8 ms·

A $100+ million revenue company has the capital to comply with GDPR. The 1-5 man bootstrapped start up does not. They will be in the 3 felonies a day type of n

A $100+ million revenue company has the capital to comply with GDPR. The 1-5 man bootstrapped start up does not. They will be in the 3 felonies a day type of non-compliance and hunted by bureaucrats looking for easy targets. Other countries have a philosophy of exempting small business from complicated regulations because of this. The EU tends to not do this. That is the fundamental issue and it has nothing to do with monopoly. Just like you need progressive taxation to not choke out the poor, you need progressive regulation to not choke out the small business.

realusername 9y ago
I did not see anything in GDPR which does not make sense to me, it looks like common sense applied to data management.(Edit: It's rare enough to have some legal text in IT which makes sense in real life, I'm surprised). I don't see why small businesses should be exempt for basic regulation, small businesses are not exempt from fire safety regulation either. > The 1-5 man bootstrapped start up does not. In my current company we are only two developers and we will comply with GDPR, it's going to take us a week or two worth of technical work, it's really not a big deal.
- woolvalley 9y ago
  The GDPR seems easy, but I get a feeling you haven't tried to actually properly implement the GDPR regs, talking to lawyers and everything. If you have you'll see there is far more involved than you think. I wish it was easy as just manually looking for user data after an email, deleting it, and keeping that email request as part of the 'audit log'. And getting affirmative consent during signup. Most small businesses would be fine with something that casual. EDIT: If you guys winged it by actually just reading the regulations and winging it, you probably did something wrong.
  - rectang 9y ago
    The GDPR is inconvenient with many of the shady business models popular among web-centric companies. In the long run, it's good for all of us if those business models are discouraged.
    - woolvalley 9y ago
      It's inconvenient for the non-shady, non adtech, we give you a service in exchange for money businesses too! I think the best thing to take away from GDPR compliance is 'it's not as easy as you think it is', 'it's not as obvious as you think it is', and small businesses who totally respect privacy will probably still be breaking GDPR.
      - rectang 9y ago
        I'm OK with that and I accept that cost, because in my eyes stopping the savage victimization of users is worthwhile. For you (or the WSJ) to persuade me that the GDPR is problematic, I'd have to believe that first, that's something that those opposed to the GDPR actually care about, and that it's something that could be achieved through other means.
        chrischen 9y ago
        Except this does nothing to really stop the savage victimization of users by Facebook or Google. If anything it solidifes their dominance. The abuses are happening from these big companies, not the thousands of tiny startups that live and die within months that have a few hundred thousand users.
        dvfjsdhgfv 9y ago
        This argument is of the "we can't solve the problem completely, so let's do nothing about it" kind. The abuse is happening from both camps and we all know it, especially here on HN where some of us are actively developing user-tracking schemes and ad-targeting platforms for a living.
        nemothekid 9y ago
        IMO, it's less "both camps are doing it" and more have we now insulated these giants from any future competition. For example, how do the decentralized social platforms (mastadon, diaspora), exist under GDPR?
  - realusername 9y ago
    > EDIT: If you guys winged it by actually just reading the regulations and winging it, you probably did something wrong. Most of the work in my company for GDPR is around user profiles, we store very few data about the users so we don't have that much to take care of. I guess if your business is to gather customer data, it's a completely different story.
    - s17n 9y ago
      You are responsible to everyone who you have data about, regardless of whether or not they are your user. If I use your service to store a photo of my mom, you now have a legal obligation to her even though you don't even know she exists. Any text that you store, you are required to know who is mentioned in it and give them tools for download, right to be forgotten, etc.
      - realusername 9y ago
        > You are responsible to everyone who you have data about, regardless of whether or not they are your user. We have zero data on non-users so this part is not relevant to us, like I said it's not a data-gathering company. For the tools to download, remove data, consent... That's what I meant with that one or two weeks worth of work.
      - Aengeuad 9y ago
        What you are suggesting would not only make compliance of GDPR impossible for any company that accepts any form of user submitted data, it would also violate the privacy of the users submitting said data. If I, party A, send a message to party B that happens to contain information about party C, party C does not get to see the messages between parties A and B just because it concerns them or has personally identifying information about them.
        dogma1138 9y ago
        Actually under GDPR they do you need to perform data discovery to identify that data. https://enterprise.microsoft.com/en-gb/articles/roles/discover-gdpr/ https://enterprise.microsoft.com/en-gb/articles/roles/discov... GDPR does not cover only data you collect through your primary business model but ALL DATA defined as Personal Information under the GDPR.
  - mercer 9y ago
    So, honest question for you and others who have know more about this stuff: is it possible that perhaps you're erring on the side of caution a little too much? It's a lawyer's job to worry about everything that could go wrong, and assume a worst-case scenario, but surely in many cases GDPR will be about the spirit of the law rather than the letter? For example, while I personally think the backing-up-now-deleted-user-data issue is not insurmountable, assuming it's not, I cannot imagine that these 'small companies' will be fined left and right for failing to remove a user's data from every backup. And that's even assuming that there's a high likelihood that said backups will be investigated. To make an analogy: there are quite a number of regulations in effect concerning invoicing that are flagrantly violated by almost every single small-business owner that I know. Some of them have won the 'audit-lottery' and did not suffer any significant consequences, because their transgression was relatively minor (stuff like correcting an invoice and sending it without properly sending a credit-invoice first to nullify the initial invoice). Again, I'm way out of my depth here so by all means yell at me for being irresponsible about this :).
    - fasteddie 9y ago
