13 ms·

The GDPR seems easy, but I get a feeling you haven't tried to actually properly implement the GDPR regs, talking to lawyers and everything. If you have you'll

The GDPR seems easy, but I get a feeling you haven't tried to actually properly implement the GDPR regs, talking to lawyers and everything. If you have you'll see there is far more involved than you think. I wish it was easy as just manually looking for user data after an email, deleting it, and keeping that email request as part of the 'audit log'. And getting affirmative consent during signup. Most small businesses would be fine with something that casual. EDIT: If you guys winged it by actually just reading the regulations and winging it, you probably did something wrong.

rectang 9y ago
The GDPR is inconvenient with many of the shady business models popular among web-centric companies. In the long run, it's good for all of us if those business models are discouraged.
- woolvalley 9y ago
  It's inconvenient for the non-shady, non adtech, we give you a service in exchange for money businesses too! I think the best thing to take away from GDPR compliance is 'it's not as easy as you think it is', 'it's not as obvious as you think it is', and small businesses who totally respect privacy will probably still be breaking GDPR.
  - rectang 9y ago
    I'm OK with that and I accept that cost, because in my eyes stopping the savage victimization of users is worthwhile. For you (or the WSJ) to persuade me that the GDPR is problematic, I'd have to believe that first, that's something that those opposed to the GDPR actually care about, and that it's something that could be achieved through other means.
    - chrischen 9y ago
      Except this does nothing to really stop the savage victimization of users by Facebook or Google. If anything it solidifes their dominance. The abuses are happening from these big companies, not the thousands of tiny startups that live and die within months that have a few hundred thousand users.
      - dvfjsdhgfv 9y ago
        This argument is of the "we can't solve the problem completely, so let's do nothing about it" kind. The abuse is happening from both camps and we all know it, especially here on HN where some of us are actively developing user-tracking schemes and ad-targeting platforms for a living.
        nemothekid 9y ago
        IMO, it's less "both camps are doing it" and more have we now insulated these giants from any future competition. For example, how do the decentralized social platforms (mastadon, diaspora), exist under GDPR?
        AstralStorm 9y ago
        Under explicit consent of the people putting the data in. All this needs is a nice informative screen on how the data will be used and that it will be publicly available, which may mean being processed by other registered users and unknown third parties. The networks will not be able to process the data in other ways than making it available. If you break someone's privacy laws you will be liable directly. Probably also a note that data on this network cannot be completely deleted for specific technical reasons.
      - rectang 9y ago
        So your proposal is a return to the status quo ante and unlimited exploitation of users? Not good enough. I will take the imperfect good of the GDPR as an incremental improvement over the option of abject surrender.
  - xg15 9y ago
    I think this objection sounds vague. Could you give some examples of regulations where one should talk with a lawyer before implementing?
- LoSboccacc 9y ago
  Do you have any european contacts on your mobile phone? Hope you have consent for those. We’re at this level of inconvenience.
  - seszett 9y ago
    Do you think you have contacts on your phone from people who are not OK with it, and if that's the case do you think you should be allowed to keep them as contacts against their will? GDPR or not, that could already be judged as some form of stalking by the already existing national laws. Edit, people don't seem to like that, but the fact is that just having saved the contact info of people who did not want it has already been used as sufficient proof in harassment (I think? "harcèlement") cases in France. I would be surprised if it was not already the case elsewhere as well.
    - zeeZ 9y ago
      If your contacts are synced to the cloud, were they informed that their information will be transferred and processed overseas?
      - seszett 9y ago
        Probably not. But it would be great if you could prevent your own contact info from being sent to companies outside the EU, indeed. In practice however, I don't think that will happen.
realusername 9y ago
> EDIT: If you guys winged it by actually just reading the regulations and winging it, you probably did something wrong. Most of the work in my company for GDPR is around user profiles, we store very few data about the users so we don't have that much to take care of. I guess if your business is to gather customer data, it's a completely different story.
- s17n 9y ago
  You are responsible to everyone who you have data about, regardless of whether or not they are your user. If I use your service to store a photo of my mom, you now have a legal obligation to her even though you don't even know she exists. Any text that you store, you are required to know who is mentioned in it and give them tools for download, right to be forgotten, etc.
