11 ms·

> Small tech owners can't fight such litigations. Yes. This I think is a downside of the law. Some small owners are going to have a more difficult time. But t

by kartan 8y ago

> Small tech owners can't fight such litigations. Yes. This I think is a downside of the law. Some small owners are going to have a more difficult time. But this is true for any regulation like food safety regulations, construction regulations, etc. They hurt more a small restaurant than a big chain. But in the end, these regulations are there to protect the customers. Small restaurants have closed and will continue closing for not following food safety regulations. But what is the alternative? Is business creation the final goal of our society? Or there are things more important? In summary, small businesses are going to have to extend their insurances to also cover risks related to GDPR. But it's the price to pay for having safer data.

pdimitar 8y ago
I don't dispute the goal of GDPR -- I support it fully. My worry is that it could be abused by legal trolls. They are a fact of life.
- foxylad 8y ago
  But legal trolls have an array of legislation to attack you with. GDPR is just the latest one.
  - pdimitar 8y ago
    Agreed. GDPR simply made me aware of that once again. I still feel the trolls should have minimal amount of attack vectors to small businesses, though.
  - bryanrasmussen 8y ago
    yes but the argument is that one hit from the gdpr can kill you and maybe even most likely will even if you're in reasonable health, and most other legislation you can survive a few hits if you're not already critical.
    - DanBC 8y ago
      No. The first hit from GDPR violation will be from the regulator, asking if you actually are in violation, and giving you advice about how to come back into regulation.
      - bryanrasmussen 8y ago
        I didn't say the argument was correct, but people probably also don't want to deal with the regulator for their little side gigs even if it's only the regulator asking questions.
  - saudioger 8y ago
    GDPR is an easy one because it's fairly ambiguous and doesn't yet have precedent
    - stevetrewick 8y ago
      GDPR is for the most part making explicit things were implicit in the pre existing EU legislation, many of which have been subject to EU court rulings. There is a ton of precedent.
  - DanBC 8y ago
    Why would legal trolls use GDPR? What's in it for them?
- lagadu 8y ago
  GDPR violations aren't something a troll can sue you over. All a troll would be able to do would be to raise a complaint with their national entity responsible for it, who analyzes the complaint and then takes action themselves if deemed appropriate.
kodablah 8y ago
> But what is the alternative? Status quo? Baby steps? Enforcement of existing statutes? Consumer education? Promotion/support of preferred alternatives? Codified small business leniency? Objective enforcement clarity?
woolvalley 8y ago
TBH most food & construction safety laws are way more small business friendly than the GDPR. Food safety has a well defined relatively easy to follow rule set and food inspectors come in and give you a food safety rating, which you can work on and improve. It won't destroy a small mom & pop restaurant with a $million fine. For construction, you build your building to 'code', an inspector comes in and stamps the building and then your done. If your not code compliant, then you can correct without much penalty at all, not get a $million penalty and you don't have to go to court or get lawyers. Making your own shack in your backyard isn't an arduous process as far as code compliance goes. Since most software is constantly modified and edited, I don't think the construction model really works. More the food safety one or a data fiduciary one.
- _o_ 8y ago
  Don't use people personal data and dont allow others to spy on your users (ads, analytics,..) and you wont need to do anything. Work in best interest of your users and you will be compliant. I don't think that this is harder than food safety regulations. By the way, the technology is changing fast and a strictly defined law with "do" and "don't"s would be downplayed in weeks. that's why GDPR is conceptual (and thats why everyone is pissed off, as they can't downplay it - how many sites have you seen that are giving you a fair cookie choice?)
- a_bonobo 8y ago
  >food safety rating, which you can work on and improve But the GDPR works like this too? The $20 million fine is not automatically applied. Here's a flow chart which details the process of a GDPR breach: https://40uu5c99f3a2ja7s7miveqgqu-wpengine.netdna-ssl.com/wp-content/uploads/2018/01/GDPR-fines-and-other-sanctions-how-the-sanction-mechanism-of-GDPR-will-work-in-practice-source-European-Commission-click-for-PDF.gif https://40uu5c99f3a2ja7s7miveqgqu-wpengine.netdna-ssl.com/wp... from https://www.i-scoop.eu/gdpr/gdpr-fines-guidelines-application-penalties/ https://www.i-scoop.eu/gdpr/gdpr-fines-guidelines-applicatio... If you breach the rules, a simple reprimand without a fine is possible too.
