and gain an advantage over us, particularly if they're not in the EU themselves. So it also seems to be a case of no good deed going unpunished.
  - SllX 9y ago
    I'm sympathetic if your practices are already good, but the balance of power between an individual and a corporation is too far on the side of corporations as things stand. This levels things out for individuals who otherwise have to depend entirely on the goodwill of corporations. That includes you, the individual as well, and I hope it works out for you the corporation.

indymike 9y ago

A conscientious startup would probably not start up under these conditions. Every regulation that creates risk reduces the number of people willing to invest and enter the market.

lagadu 9y ago
You could say that having to follow tax regulations also reduces the number of people willing to enter any market. Should we also drop requirements for pharmaceutical companies to do their thing? I'm 100% certain we'd have thousands of new "pharmas" popping up within a short amount of time. Obviously this is a silly simile but the point remains: certain types of business have certain regulations, in this case if a business relies on keeping your private data then they have to follow the appropriate regulations, like most other fields.
- indymike 9y ago
  How many cures have not been discovered because of the cost of regulation? Does every regulation save lives? Please. There is a balance between serving the public interest (safety and feel good theatrics like GDPR) and what is actually the public's interest (cure to cancer, the internet, etc...).
  - chopin 9y ago
    We had bad pharmaceuticals despite regulation. As well, there are many promising (tested on few individuals) pharmaceuticals which did not survive broad clinical trials.