3 ms·

I admit to being baffled as to why they shut down. If a user of the service has given permission for their location to be shared on the 'nearby' map, then they

I admit to being baffled as to why they shut down. If a user of the service has given permission for their location to be shared on the 'nearby' map, then they still comply with all the legislation because they have tacit permission from the user that their location will be shared with others. If the user then decides NOT to share their location or want their data deleted entirely, then the as long as the site stops sharing their location or removes their data completely (within 30 days), then they are still GDPR compliant, AFAIK. EDIT: Sounds to me like a side project started getting a little unwieldy or had too much technical debt for the developer to manage, and he decided to shut it down using GDPR as a vague justification?

adventured 9y ago
They explained why. Obviously you may still disagree, however their opinion of acceptable risk is subjective (ie it's silly to tell someone what their tolerance for risk should be). > GDPR threatens website owners with fines of 4% of turnover or €20 million (whichever is higher) if they do not jump through a number of ambiguously-defined hoops. The law, combined with parasitic no-win-no-fee legal firms, puts website owners at risk of vindictive reporting. Young websites and non-profits cannot afford legal teams. Therefore the risk posed by GDPR is unacceptably high. > Perversely, this new EU law hurts small and ethical startups, but helps reinforce the dominance of Facebook, Google and Twitter, who are able to prepare and defend themselves using established legal teams and cash reserves, and who now face less competition from startups. The EU Cookie Law, EU VAT regulation and now the EU GDPR are all examples of poorly-implemented laws that add complexity and unintended side-effects for businesses within the EU.
- cyberferret 9y ago
  You are right in that I don't agree. I don't think this is a question of tolerance of risk, but that he doesn't seem to want to study all the implications. I will be first to admit that GDPR is full of holes and ambiguities and has never been tested in a court of law yet, but rather than (as the two quotes you pulled from his site) assume that GDPR has been set up to give the 'big boys' free reign and punish small operators, I'd like to think that GDPR actually puts a LOT more accountability on the larger players and actually will put smaller players on a semi-equal footing. I really don't think that the EU will be spending the money and time (and open themselves to the PR disaster) of suing websites that might make $1000/mo for the full EUR20Million, do you?
  - adventured 9y ago
    > of suing websites that might make $1000/mo for the full EUR20Million, do you? I expect some early chilling cases that will scare the shit out of small operators. That's almost guaranteed to happen. I don't expect the EU to need to be aggressive in pursuing small operators (spending lots of money & time on it), a few demonstrative examples will do the job. They'll need to do that to make sure they're all in line. It's too great of a task to force compliance on millions of small businesses otherwise, they will have to make an example of some small businesses. If they don't, compliance by those millions of small businesses will erode over time.
  - pixl97 9y ago
    In the US copyright trolls, for example, go after small sites first. They are not able to provide the huge amount of money needed to fund a solid legal defense. The trolls can use the precedent to attack larger more well funded targets. It is not unheard of for US law enforcement to do the same thing. That is why groups like the ACLU and EFF are so important here.
    - lagadu 9y ago
      But trolls can't go after any sites. The only entity with the power to issue fines is the national regulatory entity. Trolls would only be able to present a complaint with them and let them to the assessing and investigation. Also precedent doesn't work the same way in EU jurisdictions like in the US (although it's irrelevant in this case).
- lucb1e 9y ago
  You're just citing the article, which your parent comment seems to have read. How is this a justification? Like, I can face huge consequences if I kill someone, so I just don't do it. Similarly, just mention that you're sharing data with third parties, and act on emails that ask you to remove data of an account... it's not rocket science. And it's not as if you'll get fined €20 million if one email ended up in a spam box and you didn't remove someone's account in time... it's really blowing things out of proportion to mention that without further qualification. The big money is to threaten companies like Microsoft, not small businesses that don't even make a profit.
  - adventured 9y ago
    > How is this a justification? Your premise doesn't make sense. You're arguing against someone's subjective regard for risk. That's like telling someone that their love of skydiving is stupid because it's too risky. If the operator has a very low tolerance for risk - assume it's extraordinarily low for these illustrative purposes, as we're discussing a principle that applies regardless of scale - then that's down to their preferences. It does no good to argue against subjective preferences.
lucb1e 9y ago
> he decided to shut it down using GDPR as a vague justification? That's my theory as well. It's just too bad that he drags GDPR through the mud with this as well, since there are indeed a bunch of people (just like anyone can, apparently be against net neutrality) who would prefer things to remain lawless. They'll point to this article as justification, after which the other party will have to go and read it thoroughly and attack its points, and win that sub-argument, before they're even back to square one with the original discussion.
- pdimitar 9y ago
  Not wanting to become more well-acquainted with the law is NOT the same as running a lawless operation. You make a weird conflation in your comment. Truth is, for most tech people, law is a huge extra expense -- of time, money and tons of risk.
liveoneggs 9y ago
can he provide a list of all 3rd parties he's ever shared that data with? probably not?