  - tripletao 8y ago
rorykoehler 8y ago
I'm not sure what GDPR is protecting me against that wasn't already covered by PCI-DSS and existing cybersecurity standards. Not being financially defrauded is the only thing i care about. For everything else is easy to avoid sharing personally identifiable data if it's really a concern.
- briandear 8y ago
  A point of fact though — PCI isn’t a law, it’s a voluntary standard.
  - rorykoehler 8y ago
    Yes however i can choose to not interact with non compliant service. The ignorant need to be educated rather than the informed punished.
    - blub 8y ago
      There are almost no companies that respect the customer's privacy because of the lack of regulation so you can't in fact choose anything. Companies have failed to regulate themselves since the dawn of time, this is how the world works.
      - rorykoehler 8y ago
        You won't get PCI-DSS accredited without an audit.
        jimktrains2 8y ago
        Only Level 1 compliance requires an audit. Below that a remote scan of public IPs and a self-assessment is sufficient.
- e12e 8y ago
  Do you prosecute your friend and aqaintances for uploading pictures of you to Instagram/fb etc? Block all tracking script/pixels on the Web? Avoid using the phone in order to not generate meta-data? I'm not sure how it's "easy to avoid sharing identifiable data"?
briandear 8y ago
Are people dying from data being collected for website analytics? It’s a false dichotomy to compare the risk of DEATH from bad food safety to the annoyance of getting a targeted ad whilst enjoying an online newspaper article for which you didn’t have to pay. Elevating data obtained while surfing the internet to the level of food safety or building codes is ridiculous.
- matthewmacleod 8y ago
  The attitude you have here is exactly the reason why GDPR is required. Companies worldwide have consistently failed to safely store and process personal data. There are new data breaches every day. Irresponsible processing of data has a direct negative effect, and that’s not related to the idea that it’s misused for advert targeting. Minimising the incompetence we’ve seen worldwide by treating it as “just some data collected while surfing” is baffling to me.
  - throwaway-hn123 8y ago
    It's even more concerning when this guy is the CEO of iCouch - "a platform for psychologists, therapists and counselors." Yeah, I don't think I'll be trusting my data to someone who doesn't believe user privacy is important.
ehsankia 8y ago
To me, asking a small developer with a site that gets a few thousands users to implement GDPR is like asking a dad to do full safety test on a toy car he built for his kid, just because a big company like GM had safety issues. The problem EU is trying to solve here are large companies like Facebook making monopolies and syphoning data. So why the hell do they have to impose rules on small hobby websites that run at a loss? There's a huge chunk of the web that is filled with niche web tools, mostly made as a hobby, running for free. I myself own 2-3 such sites. Now, I'm forced to spend my hobby time adding a bunch of new features on a site that already loses money? I'm sorry but the couple thousand people that depend on this tool will have to find someplace else I guess. HN sure loves to worry about AMP killing the internet, well to me this is far more dangerous. Can't wait for larger troll companies bullying small devs with lawsuits and killing all their competition using GDPR.
- riffraff 8y ago
  presumably you have laws that require street vehicles have a valid license before they can go on the road. Do you remember the police arresting someone because of a toy car they built? If not, then why do you expect the EU to go after the equivalent site with a few thousand users?
  - ehsankia 8y ago
    Logically, it's very unlikely. Realistically, seeing the risk of a $20m fine, I sure as hell won't take the chance and will take down my site until the dust settles and the kinks gets ironed out.
    - somebadguy 8y ago
      Good.
  - mdpopescu 8y ago
    > Do you remember the police arresting someone because of a toy car they built? Does this apply? [1] [1] http://fortune.com/2017/07/21/five-year-old-fine-lemonade-stand/ http://fortune.com/2017/07/21/five-year-old-fine-lemonade-st...
CryptoPunk 8y ago
>>But what is the alternative? Is business creation the final goal of our society? Or there are things more important? The alternative is to let consumers fend for themselves, and if government is going to help, limit that help to investigating and punishing fraud, enforcing contract law, and providing free information resources to help consumers make better informed decisions. Yes business creation should be the highest goal of society. New businesses are what counteract income inequality and drive innovation. We need innovation to solve the already existing problems in society, that claim tens of millions of lives every year. There is no zero risk path open to society.