      As someone responsible for implementation -- yes, we are probably erring on the side of caution too much, but "probably" doesn't cut it with the potential fines on the line. -How big is "probably? 5% chance? 0.01% Chance? -Maybe they will be lax on cookie policy slipups but not on purging delete requests from backups, how are we to know on May 26? -Maybe they will only investigate the big public giants, or maybe they will respect maliciously-intented complaints from competitors? This is why, for example, Delaware is the chosen state for corporations -- case law is settled and has a very predictable legal frame work. In the absence of data, its hard to know WHERE people will get the hammer.
  - Yetanfou 9y ago
    One of the problems stems for this dichotomy: I did not see anything in GDPR which does not make sense to me, it looks like common sense applied to data management versus I get a feeling you haven't tried to actually properly implement the GDPR regs, talking to lawyers and everything Which can be further shortened to: common sense versus talking to lawyers While interpretation of laws by necessity is at best difficult and at worst fraught with peril - reality in all its complexities is hard to catch in a few written pages - the legal profession has turned themselves into virtual toll collectors for anything related to law. Ask a lawyer about the legal implications of preparing a peanut butter sandwich and you'll be first presented with a legal disclaimer - pay me if you want advice - and then treated to a tale worthy of Lewis Carroll. GDPR is a $deity-send in this respect, good for many a year of steady income, especially given the stiff fines which threaten. ...which does not mean the person who used common sense to interpret the law is wrong. He is very much likely to be right and, having spent two weeks of technical work to prepare their infrastructure they're probably set to fulfil the obligations the law puts on them. It might need some fine-tuning here and there but that can mostly likely be handled as well without incurring the wrath of the courts. In short, talking to a lawyer about being able to do something like this by yourself is more or less guaranteed to give the same reply as e.g. talking to someone who does data rescue whether you could replace the head stack on a hard drive by yourself. In both cases it is possible as long as you're careful and use the right tools, in both cases the answer will be 'you could do this at your own peril, disaster is waiting to strike, you take up enormous risks, let the professionals handle it'. Which is true to a certain level, there are risks just like there are risks in any venture.
- LoSboccacc 9y ago
  This post will be illegal in a month and fault will be with hacker news: 91.253.39.120 Doesn’t seem to make a whole lot of sense.
  - realusername 9y ago
    I don't see the link between your comment and GDPR.
    - marksomnian 9y ago
      I think what GP is trying to do is to post their IP address in a comment, which is personal information under GDPR.
      - DanBC 9y ago
        No it isn't. IP addresses are not personal data unless you link it to a natural person.
        LoSboccacc 9y ago
        And that’s where you’re wrong. Logically? Yes. In GDPR scope? They are personal data. Guys debating with you is a blast but if you keep downvoting all correct information because it doesn’t match your gut feelings you’ll just become even more of a circlejerk of what you already have here.
        DanBC 9y ago
        > correct information You are being downvoted because you are factually incorrect. IP addresses are only personal data if you can identify a natural person from them. You can't do so unless you've linked them to other information. Thus, by themselves IP addresses are not personal information. Article 4: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... > 1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
hansen 9y ago
The startup could just respect their users privacy. It's only a matter of decency. Most people don't have much problems with it.
Jack5500 9y ago
Except for the fact, that you can easily adjust to your taxation as gorw, but that doesn't really apply to designing your software product. The advantage of the GDPR applying to everyone is that in the future startups have to think about privacy first, rather than second. That's a good thing in my book.
bad_user 9y ago
I am glad that the EU won't exempt small businesses from GDPR compliance. Here's why ... Everybody in the business knows that big companies become targets. Therefore for startups it's a land grab, aka break as many social rules as you can before getting big enough to get noticed. Just to give an example — Google's AdX platform has been anonymizing IPs given to participating advertisers at least since 2013 when I interacted with them. They also tightly controlled what kind of content and JavaScript you could serve on participating websites. For example we were not allowed to set our own cookies and even loading ad content dynamically (via JS) was a problem. The smaller ad exchanges, like MoPub and below? They didn't give a fuck. The most immoral companies around are the startups. The difference being that they don't have the resources or the reach of big companies. But that's no excuse. --- On progressive taxation, that's simply a tax on productivity, plain and simple. The majority being made of people that earn minimal to medium wage and of socially assisted folks, it's simply a way to increase taxes without pissing off the electorate. And it's choking the middle class and the small businesses. And that's because the big companies and the big earners have good lawyers and accountants that can come up with legal tax evasion schemes. The EU can't wait to fine the likes of Google and Facebook, as they've been evading a lot of taxes ;-)
davedx 9y ago
This makes no sense. Why would understaffed EU prosecutors comb through hundreds of small companies instead of going for big headline grabbing companies they could levy giant sums of money from in the revenue-% based fines? This thinking is upside down. There are also some relaxed rules in GDPR for SMEs also.
- woolvalley 9y ago
  Because it's easier to get a successful judgement against a small timer who is probably not doing it correctly vs a well funded large company. Both will happen, for different career incentive reasons.
mamon 9y ago
GDPR is about protecting human rights. My personal info staying safe is non-negotiable prerequisite, and your 3-person startup making money is totally optional. If you are unable to comply to GDPR then you shouldn’t be allowed to touch other people’s data. I won’t pity you for exactly the same reason I would not pity drug dealer complaining that his latest heroine delivery was intercepted by DEA. I think it’s good that EU tries to eradicate “let me steal and sell your secrets” business model that most SV startups are built on
DanBC 9y ago
> They will be in the 3 felonies a day type of non-compliance and hunted by bureaucrats looking for easy targets. NO THEY WON'T. This is just untrue. We've had decades of regulation - the regulators are not new - and so you can see how they work. They do not pursue everyone looking for easy cases. They go after the worst offenders, and they write letters asking them to come back into compliance.