  - realusername 9y ago
    > You are responsible to everyone who you have data about, regardless of whether or not they are your user. We have zero data on non-users so this part is not relevant to us, like I said it's not a data-gathering company. For the tools to download, remove data, consent... That's what I meant with that one or two weeks worth of work.
  - Aengeuad 9y ago
    What you are suggesting would not only make compliance of GDPR impossible for any company that accepts any form of user submitted data, it would also violate the privacy of the users submitting said data. If I, party A, send a message to party B that happens to contain information about party C, party C does not get to see the messages between parties A and B just because it concerns them or has personally identifying information about them.
    - dogma1138 9y ago
      Actually under GDPR they do you need to perform data discovery to identify that data. https://enterprise.microsoft.com/en-gb/articles/roles/discover-gdpr/ https://enterprise.microsoft.com/en-gb/articles/roles/discov... GDPR does not cover only data you collect through your primary business model but ALL DATA defined as Personal Information under the GDPR.
mercer 9y ago
So, honest question for you and others who have know more about this stuff: is it possible that perhaps you're erring on the side of caution a little too much? It's a lawyer's job to worry about everything that could go wrong, and assume a worst-case scenario, but surely in many cases GDPR will be about the spirit of the law rather than the letter? For example, while I personally think the backing-up-now-deleted-user-data issue is not insurmountable, assuming it's not, I cannot imagine that these 'small companies' will be fined left and right for failing to remove a user's data from every backup. And that's even assuming that there's a high likelihood that said backups will be investigated. To make an analogy: there are quite a number of regulations in effect concerning invoicing that are flagrantly violated by almost every single small-business owner that I know. Some of them have won the 'audit-lottery' and did not suffer any significant consequences, because their transgression was relatively minor (stuff like correcting an invoice and sending it without properly sending a credit-invoice first to nullify the initial invoice). Again, I'm way out of my depth here so by all means yell at me for being irresponsible about this :).
- fasteddie 9y ago
  As someone responsible for implementation -- yes, we are probably erring on the side of caution too much, but "probably" doesn't cut it with the potential fines on the line. -How big is "probably? 5% chance? 0.01% Chance? -Maybe they will be lax on cookie policy slipups but not on purging delete requests from backups, how are we to know on May 26? -Maybe they will only investigate the big public giants, or maybe they will respect maliciously-intented complaints from competitors? This is why, for example, Delaware is the chosen state for corporations -- case law is settled and has a very predictable legal frame work. In the absence of data, its hard to know WHERE people will get the hammer.
Yetanfou 9y ago
One of the problems stems for this dichotomy: I did not see anything in GDPR which does not make sense to me, it looks like common sense applied to data management versus I get a feeling you haven't tried to actually properly implement the GDPR regs, talking to lawyers and everything Which can be further shortened to: common sense versus talking to lawyers While interpretation of laws by necessity is at best difficult and at worst fraught with peril - reality in all its complexities is hard to catch in a few written pages - the legal profession has turned themselves into virtual toll collectors for anything related to law. Ask a lawyer about the legal implications of preparing a peanut butter sandwich and you'll be first presented with a legal disclaimer - pay me if you want advice - and then treated to a tale worthy of Lewis Carroll. GDPR is a $deity-send in this respect, good for many a year of steady income, especially given the stiff fines which threaten. ...which does not mean the person who used common sense to interpret the law is wrong. He is very much likely to be right and, having spent two weeks of technical work to prepare their infrastructure they're probably set to fulfil the obligations the law puts on them. It might need some fine-tuning here and there but that can mostly likely be handled as well without incurring the wrath of the courts. In short, talking to a lawyer about being able to do something like this by yourself is more or less guaranteed to give the same reply as e.g. talking to someone who does data rescue whether you could replace the head stack on a hard drive by yourself. In both cases it is possible as long as you're careful and use the right tools, in both cases the answer will be 'you could do this at your own peril, disaster is waiting to strike, you take up enormous risks, let the professionals handle it'. Which is true to a certain level, there are risks just like there are risks in any venture.

