13 ms·

I have to make two points. 1. This regulation is specifically (deliberately?) anti small business. If your revenue is less than €20m their fine is up to €20m,

by cft 8y ago

I have to make two points. 1. This regulation is specifically (deliberately?) anti small business. If your revenue is less than €20m their fine is up to €20m, i.e. can be 100% of your revenue, meaning bankruptcy. If your revenue is greater than €500m, your fine is capped at only 4% of your revenue, i.e. an acceptable fluctuation. It's worse than a regressive tax. 2. China also has many regulations. Instead if trying to extend their jurisdiction to foreign sites, they simply block them. I thought about this and I actually prefer the Chinese non-expansionist model: I would rather outsource due diligence to the Chinese government than hire expensive EU lawyers and then implement EU specific blocks. FYI we do not collect any data other than for spam and DDoS attack mitigation, but apparently if you have any third party code in your site like ads you have to subject all of that to this expensive audit. Well meaning regulation like this written by people who have never created anything pratical in their lives other than regulations illustrates why entrepreneurship in modern Europe is nearly impossible.

deleted 8y ago
[deleted]
Cacti 8y ago
> outsource due diligence to the Chinese government That is easily one of the more absurd statements I've seen this month. > Well meaning regulation like this written by people who have never created anything pratical in their lives And websites whose customers advertising agencies, and whose product is people, create something? Attempting to track and then monetize everything everyone does online is _creating_ something now?
- closeparen 8y ago
  Facilitating anything online is in GPDR scope, regardless of whether data monetization or advertising is involved.
- asadjb 8y ago
  > And websites whose customers advertising agencies, and whose product is people, create something? Attempting to track and then monetize everything everyone does online is _creating_ something now. This is snarky, and intentionally simplifies things down to a dumb level. Here's a list of things that "create something" while relying on an advertisement model for revenue: - Gmail - Facebook - YouTube - StackOverflow - Reddit (to some extent) - Yahoo - Miniclip - Neopets I can find a hundred other examples that are ad-revenue supported by create immense value. It's a difficult balance to strike, and while not perfect, this model has allowed us access to so many good services that would otherwise not exist. Saying that none of them "create something" is just wrong.
- cft 8y ago
  How about storing data for spam or DDoS mitigation? You need that data for those filters. But it's in the scope of GDPR. Do you give the spammers that data under SAR requirements, so they can improve? Or do you keep lawyers to justify denials of each request (some of them bogus?) We have done a lot of due diligence on GDRP and we don't "track or monetize" everything. Have you?
scrollaway 8y ago
> China also has many regulations. Instead if trying to extend their jurisdiction to foreign sites, they simply block them. I thought about this and I actually prefer the Chinese non-expansionist model: I would rather outsource due diligence to the Chinese government Hell of a way to defend the most absurd and overreaching displays of censorship we see on the modern web.
- netheril96 8y ago
  You miss the point. He’s saying that GDPR is worse than Chinese GFW.
  - matthewmacleod 8y ago
    They’re wrong, though.
    - paxys 8y ago
      They're not arguing about the laws themselves, but rather the implementation.
    - Noos 8y ago
      He's saying that it's safer for him for China just to block him out of their territory than for the EU to allow him and open him up to GDPR-related lawsuits. Even if the lawsuit is scurrilous or the fines a misunderstanding and can be reversed, that can be tremendous effort and anguish for a person. Often requiring years in court.
threeseed 8y ago
According to this it is up to €20m: https://www.gdpreu.org/compliance/fines-and-penalties/ https://www.gdpreu.org/compliance/fines-and-penalties/ And you prefer China's policy of censorship over the EU's policies of protecting consumer's privacy. Well that's interesting.
- cft 8y ago
  China policy is pro small business and EU is anti small business. I am pro small business, and I am against censorship. I see however historically opposite trends over the last 20 years: China is getting more free speech and is getting more pro small business, and Europe is the opposite. And it's not a coincidence. I think eventually the censorship curves of China and EU will cross. Small business friendliness curves crossed perhaps 15 years ago.
  - lovich 8y ago
    China's policy is pro China only and to suggest that they're regulations wouldn't change if Alibaba was 20 times the size of Amazon or any other reversal of size between US and Chinese companies is ridiculous. The GPDR might end up being bad regulation, but we we're already getting bad results for the average citizen. If the industry wasn't going to regulate itself, and it's hurting citizens, are governments supposed to just stand back and hope it works out for the best? Maybe in a libertarian paradise, but no national government is currently running on that paradigm Edit: also free speech != No regulations. Companies aren't people and they shouldn't be getting the same rights as people. You can't just do whatever you want to make a dollar and then try and claim free speech protections
