78 ms·

StreetLend.com shuts down, citing GDPR regulations

• richp10 8y ago
  GDPR is not difficult to comply with and based on the decades of experience with the Data Protection Act on which it is based, the chances of being sued (or threatened with litigation) seem tiny indeed. Also, I think the reason why this site cannot cope with GDPR run deeper than being willing to add a 'delete account' and 'download my data' functionality to a loss making site. On the screenshots, it shows a prominent section on the home page: “StreetLend with Facebook friends (and their friends, and people they endorse)” This suggests they are using the Facebook login to harvest from the Facebook social graph. Head down that particular road and you are in a privacy shit show - and after Cambridge Analytica and GDPR my guess is that Facebook is cutting of this supply of data - or setting hurdles that streetlend cannot hit. A few people were sued by the ICO for non compliance with the DPA - but it didn't open the floodgates of civil litigation. To my mind (and I am in the processes of updating two small businesses to be compliant) it just sets good ethical standards and Google / FB etc are missing a trick in not just declaring this is the standard they will follow worldwide.
• bmer 9y ago
  I thought the UK was no longer a part of the EU?
  • tankenmate 9y ago
    Tentatively scheduled for a May 2019 departure, but still sticking to EU rules until end of 2020. And finally the UK will probably always adhere to the GDPR, member of EU or not, otherwise it will be at a massive disadvantage for tech companies dealing with Europe.
    • landryraccoon 9y ago
      > And finally the UK will probably always adhere to the GDPR, member of EU or not, otherwise it will be at a massive disadvantage for tech companies dealing with Europe. I really don't see how this is the case. A small website will be going after product market fit, then they can scale and do compliance. Not adhering to GDPR means your websites can always become compliant later. To put it another way, Facebook and Google started in the US. Any founder in the EU might consider moving to the US first, getting product market fit before worrying about GDPR compliance, then get compliance once you know your product is good and you aren't just throwing that work away.
      • tankenmate 9y ago
        GDPR applies to all data controllers anywhere on the earth, if you hold private data of EU citizens or residents and don't follow the GDPR then any EU country's data protection authority can choose to prosecute. The only way to avoid the GDPR is to not hold personal identifying information on any EU citizens or EU residents.
    • genma_it 9y ago
      I find funny how people assume by default that the UK will not make even worst laws after Brexit.
  • galvin 9y ago
    They are still in the process of leaving and until they do they are subject to EU regulations.
  • AdamGibbins 9y ago
    One interpretation of GDPR is that it applies to EU citizens globally, irrelevant of where the company or its data is hosted.
    • cyberferret 9y ago
      That is our understanding of it too. It doesn't matter where your company is incorporated, or where your hosting provider stores the data - as long as an EU resident uses your service, you have to comply. I could be wrong, but we are erring on the side of caution with our SaaS app and treating this as the case.
      • adventured 9y ago
        edit: I understand this is an unpopular fact. However it is a fact that the EU does not have global jurisdiction to overrule foreign national sovereignty and dictate legislation. US businesses do not need to comply with GDPR if they are doing no business in the EU, period. No, you do not have to comply if you're outside of the EU's jurisdiction. They can only hit you if you've got business in the EU that they can directly touch. Facebook, Google, etc. are aggressively complying because they want to continue making money in the EU. They'll have to overrule eg US or Chinese jurisdiction to force outside companies to comply with GDPR. How exactly do they intend to force compliance upon the two global superpowers with $34 trillion in economic output? It's laughable. US Federal courts will bury any attempts by the EU to legislate US laws/regulations on these matters. If I'm a US service/site, I do no business in the EU, and I store information from EU residents on my servers in the US, the EU can't force me to comply with GDPR. They have no means to force that compliance, and to overrule or dictate US domestic laws. The EU doesn't govern the world's laws, if they didn't already realize that they're about to discover it.
        • cyberferret 9y ago
          Does that still apply if we are a 'data processor' according to their definition? We are an Australian company, with servers based in the US, and we have EU companies actually using our SaaS to manage their employee's information (also based in the EU). We haven't had formal legal advise on this, but upon discussions with other service providers, it seems we still have to be compliant because our paying customers who actually own the data are based in the EU.
  • M2Ys4U 9y ago
    1. The UK is still a member of the European Union 2. The GDPR is already law, it just had a 2 year delay before it fully came in to force
• donttrack 9y ago
  Why did it have to shut down?
  • tankenmate 9y ago
    Unable and/or unwilling to assess compliance/risk, this leads to the owner wanting to shut down.
  • AdamGibbins 9y ago
    Scroll down, it answers the question.
    • lucb1e 9y ago
      (not OP) I scrolled down and didn't find an answer. The section labeled "why shut down" mentions (paragraph by paragraph): - "[GDPR] creates uncertainty and risk" -- which? - "fines of 4% of turnover or €20 million (whichever is higher)" -- as if a small infraction is going to get the maximum punishment. He can't be serious here. - "ambiguously-defined hoops" -- which requirements are ambiguous? - "parasitic no-win-no-fee legal firms, puts website owners at risk of vindictive reporting" -- if you ever needed one of those companies (I did unfortunately), you'd know that someone always ends up paying the lawyers. Either the sued company or the client. It's definitely not risk-free for the client. - "this new EU law hurts small and ethical startups" -- what clause of GDPR would ethical startups run afoul of anyway? It's aimed at unethical ones. And as for "small", then you can't get a big fine anyway right? At least, unless you intentionally cause big damages, I don't see how a small firm like this could unintentionally cause such big damages that large fines are in order. So it's not answered. And I am still wondering what part of GDPR he doesn't already comply with in the website's current form, as the Dutch "WBP" from 2001 required 95% the same things. I assume the UK generally has somewhat similar laws.
      • davorak 9y ago
        Some people are under the impression that ip addresses fall under "personal information". So if the user account is deleted and the associated ip logs are not deleted this would be a GDPR violation. Another potential violation would be asking a users age(like asking their birthday), but not needing their age for the operation of the service. It is currently unclear how rigorously GDPR will be enforced. In the extreme case of rigorous enforcement nearly all current server/frameworks would cause violations by default and would need to be overhauled. There are a bunch of other examples in the comments that are likely violations for the site as well. It is unclear how many of these apply since it is unclear how the GDPR will be enforced.
• cyberferret 9y ago
  I admit to being baffled as to why they shut down. If a user of the service has given permission for their location to be shared on the 'nearby' map, then they still comply with all the legislation because they have tacit permission from the user that their location will be shared with others. If the user then decides NOT to share their location or want their data deleted entirely, then the as long as the site stops sharing their location or removes their data completely (within 30 days), then they are still GDPR compliant, AFAIK. EDIT: Sounds to me like a side project started getting a little unwieldy or had too much technical debt for the developer to manage, and he decided to shut it down using GDPR as a vague justification?
  • adventured 9y ago
    They explained why. Obviously you may still disagree, however their opinion of acceptable risk is subjective (ie it's silly to tell someone what their tolerance for risk should be). > GDPR threatens website owners with fines of 4% of turnover or €20 million (whichever is higher) if they do not jump through a number of ambiguously-defined hoops. The law, combined with parasitic no-win-no-fee legal firms, puts website owners at risk of vindictive reporting. Young websites and non-profits cannot afford legal teams. Therefore the risk posed by GDPR is unacceptably high. > Perversely, this new EU law hurts small and ethical startups, but helps reinforce the dominance of Facebook, Google and Twitter, who are able to prepare and defend themselves using established legal teams and cash reserves, and who now face less competition from startups. The EU Cookie Law, EU VAT regulation and now the EU GDPR are all examples of poorly-implemented laws that add complexity and unintended side-effects for businesses within the EU.
    • cyberferret 9y ago
      You are right in that I don't agree. I don't think this is a question of tolerance of risk, but that he doesn't seem to want to study all the implications. I will be first to admit that GDPR is full of holes and ambiguities and has never been tested in a court of law yet, but rather than (as the two quotes you pulled from his site) assume that GDPR has been set up to give the 'big boys' free reign and punish small operators, I'd like to think that GDPR actually puts a LOT more accountability on the larger players and actually will put smaller players on a semi-equal footing. I really don't think that the EU will be spending the money and time (and open themselves to the PR disaster) of suing websites that might make $1000/mo for the full EUR20Million, do you?