adventured 9y ago

They explained why. Obviously you may still disagree, however their opinion of acceptable risk is subjective (ie it's silly to tell someone what their tolerance for risk should be). > GDPR threatens website owners with fines of 4% of turnover or €20 million (whichever is higher) if they do not jump through a number of ambiguously-defined hoops. The law, combined with parasitic no-win-no-fee legal firms, puts website owners at risk of vindictive reporting. Young websites and non-profits cannot afford legal teams. Therefore the risk posed by GDPR is unacceptably high. > Perversely, this new EU law hurts small and ethical startups, but helps reinforce the dominance of Facebook, Google and Twitter, who are able to prepare and defend themselves using established legal teams and cash reserves, and who now face less competition from startups. The EU Cookie Law, EU VAT regulation and now the EU GDPR are all examples of poorly-implemented laws that add complexity and unintended side-effects for businesses within the EU.

cyberferret 9y ago
You are right in that I don't agree. I don't think this is a question of tolerance of risk, but that he doesn't seem to want to study all the implications. I will be first to admit that GDPR is full of holes and ambiguities and has never been tested in a court of law yet, but rather than (as the two quotes you pulled from his site) assume that GDPR has been set up to give the 'big boys' free reign and punish small operators, I'd like to think that GDPR actually puts a LOT more accountability on the larger players and actually will put smaller players on a semi-equal footing. I really don't think that the EU will be spending the money and time (and open themselves to the PR disaster) of suing websites that might make $1000/mo for the full EUR20Million, do you?
- adventured 9y ago
  > of suing websites that might make $1000/mo for the full EUR20Million, do you? I expect some early chilling cases that will scare the shit out of small operators. That's almost guaranteed to happen. I don't expect the EU to need to be aggressive in pursuing small operators (spending lots of money & time on it), a few demonstrative examples will do the job. They'll need to do that to make sure they're all in line. It's too great of a task to force compliance on millions of small businesses otherwise, they will have to make an example of some small businesses. If they don't, compliance by those millions of small businesses will erode over time.
- pixl97 9y ago
  In the US copyright trolls, for example, go after small sites first. They are not able to provide the huge amount of money needed to fund a solid legal defense. The trolls can use the precedent to attack larger more well funded targets. It is not unheard of for US law enforcement to do the same thing. That is why groups like the ACLU and EFF are so important here.
  - lagadu 9y ago
    But trolls can't go after any sites. The only entity with the power to issue fines is the national regulatory entity. Trolls would only be able to present a complaint with them and let them to the assessing and investigation. Also precedent doesn't work the same way in EU jurisdictions like in the US (although it's irrelevant in this case).
lucb1e 9y ago
You're just citing the article, which your parent comment seems to have read. How is this a justification? Like, I can face huge consequences if I kill someone, so I just don't do it. Similarly, just mention that you're sharing data with third parties, and act on emails that ask you to remove data of an account... it's not rocket science. And it's not as if you'll get fined €20 million if one email ended up in a spam box and you didn't remove someone's account in time... it's really blowing things out of proportion to mention that without further qualification. The big money is to threaten companies like Microsoft, not small businesses that don't even make a profit.
- adventured 9y ago
  > How is this a justification? Your premise doesn't make sense. You're arguing against someone's subjective regard for risk. That's like telling someone that their love of skydiving is stupid because it's too risky. If the operator has a very low tolerance for risk - assume it's extraordinarily low for these illustrative purposes, as we're discussing a principle that applies regardless of scale - then that's down to their preferences. It does no good to argue against subjective preferences.

lucb1e 9y ago

> he decided to shut it down using GDPR as a vague justification? That's my theory as well. It's just too bad that he drags GDPR through the mud with this as well, since there are indeed a bunch of people (just like anyone can, apparently be against net neutrality) who would prefer things to remain lawless. They'll point to this article as justification, after which the other party will have to go and read it thoroughly and attack its points, and win that sub-argument, before they're even back to square one with the original discussion.

pdimitar 9y ago
Not wanting to become more well-acquainted with the law is NOT the same as running a lawless operation. You make a weird conflation in your comment. Truth is, for most tech people, law is a huge extra expense -- of time, money and tons of risk.

liveoneggs 9y ago

can he provide a list of all 3rd parties he's ever shared that data with? probably not?