4 ms·

Where on Earth are you getting this number from? From the consultants I have spoken with and looking at the issue for my own company. Depending on what your s

Where on Earth are you getting this number from? From the consultants I have spoken with and looking at the issue for my own company. Depending on what your service does, the process of GDPR compliance can be incredibly complex and involve rewriting a significant percentage of your code. Even then, you may not be in the clear because it is up for unique interpretations in the courts of 28 distinct countries. It is, quite simply, a mess. Maybe it's one that will work out to users' benefit in the end, but that doesn't help the companies trying to serve them that don't have millions of dollars to spend on compliance.

codingdave 9y ago
Does it cost 7 figures if you don't hire consultants?
- downandout 9y ago
  Depends. If you happen to be both a lawyer that is well versed in the laws of all 28 EU countries, who can divine how each country will interpret and enforce the law, and also a coder with lots of time on your hands to implement in code what you hope is the correct interpretation of these laws, you may be able to do it for free. Most companies don't have a person like this though, and need to rely on outside experts for one or both of these.
  - user5994461 9y ago
    The interpretation of laws and specific contexts are usually relatively straightforward for people who are trained in legal speak, not engineers. There should be hardly any change needed as long as the service only gathers data that is required for it and users are willingly using the service. The problem if for companies that do heavy identification of users against their will like in adtech or companies that gather and resell personal information.
  - gerdesj 9y ago
    Bollocks! First off: GDPR will be harmonised across all 28 member states (not countries) - that's the point of it. For example in the UK, the current Data Protection Act of 1998 will be superseded by GDPR (https://www.itgovernance.co.uk/data-protection https://www.itgovernance.co.uk/data-protection) You do not need to be a lawyer to understand GDPR, you merely need the ability to read, and have a few hours to devote to research. Implementing a policy that is compatible with GDPR is not hard. It does require some thought and some time and will need some training across your organisation. If you do not have a market in the EU then it need not worry you at all. Funnily enough, if you bin (or neuter) those social icons and a few .js thingies from your website you'll be well on the way. Now think about how you would like to be treated, personally ... yep - you'll be fine. No lawyers needed and certainly not seven figure sums for handwaving. You really can use research and common sense and some time, to do the job in house effectively. I might politely suggest that it is a pretty good standard to work to anyway: it is designed to protect the privacy of individual people. I consider myself an individual and perhaps you do too.
    - downandout 9y ago
      You do not need to be a lawyer to understand GDPR And yet billions are being spent on exactly that - because it's an incredibly complex law that can indeed be subject to different interpretations in each country. I have been briefed on this point specific by lawyers in the EU for to whom we paid a fortune, only to decide that it was too risky to allow EU traffic. It's not just a matter of taking away "a few .js thingies" as you put it.
      - gerdesj 9y ago
        I am a director of a UK based IT company (MD) I am also the ISO9001 senior worrier and an ISO27001 sponsor. Just in case you are concerned that I might be a PHB (I do not have enough hair anyway): I run Arch Linux on all my PCs and am personally CREST accredited. The purpose of GDPR is protect individual's right to privacy - I doubt you can fault that. You and I are both individuals ... Have you actually sat down with a copy of the GDPR a clear mind, and some really good coffee and bothered to read it? If you are arguing the toss with me based on something that someone else has told you then go away. GDPR is designed to protect people - you and I if you like. I'm a fan of it.
- mst 9y ago
  My employer, https://shadow.cat/ https://shadow.cat/ is offering GDPR compliance consultancy, and so far the take away has been "if you're a non-tech company, it's not honestly that hard" plus "if you're a tech company, it's only hard if your entire business model is built around exploiting your customers' data". If it costs 7 figures to hire consultants, either your business model was parasitic in the first place or your consultants are attempting to fleece you. (if you don't believe me, email mdk@shadowcat.co.uk and ask - I run the tech team, I'm not nearly as much of an expert on the rules as he is - and if you're emailing him to ask with no intention to pay us anything, that's fine, just make sure to blame me)
matthewmacleod 9y ago
I’m sorry, I have a great deal of difficulty believing this. there are essentially no situations in which GDPR compliance should be particularly onerous. The principles are pretty simple, and while it will take some time until there is clarity on edge cases, most actions required should be straigtforward. I’d be fascinated to know what product you build that is so inextricably tied to user data that it will cost “millions” to comply.
- downandout 9y ago
  I’m sorry, I have a great deal of difficulty believing this. Then you obviously haven’t read the whole thing or had to comply with it.
  - matthewmacleod 9y ago
    I have done both. It it possible that you’ve been fleeced by your consultants? You’ve notably avoided talking what you’re doing that would require onerous compliance, details of which would go at least part way towards substantiating our rather unbelievable ideas about the cost of compliance.
    - downandout 9y ago
      Have you done a search to verify that others feel that GDPR compliance is easy and cheap? I think you’re way off base here, and I’m not alone.
      - matthewmacleod 9y ago
        Yeah, anybody I’ve met with experience is pretty confident in that. The people I’ve met who aren’t fall into three categories: 1. People who don’t know much about the rules and have concocted a distorted version of them 2. People who are running a business that relies on misuse of personal data and who will be directly affected 3. People who have some ideological or politicical viewpoint which generally opposes regulation. I have encountered no situation where someone has been able to demonstrate to me a convincing case where GDPR compliance is onerous, or indeed more work than any best practices they should have already been following.