• advisedwang 9y ago
  As far as I understand, to make this site GDPR compliant you would have to: 1. Get consent when someone creates an account, saying what you do with the data including how you make automatic decision (e.g. which amazon pages you recommend). 2. Allow people to unconsent/delete accounts 3. Have a page that allows a user to download their data. 4. Have a way for them to fix mistakes in that information That doesn't seem that burdensome. In fact some flavor of that is pretty much what you get with standard a standard create account/view account/change account/delete account workflow.
  • hidiegomariani 9y ago
    I agree, this guy seems just to cry with no clear reason whatsoever
    • HenryBemis 9y ago
      The guy apart from crying without ever having read those 80 pages (english language text), doesn't see the big picture. The fact that I can force Facebook, Google, etc. to tell me what they are doing with my data (which I btw had given consent to treat like yesterday's newspaper), and subsequently asking the various Cambridge Analytica's the same question, gives the people a power they never had. Now they do. He wants to leave the game? Feel free! He wants people to be completely powerless? Well.. the kitchen has a door. Feel free to open and leave if it gets too hot.
      • WillPostForFood 9y ago
        This is the classic unintended effect of this kind of regulation. It is harder for small and new companies to comply and crowds them out, further entrenching the power and control of Facebook and Google.
        • CrLf 9y ago
          Actually, it's easier for small and especially new companies to comply. Now, maybe they don't want to, but I don't feel any kind of sympathy for cost cutting on my privacy. What you say it's an unintended side effect, I think is very much intended. That's why the GDPR (if it doesn't fail for other reasons) is a very welcome regulation.
• amaccuish 9y ago
  Not really a "victim"
• ujkwast 9y ago
  >GDPR threatens website owners with fines of 4% of turnover or €20 million (whichever is higher) if they do not jump through a number of ambiguously-defined hoops. The law, combined with parasitic no-win-no-fee legal firms, puts website owners at risk of vindictive reporting. Young websites and non-profits cannot afford legal teams. Therefore the risk posed by GDPR is unacceptably high. I get the point about legal trolls,but how are the hoops ambigously defined? - don't store data you don't need for your business' stated purpose - get active consent before you do so - be ready to delete data on command - store the data with best principles (i.e., instead of having ID and other stuff connected, centralize identifiying information and protect,use pseudonyms otherwise) IANAL, but this seems pretty sensible?
  • ams6110 9y ago
    He said the site does not make money. So why would he spend more of his time to make the changes needed to be compliant? That said, I think the fear of no win, no fee legal firms is a little overblown. You can't get blood out of a turnip and if he's not making money there's no reason any law firm would be interested in suing him.
    • lucb1e 9y ago
      > He said the site does not make money. So why would he spend more of his time to make the changes needed to be compliant? I'm honestly wondering what the law previously said regarding data protection. The Dutch WBP from 2001 already covers everything that he would have to do under GDPR given this website, so unless the UK has some very weird laws (or unless we're weird), nothing would change. Perhaps an extra tickbox on signing up that says "yeah yeah I'm really very aware that my data is shared with third parties". Most likely, this is a good excuse to go "I refuse to read the long legalese [even if it's 95% the same as before] and I'm just going to quit this loss-turning website without the community turning sour on me because I have a good excuse".
      • mikekchar 9y ago
        The main difference is that you have to tell people ahead of time what you are going to do with the data and what lawful basis you are going to use to justify that usage. Later you can't change your mind. Additionally, you have to record what you have previously told people (so you can say, "On this date we informed you that we would use the data in this way, are we are doing so"). One other potential difference is that you need to be able to inform the user specifically with which 3rd parties you have shared the information. Generally speaking, I think most sites will require some additional development work to update their UI and to store the data. If you have been compliant with the previous laws then it should be no problem. One wrinkle is that in the previous laws there was no way for your customer to find out if you were following the law or not (without suing you). With GDPR they have a right to both be notified what you plan to do and the right to request evidence that you are following that plan. There will be many companies that will have to alter their processes significantly to account for this.
• originalsimba 9y ago
  What happens when GDPR conflicts with SOX, which prohibits the destruction of data? GDPR is a great example of the kinds of disasters that happen when nations try to force the entire planet to follow their unilateral actions.
  • kartan 9y ago
    If you are a bank and a client asks you to delete their data. The bank will still keep it for the tax agencies. If a tribunal gets asked to delete the personal data of the accused, they will keep the data. There is a principle of public interest and public obligations to keep data. What part do you think that is a disaster?
    • originalsimba 9y ago
      > What part do you think that is a disaster? uh... this post is about a guy losing his business because of the GDPR. What part of that isn't a disaster? >If you are a bank and a client asks you to delete their data. The bank will still keep it for the tax agencies. > If a tribunal gets asked to delete the personal data of the accused, they will keep the data. > There is a principle of public interest and public obligations to keep data. In other words, GDPR has no teeth outside of Europe.
      • lazyasciiart 9y ago
        GPDR explicitly lets organizations keep data if they need to. Do you think it just turned into a magical get-out-of-your-past switch that means "my employer will have to delete records of firing me!"?
        • originalsimba 9y ago
          > In other words, GDPR has no teeth outside of Europe. In other words, GDPR has no teeth outside of Europe.
        • abraae 9y ago
• hywel 9y ago
  It seems like more research into GDPR could have prevented this. Firstly, there's nothing this site does that is so unusual. If the user gives explicit and informed consent for their data to be used in this way, then you are likely to be covered. Secondly, it's looking unlikely that the rules will be enforced that strictly in the near term, especially against a small, hobby website. IANAL but you likely have a couple of years until you have any chance of being on the ICO's radar (ICO is the UK's enforcer). And even then, you can reasonably expect the find to be << €4M. Thirdly, if you run this site from a limited company (about £100/year to maintain), then the very worst case would be that you are investigated under the GDPR in the future, and you can fold the site then at which point your liability ends. No need to do it now, in fear of something that may never happen. I hope it's not too late to change your mind about shutting down!
  • HenryBemis 9y ago
    I am currently working in one of this multi-$bn companies. They run/are preparing GDPR. So far I haven't found ANY person who has read the full 80 pages. Everyone is asking eveyrone else, they download whatever presentations they find on the internet, but NOT ONE have bothered reading the damn thing. It will be a massacre for many companies, only because very few do their homework.
    • dboreham 9y ago
      I'm going to add this syndrome to my growing list of "odd psychology in the software business" articles to write some day.
    • return1 9y ago
      the damn thing is more abstract than poetry. it s indicative that all these months, i have not seen a single article / presentation that provides a concrete example of how to shield a website.
      • mikekchar 9y ago
        The law is completely readable by non-lawyers, IMHO. It's one of the better written laws I've seen. But here's a website by the UK government that explains what all the terms mean and exactly what you have to do: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
• rzwitserloot 9y ago
  The GDPR is about 68 to 90 pages depending on which language you're reading it in. It is trying to be futureproof by leaving measures defined in terms of 'current state of technology', 'reasonable security considering the risk' and other such ambiguous terms. I run a small business and I like this. Just about anybody can read it and understand what rights and requirements are being set out in it. The GDPR specifically refers to the concept of "micro, small and medium-sized enterprises" [GDPR 40p1 and 42p1 use this text; they direct member states about the spirit of the law, referring that the needs of such businesses need to be taken into account]. GDPR 58p2 sets out that regulatory bodies in a member state have the power to issue warnings. As in, if you mess up, unless the mess-up is malicious or excessively negligent, you get a written warning and reasonable time to fix the problem. My government (The Netherlands) has taken the effort, as have a significant number of third parties, of creating a legal document of 3 to 10 pages covering some details, and they generally set out more explicitly that you grant yourself a week or so to fix problems without penalty. Whilst the GDPR is intentionally ambiguous in order to try to be somewhat futureproof and remain short enough to read back to back in an afternoon, it's fairly clear this is perfectly fine. The most strenuous sections of the GDPR involve requests from those whose data you store. If they ask you to supply what data you have of them, and whom you've shared it with, you have to comply. Within reasonable timeframes, and you cannot lie about it. If they ask that you delete this data, you must be capable of doing so, and you must do so within a reasonable timeframe. However, the GDPR is nice enough to grant you exceptions for reasonable measures which nevertheless make it hard to comply. Things like a backup tape are specifically called out. It's okay if data that's been requested to be removed, stays on those. You would have to show that this data is pseudonimized (GDPR-ese for encrypted, pretty much). Any service which has a hard time supporting requests to explain what data you store and where you've stored it, or which cannot delete it from the main service on demand... should indeed just call it a day and shut down. I don't think a service like streetlend would have a hard time supporting such requests, however.