    - briandear 8y ago
      Companies absolutely should have free speech rights. A company is a group of PEOPLE who have joined together to sell or promote a product, service, or policy. Should a union be denied freedom of speech? Because a union is a corporation as well. What about the Sierra Club? Should they be silenced? They too are a corporation. Should a teachers union be allowed to speak, but Khan Academy denied the same right? Should organizations advocating free WiFi be allowed speech, but Comcast be denied the same right? The “companies are not people” tripe being parroted since Citizens United is a naïve and dangerous road down which people are attempting to travel. At the core of the issue is the right of free association. Free association is fundamental to free speech and a free society. Profit motive is irrelevant because profit is just as valid of a goal as “better schools” or “better public policy” or whatever the cause might be.
a_bonobo 8y ago
> If your revenue is less than €20m their fine is flat €20m, As I posted elsewhere, this is NOT true. >The $20 million fine is not automatically applied. Here's a flow chart which details the process of a GDPR breach: https://40uu5c99f3a2ja7s7miveqgqu-wpengine.netdna-ssl.com/wp-content/uploads/2018/01/GDPR-fines-and-other-sanctions-how-the-sanction-mechanism-of-GDPR-will-work-in-practice-source-European-Commission-click-for-PDF.gif https://40uu5c99f3a2ja7s7miveqgqu-wpengine.netdna-ssl.com/wp... >from https://www.i-scoop.eu/gdpr/gdpr-fines-guidelines-application-penalties/ https://www.i-scoop.eu/gdpr/gdpr-fines-guidelines-applicatio...
- downandout 8y ago
  While not “automatically applied,” what part of what you linked to says they won’t use their discretion to assess the maximum penalty in most situations? What stops them?
  - mygo 8y ago
    > What stops them? Some people just accept it when someone says they won’t do something that they totally can. I know, it doesn’t really make sense. If someone tells me “well it says that we can do that if you go by what’s on paper, but we wouldn’t actually do that”, then change it so that it says on paper that you won’t, or I’m inclined to think that you totally will, because you totally can.
    - lanbanger 8y ago
      Agreed. Sounds like every employment contract I've ever read (and usually not signed).
  - a_bonobo 8y ago
    There is a set of rules that are followed when determining a fine: https://www.gdpreu.org/compliance/fines-and-penalties/ https://www.gdpreu.org/compliance/fines-and-penalties/ These rules look at whether your company has infringed before, whether you've notified the state on your own, etc. pp. The current Information Commissioner Office system has a similar system in place. Out of 17,300 cases reported in 2017, 16 resulted in a fine. Source: https://www.infosecurity-magazine.com/opinions/gdpr-timebomb-huge-fines/ https://www.infosecurity-magazine.com/opinions/gdpr-timebomb...
oldcynic 8y ago
> If your revenue is less than €20m their fine is flat €20m Rubbish, this is just spreading FUD. From the UK ICO: "It’s true we’ll have the power to impose fines much bigger than the £500,000 limit the DPA allows us. It’s also true that companies are fearful of the maximum £17 million or 4% of turnover allowed under the new law. But it’s scaremongering to suggest that we’ll be making early examples of organisations for minor infringements or that maximum fines will become the norm." Look at the track record of the UK ICO - how many small businesses and side gigs have been fined £500k? How many businesses of any type have been fined the current maximum of £500k? So where does this ludicrous assumption that everyone is always going to be hit with the maximum fine from here on in come from?
- firic 8y ago
  It's scaremongering to assume that a country would enforce the letter of the law? I am not a lawyer, how can I tell when a judge will or will not enforce a ridiculous law? After all, England almost jailed something for training their dog to give the Hitler salute or for posting something mean on Facebook.
  - kristianc 8y ago
    > After all, England almost jailed something for training their dog to give the Hitler salute or for posting something mean on Facebook. reply. He wasn't 'almost jailed' - he was fined £800. And the video involved him saying 'Gas the Jews' over and over again to his dog, to which the dog reacted.
    - firic 8y ago
      I don't know how close he was to being jailed, but Washington Post (MSM) wrote "Now it will probably land Meechan in prison." [1] [1] https://www.washingtonpost.com/amphtml/news/the-intersect/wp/2018/03/21/for-weeks-he-trained-a-dog-to-do-a-nazi-salute-the-man-was-just-convicted-of-a-hate-crime/?noredirect=on https://www.washingtonpost.com/amphtml/news/the-intersect/wp...
      - 8y ago
somberi 8y ago
A related thread that you might find useful w.r.t to anti-small business biases in GDPR. https://news.ycombinator.com/item?id=16909945 https://news.ycombinator.com/item?id=16909945
rdiddly 8y ago