by kartan 8y ago

pdimitar 8y ago

I don't dispute the goal of GDPR -- I support it fully. My worry is that it could be abused by legal trolls. They are a fact of life.

foxylad 8y ago
But legal trolls have an array of legislation to attack you with. GDPR is just the latest one.
- pdimitar 8y ago
  Agreed. GDPR simply made me aware of that once again. I still feel the trolls should have minimal amount of attack vectors to small businesses, though.
- bryanrasmussen 8y ago
  yes but the argument is that one hit from the gdpr can kill you and maybe even most likely will even if you're in reasonable health, and most other legislation you can survive a few hits if you're not already critical.
  - DanBC 8y ago
    No. The first hit from GDPR violation will be from the regulator, asking if you actually are in violation, and giving you advice about how to come back into regulation.
    - bryanrasmussen 8y ago
      I didn't say the argument was correct, but people probably also don't want to deal with the regulator for their little side gigs even if it's only the regulator asking questions.
- saudioger 8y ago
  GDPR is an easy one because it's fairly ambiguous and doesn't yet have precedent
  - stevetrewick 8y ago
    GDPR is for the most part making explicit things were implicit in the pre existing EU legislation, many of which have been subject to EU court rulings. There is a ton of precedent.
- DanBC 8y ago
  Why would legal trolls use GDPR? What's in it for them?
lagadu 8y ago
GDPR violations aren't something a troll can sue you over. All a troll would be able to do would be to raise a complaint with their national entity responsible for it, who analyzes the complaint and then takes action themselves if deemed appropriate.

kodablah 8y ago

> But what is the alternative? Status quo? Baby steps? Enforcement of existing statutes? Consumer education? Promotion/support of preferred alternatives? Codified small business leniency? Objective enforcement clarity?

woolvalley 8y ago

TBH most food & construction safety laws are way more small business friendly than the GDPR. Food safety has a well defined relatively easy to follow rule set and food inspectors come in and give you a food safety rating, which you can work on and improve. It won't destroy a small mom & pop restaurant with a $million fine. For construction, you build your building to 'code', an inspector comes in and stamps the building and then your done. If your not code compliant, then you can correct without much penalty at all, not get a $million penalty and you don't have to go to court or get lawyers. Making your own shack in your backyard isn't an arduous process as far as code compliance goes. Since most software is constantly modified and edited, I don't think the construction model really works. More the food safety one or a data fiduciary one.

_o_ 8y ago
Don't use people personal data and dont allow others to spy on your users (ads, analytics,..) and you wont need to do anything. Work in best interest of your users and you will be compliant. I don't think that this is harder than food safety regulations. By the way, the technology is changing fast and a strictly defined law with "do" and "don't"s would be downplayed in weeks. that's why GDPR is conceptual (and thats why everyone is pissed off, as they can't downplay it - how many sites have you seen that are giving you a fair cookie choice?)
a_bonobo 8y ago
>food safety rating, which you can work on and improve But the GDPR works like this too? The $20 million fine is not automatically applied. Here's a flow chart which details the process of a GDPR breach: https://40uu5c99f3a2ja7s7miveqgqu-wpengine.netdna-ssl.com/wp-content/uploads/2018/01/GDPR-fines-and-other-sanctions-how-the-sanction-mechanism-of-GDPR-will-work-in-practice-source-European-Commission-click-for-PDF.gif https://40uu5c99f3a2ja7s7miveqgqu-wpengine.netdna-ssl.com/wp... from https://www.i-scoop.eu/gdpr/gdpr-fines-guidelines-application-penalties/ https://www.i-scoop.eu/gdpr/gdpr-fines-guidelines-applicatio... If you breach the rules, a simple reprimand without a fine is possible too.
- tripletao 8y ago

rorykoehler 8y ago

I'm not sure what GDPR is protecting me against that wasn't already covered by PCI-DSS and existing cybersecurity standards. Not being financially defrauded is the only thing i care about. For everything else is easy to avoid sharing personally identifiable data if it's really a concern.