  • tomxor 9y ago
    > The GDPR is about 68 to 90 pages depending on which language you're reading it in [...] I run a small business and I like this. Just about anybody can read it and understand what rights and requirements are being set out in it. I don't run a small business, I make small things on the internet, this is not why I got into tech, I don't want to read 68 pages of yuk. If I made a small site that saves some user data i'd just pull it down too, I don't want the burden of worrying about being sued for some small thing I created, you just wont have it anymore. FB fucked it up for everyone, ultimately people gota learn that when you give data to someone you implicitly entrust them with it. FB had to go and be evil and now the EU is overreaching demanding everyone spend their time bubble wrapping everything... everyone backing them up are the village people taking to the streets with torches and burning shopkeepers after the king was found doing witchcraft. Go burn the king.
• hrktb 9y ago
  > Did it turn a profit? No, sadly not, but running at a loss was fine as my day job covered the bills. It seems the root of the issue would be financing the changes. In a way, looking further into the regulations to clear how to deal with ambiguous parts or even straight hire a lawyer to look at the details would be a simple move if the expense could be justified. Could it be summed up as “unexpected but mandatory changes kill unprofitable business” ?
  • darawk 9y ago
    It could if you also added "and prevent possibly profitable businesses from ever being started".
    • mdpopescu 9y ago
      Yes. Starting a business is already a huge mental effort, I've done it once when I was 19 and never since, even though it's pretty much expected of me (programmer after 40). Adding "you might have to pay 20 million euros" to the list of risks is... indescribable.
  • strken 9y ago
    It's not like he ever intended to turn it into the next Facebook, though, is it? It's like your grandmother's unprofitable home-made scone business shutting down because she doesn't have a certified kitchen.
    • estel 9y ago
      If her scone business started accepting payments by card then I think it should be held to the similar standards as larger businesses when it comes to securing card details. Which is kind of what GDPR wants to do for personal data: if you want to collect it from me, there are a minimum set of standards that you need to adhere to because it’s my data.
      • jimktrains2 9y ago
        The pci DSS is well speced and reasonable.
• bdz 9y ago
  Couple of video game services are also shutting down due to GDPR Super Monday Night Combat wich was developed in the US by Uber Entertainment [1] Ragnarok Online terminates the access from Europe. They are in Korea. [2] 1 https://steamcommunity.com/games/104700/announcements/detail/1661142811548355195 https://steamcommunity.com/games/104700/announcements/detail... 2 http://blog.warpportal.com/?p=10892 http://blog.warpportal.com/?p=10892
  • codedokode 9y ago
    I don't really understand why. They just should not collect real names or any other personal information and then they would be fine.
    • lmkg 9y ago
      Not really. The GDPR covers "personal data," which is much broader than the category of "personally identifiable information" that other legislation covers. A user identifier, even if opaque and not related to any personal information, counts as personal data.
      • actuator 9y ago
        Yeah, and the crazy thing is if you talk with a lawyer they would label anything and everything as personal data just because of how abstract some of the things are in the regulation. For example, IP address is PII and if you derive city, region or country from that it becomes personal data. Now if you are a small project or startup there is high chance that you are using some of the external analytics tools like GA or mixpanel(as building a good analytics tool is an effort on its own). Now you have to take care of data like country there as well and be very careful that you delete data like this as well.
        • izacus 9y ago
          You've been talking to a bag lawyer then.
        • 9y ago
• deleted 9y ago
  [deleted]
• redskin89 9y ago
  The author is a well known brexit advocate. Trying to put the responsibility of his failure on the EU... typical brexiter ...
• dboreham 9y ago
  Here's the thing: if you already cared about your users' privacy and security, and had some level of common decency in your approach to users, none of this is a big deal or indeed different to what you'd already be doing.
  • jimktrains2 9y ago
    Except the gdpr goes well beyond common decency.
    • Majestic121 9y ago
      No, it does not.
      • vixen99 9y ago
        Pointless comment unless you specify!
      • jimktrains2 9y ago
        The gdpr is ill-specified for starters. The commentary conflicts with the law itself, and the law makes it nearly impossible to know if you're dealing with a gdpr data subject. I firmly believe that companies need to protect their data better as the consequences of loss aren't shouldered by them, which the gdpr says nothing about. I also firmly believe that it's their data. When I send data to another machine, I was never under the impression that said information was mine. I was never under the impression that anything I have on Facebook was ever or will ever be private. I consider order information vital information _of the company_. When I choose to load thea Google analytics tracker, I have no notion that I own that tracking information. Splitting basic infrastructure like backups and logs by customer or introducing a whole system of flimsy cryptography to support that is no where near reasonable and well beyond common decency. Explaining all uses of data and why decisions are made isn't common decency. Again, I sent you my data, it is now the server's/company's. I expect them to do what they will with it. The gdpr is well intentioned, but ultimately nothing more than toxic smoke and carnavel mirrors. It is an underspecified mess and burden creating the notion that you can renege on data you send someone else.
• rando444 9y ago
  Unless the owner is doing something shady (or just doesn't understand the GDPR), the issue is pretty clear. He's running an unprofitable business (by his own admission), and likely is running it as some sort of sole proprietorship and doesn't want to take the risk on himself. The solution is to create a company so that the company can shoulder most of the risk so the company goes bankrupt in the event he finds himself unwilling to comply with regulatory requests. I'm guessing he just doesn't want to dump any more money into a failing project, which is his decision to make. Is this a failure of the GDPR though, or a success? Personally I think fly-by-night websites should be the last people responsible for handling personal data. If they're unwilling to attempt to comply with regulations, then perhaps the internet is a better place without these sites.
  • deleted 9y ago
    [deleted]
  • ajdlinux 9y ago
    While creating a company does shield you from some level of personal liability, you're (a) still exposed to directors' duties and similar obligations that attach to a director personally, and (b) still at risk of having your name attached to a company that has gone into liquidation.
  • tptacek 9y ago
    In the US, as a sort of general non-lawyerly rule of thumb, incorporation shields owners from contract liability, but not from tort liability, which is what they'd face from GDPR screwups.
    • rando444 9y ago
      Depends on the screwup. If he were directly involved in doing something malicious or extremely negligent towards his customers he could be liable. If he can't trust himself not to be in this category though, I would argue that shutting down is still the desired result.
  • scrollaway 9y ago
• deleted 9y ago
  [deleted]
• paxys 9y ago
  Kinda weird that the whole post is an advertisement for the website which is anyways shutting down, but contains no explanation for WHY the regulations aren't feasible to implement.
  • lwansbrough 9y ago
    Have you actually looked at GDPR? It's virtually infeasible for any small company to adhere to, based on the decades worth of software that we've built the world's economy around. Logs, databases, backup systems, analytics, metrics, sign in systems, e-commerce systems, fundamental algorithms were all built without any concept of users being able to legally claw back their data. Actually implementing this stuff in the real world is a fucking nightmare. It means rebuilding your entire stack if you actually intend to comply with the laws to their fullest extent. And even then, someone can hire a lawyer and sue you, which then burdens you as you struggle to prove your compliance, wasting valuable time and resources for someone who didn't have the forethought to decide ahead of time if they wanted you to have access to their data or not.
    • nfoz 9y ago
      > It's virtually infeasible for any small company to adhere to, based on the decades worth of software that we've built the world's economy around. Ah, that's exactly it. Decades worth of software irrevocably centred around tracking and analytics. It would be glorious to see it all thrown in the fire. We can write software and protocols that don't spy on people. Let's get back to that.
      • lwansbrough 9y ago
        Cool, looking forward to the magical solutions people come up with for performing full text search on encrypted PII, lest you get sued for $10M for keeping someone's name in your database that they willingly handed over to you.