Compliance is trivial and involves steps that are already best-practices anyway. You won't need to split any atoms. https://techblog.bozho.net/gdpr-practical-guide-developers/ https://techblog.bozho.net/gdpr-practical-guide-developers/ The penalty isn't meant to be something you afford. It's a penalty. (It's a feature, not a bug.) I'm having a really hard time not being sarcastic right now but compliance with the law might also end up being an economical option worth looking into. Cheaper than lawyering-up for being sued by shysters for non-compliance, and cheaper than being penalized for non-compliance. Mind you, taking whatever-it-is off the internet is fine too. I totally understand. What I don't like is all the whiny sanctimony and martyrdom. "Yes I'm taking my thing off the internet, but first I'm going to make a big deal about what a tragedy it is for the world." Um no. The fact that your thing is a "small business" means few people care about it. (Sad to say. More people care about Facebook than about you. That's why they're the big incumbent.) And it emphatically doesn't mean for example, that you're some hallowed, heroic underdog who deserves protection, especially when you won't even afford the same to your own users and their data.
- closeparen 8y ago
  >Compliance is trivial Compliance depends on how well your understanding of of a bunch of fuzzy terms like "legitimate interest," "level of security appropriate to the risk," "necessary in relation to the purposes for which they are processed," "no longer than necessary," etc. align with 28 different regulators and judiciaries. That's as far from "trivial" as it gets. Bozho.net is not a lawyer, not your lawyer, and even if here were your top-tier lawyer specialized in data privacy he wouldn't have a clue what courts were going to take these things to mean in the context of GDPR, because there aren't any judgements yet. Security and minimization standards are also about "taking into account the state of the art" - do you know what the state of the art is, and is your organization capable of implementing it? An entirely plausible outcome here is that only the most advanced engineering organizations have technology that meets these standards.
  - guitarbill 8y ago
    > the most advanced engineering organizations have technology that meets these standards. Horeshit. There is nothing advanced about storing only the data you need. However, if you've been hoarding like crazy and weighed down with technical debt, and haven't used the last two years, then yeah, might be hard. Yes, it's a new law, yes, in practice it will be defined by judgments. How is this different from any other new law, other than this one impacts IT harder? And let me guess what the alternative is: do nothing. Consider also that European law is different to US law. We draft laws and contracts in a conceptual/abstract way, whereas in the US where everything has to be exhaustive, explicit, and over-worked; just in case anybody dare sues. GDPR recognises one-size-fits-all won't work. Yes, that means it has some vague terms. Yes, you might have to show you thought about the implementation, and that you erred on the side of privacy. It's funny how everybody always talks about the maximum fines, not the other sanctions that the GDPR can impose. Guess that's just more sensational.
xg15 8y ago
> 1. This regulation is specifically (deliberately?) anti small business. If your revenue is less than €20m their fine is up to €20m, i.e. can be 100% of your revenue, meaning bankruptcy. If your revenue is greater than €500m, your fine is capped at only 4% of your revenue, i.e. an acceptable fluctuation. It's worse than a regressive tax. With the amount of creativity observable for inventing tax-avoiding business structures, I'm sure if the minimum clause weren't there, big players would quickly find a way to spread their revenue over dozens of small entities, each looking like a "small business" on paper. So I'm not sure it would be even possible to make a regulation "with teeth" that explicitly exempts small players.
s73v3r_ 8y ago
" This regulation is specifically (deliberately?) anti small business" No, it is not. "Well meaning regulation like this written by people who have never created anything pratical in their lives other than regulations illustrates why entrepreneurship in modern Europe is nearly impossible." No, it doesn't. It demonstrates that far too many "entrepreneurs" are people who want to play fast and loose with regulations, and not be held accountable for anything.
- AnimalMuppet 8y ago
  Don't think of regulation as a binary - on or off. Instead, think of it as an adjustable knob. The higher you turn the knob, the harder it becomes to (compliantly) do things. Also (if the regulations are working as they should), the less the things that people do produce bad side effects. But the "harder to do things" part mean that fewer things get done - fewer new products and services get created. As the knob goes higher, not all of the things that don't get done are things that the regulations are designed to prevent. Some are perfectly fine things, but the burden of proving it is too much for the single person tinkering in their apartment to ever try to turn their idea into releasable reality.
  - s73v3r_ 8y ago
    Sure, I agree with the knob analogy. I just don't think this puts that knob anywhere near too high. Quite frankly, if this industry was guided by ethics, most of these things would be things that companies are already doing.
    - AnimalMuppet 8y ago
      "This" (GDPR) may not. There's more than one regulation that make up "regulations", though. It's the total load that's the issue, not one directive.
      - s73v3r_ 8y ago
        I don't believe the entire load is anywhere near there, then. Also, for a lot of these things, once you have the procedures in place, maintaining compliance does not take much effort.

