3 ms·

Just one data point, from me as a DPO-equivalent: My company is squarely in the SMB camp at 21 employees and single-digit millions in revenue across three busi

Just one data point, from me as a DPO-equivalent: My company is squarely in the SMB camp at 21 employees and single-digit millions in revenue across three business lines. GDPR compliance has already cost us hundreds of thousands of dollars and will cost us more as we go on. There will be some very minor benefits to our customers, perhaps, but for the same amount of money we could 100%-definitely-for-sure-absolutely give all of our customers things they would, if given the choice, trade those benefits for. That's the thing; it's like when you buy an appliance. You can buy the thing that meets the needs for $X, or you can buy something that's better for $2X. Of course, the better appliance would be better. Should we make a law that requires companies to only make the better one? That law would provide a benefit, because consumers would get the better appliance, right? Okay, sure -- but at what cost? And what value-producing companies (because companies do provide value for customers!) are going to be marginally less efficient and therefore marginally less effective and therefore, on the margin, go out of business because of it? There are valuable ideas in the GDPR. The execution is pretty crappy, and in the end it I think it likely reduces net consumer autonomy because it gives them less choice in how they relate to companies.

GordonS 9y ago
> GDPR compliance has already cost us hundreds of thousands of dollars and will cost us more as we go on Wow, that's incredible! Can I ask where you are based and roughly how the cost is broken down? I just can't grok how an SMB would need to spend so much on something that seemed relatively straightforward for my own business.
- Matticus_Rex 9y ago
  We're a US-based remote company with employees in four countries and contractors in a few others. I have a sense that some of our unique needs make things more complicated for us than for many others, but my other SMB friends seem to be facing a lot of the same struggles. I go into some more specific categories in another subthread in this article.
- jimnotgym 9y ago
  It seems incredibly excessive to me unless your business model is harvesting personal data. I work at a rather larger SME (multi channel retailer/wholesaler) and we are spending almost nothing. But then we were not doing anything creepy with our customer data before. We are updating some documentation and will ditch some old data we don't need any more, reword the privacy policy on our website etc. I am not apportioning any direct cost to GDPR as these are all things that need attention periodically anyway.
icebraining 9y ago
You can buy the thing that meets the needs for $X, or you can buy something that's better for $2X. Of course, the better appliance would be better. Should we make a law that requires companies to only make the better one? Well, it depends. If by "better" we mean it has an extra secondary feature, probably not. But if by "better" we mean it doesn't catch fire during use, then probably yes. The execution is pretty crappy, and in the end it I think it likely reduces net consumer autonomy because it gives them less choice in how they relate to companies. Can you expand on this? As far as I know, consumers can still give you express consent to use the data in other ways.
- Matticus_Rex 9y ago
  One example would be that consumers are literally no longer allowed to give their data in exchange for a service, download, etc. Companies can still offer these things and ask for the data, but the GDPR specifically disallows companies from making that thing contingent on the customer giving them the data. In my role as a consumer, I have several services I use and many companies I've given my contact info to in order to get something from them. I love being able to use my information as currency. The outcome of the GDPR's treatment will not be that these companies still create the same whitepapers, services, etc. and just give them away for free. It will be that they move their energy to something else, because the whole point in creating those resources was to get the information, and this will probably cut that ROI for that in half or more. In my business roles, I had active projects to create valuable stuff for clients around that type of thing, and they now don't make sense.
ProblemFactory 9y ago
> it's like when you buy an appliance. You can buy the thing that meets the needs for $X, or you can buy something that's better for $2X. Of course, the better appliance would be better. Should we make a law that requires companies to only make the better one? Maybe? Many such laws already exist: regulations on fire safety of buildings, fire safety of pillows and furniture, energy efficiency and safety of cars and home appliances, anything related to food processing, and so on. I don't think there are any consumer products at all where governments haven't made laws about only selling "the better one".

GordonS 9y ago

> GDPR compliance has already cost us hundreds of thousands of dollars and will cost us more as we go on Wow, that's incredible! Can I ask where you are based and roughly how the cost is broken down? I just can't grok how an SMB would need to spend so much on something that seemed relatively straightforward for my own business.

Matticus_Rex 9y ago
We're a US-based remote company with employees in four countries and contractors in a few others. I have a sense that some of our unique needs make things more complicated for us than for many others, but my other SMB friends seem to be facing a lot of the same struggles. I go into some more specific categories in another subthread in this article.
jimnotgym 9y ago
It seems incredibly excessive to me unless your business model is harvesting personal data. I work at a rather larger SME (multi channel retailer/wholesaler) and we are spending almost nothing. But then we were not doing anything creepy with our customer data before. We are updating some documentation and will ditch some old data we don't need any more, reword the privacy policy on our website etc. I am not apportioning any direct cost to GDPR as these are all things that need attention periodically anyway.

icebraining 9y ago

You can buy the thing that meets the needs for $X, or you can buy something that's better for $2X. Of course, the better appliance would be better. Should we make a law that requires companies to only make the better one? Well, it depends. If by "better" we mean it has an extra secondary feature, probably not. But if by "better" we mean it doesn't catch fire during use, then probably yes. The execution is pretty crappy, and in the end it I think it likely reduces net consumer autonomy because it gives them less choice in how they relate to companies. Can you expand on this? As far as I know, consumers can still give you express consent to use the data in other ways.

Matticus_Rex 9y ago
One example would be that consumers are literally no longer allowed to give their data in exchange for a service, download, etc. Companies can still offer these things and ask for the data, but the GDPR specifically disallows companies from making that thing contingent on the customer giving them the data. In my role as a consumer, I have several services I use and many companies I've given my contact info to in order to get something from them. I love being able to use my information as currency. The outcome of the GDPR's treatment will not be that these companies still create the same whitepapers, services, etc. and just give them away for free. It will be that they move their energy to something else, because the whole point in creating those resources was to get the information, and this will probably cut that ROI for that in half or more. In my business roles, I had active projects to create valuable stuff for clients around that type of thing, and they now don't make sense.

ProblemFactory 9y ago

> it's like when you buy an appliance. You can buy the thing that meets the needs for $X, or you can buy something that's better for $2X. Of course, the better appliance would be better. Should we make a law that requires companies to only make the better one? Maybe? Many such laws already exist: regulations on fire safety of buildings, fire safety of pillows and furniture, energy efficiency and safety of cars and home appliances, anything related to food processing, and so on. I don't think there are any consumer products at all where governments haven't made laws about only selling "the better one".