        • freeone3000 9y ago
• anonytrary 9y ago
  > GDPR threatens website owners with fines of 4% of turnover or €20 million (whichever is higher) if they do not jump through a number of ambiguously-defined hoops. Disregarding the "hoops" -- shouldn't this 4% go entirely to the affected users? I thought this was meant to protect the users. Seems like a cash-grab by the government. Can someone make a good argument as to why the fines should be paid to a third party (the state) when this issue is between the service provider and the customers? The only thing I can think of is that the state is the only entity which can enforce the new rights, meaning they get paid for violations of the rights. Still, if someone threatens the integrity and privacy of your data, shouldn't the damages be paid to you?
  • pixl97 9y ago
    $20M fine. 80M users. Here's you 25 cent check. Much like class action lawsuits, the end user doesn't make much. The lawyers or the state, which go to great expense may recover their expenses, or they may not. The largepunitive fine is to prevent the suits from ever happening in the first place.
  • avar 9y ago
    > [...]Can someone make a good argument as to > why the fines should be paid to a third > party (the state) when this issue is between > the service provider and the customers?[...] The same reason you pay speeding tickets to the state instead of personally to each person living on the street you sped on, or who could otherwise have been directly affected by that specific occurrence of speeding. Or the same reason health inspection fines for restaurants in the US are paid to the city or state, not everyone who's ever visited the restaurant. There's no concept in the GDPR that the violation only exists between the site and the users whose privacy it violated, where are you getting that idea from?
    • anonytrary 9y ago
      > pay speeding tickets to the state instead of personally to each person living on the street you sped on Roads are usually state-owned property, whereas your personal information is your property, right? If Alice mishandles Bob's property, why is Charlie getting paid for it? > There's no concept in the GDPR that the violation only exists between the site and the users whose privacy it violated Why not? The site-customer relationship is the only relevant one here. What prevents a profitable, large-scale data mining company from simply accepting the Max(4%,$20m) = 4% tax for mishandling data? A $20m dollar fine would surely deter smaller actors, but the 4% fine doesn't seem like a deterrent for large-scale data-mining operations, which can be incredibly lucrative. For example, if Facebook had the choice between not using the data and making $60b per year, versus using the data and making $90b - .04 x $30b, wouldn't they accept the tax and continue using the data? If this is the case, I don't see GDPR making a big difference if the highest-market-share companies can "get away" with paying the fee. This would increase the gap of viable profit models between smaller and larger companies, at the sole benefit of the state, with little, if any, benefit for the victims (the users). Of course, I am assuming that there is no criminal penalty for noncompliance. The government might think: why impose a criminal penalty if the state can simply tax large corporations for the mountains of profit they are making off of insights from personal data?
• liveoneggs 9y ago
  GDPR is having a massive chilling affect at my job as well. I think some brand new web frameworks need to be born that focus on compliance. It feels like a solid opening to me to get some new ideas out.
• liveoneggs 9y ago
  I went to a conference recently and attempted to have a discussion about GDPR. Two other people showed up, none of whom had not done any research into the issue at all. My fear is that patent-lawyer-style firms will start aggressively blackmailing companies for "settlements" or they will begin tons of GDPR-based violations aimed at your business.
• sergiotapia 9y ago
  Another business destroyed due to needless regulations and busy suits.
  • kennywinker 9y ago
    I'm not sure "needless" is the right word here. Even if you think this law is bad, there is clearly a need for data privacy and protection laws. People's reaction to their data being scooped up by Cambridge Analytica just because a facebook friend did a survey proves the need. What CA did was probably legal, but in most people's minds should not have been legal.
    • lwansbrough 9y ago
      > there is clearly a need for data privacy and protection laws Is there? What if people just accepted responsibility for carelessly handing out information to third parties? Certainly there is much more individuals can do to protect themselves before the government steps in and slaughters small business like the EU did. > but in most people's minds should not have been legal Do people think a company selling user data to another company should be illegal? Or are most people more concerned with the relation said company has with Russia, and their potential involvement in influencing the US election? I think it's the latter. And certainly there should be laws about data transactions involving the state's democratic security.
      • _o_ 9y ago
        Yes people do think, that selling/collecting their personal data to other companies into their disadvantage should be illegal.
      • kennywinker 9y ago
        if your business isn’t viable without respecting some basic privacy rules, you should not be in business - big or small. > What if people just accepted responsibility for carelessly handing out information to third parties? Without being legally compelled to, few companies have been forthcoming about providing users with information about what they are disclosing and when. Consent is being given, but not informed consent.
• Proven 9y ago
  The EU is destroying prosperity and making lives more miserable than they already are.
• teeray 9y ago
  Is there any kind of blanket CYA waiver that we can put on sign-up pages like "if you're an EU citizen, sorry you can't use this site because GDPR. Definitely don't click 'sign up' below anyway" ? What is the opt-out criteria for a site?
  • filoleg 9y ago
    Interested in finding this out as well. So far, not a single thread discussing GDPR on HN made this explicitly clear.
    • dingo_bat 9y ago
      That's part of the fun. It is so ambiguous and vague that nobody is clear on the specifics.
      • izacus 9y ago
        It's only unambiguous to the people who don't want to refuse to understand it because they're making profit on selling out people's data.
        • Multicomp 9y ago
          That is a false choice. According to that, you A) love this law or B) exist only to profit off tracking pixels and JavaScript beacons mwa he ha Or it could be the people running 100-user-or-less sites are trying to see if they can just leave their sites up, ignore the "oh yeah, well your web server has IP addresses in your LOGS doesn't it!? Well guess what, OUR logs show an EU IP address, so you know what the letter of the law let's us do? €20 million fine, you data slurping fiend!!" frivolous lawsuits in hopes of keeping their little side project which while (maybe) technically noncompliant, aren't actually using the data for those nefarious purposes, only DDoS and spam mitigations.
    • ehsankia 9y ago
      Here's an even dumber question. If you don't live in the EU and your site is not hosted there, do they have any legal power to get to you? What is the worst case scenario if you don't respond and don't pay any fines? Will they block your site from the EU or get your provider to take it down? What kind of power do they have to come at you?
• marcrosoft 9y ago
  Regulation always has unintended consequences. This is an example of it. Although they mean well regulation never accomplishes its goal and restricts the freedom of many.
  • oblio 9y ago
    > Although they mean well regulation never accomplishes its goal Yeah man, that's why we have the safest cars and airplanes in history, because of the free market, not because of regulations. I'm sure that United Airlines, who literally dragged a passenger from their airplane, would have invested a ton in passenger safety if not forced by regulators. Sarcasm aside, laws do work. There's a reason the most developed countries in the world have a very strong legal system. You give up a bit of freedom (which is a bit of an obsession for Americans) in exchange for a lot of protection from various nasty things people do to each other. As a result you sleep better and you get the side benefit of a special brand of freedom: freedom from fear from your fellow human beings, from their arbitrary whims (to a reasonable degree). Unregulated societies look like Somalia. Trust me, you wouldn't like that brand of freedom ;)
• deleted 9y ago
  [deleted]
• DevKoala 9y ago
  "Perversely, this new EU law hurts small and ethical startups, but helps reinforce the dominance of Facebook, Google and Twitter, who are able to prepare and defend themselves using established legal teams and cash reserves, and who now face less competition from startups." This bit is true. If the startup I work for had not turned profitable in the years leading up to GDPR, we would not be able to compete in this space anymore.
  • threeseed 9y ago
    These comments are just ridiculous. If your business is on such shaky ground that straightforward changes required by GPDR are going to cause your business to collapse then you have bigger problems. Because one employee suing you or your rent increasing will also cause you to collapse.
    • freeone3000 9y ago
      >because one employee suing you or your rent increasing will also cause you to collapse. Yes, these are well-known causes of company collapse, so well-known that we have entire industries mitigating the risk (multi-year leases at fixed rate, shell corporations renting (see: wework), and temporary contractor/agency staffing). We don't have that for GDPR yet.
• toomanybeersies 9y ago
  As far as I'm aware, you cannot be privately sued for breach of GDPR. You can only send complaints to the regulatory agency, who then take action. The fines levied then go to the government. There is no incentive for lawyers to troll around trying to sue for breach of GDPR, because there's no money to be made by them.
  • pdimitar 9y ago
    Do we know that for a fact? Sounds good but I have the bad feeling some legal groups will find a way around it. I hope I am wrong though. Really. Time will tell best, I guess.