by cft 8y ago

deleted 8y ago

[deleted]

Cacti 8y ago

> outsource due diligence to the Chinese government That is easily one of the more absurd statements I've seen this month. > Well meaning regulation like this written by people who have never created anything pratical in their lives And websites whose customers advertising agencies, and whose product is people, create something? Attempting to track and then monetize everything everyone does online is _creating_ something now?

closeparen 8y ago
Facilitating anything online is in GPDR scope, regardless of whether data monetization or advertising is involved.
asadjb 8y ago
> And websites whose customers advertising agencies, and whose product is people, create something? Attempting to track and then monetize everything everyone does online is _creating_ something now. This is snarky, and intentionally simplifies things down to a dumb level. Here's a list of things that "create something" while relying on an advertisement model for revenue: - Gmail - Facebook - YouTube - StackOverflow - Reddit (to some extent) - Yahoo - Miniclip - Neopets I can find a hundred other examples that are ad-revenue supported by create immense value. It's a difficult balance to strike, and while not perfect, this model has allowed us access to so many good services that would otherwise not exist. Saying that none of them "create something" is just wrong.
cft 8y ago
How about storing data for spam or DDoS mitigation? You need that data for those filters. But it's in the scope of GDPR. Do you give the spammers that data under SAR requirements, so they can improve? Or do you keep lawyers to justify denials of each request (some of them bogus?) We have done a lot of due diligence on GDRP and we don't "track or monetize" everything. Have you?

