4 ms·

(1) respects their users and their data and (2) has proper security in place is most likely going to already be mostly compliant before they even start. If the

(1) respects their users and their data and (2) has proper security in place is most likely going to already be mostly compliant before they even start. If the law said this, and only this, that would be fine. But that's not what it says. It's a very complex law subject to unique interpretations in the courts of 28 unique countries. GDPR compliance isn't a thing you can get accredited for in the first place Did I say you could get accredited for it? I didn't, but nevertheless, you have to comply with the law (or block EU traffic, if you don't rely on it), and doing so can be very expensive.

jacquesm 9y ago
> If the law said this, and only this, that would be fine. But that's not what it says. It's a very complex law subject to unique interpretations in the courts of 28 unique countries. Sure you can make it as complex as you want. But the practical upshot is this: as long as you are going around using FUD rather than fact to pretend that the GDPR is unworkable you're setting yourself up for a nasty surprise. Instead go and make a 'best effort' and spend a few productive weeks on getting rid of the most obvious differences between where you are today and where the law says you should be and you will be doing better than most and will be able to sleep just fine because just like with running away from hungry lions you only have to run faster than the competition. And as long as you're not in fintech, social media, advertising, medtech, insurance or doing something really shady you most likely will be fine anyway because those segments are where the majority of the people that I talk to about this subject expect the first action. The courts of '28 unique countries' are not each and every one of them going to give a unique interpretation of this law. What you can expect is that starting 2019 or so a couple of serious offenders will be first warned and then fined to show the rest of the world they're not dicking around this time so make-believe arguments won't cut it. I'm pretty happy that the GDPR exists, the business world had a bowshot in the form of the cookie law, that got ignored or arm-chair legalesed into an ineffective operation when everybody had the option to actually comply with the spirit of the law as well as the letter (the spirit: stop tricking users everywhere: the letter: put up a cookie wall and continue tracking like before once the user inevitably clicks 'ok'). When industries fail to self-regulate sooner or later regulators step in. In this case it is later but as laws come the GDPR is surprisingly clear and accessible.
- downandout 9y ago
  Instead go and make a 'best effort' and spend a few productive weeks on getting rid of the most obvious differences between where you are today and where the law says you should be and you will be doing better than most and will be able to sleep just fine because just like with running away from hungry lions you only have to run faster than the competition. In our case, the best decision was to block EU traffic and ban EU users from the forums we operate. GDPR compliance for forums specifically is essentially impossible, because almost all forums allow users to embed external images. The owners of the servers on which those images reside could start deploying tracking cookies that the forum doesn't know about at any moment, and therefore there will likely be exactly 0 GDPR compliant forums, except perhaps text-only forums. That issue alone was enough to get us to block EU users, but that doesn't begin to address any of the other fine points of the law. You also seem to be uner the impression that the law will not be abused by revenue hungry governments to reach into the pockets of foreign corporations. Call me cynical, but if that doesn't happen, it would be the first time in history. The spirit of GDPR is great. The implementation is the exact opposite of great.
  - voltagex_ 9y ago
    >The owners of the servers on which those images reside could start deploying tracking cookies that the forum doesn't know about at any moment. So... proxy the images and strip the cookies?
    - downandout 9y ago
      We thought about that, but then you run into other issues. All of a sudden DMCA claims will skyrocket, bandwidth costs rise, we may get our servers blocked from retrieving images from certain image hosting services, etc. That is not a silver bullet without its own risks and additional costs.
      - Operyl 9y ago
        Having done this myself for large forums, I think we had a single DMCA. Bandwidth costs are relatively inexpensive, too. You can cache images for an indefinite amount of time, serving them over your existing CDN, and purge the older cache based on last-to-access. I've not been blocked from any image hosting sites.
mgbmtl 9y ago
All 28 countries also have different privacy laws, consumer-protection laws, trademark laws (to some extent), language laws, etc. How much is that costing you?
- downandout 9y ago
  The new issue is the extent of the extraterritorial reach that was built into this law. With GDPR, the EU is essentially making the claim that it can dictate rules to and reach into the pockets of any company anywhere in the world, whether or not they have a presence in the EU.
  - gerdesj 9y ago
    You're not from 'round here are you? GDPR is internally consistent and designed from the ground up to protect individuals like you and I from the sort of companies that I at least do run and I have no idea what you do. There is no extraterritorial reach at all. If you want to deal with Europeans then you should respect their laws. In the same way I would not dream of abusing your rights, according to those laws that your legislature have granted you (within reason). In a way you might describe GDPR as a form of politeness and I'm sure we are all in favour of that. (No lawyers needed)
    - downandout 9y ago
      There is no extraterritorial reach at all You clearly have no idea what you're talking about here.
      - dang 9y ago
        Can you please not post this kind of thing to HN? You veered into being uncivil/unsubstantive several times in this thread. Besides being against the rules (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html), it undermines your argument.
  - deleted 9y ago
    [deleted]
gerdesj 9y ago
It's a very complex law subject to unique interpretations in the courts of 28 unique countries. In the UK, GDPR will replace the current legislation (Data protection Act 1998) https://www.itgovernance.co.uk/data-protection https://www.itgovernance.co.uk/data-protection The same will happen across the entire EU. It's not a very complex law subject (whatever that is) You do need to do some research and spend some time in consideration but it is not beyond the wit of man.
- downandout 9y ago
  The same will happen across the entire EU. You have been told this by the 27 remaining governments? Great news! /s
  - gerdesj 9y ago
    Well you can stick your /s up your bum (what ever that means)
    - dang 9y ago
      Please don't do this here.