  • lmkg 9y ago
    Article 79, "Right to an effective judicial remedy against a controller or processor," seems to say that individuals can sue controllers or processors. This may be limited to cases where the regulatory agency does not find in the data subject's favor? https://gdpr-info.eu/art-79-gdpr/ https://gdpr-info.eu/art-79-gdpr/ Article 82, "Right to compensation and liability," begins with the text "Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered." https://gdpr-info.eu/art-82-gdpr/ https://gdpr-info.eu/art-82-gdpr/
• pdimitar 9y ago
  What many posters here miss is that there is a big group of tech people that have no interest in dealing with legal matters more than the bare minimum, and overall deem them risky. I am one of them. People like me are well-aware of the fact that if we are not experts then we're absolutely gonna lose because a dedicated lawyer can and will dig up material you couldn't prepare yourself to defend from. Thus, complying with something somewhat ambiguous like the GDPR is still an expense -- of time, money and risk -- that many small website owners won't be willing to spare. Look, it's not hard to encrypt all personally identifiable information; there are ready-made frameworks that let you choose which DB columns you encrypt and how. You can generate a key for each user on creation and have their data encrypted with it. The problem is NOT that. The problem is what happens if a legal firm or an agency targets you. Even if you adhered to the spirit of the law, they can dig up evidence that you didn't obey the letter of the law (since GDPR is quite loose and ambiguous). Small tech owners can't fight such litigations. I am kind of baffled how this point evades so many people in this thread.
  • going_to_800 9y ago
    I'm a small business owner and this is my concern at all. What stops a competitor to just pay a lawyer to sue you or report you to GDPR authorities. Even if you are 100% compliant(which I doubt), you'll still have lots of issues, stress and wasted time with the audit.
    • pdimitar 9y ago
      Exactly. Even if you win, you won't win anything of much value -- most (if not all) of the money will likely go to your lawyer. And you have a lot to lose, mostly wasted nerves and time you could have spent improving your business -- or simply living your life stress-free. Defending even from bogus lawsuits is a huge expense of human energy for the non-experts (I'd wager that's 99% of the world's population).
      • drey08 9y ago
        We're a medium-sized software company, and we had to create a dedicated GDPR position so someone can look into everything and decide whether we're GDPR-compliant, and if not, how we can fix it. GDPR really complicates everything, even though most uf us (devs) are actually in favor of it (because we don't really like the idea of companies tracking us forever).
• voltagex_ 9y ago
  Damn, I wanted to do this for Australia (or at least NSW) for gadgets/electronics/computer parts etc. I wonder if I put geoblocking in place if I'd be covered.
• wiradikusuma 9y ago
  I didn't really understand the implications of GDPR until I read this. Now I understand the paranoia. Basically, in good faith, everyone is happy: website owners take measures to protect their users' data, and ask for consent. But 1 unsatisfied user, or heck a slimy competitor, can bring you down (I assume €20 million fine is business-killing for most startups). The key is "targeted". If you're targeted, since it's ambiguous, your chance of losing is higher. On the brighter side: Some people make extra income! /snark
  • Dayshine 8y ago
    "Targeted" is someone complaining to their national regulatory authority. Who will likely do nothing based off a single report.
• stanfordkid 9y ago
  Sad -- regulation hurts small businesses. Why not make GDPR apply once the number of users reaches a certain critical mass?
  • taylorswift_ 9y ago
    That's actually a great idea in my opinion, not sure why you were down voted. It seems that the incumbent large internet companies will easily be able to afford this burdensome regulation but new startups all the way through medium sized small businesses may struggle or even be suffocated by it. It would seem reasonable to have a tiered system where the penalties only kick in when the business has scaled.
    • romanovcode 9y ago
      I think this is horrible idea. GDPR is about data protection and consumer. It has nothing to do with companies or their profits/sizes.
• deleted 9y ago
  [deleted]
• GiorgioG 9y ago
  I would think any small software shop outside of Europe is better off blocking all EU IPs rather than risk having to lawyer up when they wind up being targeted and potentially face a $20m fine. It would be financially irresponsible to do otherwise unless they have some kind of GDPR insurance policy (if such a thing exists.)
  • geomark 9y ago
    A handy service that checks if a visitor is from an EU IP would be handy.
    • jimktrains2 9y ago
      Any geoip database will do.
• cf 9y ago
  I don't get the hand wringing. If you have an image sharing service you will have to contend with child pornography. If you have any content sharing service you have to deal with copyright infringement. You need a lawyer to create a company. If you do open source you will often put a license file in your github repo. Tech has already and will continue to interact with laws/lawyers. At some point open source libraries will appear to streamline compliance. For now it sucks but ya gotta muddle through or call it a day.
  • freeone3000 9y ago
    In the first two cases, we generally don't. Or didn't, until recently. DMCA is very push-oriented: You get a takedown notice specifying certain URLs, you take down that content. Compliance solved! GDPR requires restructuring of applications to keep data on a temporary basis with the consent of the users, to remove data after the fact, to selectively restore, and to allow users access to their own data. These are proactive steps required, and while applications written in the next six months will be built with those requirements in mind, it's still a fairly large burden for business-as-usual applications.
    • cf 9y ago
      Totally, but there are unlikely to be many ways to structure the law to give users consent over their data and not burden business as usual. Even responding to DMCA requests is burdensome. You can automate it like Google has tried but it fails sometimes and has become a major technical and personell challenge. I don't want to trivialize compliance. Even ostensibly simple requirements are never quite that, and every second spent on them is time not spent on your product.
    • twanvl 9y ago
      > GDPR requires restructuring of applications to keep data on a temporary basis with the consent of the users The GDPR requires mostly that you document what data is stored and how, and that you have a legitimate reason for doing it this way. Consent is not necessarily required. > to selectively restore, and to allow users access to their own data. So, you get a takedown/access notice, and then you take down/show that data. Compliance solved.
• ausjke 9y ago
  If I own a small business, what about I just sell online without collecting any data at all? Credit-card and Paypal etc are third-party APIs that I do not have a copy for my own, shipping can be out-sourced to USPS/UPS/Fedex and I don't keep any of them either. Am I now safe for GDPR? It's like a grocery store, you buy stuff and leave the door, I have nothing on record other than you paid me via credit card or nameless cash before you walk out of the door. Don't know how to do RMA though, maybe for each purchase my site and the buyer both should have a receipt that just records the transaction but nothing else private, still not sure how to implement that though. It's so unhelpful for small business owners.
  • woolvalley 9y ago
    It doesn't matter what you do, since you can still get a GDPR inspection / lawsuit that ends up with you non-guilty and losing a lot of money and time.
  • rorykoehler 9y ago
    How much are you going to sell if you can't market your goods or services properly?
    • jimktrains2 9y ago
      > How much are you going to sell if you can't market your goods or services properly? You can market without having per-user data. People did it for millennia.
• deleted 9y ago
  [deleted]
• lopmotr 9y ago
  Couldn't he keep operating until he gets caught, then lose the case, go bankrupt (the company, not himself), and shutdown at that point instead of now?
  • MentallyRetired 9y ago
    That seems like a lot more trouble than shuttering the site now.
• jancsika 9y ago
  How is Moxie's Signal affected by GDPR?
• pishpash 9y ago
  Are there no exemptions in GDPR for small-time operations like StreetLend? Was it a problem because of its affiliation with Amazon?
• matte_black 9y ago
  My question is, if the choice is between shutting down or just completely firewalling out all citizens of the EU, why not limp along without the EU market instead of dying out completely? If a site makes it very clear EU citizens are not welcome on the service and will be banned on site, can they really be held liable for any EU citizens who get in anyway through proxies? Our company has stated it has no plans to comply with GDPR and if faced with litigation it will simply be ignored unless the United States government gets involved. Complying is simply something we can’t afford to do right now, especially for a market that makes us a lot less revenue.
  • return1 9y ago
    this startup is based in EU so they have to comply for all their users around the world.
    • matte_black 9y ago
      Why not just move all the servers off the EU and reincorporate?
      • liveoneggs 9y ago
        > Why not just
• gopher2 9y ago
  It seems better to ban EU citizens from your service than to shut down entirely.
  • FPGAhacker 9y ago
    It will be interesting to see if hacker news shuts down or starts blocking/banning EU. They certainly aren't compliant today.