scrollaway 8y ago

> China also has many regulations. Instead if trying to extend their jurisdiction to foreign sites, they simply block them. I thought about this and I actually prefer the Chinese non-expansionist model: I would rather outsource due diligence to the Chinese government Hell of a way to defend the most absurd and overreaching displays of censorship we see on the modern web.

netheril96 8y ago
You miss the point. He’s saying that GDPR is worse than Chinese GFW.
- matthewmacleod 8y ago
  They’re wrong, though.
  - paxys 8y ago
    They're not arguing about the laws themselves, but rather the implementation.
  - Noos 8y ago
    He's saying that it's safer for him for China just to block him out of their territory than for the EU to allow him and open him up to GDPR-related lawsuits. Even if the lawsuit is scurrilous or the fines a misunderstanding and can be reversed, that can be tremendous effort and anguish for a person. Often requiring years in court.

threeseed 8y ago

According to this it is up to €20m: https://www.gdpreu.org/compliance/fines-and-penalties/ https://www.gdpreu.org/compliance/fines-and-penalties/ And you prefer China's policy of censorship over the EU's policies of protecting consumer's privacy. Well that's interesting.

cft 8y ago
China policy is pro small business and EU is anti small business. I am pro small business, and I am against censorship. I see however historically opposite trends over the last 20 years: China is getting more free speech and is getting more pro small business, and Europe is the opposite. And it's not a coincidence. I think eventually the censorship curves of China and EU will cross. Small business friendliness curves crossed perhaps 15 years ago.
- lovich 8y ago
  China's policy is pro China only and to suggest that they're regulations wouldn't change if Alibaba was 20 times the size of Amazon or any other reversal of size between US and Chinese companies is ridiculous. The GPDR might end up being bad regulation, but we we're already getting bad results for the average citizen. If the industry wasn't going to regulate itself, and it's hurting citizens, are governments supposed to just stand back and hope it works out for the best? Maybe in a libertarian paradise, but no national government is currently running on that paradigm Edit: also free speech != No regulations. Companies aren't people and they shouldn't be getting the same rights as people. You can't just do whatever you want to make a dollar and then try and claim free speech protections
  - briandear 8y ago
    Companies absolutely should have free speech rights. A company is a group of PEOPLE who have joined together to sell or promote a product, service, or policy. Should a union be denied freedom of speech? Because a union is a corporation as well. What about the Sierra Club? Should they be silenced? They too are a corporation. Should a teachers union be allowed to speak, but Khan Academy denied the same right? Should organizations advocating free WiFi be allowed speech, but Comcast be denied the same right? The “companies are not people” tripe being parroted since Citizens United is a naïve and dangerous road down which people are attempting to travel. At the core of the issue is the right of free association. Free association is fundamental to free speech and a free society. Profit motive is irrelevant because profit is just as valid of a goal as “better schools” or “better public policy” or whatever the cause might be.

a_bonobo 8y ago

> If your revenue is less than €20m their fine is flat €20m, As I posted elsewhere, this is NOT true. >The $20 million fine is not automatically applied. Here's a flow chart which details the process of a GDPR breach: https://40uu5c99f3a2ja7s7miveqgqu-wpengine.netdna-ssl.com/wp-content/uploads/2018/01/GDPR-fines-and-other-sanctions-how-the-sanction-mechanism-of-GDPR-will-work-in-practice-source-European-Commission-click-for-PDF.gif https://40uu5c99f3a2ja7s7miveqgqu-wpengine.netdna-ssl.com/wp... >from https://www.i-scoop.eu/gdpr/gdpr-fines-guidelines-application-penalties/ https://www.i-scoop.eu/gdpr/gdpr-fines-guidelines-applicatio...

