6 ms·

Probably not. I really have mixed emotions about GDPR being a SaaS founder. It seems overstepping and heavy handed that the EU can enact laws that affect Americ

Probably not. I really have mixed emotions about GDPR being a SaaS founder. It seems overstepping and heavy handed that the EU can enact laws that affect American's and American companies. The EU can do what it wants, but generally I am against regulation as it promotes bureaucracy, stifles innovation, and creates fluff and burden's especially on small companies such Chief Data Protection Officer and Chief Data Officer.

PirateBay 8y ago
It's not over stepping. Don't like the laws? Don't do business there. States in the US have different laws that affect operating businesses in them, too.
- Mandatum 8y ago
  Funnily enough I operate a service to download copyright-expired content.. Only most of the content is still under copyright in the US. Early Elvis works seem to be very popular. I've banned all non-local IP addresses from the website with a splash page which tells them why they're unable to access content. This also doesn't stop my local ISP's and hosts eventually giving up on hosting my content as they're sick of reviewing DMCA's from US-based copyright-holders. Many of the smaller ones simply give me 24 hours notice or no notice at all, nobody wants to risk a lawsuit from the big-bad US media companies. I get several hundred letters and emails a year with copyright holders threatening lawsuits and legal action. I suspect similar issues will arise for non-GDPR compliant services in the form of user support tickets.
  - tripletao 8y ago
    Isn't "webhosts that cheerfully ignore DMCA complaints" a large, well-established industry?
    - Mandatum 8y ago
      Not in my country, and I have no intention of hosting this outside these borders which could get me in legal hot water.
      - tripletao 8y ago
        For curiosity, where are you? Are you unable to find a DMCA-proof server in a country where your content would also be legal, or is there a different problem?
        Mandatum 8y ago
        It's a different problem - I'm part of the Commonwealth. I could host it in a country that would ignore requests, but the point of the website is to do everything correctly. If I hosted my content in a country that doesn't care about copyright or DMCA, I'm putting myself at risk if I was brought into court as I've purposefully skirted around laws. My country has proven we are held to US copyright law - see the Kim DotCom case. What would usually be considered a matter for civil court was brought into criminal court because it crossed borders and unfounded claims were made against the accused (namely money laundering) who's now being extradited. I simply want to provide a free, legal media service to those in my country. There's no money in it - I don't even run AdSense, I simply pay for hosting. So far, so good. If I do get dragged into court, I expect a precedence to be set for future cases. This will also open up a lot of free historical media for government-run TV and streaming services, and local media producers. It's kind of like a weird tech protest against goofy copyright laws.
        tripletao 8y ago
        But does US law actually require you to respond to the DMCA notice? Like, the provider loses its safe harbor, but if there's no violation of US copyright law then why does that matter? That's perhaps a different test case from the one that you intend, of course...
        Mandatum 8y ago
deleted 8y ago
[deleted]
mholt 8y ago
This also bothers me a lot. I've always wondered how the EU intends to enforce its laws upon my little side projects here in the US.
- BLanen 8y ago
  >I've always wondered how the EU intends to enforce its laws upon my little side projects here in the US. It doesn't. It's made to force you to comply when you become bigger.
  - mholt 8y ago
    So it has clauses about project/service/product size/popularity?
    - dangrossman 8y ago
      In fact, yes. For example, the record-keeping requirements don't apply to most businesses with less than 250 employees. The DPO requirements don't apply to most businesses with less than 250 employees. The entire regulation doesn't apply if you don't target people in the EU and don't offer goods or services to people in the EU. Some of the requirements only apply if you process data on large numbers of people regularly, rather than occasionally. And there's a recital calling on member states that enact and enforce the regulation to pay special attention to the unique needs of micro, small and medium sized businesses.
      - cimmanom 8y ago
        DPO?
        bkanber 8y ago
        Data Protection Officer. There are a few situations where you MUST assign a DPO (large company, or systemic monitoring or processing of data, or processing of protected data). If you're talking about a tiny side project with basic data protection and you're not doing social scraping, GDPR will likely ignore you.
astro_robot 8y ago
This bothers me a lot as well. The EU shouldn't have domain over American companies. There's a reason that there isn't a ton of Tech companies in places like Germany.
- BLanen 8y ago
  They don't have domain over American companies. Just don't accept European customer's data and you're fine.
  - panarky 8y ago
    I'm not a citizen of Pakistan. I don't live in Pakistan. My servers aren't in Pakistan. Pakistan can't force me to comply with their laws just because a Pakistani national uses my site. Same thing with EU laws.
    - roddds 8y ago
      If you want to do business in Pakistan you do.
      - panarky 8y ago
        I'm not doing business in Pakistan or in the EU. The mere fact that a Pakistani or European uses my site doesn't subject me to the laws of Pakistan or the European Union.
        marak830 8y ago
        The fact that they are using your site means you are doing business with them.
        dzelzs 8y ago
        You know, same could be said for the US, but look how that turned out for Kim Dotcom. Extradition and humongous expenses for him - all because people in a country that was unrelated to the site decided to break their copyright rules and use it :).
tehabe 8y ago
Demanding privacy is not overstepping it is consumer protection. The consumer need to rely that you treat their data responsibly and the GDPR is a rule book what you need to do. And yes, this rule book knows sanctions.
DanBC 8y ago
> It seems overstepping and heavy handed that the EU can enact laws that affect American's and American companies. Unlike eg Kinder Eggs? https://www.cbp.gov/newsroom/national-media-release/dont-be-surprised-kinder-eggs-seizures-double https://www.cbp.gov/newsroom/national-media-release/dont-be-...