    • dangrossman 9y ago
      In what way isn't Hacker News compliant today? There's a "Legal" link at the bottom of the page where they detail what information they collect, who it's shared with and what it's used for. It includes instructions for how to contact them with requests to access or correct that information. It describes the legitimate interest basis for information they collect without explicit consent (e.g. moderation, preventing fraud). Sounds to me like they have a lawyer that knows GPDR over there.
      • Gigablah 9y ago
        Can you close your account on Hacker News and have all your data deleted? No, according to this: "Please note that we have no obligation to delete any of stories, favorites or comments listed in your profile or otherwise remove their association with your profile or username." https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/dealing-citizens/do-we-always-have-delete-personal-data-if-person-asks_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... "The General Data Protection Regulation (GDPR) gives individuals the right to ask for their data to be deleted and organisations do have an obligation to do so..." So no, it's not compliant.
        • ec109685 9y ago
          > for reasons of public interest (for example public health, scientific, statistical or historical research purposes). Comments could be considered that…
• wonder_er 9y ago
  Does anyone expect the GCHQ to get investigated based on its collection and use of private data? I won't hold my breath that this will ever happen. For that reason (and many others) I expect that GDPR enforcement will be capricious and biased and used as a weapon against unpopular groups.
  • brongondwana 9y ago
    Nope, law enforcement groups get a special carve-out. They can collect whatever.
• deleted 9y ago
  [deleted]
• rdlecler1 9y ago
  What bothers me about GDPR is that you can’t make consent a precondition for service. Maybe user data is my business model. Or maybe I’m a US company and I don’t want to have to deal with issues of Europeans accessing my site. Why should the GDPR be my problem if I’m not in the EU. Don’t like it, don’t use it. There’s too much over reach here.
  • ec109685 9y ago
    That isn’t true. You can ask for what is necessary to run your business as a precondition for using your site.
    • rdlecler1 9y ago
      No it’s not. https://www.google.com/amp/blog.lukaszolejnik.com/gdpr-consent-requirements-first-ico-guidelines/amp/ https://www.google.com/amp/blog.lukaszolejnik.com/gdpr-conse...
      • ec109685 8y ago
        That isn’t true. YouTube for instance requires you to give basic consent to use YouTube: https://adexchanger.com/privacy/this-is-how-google-is-preparing-for-gdpr/ https://adexchanger.com/privacy/this-is-how-google-is-prepar... (not the best citation)
        • ec109685 8y ago
          Another example: https://mobile.twitter.com/johnnyryan/status/993827965594202112 https://mobile.twitter.com/johnnyryan/status/993827965594202...
  • cyphar 9y ago
    Then block anyone from the EU from accessing your website. If you don't want to deal with EU laws then don't do business with the EU -- it's that simple. If you operated a legal online narcotics or pornography business you would have to do the same thing to not do business with countries where your wares would be illegal to sell. You can't have it both ways. Either you want to have EU residents as customers, or you don't want to deal with EU laws.
• bigjimslade 9y ago
  Government is not on your side. Remember that, for all countries, for all times, for all peoples. Government protects itself first, at your expense, by helping those who can help it accomplish that said goal. If you can't help it to that end, you're nothing, literally. It truly couldn't care less about you, your liberties, or even your very life. Government can and does completely destroy people's lives, regularly, for having committed no moral offense of any kind, having caused no harm whatsoever to anyone anywhere in any way, but instead for having violated nothing more than a statute granting random behavioral power over you to some overfunded, distant, and uninterested regulatory agency. This explanation might aid those who're confused about why a community strengthening, environmentally positive, socially worthwhile website like Streetlend would shut down in response to this huge collection of laws that was sold to us as actually helping us.
  • civilitty 9y ago
    > a community strengthening, environmentally positive, socially worthwhile website like Streetlend If Streetlend were even remotely as you described, they would have easily made enough money to defend itself against the government - all in glorious free market fashion. All hail supply side Jesus! Oh wait, it's tiny operation making a pittance in revenue. Whoopsie! Thankfully, this is the 21st century and Western society has long ago decided that it'd rather have "the government" destroy individuals with a system of courts to appeal to rather than let anyone do whatever they wanted. Thanks Obama.
    • CryptoPunk 9y ago
      Many large and profitable enterprises struggled as marginally profitable businesses for an extended period of time before finding a formula that worked. The ability to run a failing business is also valuable in and of itself. Look at the businesses run by the McDonalds brothers before they opened McDonald's restaurant for example, which helped them gain the experience necessary to eventually create a successful business. >>Thankfully, this is the 21st century and Western society has long ago decided that it'd rather have "the government" destroy individuals with a system of courts to appeal to rather than let anyone do whatever they wanted. Ah yes the 21st century, where a growing proportion of young adults live at home, have given up on starting a family, and have a shrinking pool of industries in which they can afford to start a business or career, as a result of an increasing number of well-intentioned regulations. Regulations like GDPR are hopelessly misguided attempts to centrally plan greed and abuse out of society. The complex bureaucratic rules attempt to anticipate every permutation of commercial interaction, and predetermine the correct parameters of action for each permutation. It's absurdly reductionist and unworkable, and only results in more rent-seeking and less efficiency.
• deleted 9y ago
  [deleted]
• _o_ 9y ago
  I can shutdown my site at any given moment, citing attack from Mars. And? I think that GDPR was just an excuse, if this would be a booming bussiness, he wouldn't have problem adjusting to GDPR.
• johnmarcus 9y ago
  I find it hilarious that so many think 'its ok to force 70page read for every developer because look what Facebook did'. But at the same time if anyone read the EULA of Facebook when you signed up, then you would have known precisely the risks of sharing your data with Facebook. They hid absolutely nothing from view. Chew on that for a bit.
  • lagadu 9y ago
    Surely you're aware of what is known as inalienable rights? Rights that you cannot sign away no matter what?
• sitkack 9y ago
  Nerds operate on technicalities, many laws operate on best effort and in-faith. It is extremely easy to to be in compliance with GDPR 1. Try 2. Do it 3. Keep Doing it
  • jdminhbg 9y ago
    Good luck with your "but We Tried and then We Kept Trying" legal brief.
    • sitkack 9y ago
      This isn't Sarbanes–Oxley, this is literally don't be stupid with customer data. > "but We Tried and then We Kept Trying" Will literally get you 100% of the way there if done in good faith. Crypto-shred anything you acquire from an end user and you are good. Collect the bare minimum to offer the service you claim to be offering, and you are good. Alert the customer on how their data will be stored, used and fused and you are good. Of all people, programmers should stop whining about how hard and oppressed their lives are. The EU is telling you to stop being a clueless *sshole. If you even attempt to stop being one, you are fine.
• arkis22 9y ago
  I am about to launch a startup. As an American citizen GPDR scares the shit out of me. My app doesn't do anything I consider rude to my users but that doesn't mean European courts can't find something wrong with the way I do business. I consider myself lucky that I'm in a state that doesn't make me collect tax in states I don't have nexus. Europeans are required to use something like chargebee to deal with VAT in different countries. I don't mean to be rude, but if a service like chargebee didn't exist, you Europeans would be fucked. I'm sure VAT is just the visible part of the iceberg. It's an awful situation for entrepreneurs.
  • clappski 9y ago
    ‘Europeans would be fucked’... as if there aren’t any successful or innovative European companies? Bare in mind that you probably use some sort of service to handle every time of payment, even if it’s a local sale (e.g. Stripe, VISA Pay/V PAY etc.). Additionally, selling goods in the US is just as complicated for an external business as it is into the EU - state, county and city sales taxes, as well as exemptions from US taxes laid out in international treaties have to be accounted for. The general advise if you want to sell internationally is ‘get an accountant’, because it’s actually quite a complicated subject (unsurprisingly).
    • arkis22 9y ago
      There are, but few of them are one man operations like me. There will be even less one person startups (or none) now. The compliance tax burden for American companies varies by state. I'm lucky to live in one that isn't onerous. Luck is a factor when starting a business, but regulatory capture is a bad kind of luck.
  • tzs 9y ago
    VAT is actually pretty easy to deal with as a non-European business. The combined work to handle VAT for all of the EU is less than the work to handle sales tax for a single US state.