downandout 8y ago
While not “automatically applied,” what part of what you linked to says they won’t use their discretion to assess the maximum penalty in most situations? What stops them?
- mygo 8y ago
  > What stops them? Some people just accept it when someone says they won’t do something that they totally can. I know, it doesn’t really make sense. If someone tells me “well it says that we can do that if you go by what’s on paper, but we wouldn’t actually do that”, then change it so that it says on paper that you won’t, or I’m inclined to think that you totally will, because you totally can.
  - lanbanger 8y ago
    Agreed. Sounds like every employment contract I've ever read (and usually not signed).
- a_bonobo 8y ago
  There is a set of rules that are followed when determining a fine: https://www.gdpreu.org/compliance/fines-and-penalties/ https://www.gdpreu.org/compliance/fines-and-penalties/ These rules look at whether your company has infringed before, whether you've notified the state on your own, etc. pp. The current Information Commissioner Office system has a similar system in place. Out of 17,300 cases reported in 2017, 16 resulted in a fine. Source: https://www.infosecurity-magazine.com/opinions/gdpr-timebomb-huge-fines/ https://www.infosecurity-magazine.com/opinions/gdpr-timebomb...

oldcynic 8y ago

> If your revenue is less than €20m their fine is flat €20m Rubbish, this is just spreading FUD. From the UK ICO: "It’s true we’ll have the power to impose fines much bigger than the £500,000 limit the DPA allows us. It’s also true that companies are fearful of the maximum £17 million or 4% of turnover allowed under the new law. But it’s scaremongering to suggest that we’ll be making early examples of organisations for minor infringements or that maximum fines will become the norm." Look at the track record of the UK ICO - how many small businesses and side gigs have been fined £500k? How many businesses of any type have been fined the current maximum of £500k? So where does this ludicrous assumption that everyone is always going to be hit with the maximum fine from here on in come from?

firic 8y ago
It's scaremongering to assume that a country would enforce the letter of the law? I am not a lawyer, how can I tell when a judge will or will not enforce a ridiculous law? After all, England almost jailed something for training their dog to give the Hitler salute or for posting something mean on Facebook.
- kristianc 8y ago
  > After all, England almost jailed something for training their dog to give the Hitler salute or for posting something mean on Facebook. reply. He wasn't 'almost jailed' - he was fined £800. And the video involved him saying 'Gas the Jews' over and over again to his dog, to which the dog reacted.
  - firic 8y ago
    I don't know how close he was to being jailed, but Washington Post (MSM) wrote "Now it will probably land Meechan in prison." [1] [1] https://www.washingtonpost.com/amphtml/news/the-intersect/wp/2018/03/21/for-weeks-he-trained-a-dog-to-do-a-nazi-salute-the-man-was-just-convicted-of-a-hate-crime/?noredirect=on https://www.washingtonpost.com/amphtml/news/the-intersect/wp...
    - 8y ago

somberi 8y ago

A related thread that you might find useful w.r.t to anti-small business biases in GDPR. https://news.ycombinator.com/item?id=16909945 https://news.ycombinator.com/item?id=16909945

rdiddly 8y ago

Compliance is trivial and involves steps that are already best-practices anyway. You won't need to split any atoms. https://techblog.bozho.net/gdpr-practical-guide-developers/ https://techblog.bozho.net/gdpr-practical-guide-developers/ The penalty isn't meant to be something you afford. It's a penalty. (It's a feature, not a bug.) I'm having a really hard time not being sarcastic right now but compliance with the law might also end up being an economical option worth looking into. Cheaper than lawyering-up for being sued by shysters for non-compliance, and cheaper than being penalized for non-compliance. Mind you, taking whatever-it-is off the internet is fine too. I totally understand. What I don't like is all the whiny sanctimony and martyrdom. "Yes I'm taking my thing off the internet, but first I'm going to make a big deal about what a tragedy it is for the world." Um no. The fact that your thing is a "small business" means few people care about it. (Sad to say. More people care about Facebook than about you. That's why they're the big incumbent.) And it emphatically doesn't mean for example, that you're some hallowed, heroic underdog who deserves protection, especially when you won't even afford the same to your own users and their data.