realusername 9y ago

I did not see anything in GDPR which does not make sense to me, it looks like common sense applied to data management.(Edit: It's rare enough to have some legal text in IT which makes sense in real life, I'm surprised). I don't see why small businesses should be exempt for basic regulation, small businesses are not exempt from fire safety regulation either. > The 1-5 man bootstrapped start up does not. In my current company we are only two developers and we will comply with GDPR, it's going to take us a week or two worth of technical work, it's really not a big deal.

woolvalley 9y ago
The GDPR seems easy, but I get a feeling you haven't tried to actually properly implement the GDPR regs, talking to lawyers and everything. If you have you'll see there is far more involved than you think. I wish it was easy as just manually looking for user data after an email, deleting it, and keeping that email request as part of the 'audit log'. And getting affirmative consent during signup. Most small businesses would be fine with something that casual. EDIT: If you guys winged it by actually just reading the regulations and winging it, you probably did something wrong.
- rectang 9y ago
  The GDPR is inconvenient with many of the shady business models popular among web-centric companies. In the long run, it's good for all of us if those business models are discouraged.
  - woolvalley 9y ago
    It's inconvenient for the non-shady, non adtech, we give you a service in exchange for money businesses too! I think the best thing to take away from GDPR compliance is 'it's not as easy as you think it is', 'it's not as obvious as you think it is', and small businesses who totally respect privacy will probably still be breaking GDPR.
    - rectang 9y ago
      I'm OK with that and I accept that cost, because in my eyes stopping the savage victimization of users is worthwhile. For you (or the WSJ) to persuade me that the GDPR is problematic, I'd have to believe that first, that's something that those opposed to the GDPR actually care about, and that it's something that could be achieved through other means.
      - chrischen 9y ago
        Except this does nothing to really stop the savage victimization of users by Facebook or Google. If anything it solidifes their dominance. The abuses are happening from these big companies, not the thousands of tiny startups that live and die within months that have a few hundred thousand users.
        dvfjsdhgfv 9y ago
        This argument is of the "we can't solve the problem completely, so let's do nothing about it" kind. The abuse is happening from both camps and we all know it, especially here on HN where some of us are actively developing user-tracking schemes and ad-targeting platforms for a living.
        nemothekid 9y ago
        IMO, it's less "both camps are doing it" and more have we now insulated these giants from any future competition. For example, how do the decentralized social platforms (mastadon, diaspora), exist under GDPR?
- realusername 9y ago
  > EDIT: If you guys winged it by actually just reading the regulations and winging it, you probably did something wrong. Most of the work in my company for GDPR is around user profiles, we store very few data about the users so we don't have that much to take care of. I guess if your business is to gather customer data, it's a completely different story.
  - s17n 9y ago
    You are responsible to everyone who you have data about, regardless of whether or not they are your user. If I use your service to store a photo of my mom, you now have a legal obligation to her even though you don't even know she exists. Any text that you store, you are required to know who is mentioned in it and give them tools for download, right to be forgotten, etc.
    - realusername 9y ago
      > You are responsible to everyone who you have data about, regardless of whether or not they are your user. We have zero data on non-users so this part is not relevant to us, like I said it's not a data-gathering company. For the tools to download, remove data, consent... That's what I meant with that one or two weeks worth of work.
    - Aengeuad 9y ago
      What you are suggesting would not only make compliance of GDPR impossible for any company that accepts any form of user submitted data, it would also violate the privacy of the users submitting said data. If I, party A, send a message to party B that happens to contain information about party C, party C does not get to see the messages between parties A and B just because it concerns them or has personally identifying information about them.
      - dogma1138 9y ago
        Actually under GDPR they do you need to perform data discovery to identify that data. https://enterprise.microsoft.com/en-gb/articles/roles/discover-gdpr/ https://enterprise.microsoft.com/en-gb/articles/roles/discov... GDPR does not cover only data you collect through your primary business model but ALL DATA defined as Personal Information under the GDPR.
- mercer 9y ago