    • arkis22 9y ago
• enugu 9y ago
  What would be great is an 'open source' legal movement. Non-profit legal orgs which read the details of laws, cases and then put up detailed 'views' of the laws from the perspective of an individual, company, buyer, seller, landlord, tenant etc. Instead of having a list of laws, have an experience based checklist for each type of agent. Also, requiring the government to not just frame laws but provide this kind of information. The ico website[1] seems to be doing it for this particular law. This might be less useful in boundary cases, where firms with legal resources play at the edge, but it can at least serve as a safe upper bound for a lot of regular activity. Lot of this information already exists in books, legal reviews, but this is important enough to be made conveniently available on an public website. [1] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
• sriku 9y ago
  Wouldn't it be better for most small businesses if EU required a kind of "GDPR certification" that comes with its own audits? That might contain potential predatory law suits? On the practical front,how would a product like google docs that offers collaborative editing deal with "forget me"? If I edited someone else's document, would Google (or whoever) be obliged to contact the co-authors to request that edits be removed? ... or should they do that automatically? What's expected to happen to the version history of these documents?
  • midasz 9y ago
    It's the EU, not the USA. There will be no lawsuits. Compliance agency will check, they will report to the business, the business gets time to fix it. Unless very negligent, there will be fines.
• chasb 9y ago
  For anyone interested we (Aptible) made this Slack community to answer questions about GDPR: https://join.slack.com/t/gridiron-gdpr/shared_invite/enQtMzQ5OTI2MzkwMjU4LWRkYzFiM2IyN2JhZjJlOTVmODkyOTk3MDJiYzBiYWVjYTkwZjg3YTEwNjAyZTliZjY3YmY3M2NkZWQ4NWM3OTk https://join.slack.com/t/gridiron-gdpr/shared_invite/enQtMzQ... Disclaimer: we are a vendor that makes a SaaS offering for GDPR
  • mdpopescu 9y ago
    Er... is that meant to be funny? That website is asking for my email without saying what it's used for :) Also, I can't refuse to provide it and still get access to the functionality.
    • chasb 9y ago
      Literally the only thing the landing page says is the purpose and what your email is used for: "Join the Slack workspace Aptible Gridiron GDPR Slack", and "Verify your email"
      • freeone3000 9y ago
        Neither of those state why you need an email, though. Why not a user ID of the user's own choosing? Why does this email need to be verified?
        • Dayshine 8y ago
          ...it's slack.
• Meekro 9y ago
  Typical.. Equifax gets off with a slap on the wrist. Facebook talks to Congress for a bit before returning to business as usual. Nothing happens to Cambridge Analytica. But damn if they don't destroy a few small businesses to show that the government is on the case.
  • guitarbill 9y ago
    Equifax is US. Congress is US. Cambridge Analytica got raided by ICO, the UK's data protection agency, investigation is ongoing (although on of the witnesses is a bit... shaky). Troll somewhere else.
  • jacquesm 9y ago
    Different government.
• chrismatheson 9y ago
  Am I missing something?? Sure you could be sued, and that might end the small business. But isn’t that what limited liability companies are for? Option 1: close it down through fear of something happening. Option 2: close it down if the worst thing actually happens. Either way if the small company is operating at a loss/ v small profit, it’s not going to harm you personally?
  • chunkyslink 9y ago
    Yes, I think you are missing somewthing. You can't be sued for GDPR. You get reported to an authority that will handle the process. The Americans think you can just sue people all the time. It not what it is like in Europe. The point of this legislation is to help users, not to penalise businesses. I mean how many companies were prosecuted for the cookie law?
    • boobsbr 9y ago
      > You get reported to an authority that will handle the process. And then the authority will prosecute and fine you. You're screwed either way.
      • chunkyslink 9y ago
        No you don't. You get the opportunity to sort things out first. This is not about prosecuting business. It is about protecting users. Completely different. It is really not such a big deal.
      • DanBC 9y ago
        Unlikely. What's more likely is the regulator will send you a letter asking if you are in compliance or not, and then send you information about current best practice to bring you back into regulation. If your breaches are deliberate and flagrant you may end up with a fine. But regulation in Europe really is light touch.
• aryehof 9y ago
  I think this a political statement protesting regulation. It expresses a real ignorance of the legal process, culture and mindset in Europe that looks to actually protect the public from abuses of power, position and exploitation.
• raverbashing 9y ago
  GDPR discussions: Americans trying to interpret European Law and European way of enforcing laws That describes most of it
  • aeorgnoieang 9y ago
    > GDPR discussions: Americans trying to interpret European Law and European way of enforcing laws Should they just pretend they don't exist? The Europeans haven't interpreted this law or provided a clear history of enforcement either. That's the point of these discussions – they're uncertain about the consequences of the law!
    • raverbashing 9y ago
      Of course they shouldn't pretend it doesn't exist. But the interpretation should be seen in light of enforcement of current data protection regulations (as per ICO in the UK, and corresponding BDSGs in Germany, for example). GDPR is not "starting from zero" but it's based on current legislation. See for example: https://globalcompliancenews.com/data-privacy/data-protection-enforcement-in-germany/ https://globalcompliancenews.com/data-privacy/data-protectio...
      • freeone3000 9y ago
        The current regulation has been widely ignored and of no consequence to Americans. GDPR looks like it's going to be matter, unlike previous privacy laws.
  • lajhsdfkl 9y ago
    How about, I won't even try interpreting it and watch a few unfortunate fools get fined so I can learn from their mistakes. Until then, none of my websites will be available in the EU until I can afford a legal team.
• svennek 9y ago
  I read the farwell-post as "My start-up failed, and I am shutting it down because I am sick of it", but instead of owning up, I blame the GDPR... As a Brit, he would most likely already have to comply with most of the stuff already. And he should know that most government bodies use dialogue instead of fines initially..
• thinkingemote 9y ago
  Can we go back and see what HN users views about the EU Cookie Law was, before the law was put into implementation? Perhaps we will also see hearty support for it, as we now see with the GDPR - when the EU cookie law is just regarded as a nuisance now.
  • smileypete 9y ago
    https://hn.algolia.com/?query=Cookie https://hn.algolia.com/?query=Cookie Law It's counter productive in that disabling or regularly clearing cookies to improve privacy can result in annoying popup messages every. single. time. a website is visited. I am truly grateful to the developer or the firefox addon 'I don't care about cookies'...
• DanBC 9y ago
  > GDPR threatens website owners with fines of 4% of turnover or €20 million (whichever is higher) This is only for the worst, flagrant willing and knowing breaches. Small websites who made an effort to comply wouldn't ever get hit with this kind of fine.
• soufron 9y ago
  WTF... The GDPR is only the continuation of the current regulation. If they can't follow it now, it's probably they were already not respecting it before. And all in all, it really looks like a way to get out without having to admit some other failure.
  • eterm 9y ago
    Yeah I struggle to see how all these businesses which are panicking over GDPR could ever have been compliant with, for example, the UK DPR which has been in effect for a very long time and has many of the same requirements. The biggest change going to GDPR is clearer definitions of what a data controller is and data processors and new restrictions on "automated decision making". The ability to view, delete and demand data be accurate has long been a requirement of meeting UK data protection laws and I'm sure many other countries too. It seems that businesses just ignored the law until it came with fines worth worrying about. A bit like the VATMOSS changes where US businesses were worrying they would have to start dealing with EU VAT even though that was the case previously.
• csomar 9y ago
  I might have missed the GDPR news/discussions but if you are in a non-eu country and you are harvesting/using EU citizens data what could the EU do?
• nottorp 9y ago
  They're afraid of frivolous lawsuits... does this mean the loser doesn't pay the winner's expenses in the UK either? Judging by their post and the comments here, this is more of a problem with the US/UK legal system not with the EU regulation.
  • deleted 9y ago
    [deleted]
• vincnetas 9y ago
  How many times i have seen comments comparing civil engineers and software engineers and the liabilities each have. Civil engineer failing to comply with regulations ending up in jail vs. software engineer well, doing nothing if his software does something wrong. So welcome to the future where software engineers will be held responsible for what they create. I think it's right direction. And don't start with 'hackers playing for fun with side projects will no longer be able to do this'. It's same for engineer building a shed in his backyard. No one will have problems if he has not done load calculations and is using that shed by him self. Only difference is that if you put it on the internet it's like building that shed in a public park. And then you have problems if you don't think what you are doing.
  • sb8244 9y ago
    People die when a civil engineer messes up. Most people don't die from a website.
    • arnoooooo 9y ago
      That does not mean that software has no real world consequences. Otherwise, why would people be building software ? There's a reason companies which are 100% software can be valued in the billions of dollars. Their software has huge, very real consequences.
