7 ms·

Unless the owner is doing something shady (or just doesn't understand the GDPR), the issue is pretty clear. He's running an unprofitable business (by his own a

Unless the owner is doing something shady (or just doesn't understand the GDPR), the issue is pretty clear. He's running an unprofitable business (by his own admission), and likely is running it as some sort of sole proprietorship and doesn't want to take the risk on himself. The solution is to create a company so that the company can shoulder most of the risk so the company goes bankrupt in the event he finds himself unwilling to comply with regulatory requests. I'm guessing he just doesn't want to dump any more money into a failing project, which is his decision to make. Is this a failure of the GDPR though, or a success? Personally I think fly-by-night websites should be the last people responsible for handling personal data. If they're unwilling to attempt to comply with regulations, then perhaps the internet is a better place without these sites.

deleted 9y ago
[deleted]
ajdlinux 9y ago
While creating a company does shield you from some level of personal liability, you're (a) still exposed to directors' duties and similar obligations that attach to a director personally, and (b) still at risk of having your name attached to a company that has gone into liquidation.
tptacek 9y ago
In the US, as a sort of general non-lawyerly rule of thumb, incorporation shields owners from contract liability, but not from tort liability, which is what they'd face from GDPR screwups.
- rando444 9y ago
  Depends on the screwup. If he were directly involved in doing something malicious or extremely negligent towards his customers he could be liable. If he can't trust himself not to be in this category though, I would argue that shutting down is still the desired result.
scrollaway 9y ago
I think there's stigma around GDPR among some entrepreneurs because of a complete refusal from some people to see personal data as something they need to treat carefully. Let's look at an alternate universe for a moment, where online shopping developed with very barebones regulations, PCI-DSS isn't a thing and fraud is far more rampant. Now the EU introduces new regulations much like PCI-DSS with heavy fines attached to it. Suddenly you would have every small business coming out of the woodwork, claiming PCI compliance is a huge hassle, the fines are unreasonable, etc. Yeah, PCI compliance is a hassle (which is why we have companies such as Stripe taking care of it for you). But to protect and empower the users, it's needed. This isn't about your business, it's about your users and how they can, today thanks to PCI-DSS, generally trust that their credit card is safe to enter online (which is a net good for any industry that needs online payments). But that universe is crazy because, who wouldn't treat credit card numbers as extremely sensitive data? Well, many companies who today aren't actually PCI-DSS compliant. Sometimes devs just don't know why, when or even how to encrypt the data and nobody audits that until there's a breach. So my opinion is this is a success of GDPR. Clearly nobody in this comment section thinks the person in question would really have had a hard time complying with it, and probably wanted to shut down anyway. Either its users are better off because the service is a data vampire that doesn't care about compliance, or it's a no-op because it would have shut down either way. Make room for competition that does care, I'm all for that.
- closeparen 9y ago
  > PCI-DSS isn't a thing and fraud is far more rampant. Now the EU introduces new regulations much like PCI-DSS with heavy fines attached to it. That would be amazing! Then we'd actually have to adopt a push-based or one-time-use transaction model, rather than living under the fantasy (disproven on a daily basis) that merchants should be in the business of keeping secrets, or are even capable of it. It's hard for me to take anything someone says seriously after they express admiration for the credit card number security model.
  - scrollaway 9y ago
    That wasn't the point of my post but what you're thinking about is actually in progress! Google PSD2 for more info :)
closeparen 9y ago
>If they're unwilling to attempt to comply with regulations This is an obtuse, bordering on malicious misreading of the post. They're not unwilling to implement the necessary features. They're unwilling to shoulder the risk. > Personally I think fly-by-night websites should be the last people responsible for handling personal data. If they're unwilling to attempt to comply with regulations, then perhaps the internet is a better place without these sites. This isn't a data broker, a credit reporting agency, someone with a giant sensor fleet, etc. It's extremely straightforward to not share data with a "fly-by-night" website like this.
- rando444 9y ago
  Yes, they're unwilling to shoulder the risk.. so why should they get to keep people's data? Because it's a small operation? Because the owner doesn't have time to secure it? Yeah, it's extremely easy to not share your data with them.. if you know they don't care about protecting it.. But what about all of the other people on the internet that don't know this guy doesn't care about your privacy? Convincing businesses to take your personal data seriously is the whole point, and you shouldn't get a free pass just because you only handle people's personal data in your spare time.
  - closeparen 9y ago
    > so why should they get to keep people's data? Because people voluntarily provide it to them. > But what about all of the other people on the internet that don't know this guy doesn't care about your privacy? Governments confront problems with this general shape all the time... the result is usually labeling requirements. Sure, this guy should not be allowed to claim he has a crack team of elite cybersecurity engineers when he doesn't. Regardless, no one is asking him keep secrets for them. It's a niche Craigslist. >Because it's a small operation? You're actively campaigning to degrade privacy (and also user freedom, competition, and choice) to a much greater degree by displacing these activities onto large, centralized platforms. Especially those which are monetizing your data to a high enough degree that it's worthwhile to staff a compliance team for the privilege of continuing to do so.
vpribish 9y ago
sounds like you are willing to eliminate hobby websites and nights and weekends startups, forcing every new idea to incorporate first. that's the sort of thing that the internet was supposed to route around.