  So, honest question for you and others who have know more about this stuff: is it possible that perhaps you're erring on the side of caution a little too much? It's a lawyer's job to worry about everything that could go wrong, and assume a worst-case scenario, but surely in many cases GDPR will be about the spirit of the law rather than the letter? For example, while I personally think the backing-up-now-deleted-user-data issue is not insurmountable, assuming it's not, I cannot imagine that these 'small companies' will be fined left and right for failing to remove a user's data from every backup. And that's even assuming that there's a high likelihood that said backups will be investigated. To make an analogy: there are quite a number of regulations in effect concerning invoicing that are flagrantly violated by almost every single small-business owner that I know. Some of them have won the 'audit-lottery' and did not suffer any significant consequences, because their transgression was relatively minor (stuff like correcting an invoice and sending it without properly sending a credit-invoice first to nullify the initial invoice). Again, I'm way out of my depth here so by all means yell at me for being irresponsible about this :).
  - fasteddie 9y ago
    As someone responsible for implementation -- yes, we are probably erring on the side of caution too much, but "probably" doesn't cut it with the potential fines on the line. -How big is "probably? 5% chance? 0.01% Chance? -Maybe they will be lax on cookie policy slipups but not on purging delete requests from backups, how are we to know on May 26? -Maybe they will only investigate the big public giants, or maybe they will respect maliciously-intented complaints from competitors? This is why, for example, Delaware is the chosen state for corporations -- case law is settled and has a very predictable legal frame work. In the absence of data, its hard to know WHERE people will get the hammer.
- Yetanfou 9y ago
  One of the problems stems for this dichotomy: I did not see anything in GDPR which does not make sense to me, it looks like common sense applied to data management versus I get a feeling you haven't tried to actually properly implement the GDPR regs, talking to lawyers and everything Which can be further shortened to: common sense versus talking to lawyers While interpretation of laws by necessity is at best difficult and at worst fraught with peril - reality in all its complexities is hard to catch in a few written pages - the legal profession has turned themselves into virtual toll collectors for anything related to law. Ask a lawyer about the legal implications of preparing a peanut butter sandwich and you'll be first presented with a legal disclaimer - pay me if you want advice - and then treated to a tale worthy of Lewis Carroll. GDPR is a $deity-send in this respect, good for many a year of steady income, especially given the stiff fines which threaten. ...which does not mean the person who used common sense to interpret the law is wrong. He is very much likely to be right and, having spent two weeks of technical work to prepare their infrastructure they're probably set to fulfil the obligations the law puts on them. It might need some fine-tuning here and there but that can mostly likely be handled as well without incurring the wrath of the courts. In short, talking to a lawyer about being able to do something like this by yourself is more or less guaranteed to give the same reply as e.g. talking to someone who does data rescue whether you could replace the head stack on a hard drive by yourself. In both cases it is possible as long as you're careful and use the right tools, in both cases the answer will be 'you could do this at your own peril, disaster is waiting to strike, you take up enormous risks, let the professionals handle it'. Which is true to a certain level, there are risks just like there are risks in any venture.
LoSboccacc 9y ago
This post will be illegal in a month and fault will be with hacker news: 91.253.39.120 Doesn’t seem to make a whole lot of sense.
- realusername 9y ago
  I don't see the link between your comment and GDPR.
  - marksomnian 9y ago
    I think what GP is trying to do is to post their IP address in a comment, which is personal information under GDPR.
    - DanBC 9y ago
      No it isn't. IP addresses are not personal data unless you link it to a natural person.
      - LoSboccacc 9y ago
        And that’s where you’re wrong. Logically? Yes. In GDPR scope? They are personal data. Guys debating with you is a blast but if you keep downvoting all correct information because it doesn’t match your gut feelings you’ll just become even more of a circlejerk of what you already have here.
        DanBC 9y ago
        > correct information You are being downvoted because you are factually incorrect. IP addresses are only personal data if you can identify a natural person from them. You can't do so unless you've linked them to other information. Thus, by themselves IP addresses are not personal information. Article 4: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... > 1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