briandear 8y ago
A point of fact though — PCI isn’t a law, it’s a voluntary standard.
- rorykoehler 8y ago
  Yes however i can choose to not interact with non compliant service. The ignorant need to be educated rather than the informed punished.
  - blub 8y ago
    There are almost no companies that respect the customer's privacy because of the lack of regulation so you can't in fact choose anything. Companies have failed to regulate themselves since the dawn of time, this is how the world works.
    - rorykoehler 8y ago
      You won't get PCI-DSS accredited without an audit.
      - jimktrains2 8y ago
        Only Level 1 compliance requires an audit. Below that a remote scan of public IPs and a self-assessment is sufficient.
e12e 8y ago
Do you prosecute your friend and aqaintances for uploading pictures of you to Instagram/fb etc? Block all tracking script/pixels on the Web? Avoid using the phone in order to not generate meta-data? I'm not sure how it's "easy to avoid sharing identifiable data"?

briandear 8y ago

Are people dying from data being collected for website analytics? It’s a false dichotomy to compare the risk of DEATH from bad food safety to the annoyance of getting a targeted ad whilst enjoying an online newspaper article for which you didn’t have to pay. Elevating data obtained while surfing the internet to the level of food safety or building codes is ridiculous.

matthewmacleod 8y ago
The attitude you have here is exactly the reason why GDPR is required. Companies worldwide have consistently failed to safely store and process personal data. There are new data breaches every day. Irresponsible processing of data has a direct negative effect, and that’s not related to the idea that it’s misused for advert targeting. Minimising the incompetence we’ve seen worldwide by treating it as “just some data collected while surfing” is baffling to me.
- throwaway-hn123 8y ago
  It's even more concerning when this guy is the CEO of iCouch - "a platform for psychologists, therapists and counselors." Yeah, I don't think I'll be trusting my data to someone who doesn't believe user privacy is important.

ehsankia 8y ago

To me, asking a small developer with a site that gets a few thousands users to implement GDPR is like asking a dad to do full safety test on a toy car he built for his kid, just because a big company like GM had safety issues. The problem EU is trying to solve here are large companies like Facebook making monopolies and syphoning data. So why the hell do they have to impose rules on small hobby websites that run at a loss? There's a huge chunk of the web that is filled with niche web tools, mostly made as a hobby, running for free. I myself own 2-3 such sites. Now, I'm forced to spend my hobby time adding a bunch of new features on a site that already loses money? I'm sorry but the couple thousand people that depend on this tool will have to find someplace else I guess. HN sure loves to worry about AMP killing the internet, well to me this is far more dangerous. Can't wait for larger troll companies bullying small devs with lawsuits and killing all their competition using GDPR.

riffraff 8y ago
presumably you have laws that require street vehicles have a valid license before they can go on the road. Do you remember the police arresting someone because of a toy car they built? If not, then why do you expect the EU to go after the equivalent site with a few thousand users?
- ehsankia 8y ago
  Logically, it's very unlikely. Realistically, seeing the risk of a $20m fine, I sure as hell won't take the chance and will take down my site until the dust settles and the kinks gets ironed out.
  - somebadguy 8y ago
    Good.
- mdpopescu 8y ago
  > Do you remember the police arresting someone because of a toy car they built? Does this apply? [1] [1] http://fortune.com/2017/07/21/five-year-old-fine-lemonade-stand/ http://fortune.com/2017/07/21/five-year-old-fine-lemonade-st...

CryptoPunk 8y ago

>>But what is the alternative? Is business creation the final goal of our society? Or there are things more important? The alternative is to let consumers fend for themselves, and if government is going to help, limit that help to investigating and punishing fraud, enforcing contract law, and providing free information resources to help consumers make better informed decisions. Yes business creation should be the highest goal of society. New businesses are what counteract income inequality and drive innovation. We need innovation to solve the already existing problems in society, that claim tens of millions of lives every year. There is no zero risk path open to society.