3 ms·

Not necessarily a contradiction - GDPR could have many possible effects; it's too early to claim that these effects will disproportionately harm small companies

by candu 9y ago

Not necessarily a contradiction - GDPR could have many possible effects; it's too early to claim that these effects will disproportionately harm small companies. One possibility, of course, is that larger companies will have more resources to tackle GDPR compliance, and thus be better able to respond effectively than small companies. However, it's also possible that, by taking privacy / security seriously from day one and storing the minimal set of user data needed to operate, a smaller company will have a distinct advantage over some BigCo that must now migrate sprawling, inter-tangled distributed systems never designed for GDPR compliance. After all, that small company now has a compelling legal reason to avoid feature / data warehousing bloat and save their limited engineering resources, whereas the larger company most certainly has that bloat baked deeply into their stack due to years and years of "Big Data" hype.

kodablah 9y ago
> it's too early to claim that these effects will disproportionately harm small companies. It's not too early to claim that the risks are disproportionate. Those of us with small companies really just count on subjective enforcement. Sadly, it seems everyone says "do nothing wrong, nothing to worry about" with these kinds of laws and don't understand risk management or the cost of conformance.
deltron3030 9y ago
It's not strictness being the problem, it's the uncertainty. GDPR seems like a framework to take out anybody at will, because nobody can really conform to the laws due to that uncertainty. If you do anything really disruptive/innovative, you're probably gonna get problems.
- candu 8y ago
  I really dislike this use of the term "disruptive / innovative" - it's almost a circular definition in this context, since it's effectively being used to mean "anything new that has a high chance of running afoul of the law". English has better words for this sort of thing: criminal, negligent, etc. Launching a new product / service does not give a company carte blanche to do whatever they like, no matter what Uber et al. may prefer to believe. Suppose I want to create a "gun-share" app, because, you know, sharing economy and stuff. I should fully expect that, where laws exist that make this infeasible (e.g. background checks, transfer of ownership laws, etc.), those laws will be enforced. I should also fully expect that those laws might change. If I've been paying attention to the broader world - something that Silicon Valley isn't historically that great at - I should probably have seen this coming for years, since that's how long it takes to build support for legislation. GDPR didn't come out of nowhere; data privacy, security, and ownership concerns have been building for a while now. In the case of the GDPR: my personal position is that it gives EU citizens rights we should all have had from the start with respect to our data. Good on them for passing it, and for giving it teeth. If that tramples on some service that can't be bothered to respect those rights, I couldn't care less - and I say this as a small business owner who's fully aware that, yes, someday I too may face a GDPR compliance request. Maybe I'll be prepared, maybe I won't, maybe it'll never happen; that's part of doing business.

by candu 9y ago

kodablah 9y ago

> it's too early to claim that these effects will disproportionately harm small companies. It's not too early to claim that the risks are disproportionate. Those of us with small companies really just count on subjective enforcement. Sadly, it seems everyone says "do nothing wrong, nothing to worry about" with these kinds of laws and don't understand risk management or the cost of conformance.

deltron3030 9y ago

It's not strictness being the problem, it's the uncertainty. GDPR seems like a framework to take out anybody at will, because nobody can really conform to the laws due to that uncertainty. If you do anything really disruptive/innovative, you're probably gonna get problems.

candu 8y ago
I really dislike this use of the term "disruptive / innovative" - it's almost a circular definition in this context, since it's effectively being used to mean "anything new that has a high chance of running afoul of the law". English has better words for this sort of thing: criminal, negligent, etc. Launching a new product / service does not give a company carte blanche to do whatever they like, no matter what Uber et al. may prefer to believe. Suppose I want to create a "gun-share" app, because, you know, sharing economy and stuff. I should fully expect that, where laws exist that make this infeasible (e.g. background checks, transfer of ownership laws, etc.), those laws will be enforced. I should also fully expect that those laws might change. If I've been paying attention to the broader world - something that Silicon Valley isn't historically that great at - I should probably have seen this coming for years, since that's how long it takes to build support for legislation. GDPR didn't come out of nowhere; data privacy, security, and ownership concerns have been building for a while now. In the case of the GDPR: my personal position is that it gives EU citizens rights we should all have had from the start with respect to our data. Good on them for passing it, and for giving it teeth. If that tramples on some service that can't be bothered to respect those rights, I couldn't care less - and I say this as a small business owner who's fully aware that, yes, someday I too may face a GDPR compliance request. Maybe I'll be prepared, maybe I won't, maybe it'll never happen; that's part of doing business.