rectang 9y ago

The GDPR is inconvenient with many of the shady business models popular among web-centric companies. In the long run, it's good for all of us if those business models are discouraged.

woolvalley 9y ago
It's inconvenient for the non-shady, non adtech, we give you a service in exchange for money businesses too! I think the best thing to take away from GDPR compliance is 'it's not as easy as you think it is', 'it's not as obvious as you think it is', and small businesses who totally respect privacy will probably still be breaking GDPR.
- rectang 9y ago
  I'm OK with that and I accept that cost, because in my eyes stopping the savage victimization of users is worthwhile. For you (or the WSJ) to persuade me that the GDPR is problematic, I'd have to believe that first, that's something that those opposed to the GDPR actually care about, and that it's something that could be achieved through other means.
  - chrischen 9y ago
    Except this does nothing to really stop the savage victimization of users by Facebook or Google. If anything it solidifes their dominance. The abuses are happening from these big companies, not the thousands of tiny startups that live and die within months that have a few hundred thousand users.
    - dvfjsdhgfv 9y ago
      This argument is of the "we can't solve the problem completely, so let's do nothing about it" kind. The abuse is happening from both camps and we all know it, especially here on HN where some of us are actively developing user-tracking schemes and ad-targeting platforms for a living.
      - nemothekid 9y ago
        IMO, it's less "both camps are doing it" and more have we now insulated these giants from any future competition. For example, how do the decentralized social platforms (mastadon, diaspora), exist under GDPR?
        AstralStorm 9y ago
        Under explicit consent of the people putting the data in. All this needs is a nice informative screen on how the data will be used and that it will be publicly available, which may mean being processed by other registered users and unknown third parties. The networks will not be able to process the data in other ways than making it available. If you break someone's privacy laws you will be liable directly. Probably also a note that data on this network cannot be completely deleted for specific technical reasons.
    - rectang 9y ago
      So your proposal is a return to the status quo ante and unlimited exploitation of users? Not good enough. I will take the imperfect good of the GDPR as an incremental improvement over the option of abject surrender.
- xg15 9y ago
  I think this objection sounds vague. Could you give some examples of regulations where one should talk with a lawyer before implementing?
LoSboccacc 9y ago
Do you have any european contacts on your mobile phone? Hope you have consent for those. We’re at this level of inconvenience.
- seszett 9y ago
  Do you think you have contacts on your phone from people who are not OK with it, and if that's the case do you think you should be allowed to keep them as contacts against their will? GDPR or not, that could already be judged as some form of stalking by the already existing national laws. Edit, people don't seem to like that, but the fact is that just having saved the contact info of people who did not want it has already been used as sufficient proof in harassment (I think? "harcèlement") cases in France. I would be surprised if it was not already the case elsewhere as well.
  - zeeZ 9y ago
    If your contacts are synced to the cloud, were they informed that their information will be transferred and processed overseas?
    - seszett 9y ago
      Probably not. But it would be great if you could prevent your own contact info from being sent to companies outside the EU, indeed. In practice however, I don't think that will happen.

realusername 9y ago

> EDIT: If you guys winged it by actually just reading the regulations and winging it, you probably did something wrong. Most of the work in my company for GDPR is around user profiles, we store very few data about the users so we don't have that much to take care of. I guess if your business is to gather customer data, it's a completely different story.