AmericanChopper 9y ago
Pretty much any start up starts out as a "fly-by-night website". Maybe this guy's just an idiot, but regulations like this harm small businesses and innovation. You can debate the merit of them, but this is what they cost.
- scrollaway 9y ago
  You're being downvoted unfairly. It is what they cost. Those costs can be mitigated though; there's a lot of businesses that make it their goal to solve regulations for small startups. The question is more on the side of, is the cost worth it? A good and much longer-running example of this is in the medical industry. There are massive regulations around development of new drugs and treatments. Massive regulations around experimentation on humans. This stifles innovation and prevents potentially life-changing drugs from making it to the market faster, or sometimes ever. It also prevents a lot of other things, such as crackpots from entering the mass market and selling poison as an anti-aging drug. Is it worth it? There's still debate about this today, especially when promising cancer treatments are taking years/decades to reach the market (=> how many lives are lost during that time? What's the tradeoff for someone who is terminally ill anyway? etc). I'm not nearly informed enough to pick a side in that debate, but it goes to show it's not necessarily a bad thing for "fly by night websites" to be heavily impacted by regulations like these.
  - eadmund 9y ago
    > Those costs can be mitigated though; there's a lot of businesses that make it their goal to solve regulations for small startups. Part of my concern is that in order for those regulation-solving businesses to have a working business model, they can't just support every stack under the Sun. Instead, you'll get something like GDPR for Azure™ — which means that it'll be that much more expensive for a startup using an outside-the-box stack to get started. That's the point of a lot of regulation, really: to insulate firms which already exist from disruption.
  - strken 9y ago
    The difference here is that the GDPR is widely believed to be aimed at Facebook, Google, and friends, and those companies are a threat to privacy partly because of the enormous scale of their data collection in addition to the intrinsically private nature of the data itself. The question, then, is whether a small "business" that's closer to a charity or a resume padder needs to be regulated in the same way as Facebook when it doesn't collect data on the same scale. I don't think this applies to medical startups, where human lives are at the same risk regardless of how many customers are using the tech.
tripletao 9y ago
"Failing" seems a bit harsh. Lots of people run websites that don't make money, and lots of users get value from such sites. Sometimes the operator still hopes to gain from the site (in publicity or whatever), or sometimes it's just a gift. The GDPR just made that gift more expensive. If he's not doing anything deliberately shady, then the probability that he'll get fined is small; but a small probability times 20M EUR is still a big number. Maybe I don't understand the GDPR well enough, but the statutory fines seem insane to me. Why do you think 20M EUR is the right number here? Or am I missing details of the law (the law, not how you expect it will be enforced) that mean his actual maximum liability is smaller? Do you just have extraordinary confidence in the regulators to "do the right thing", and thus no qualms about giving them the legal authority to ruin his life?
- dleslie 9y ago
  The gift part is lost on so many. Perhaps it was unintended to increase the potential burden of monetary cost to running services that were created and provided as hobbies or otherwise as a goodwill gesture to others. Or maybe the regulators didn't care to consider the impact on such services. Or maybe ... Regardless, thanks to regulators and data/service silos the web we once new or dreamed of is fading from reality. With just the silos to contend with such services could hitherto continue to exist with little concern for the actions of the behemoths; but now such an existence is threatened by regulatory concerns which blanket all regardless of their role and activity. Perhaps the correct action is to blackhole .EU?
neximo64 9y ago
The owner is just focusing on their startup, as they should be. It's up to the owner to decide their tolerance of risk against regulations which hold them to account. A defensive piece you've made completely misunderstands how a business works in terms of the decisions made regarding risk, especially to an individual who lacks bandwidth/resources. According to your post, you only expect well endowed individuals/large businesses to be compliant, which is precisely the problem.
Clubber 9y ago
When I was reading about the GDPR today, I read that email address and IP are considered private data as well. This means any website with an email login or subscription or that even logs hits with the request IP must take action. I fully support protection against physical locations and personal information (name, address, etc), but to include email and IP address seems a little excessive.
- kenning 9y ago
  Friend works in data law and says that it's ambiguous. One of the problems is that people use personal information in their email. Also, you have no idea if it's actually personal information or just a nickname they've given themselves. For these reasons it looks unlikely that emails will be considered personally identifiable information.
  - guitarbill 9y ago
    That's unlikely to be true. And people are stupid, and will use their email address - just look at e.g. the Ashley Madison hack. So for most people, it's personal information, and the law will probably treat it as such.
- NamTaf 9y ago
  I get and somewhat agree with your point, but on the flipside, excluding certain types of data means that companies will focus on abusing them to skirt regulations. I can see why they just went all-in on the types of data that are considered PII, because in different contexts, different data are possibly PII. It's not a perfect solution, but I'm not sure there is one.
- nfoz 9y ago
  My email address and IP address ARE personally identifying. I am delighted that websites should protect this information.
deleted 9y ago
[deleted]
bitL 9y ago
> The solution is to create a company Single member LLCs allow piercing of corporate veil pretty easily.