hansen 9y ago

The startup could just respect their users privacy. It's only a matter of decency. Most people don't have much problems with it.

Jack5500 9y ago

Except for the fact, that you can easily adjust to your taxation as gorw, but that doesn't really apply to designing your software product. The advantage of the GDPR applying to everyone is that in the future startups have to think about privacy first, rather than second. That's a good thing in my book.

bad_user 9y ago

I am glad that the EU won't exempt small businesses from GDPR compliance. Here's why ... Everybody in the business knows that big companies become targets. Therefore for startups it's a land grab, aka break as many social rules as you can before getting big enough to get noticed. Just to give an example — Google's AdX platform has been anonymizing IPs given to participating advertisers at least since 2013 when I interacted with them. They also tightly controlled what kind of content and JavaScript you could serve on participating websites. For example we were not allowed to set our own cookies and even loading ad content dynamically (via JS) was a problem. The smaller ad exchanges, like MoPub and below? They didn't give a fuck. The most immoral companies around are the startups. The difference being that they don't have the resources or the reach of big companies. But that's no excuse. --- On progressive taxation, that's simply a tax on productivity, plain and simple. The majority being made of people that earn minimal to medium wage and of socially assisted folks, it's simply a way to increase taxes without pissing off the electorate. And it's choking the middle class and the small businesses. And that's because the big companies and the big earners have good lawyers and accountants that can come up with legal tax evasion schemes. The EU can't wait to fine the likes of Google and Facebook, as they've been evading a lot of taxes ;-)

davedx 9y ago

This makes no sense. Why would understaffed EU prosecutors comb through hundreds of small companies instead of going for big headline grabbing companies they could levy giant sums of money from in the revenue-% based fines? This thinking is upside down. There are also some relaxed rules in GDPR for SMEs also.

woolvalley 9y ago
Because it's easier to get a successful judgement against a small timer who is probably not doing it correctly vs a well funded large company. Both will happen, for different career incentive reasons.

mamon 9y ago

GDPR is about protecting human rights. My personal info staying safe is non-negotiable prerequisite, and your 3-person startup making money is totally optional. If you are unable to comply to GDPR then you shouldn’t be allowed to touch other people’s data. I won’t pity you for exactly the same reason I would not pity drug dealer complaining that his latest heroine delivery was intercepted by DEA. I think it’s good that EU tries to eradicate “let me steal and sell your secrets” business model that most SV startups are built on

DanBC 9y ago

> They will be in the 3 felonies a day type of non-compliance and hunted by bureaucrats looking for easy targets. NO THEY WON'T. This is just untrue. We've had decades of regulation - the regulators are not new - and so you can see how they work. They do not pursue everyone looking for easy cases. They go after the worst offenders, and they write letters asking them to come back into compliance.