s17n 9y ago
You are responsible to everyone who you have data about, regardless of whether or not they are your user. If I use your service to store a photo of my mom, you now have a legal obligation to her even though you don't even know she exists. Any text that you store, you are required to know who is mentioned in it and give them tools for download, right to be forgotten, etc.
- realusername 9y ago
  > You are responsible to everyone who you have data about, regardless of whether or not they are your user. We have zero data on non-users so this part is not relevant to us, like I said it's not a data-gathering company. For the tools to download, remove data, consent... That's what I meant with that one or two weeks worth of work.
- Aengeuad 9y ago
  What you are suggesting would not only make compliance of GDPR impossible for any company that accepts any form of user submitted data, it would also violate the privacy of the users submitting said data. If I, party A, send a message to party B that happens to contain information about party C, party C does not get to see the messages between parties A and B just because it concerns them or has personally identifying information about them.
  - dogma1138 9y ago
    Actually under GDPR they do you need to perform data discovery to identify that data. https://enterprise.microsoft.com/en-gb/articles/roles/discover-gdpr/ https://enterprise.microsoft.com/en-gb/articles/roles/discov... GDPR does not cover only data you collect through your primary business model but ALL DATA defined as Personal Information under the GDPR.

mercer 9y ago

So, honest question for you and others who have know more about this stuff: is it possible that perhaps you're erring on the side of caution a little too much? It's a lawyer's job to worry about everything that could go wrong, and assume a worst-case scenario, but surely in many cases GDPR will be about the spirit of the law rather than the letter? For example, while I personally think the backing-up-now-deleted-user-data issue is not insurmountable, assuming it's not, I cannot imagine that these 'small companies' will be fined left and right for failing to remove a user's data from every backup. And that's even assuming that there's a high likelihood that said backups will be investigated. To make an analogy: there are quite a number of regulations in effect concerning invoicing that are flagrantly violated by almost every single small-business owner that I know. Some of them have won the 'audit-lottery' and did not suffer any significant consequences, because their transgression was relatively minor (stuff like correcting an invoice and sending it without properly sending a credit-invoice first to nullify the initial invoice). Again, I'm way out of my depth here so by all means yell at me for being irresponsible about this :).

fasteddie 9y ago
As someone responsible for implementation -- yes, we are probably erring on the side of caution too much, but "probably" doesn't cut it with the potential fines on the line. -How big is "probably? 5% chance? 0.01% Chance? -Maybe they will be lax on cookie policy slipups but not on purging delete requests from backups, how are we to know on May 26? -Maybe they will only investigate the big public giants, or maybe they will respect maliciously-intented complaints from competitors? This is why, for example, Delaware is the chosen state for corporations -- case law is settled and has a very predictable legal frame work. In the absence of data, its hard to know WHERE people will get the hammer.

Yetanfou 9y ago

One of the problems stems for this dichotomy: I did not see anything in GDPR which does not make sense to me, it looks like common sense applied to data management versus I get a feeling you haven't tried to actually properly implement the GDPR regs, talking to lawyers and everything Which can be further shortened to: common sense versus talking to lawyers While interpretation of laws by necessity is at best difficult and at worst fraught with peril - reality in all its complexities is hard to catch in a few written pages - the legal profession has turned themselves into virtual toll collectors for anything related to law. Ask a lawyer about the legal implications of preparing a peanut butter sandwich and you'll be first presented with a legal disclaimer - pay me if you want advice - and then treated to a tale worthy of Lewis Carroll. GDPR is a $deity-send in this respect, good for many a year of steady income, especially given the stiff fines which threaten. ...which does not mean the person who used common sense to interpret the law is wrong. He is very much likely to be right and, having spent two weeks of technical work to prepare their infrastructure they're probably set to fulfil the obligations the law puts on them. It might need some fine-tuning here and there but that can mostly likely be handled as well without incurring the wrath of the courts. In short, talking to a lawyer about being able to do something like this by yourself is more or less guaranteed to give the same reply as e.g. talking to someone who does data rescue whether you could replace the head stack on a hard drive by yourself. In both cases it is possible as long as you're careful and use the right tools, in both cases the answer will be 'you could do this at your own peril, disaster is waiting to strike, you take up enormous risks, let the professionals handle it'. Which is true to a certain level, there are risks just like there are risks in any venture.