deleted 9y ago

[deleted]

ajdlinux 9y ago

While creating a company does shield you from some level of personal liability, you're (a) still exposed to directors' duties and similar obligations that attach to a director personally, and (b) still at risk of having your name attached to a company that has gone into liquidation.

tptacek 9y ago

In the US, as a sort of general non-lawyerly rule of thumb, incorporation shields owners from contract liability, but not from tort liability, which is what they'd face from GDPR screwups.

rando444 9y ago
Depends on the screwup. If he were directly involved in doing something malicious or extremely negligent towards his customers he could be liable. If he can't trust himself not to be in this category though, I would argue that shutting down is still the desired result.

scrollaway 9y ago

I think there's stigma around GDPR among some entrepreneurs because of a complete refusal from some people to see personal data as something they need to treat carefully. Let's look at an alternate universe for a moment, where online shopping developed with very barebones regulations, PCI-DSS isn't a thing and fraud is far more rampant. Now the EU introduces new regulations much like PCI-DSS with heavy fines attached to it. Suddenly you would have every small business coming out of the woodwork, claiming PCI compliance is a huge hassle, the fines are unreasonable, etc. Yeah, PCI compliance is a hassle (which is why we have companies such as Stripe taking care of it for you). But to protect and empower the users, it's needed. This isn't about your business, it's about your users and how they can, today thanks to PCI-DSS, generally trust that their credit card is safe to enter online (which is a net good for any industry that needs online payments). But that universe is crazy because, who wouldn't treat credit card numbers as extremely sensitive data? Well, many companies who today aren't actually PCI-DSS compliant. Sometimes devs just don't know why, when or even how to encrypt the data and nobody audits that until there's a breach. So my opinion is this is a success of GDPR. Clearly nobody in this comment section thinks the person in question would really have had a hard time complying with it, and probably wanted to shut down anyway. Either its users are better off because the service is a data vampire that doesn't care about compliance, or it's a no-op because it would have shut down either way. Make room for competition that does care, I'm all for that.