jacquesm 9y ago

> If the law said this, and only this, that would be fine. But that's not what it says. It's a very complex law subject to unique interpretations in the courts of 28 unique countries. Sure you can make it as complex as you want. But the practical upshot is this: as long as you are going around using FUD rather than fact to pretend that the GDPR is unworkable you're setting yourself up for a nasty surprise. Instead go and make a 'best effort' and spend a few productive weeks on getting rid of the most obvious differences between where you are today and where the law says you should be and you will be doing better than most and will be able to sleep just fine because just like with running away from hungry lions you only have to run faster than the competition. And as long as you're not in fintech, social media, advertising, medtech, insurance or doing something really shady you most likely will be fine anyway because those segments are where the majority of the people that I talk to about this subject expect the first action. The courts of '28 unique countries' are not each and every one of them going to give a unique interpretation of this law. What you can expect is that starting 2019 or so a couple of serious offenders will be first warned and then fined to show the rest of the world they're not dicking around this time so make-believe arguments won't cut it. I'm pretty happy that the GDPR exists, the business world had a bowshot in the form of the cookie law, that got ignored or arm-chair legalesed into an ineffective operation when everybody had the option to actually comply with the spirit of the law as well as the letter (the spirit: stop tricking users everywhere: the letter: put up a cookie wall and continue tracking like before once the user inevitably clicks 'ok'). When industries fail to self-regulate sooner or later regulators step in. In this case it is later but as laws come the GDPR is surprisingly clear and accessible.

downandout 9y ago
Instead go and make a 'best effort' and spend a few productive weeks on getting rid of the most obvious differences between where you are today and where the law says you should be and you will be doing better than most and will be able to sleep just fine because just like with running away from hungry lions you only have to run faster than the competition. In our case, the best decision was to block EU traffic and ban EU users from the forums we operate. GDPR compliance for forums specifically is essentially impossible, because almost all forums allow users to embed external images. The owners of the servers on which those images reside could start deploying tracking cookies that the forum doesn't know about at any moment, and therefore there will likely be exactly 0 GDPR compliant forums, except perhaps text-only forums. That issue alone was enough to get us to block EU users, but that doesn't begin to address any of the other fine points of the law. You also seem to be uner the impression that the law will not be abused by revenue hungry governments to reach into the pockets of foreign corporations. Call me cynical, but if that doesn't happen, it would be the first time in history. The spirit of GDPR is great. The implementation is the exact opposite of great.
- voltagex_ 9y ago
  >The owners of the servers on which those images reside could start deploying tracking cookies that the forum doesn't know about at any moment. So... proxy the images and strip the cookies?
  - downandout 9y ago
    We thought about that, but then you run into other issues. All of a sudden DMCA claims will skyrocket, bandwidth costs rise, we may get our servers blocked from retrieving images from certain image hosting services, etc. That is not a silver bullet without its own risks and additional costs.
    - Operyl 9y ago
      Having done this myself for large forums, I think we had a single DMCA. Bandwidth costs are relatively inexpensive, too. You can cache images for an indefinite amount of time, serving them over your existing CDN, and purge the older cache based on last-to-access. I've not been blocked from any image hosting sites.

mgbmtl 9y ago

All 28 countries also have different privacy laws, consumer-protection laws, trademark laws (to some extent), language laws, etc. How much is that costing you?

downandout 9y ago
The new issue is the extent of the extraterritorial reach that was built into this law. With GDPR, the EU is essentially making the claim that it can dictate rules to and reach into the pockets of any company anywhere in the world, whether or not they have a presence in the EU.
- gerdesj 9y ago
  You're not from 'round here are you? GDPR is internally consistent and designed from the ground up to protect individuals like you and I from the sort of companies that I at least do run and I have no idea what you do. There is no extraterritorial reach at all. If you want to deal with Europeans then you should respect their laws. In the same way I would not dream of abusing your rights, according to those laws that your legislature have granted you (within reason). In a way you might describe GDPR as a form of politeness and I'm sure we are all in favour of that. (No lawyers needed)
  - downandout 9y ago
    There is no extraterritorial reach at all You clearly have no idea what you're talking about here.
    - dang 9y ago
      Can you please not post this kind of thing to HN? You veered into being uncivil/unsubstantive several times in this thread. Besides being against the rules (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html), it undermines your argument.
- deleted 9y ago
  [deleted]

gerdesj 9y ago

It's a very complex law subject to unique interpretations in the courts of 28 unique countries. In the UK, GDPR will replace the current legislation (Data protection Act 1998) https://www.itgovernance.co.uk/data-protection https://www.itgovernance.co.uk/data-protection The same will happen across the entire EU. It's not a very complex law subject (whatever that is) You do need to do some research and spend some time in consideration but it is not beyond the wit of man.

downandout 9y ago
The same will happen across the entire EU. You have been told this by the 27 remaining governments? Great news! /s
- gerdesj 9y ago
  Well you can stick your /s up your bum (what ever that means)
  - dang 9y ago
    Please don't do this here.