codingdave 9y ago

Does it cost 7 figures if you don't hire consultants?

downandout 9y ago
Depends. If you happen to be both a lawyer that is well versed in the laws of all 28 EU countries, who can divine how each country will interpret and enforce the law, and also a coder with lots of time on your hands to implement in code what you hope is the correct interpretation of these laws, you may be able to do it for free. Most companies don't have a person like this though, and need to rely on outside experts for one or both of these.
- user5994461 9y ago
  The interpretation of laws and specific contexts are usually relatively straightforward for people who are trained in legal speak, not engineers. There should be hardly any change needed as long as the service only gathers data that is required for it and users are willingly using the service. The problem if for companies that do heavy identification of users against their will like in adtech or companies that gather and resell personal information.
- gerdesj 9y ago
  Bollocks! First off: GDPR will be harmonised across all 28 member states (not countries) - that's the point of it. For example in the UK, the current Data Protection Act of 1998 will be superseded by GDPR (https://www.itgovernance.co.uk/data-protection https://www.itgovernance.co.uk/data-protection) You do not need to be a lawyer to understand GDPR, you merely need the ability to read, and have a few hours to devote to research. Implementing a policy that is compatible with GDPR is not hard. It does require some thought and some time and will need some training across your organisation. If you do not have a market in the EU then it need not worry you at all. Funnily enough, if you bin (or neuter) those social icons and a few .js thingies from your website you'll be well on the way. Now think about how you would like to be treated, personally ... yep - you'll be fine. No lawyers needed and certainly not seven figure sums for handwaving. You really can use research and common sense and some time, to do the job in house effectively. I might politely suggest that it is a pretty good standard to work to anyway: it is designed to protect the privacy of individual people. I consider myself an individual and perhaps you do too.
  - downandout 9y ago
    You do not need to be a lawyer to understand GDPR And yet billions are being spent on exactly that - because it's an incredibly complex law that can indeed be subject to different interpretations in each country. I have been briefed on this point specific by lawyers in the EU for to whom we paid a fortune, only to decide that it was too risky to allow EU traffic. It's not just a matter of taking away "a few .js thingies" as you put it.
    - gerdesj 9y ago
      I am a director of a UK based IT company (MD) I am also the ISO9001 senior worrier and an ISO27001 sponsor. Just in case you are concerned that I might be a PHB (I do not have enough hair anyway): I run Arch Linux on all my PCs and am personally CREST accredited. The purpose of GDPR is protect individual's right to privacy - I doubt you can fault that. You and I are both individuals ... Have you actually sat down with a copy of the GDPR a clear mind, and some really good coffee and bothered to read it? If you are arguing the toss with me based on something that someone else has told you then go away. GDPR is designed to protect people - you and I if you like. I'm a fan of it.
mst 9y ago
My employer, https://shadow.cat/ https://shadow.cat/ is offering GDPR compliance consultancy, and so far the take away has been "if you're a non-tech company, it's not honestly that hard" plus "if you're a tech company, it's only hard if your entire business model is built around exploiting your customers' data". If it costs 7 figures to hire consultants, either your business model was parasitic in the first place or your consultants are attempting to fleece you. (if you don't believe me, email mdk@shadowcat.co.uk and ask - I run the tech team, I'm not nearly as much of an expert on the rules as he is - and if you're emailing him to ask with no intention to pay us anything, that's fine, just make sure to blame me)

matthewmacleod 9y ago

I’m sorry, I have a great deal of difficulty believing this. there are essentially no situations in which GDPR compliance should be particularly onerous. The principles are pretty simple, and while it will take some time until there is clarity on edge cases, most actions required should be straigtforward. I’d be fascinated to know what product you build that is so inextricably tied to user data that it will cost “millions” to comply.

downandout 9y ago
I’m sorry, I have a great deal of difficulty believing this. Then you obviously haven’t read the whole thing or had to comply with it.
- matthewmacleod 9y ago
  I have done both. It it possible that you’ve been fleeced by your consultants? You’ve notably avoided talking what you’re doing that would require onerous compliance, details of which would go at least part way towards substantiating our rather unbelievable ideas about the cost of compliance.
  - downandout 9y ago
    Have you done a search to verify that others feel that GDPR compliance is easy and cheap? I think you’re way off base here, and I’m not alone.
    - matthewmacleod 9y ago
      Yeah, anybody I’ve met with experience is pretty confident in that. The people I’ve met who aren’t fall into three categories: 1. People who don’t know much about the rules and have concocted a distorted version of them 2. People who are running a business that relies on misuse of personal data and who will be directly affected 3. People who have some ideological or politicical viewpoint which generally opposes regulation. I have encountered no situation where someone has been able to demonstrate to me a convincing case where GDPR compliance is onerous, or indeed more work than any best practices they should have already been following.