closeparen 9y ago
> PCI-DSS isn't a thing and fraud is far more rampant. Now the EU introduces new regulations much like PCI-DSS with heavy fines attached to it. That would be amazing! Then we'd actually have to adopt a push-based or one-time-use transaction model, rather than living under the fantasy (disproven on a daily basis) that merchants should be in the business of keeping secrets, or are even capable of it. It's hard for me to take anything someone says seriously after they express admiration for the credit card number security model.
- scrollaway 9y ago
  That wasn't the point of my post but what you're thinking about is actually in progress! Google PSD2 for more info :)

closeparen 9y ago

>If they're unwilling to attempt to comply with regulations This is an obtuse, bordering on malicious misreading of the post. They're not unwilling to implement the necessary features. They're unwilling to shoulder the risk. > Personally I think fly-by-night websites should be the last people responsible for handling personal data. If they're unwilling to attempt to comply with regulations, then perhaps the internet is a better place without these sites. This isn't a data broker, a credit reporting agency, someone with a giant sensor fleet, etc. It's extremely straightforward to not share data with a "fly-by-night" website like this.

rando444 9y ago
Yes, they're unwilling to shoulder the risk.. so why should they get to keep people's data? Because it's a small operation? Because the owner doesn't have time to secure it? Yeah, it's extremely easy to not share your data with them.. if you know they don't care about protecting it.. But what about all of the other people on the internet that don't know this guy doesn't care about your privacy? Convincing businesses to take your personal data seriously is the whole point, and you shouldn't get a free pass just because you only handle people's personal data in your spare time.
- closeparen 9y ago
  > so why should they get to keep people's data? Because people voluntarily provide it to them. > But what about all of the other people on the internet that don't know this guy doesn't care about your privacy? Governments confront problems with this general shape all the time... the result is usually labeling requirements. Sure, this guy should not be allowed to claim he has a crack team of elite cybersecurity engineers when he doesn't. Regardless, no one is asking him keep secrets for them. It's a niche Craigslist. >Because it's a small operation? You're actively campaigning to degrade privacy (and also user freedom, competition, and choice) to a much greater degree by displacing these activities onto large, centralized platforms. Especially those which are monetizing your data to a high enough degree that it's worthwhile to staff a compliance team for the privilege of continuing to do so.

vpribish 9y ago

sounds like you are willing to eliminate hobby websites and nights and weekends startups, forcing every new idea to incorporate first. that's the sort of thing that the internet was supposed to route around.

AmericanChopper 9y ago

Pretty much any start up starts out as a "fly-by-night website". Maybe this guy's just an idiot, but regulations like this harm small businesses and innovation. You can debate the merit of them, but this is what they cost.