closeparen 8y ago
>Compliance is trivial Compliance depends on how well your understanding of of a bunch of fuzzy terms like "legitimate interest," "level of security appropriate to the risk," "necessary in relation to the purposes for which they are processed," "no longer than necessary," etc. align with 28 different regulators and judiciaries. That's as far from "trivial" as it gets. Bozho.net is not a lawyer, not your lawyer, and even if here were your top-tier lawyer specialized in data privacy he wouldn't have a clue what courts were going to take these things to mean in the context of GDPR, because there aren't any judgements yet. Security and minimization standards are also about "taking into account the state of the art" - do you know what the state of the art is, and is your organization capable of implementing it? An entirely plausible outcome here is that only the most advanced engineering organizations have technology that meets these standards.
- guitarbill 8y ago
  > the most advanced engineering organizations have technology that meets these standards. Horeshit. There is nothing advanced about storing only the data you need. However, if you've been hoarding like crazy and weighed down with technical debt, and haven't used the last two years, then yeah, might be hard. Yes, it's a new law, yes, in practice it will be defined by judgments. How is this different from any other new law, other than this one impacts IT harder? And let me guess what the alternative is: do nothing. Consider also that European law is different to US law. We draft laws and contracts in a conceptual/abstract way, whereas in the US where everything has to be exhaustive, explicit, and over-worked; just in case anybody dare sues. GDPR recognises one-size-fits-all won't work. Yes, that means it has some vague terms. Yes, you might have to show you thought about the implementation, and that you erred on the side of privacy. It's funny how everybody always talks about the maximum fines, not the other sanctions that the GDPR can impose. Guess that's just more sensational.

xg15 8y ago

> 1. This regulation is specifically (deliberately?) anti small business. If your revenue is less than €20m their fine is up to €20m, i.e. can be 100% of your revenue, meaning bankruptcy. If your revenue is greater than €500m, your fine is capped at only 4% of your revenue, i.e. an acceptable fluctuation. It's worse than a regressive tax. With the amount of creativity observable for inventing tax-avoiding business structures, I'm sure if the minimum clause weren't there, big players would quickly find a way to spread their revenue over dozens of small entities, each looking like a "small business" on paper. So I'm not sure it would be even possible to make a regulation "with teeth" that explicitly exempts small players.

s73v3r_ 8y ago

" This regulation is specifically (deliberately?) anti small business" No, it is not. "Well meaning regulation like this written by people who have never created anything pratical in their lives other than regulations illustrates why entrepreneurship in modern Europe is nearly impossible." No, it doesn't. It demonstrates that far too many "entrepreneurs" are people who want to play fast and loose with regulations, and not be held accountable for anything.

AnimalMuppet 8y ago
Don't think of regulation as a binary - on or off. Instead, think of it as an adjustable knob. The higher you turn the knob, the harder it becomes to (compliantly) do things. Also (if the regulations are working as they should), the less the things that people do produce bad side effects. But the "harder to do things" part mean that fewer things get done - fewer new products and services get created. As the knob goes higher, not all of the things that don't get done are things that the regulations are designed to prevent. Some are perfectly fine things, but the burden of proving it is too much for the single person tinkering in their apartment to ever try to turn their idea into releasable reality.
- s73v3r_ 8y ago
  Sure, I agree with the knob analogy. I just don't think this puts that knob anywhere near too high. Quite frankly, if this industry was guided by ethics, most of these things would be things that companies are already doing.
  - AnimalMuppet 8y ago
    "This" (GDPR) may not. There's more than one regulation that make up "regulations", though. It's the total load that's the issue, not one directive.
    - s73v3r_ 8y ago
      I don't believe the entire load is anywhere near there, then. Also, for a lot of these things, once you have the procedures in place, maintaining compliance does not take much effort.