      • sb8244 9y ago
        Of course software has consequences. Not the same as infrastructure of countries though. Companies are valued at billions not because of life and death risks but usually because it enables other companies to make money. On the other hand, basically everything done in civil engineering could be seen as having real danger implications. Bridges and tunnels of course, but even roads which can wash out and cause harm.
      • sturgill 9y ago
        Also their marginal cost of delivery approaches zero. High fixed costs in creating the software and almost negligible marginal costs. The return on capital can be astronomical. Online services have “real consequences.” But not of the type as goods in the physical world. PCI and HIPAA have tried to mitigate against some of the most egregious crossovers of failed software. GDPR scares me. Not in the “I don’t like the consequences” but in the “I don’t know what this does and how screwed I might be.” I’m very happy to be on the other side of the pond where I can safely observe the fallout. Feels like buying a first generation Apple device: I’ll wait a few years and let the early adopters go through the pain for me...
• StreamBright 9y ago
  It seems to me that they website would be easy to make GDPR compliant. What was the challenge here?
• gremlinsinc 9y ago
  You should open source the software / code. Maybe someone not in the EU could use it to start small side project..
• Angostura 9y ago
  Chris Beach accuses the GDPR or beigng ambiguous and an example of a of poorly-implemented laws. Combined with the guidance from something like the UK ICO, it seems to me to be remarkably clear and not onerous if your business isn't based on extracting value from user personal data in the first place. Could we have some examples of the ambiguity and poor implementation?
  • ID1452319 9y ago
    The main area of ambiguity in my opinion is around "legitimate interests". Many companies who would otherwise breach GDPR regulations are using this as a get out of jail free card, particularly sites/applications which collect personal data without consent. Personally, I think there will be a number of court cases post-GDPR to clarify what precisely is "legitimate interest" and what is a breach of the regulations.
• zerostar07 9y ago
  If GDPR is so easy to apply, why isn't HN complying?
  • jimktrains2 9y ago
    HackerNews also sends/streams data to Big Query for public usage: https://cloud.google.com/bigquery/public-data/hacker-news https://cloud.google.com/bigquery/public-data/hacker-news I think you can delete from BigQuery now, but even just a year ago you couldn't.
• KaiserPro 9y ago
  None of this violates the GDPR. So long as they clearly allow opt in to what data is being processed, and why, and a way to delete it, you are mostly ok. As the site might need to deal with issues of fraud, you are allowed a little more leeway in storing personal data.
• craigsmansion 9y ago
  I'm unsure of all the negativity regarding the GDPR here. GDPR compliance is catching up with your project's "ethical debt" in much the same way as a project sometimes has to deal with a "technical debt". If it's unimportant, it's of no concern. If you kept up with good practice, it's of no concern. It's only if it's important and you let the debt accumulate that it could potentially be a problem.
  • jimktrains2 9y ago
    > GDPR compliance is catching up with your project's "ethical debt" in much the same way as a project sometimes has to deal with a "technical debt". This is needlessly polarizing. I don't have any ethical issues with a service not letting me delete my account or download all my data. Sure, it's nice, but it's not an ethical issue if they don't. I also don't have issues with services processing and analyzing _their_ data (it's not my or our data) any way they choose without notifying me.
    • chii 8y ago
      It's not an ethical issue for you, but the world is made of many other people, and it is an ethical issue for them.
• minusSeven 9y ago
  Is it not possible to country ban each website ? Why couldn't they do that for all of europe and move on ?
• declairative 9y ago
  I've worked with the author of streetland, and he's probably the most anti-EU person I know. I'd caution taking the analysis of GPDR too seriously from someone with such a strong bias against it.
• nerdponx 9y ago
  Unfortunately the European Union's new GDPR (General Data Protection Regulation), introduced on 25th May 2018, creates uncertainty and risk that I can't justify taking. GDPR threatens website owners with fines of 4% of turnover or €20 million (whichever is higher) if they do not jump through a number of ambiguously-defined hoops. The law, combined with parasitic no-win-no-fee legal firms, puts website owners at risk of vindictive reporting. Young websites and non-profits cannot afford legal teams. Therefore the risk posed by GDPR is unacceptably high. Perversely, this new EU law hurts small and ethical startups, but helps reinforce the dominance of Facebook, Google and Twitter, who are able to prepare and defend themselves using established legal teams and cash reserves, and who now face less competition from startups. The EU Cookie Law, EU VAT regulation and now the EU GDPR are all examples of poorly-implemented laws that add complexity and unintended side-effects for businesses within the EU. Can anyone in the EU actually comment on the content here? This seems completely out of proportion with everything I have heard about the GDPR. Given the authors stance on data privacy and accessibility, I am somewhat glad that he is shutting the site down.
  • xfz 9y ago
    I'm working on GDPR compliance at the moment, as are many of my friends here in the UK. Even people in non-IT jobs have been involved or had training, so awareness is high. The figures cited above are correct, but the consensus from people I've spoken to is that the maximum fines would only be for the most serious breach. It's hard to imagine a small non-profit being fined €20 million. That said, people are taking it seriously. I can't help wondering if the owner of Streetlend has just decided it's not worth maintaining at a loss anymore and decided to take a swipe at GDPR. I can't know that of course. However what seems fairly inevitable is that technical, commercial and legal changes will come along now and then and it takes real work to adapt. I don't know of any company/organisation that is motivated to keep running but didn't try to comply with GDPR.
    • dommer 9y ago
      I tend to agree, seems a little sour. (and now I'm sounding a little judgy) https://www.borroclub.co.uk https://www.borroclub.co.uk is managing (so far) to compile to GDPR.
• dommer 9y ago
  Seems a little angry, sour, and conspiracy-esque. But 20 Mill is some dark cloud. GDPR hasn't effect https://www.borroclub.co.uk/ https://www.borroclub.co.uk/ So seems like it is possible to have a sharing website and not violate GDPR
• dumbfounder 9y ago
  Can someone explain what ramifications this has for companies operating in the US that may have "personal" data on EU people? I am curious to know if there will be a new wave of lawyers coming after me for running Twicsy. (FYI, I get requests for removals every day, and I comply with all)
• deleted 9y ago
  [deleted]
• RRRA 9y ago
  Is there a GDPR checklist of technical things to do to prevent this from happening to cash-strapped endeavours?
• dsfyu404ed 9y ago
  The result of " sed 's/GDPR/tax law/g' " applied to the comments says a lot about the filter bubble we're in.
• zerostar07 9y ago
  EU bashing aside, we 've seen this play out before. Search for old HN comments on the cookie law: It was supposed to reduce traffic by 90%, but nowadays its worse than useless. GDPR will fail too, because it does not address the crux of the issue: that most people do not care about willfully handing over their data, and in fact many of them take pleasure at being public. Most people will not care to delete their data from the service they used for 1 day. They will not ask their local bakery to hand them over reports etc. Most people spend most of their time on facebook, and most of them have already opted-in to the kind of processing that facebook does. Google, amazon, netflix, spotify etc are in line, because people are not going to give up on the most useful tech services. Some of the worst private offenders in europe are actually public services like tax authorities who dug up tons of stolen data from banks, financial services, or who use google maps and facebook to find out who is flaunting their wealth. While not NSA-level, police authorities are catching up. Registries of all kinds with very private info have very lax access rules in EU countries outside the rich north. Sure, some techies may feed their entitlement by going after some glaring cases of violations for a few months, but the case remains that, if privacy is a big issue, people are going to have to pay for it (i.e. they have pay a premium). Cryptography/decentralization remains another option.
• TheForumTroll 9y ago
  As always discussions about GDPR on HN is 99 % FUD.
• guy98238710 9y ago
  European developers have to deal with American software patents all the time to ensure global distribution of their software. And software patents are way less reasonable than GDPR. With GDPR, one can at least be sure that it is up to the site operator to ensure compliance. With software patents, there's always a risk that some random patent troll shows up with some obscure patent registered 10 years ago.
• herbst 8y ago
  I hate how GDPR forces me to log additional data. Like now I should ask for a age, have detailed access logs and so on. I have semi anonymized data that I can now either make fully anonymous or link it directly to a user. Worst of all is however that the complexity of my app doubles easily when I Actually follow all the rules.