scrollaway 9y ago
You're being downvoted unfairly. It is what they cost. Those costs can be mitigated though; there's a lot of businesses that make it their goal to solve regulations for small startups. The question is more on the side of, is the cost worth it? A good and much longer-running example of this is in the medical industry. There are massive regulations around development of new drugs and treatments. Massive regulations around experimentation on humans. This stifles innovation and prevents potentially life-changing drugs from making it to the market faster, or sometimes ever. It also prevents a lot of other things, such as crackpots from entering the mass market and selling poison as an anti-aging drug. Is it worth it? There's still debate about this today, especially when promising cancer treatments are taking years/decades to reach the market (=> how many lives are lost during that time? What's the tradeoff for someone who is terminally ill anyway? etc). I'm not nearly informed enough to pick a side in that debate, but it goes to show it's not necessarily a bad thing for "fly by night websites" to be heavily impacted by regulations like these.
- eadmund 9y ago
  > Those costs can be mitigated though; there's a lot of businesses that make it their goal to solve regulations for small startups. Part of my concern is that in order for those regulation-solving businesses to have a working business model, they can't just support every stack under the Sun. Instead, you'll get something like GDPR for Azure™ — which means that it'll be that much more expensive for a startup using an outside-the-box stack to get started. That's the point of a lot of regulation, really: to insulate firms which already exist from disruption.
- strken 9y ago
  The difference here is that the GDPR is widely believed to be aimed at Facebook, Google, and friends, and those companies are a threat to privacy partly because of the enormous scale of their data collection in addition to the intrinsically private nature of the data itself. The question, then, is whether a small "business" that's closer to a charity or a resume padder needs to be regulated in the same way as Facebook when it doesn't collect data on the same scale. I don't think this applies to medical startups, where human lives are at the same risk regardless of how many customers are using the tech.

tripletao 9y ago

"Failing" seems a bit harsh. Lots of people run websites that don't make money, and lots of users get value from such sites. Sometimes the operator still hopes to gain from the site (in publicity or whatever), or sometimes it's just a gift. The GDPR just made that gift more expensive. If he's not doing anything deliberately shady, then the probability that he'll get fined is small; but a small probability times 20M EUR is still a big number. Maybe I don't understand the GDPR well enough, but the statutory fines seem insane to me. Why do you think 20M EUR is the right number here? Or am I missing details of the law (the law, not how you expect it will be enforced) that mean his actual maximum liability is smaller? Do you just have extraordinary confidence in the regulators to "do the right thing", and thus no qualms about giving them the legal authority to ruin his life?

dleslie 9y ago
The gift part is lost on so many. Perhaps it was unintended to increase the potential burden of monetary cost to running services that were created and provided as hobbies or otherwise as a goodwill gesture to others. Or maybe the regulators didn't care to consider the impact on such services. Or maybe ... Regardless, thanks to regulators and data/service silos the web we once new or dreamed of is fading from reality. With just the silos to contend with such services could hitherto continue to exist with little concern for the actions of the behemoths; but now such an existence is threatened by regulatory concerns which blanket all regardless of their role and activity. Perhaps the correct action is to blackhole .EU?

neximo64 9y ago

The owner is just focusing on their startup, as they should be. It's up to the owner to decide their tolerance of risk against regulations which hold them to account. A defensive piece you've made completely misunderstands how a business works in terms of the decisions made regarding risk, especially to an individual who lacks bandwidth/resources. According to your post, you only expect well endowed individuals/large businesses to be compliant, which is precisely the problem.

Clubber 9y ago

When I was reading about the GDPR today, I read that email address and IP are considered private data as well. This means any website with an email login or subscription or that even logs hits with the request IP must take action. I fully support protection against physical locations and personal information (name, address, etc), but to include email and IP address seems a little excessive.

kenning 9y ago
Friend works in data law and says that it's ambiguous. One of the problems is that people use personal information in their email. Also, you have no idea if it's actually personal information or just a nickname they've given themselves. For these reasons it looks unlikely that emails will be considered personally identifiable information.
- guitarbill 9y ago
  That's unlikely to be true. And people are stupid, and will use their email address - just look at e.g. the Ashley Madison hack. So for most people, it's personal information, and the law will probably treat it as such.
NamTaf 9y ago
I get and somewhat agree with your point, but on the flipside, excluding certain types of data means that companies will focus on abusing them to skirt regulations. I can see why they just went all-in on the types of data that are considered PII, because in different contexts, different data are possibly PII. It's not a perfect solution, but I'm not sure there is one.
nfoz 9y ago
My email address and IP address ARE personally identifying. I am delighted that websites should protect this information.

deleted 9y ago

[deleted]

bitL 9y ago

> The solution is to create a company Single member LLCs allow piercing of corporate veil pretty easily.