PirateBay 8y ago

It's not over stepping. Don't like the laws? Don't do business there. States in the US have different laws that affect operating businesses in them, too.

Mandatum 8y ago
Funnily enough I operate a service to download copyright-expired content.. Only most of the content is still under copyright in the US. Early Elvis works seem to be very popular. I've banned all non-local IP addresses from the website with a splash page which tells them why they're unable to access content. This also doesn't stop my local ISP's and hosts eventually giving up on hosting my content as they're sick of reviewing DMCA's from US-based copyright-holders. Many of the smaller ones simply give me 24 hours notice or no notice at all, nobody wants to risk a lawsuit from the big-bad US media companies. I get several hundred letters and emails a year with copyright holders threatening lawsuits and legal action. I suspect similar issues will arise for non-GDPR compliant services in the form of user support tickets.
- tripletao 8y ago
  Isn't "webhosts that cheerfully ignore DMCA complaints" a large, well-established industry?
  - Mandatum 8y ago
    Not in my country, and I have no intention of hosting this outside these borders which could get me in legal hot water.
    - tripletao 8y ago
      For curiosity, where are you? Are you unable to find a DMCA-proof server in a country where your content would also be legal, or is there a different problem?
      - Mandatum 8y ago
        It's a different problem - I'm part of the Commonwealth. I could host it in a country that would ignore requests, but the point of the website is to do everything correctly. If I hosted my content in a country that doesn't care about copyright or DMCA, I'm putting myself at risk if I was brought into court as I've purposefully skirted around laws. My country has proven we are held to US copyright law - see the Kim DotCom case. What would usually be considered a matter for civil court was brought into criminal court because it crossed borders and unfounded claims were made against the accused (namely money laundering) who's now being extradited. I simply want to provide a free, legal media service to those in my country. There's no money in it - I don't even run AdSense, I simply pay for hosting. So far, so good. If I do get dragged into court, I expect a precedence to be set for future cases. This will also open up a lot of free historical media for government-run TV and streaming services, and local media producers. It's kind of like a weird tech protest against goofy copyright laws.
        tripletao 8y ago
        But does US law actually require you to respond to the DMCA notice? Like, the provider loses its safe harbor, but if there's no violation of US copyright law then why does that matter? That's perhaps a different test case from the one that you intend, of course...
        Mandatum 8y ago

deleted 8y ago

[deleted]

mholt 8y ago

This also bothers me a lot. I've always wondered how the EU intends to enforce its laws upon my little side projects here in the US.

BLanen 8y ago
>I've always wondered how the EU intends to enforce its laws upon my little side projects here in the US. It doesn't. It's made to force you to comply when you become bigger.
- mholt 8y ago
  So it has clauses about project/service/product size/popularity?
  - dangrossman 8y ago
    In fact, yes. For example, the record-keeping requirements don't apply to most businesses with less than 250 employees. The DPO requirements don't apply to most businesses with less than 250 employees. The entire regulation doesn't apply if you don't target people in the EU and don't offer goods or services to people in the EU. Some of the requirements only apply if you process data on large numbers of people regularly, rather than occasionally. And there's a recital calling on member states that enact and enforce the regulation to pay special attention to the unique needs of micro, small and medium sized businesses.
    - cimmanom 8y ago
      DPO?
      - bkanber 8y ago
        Data Protection Officer. There are a few situations where you MUST assign a DPO (large company, or systemic monitoring or processing of data, or processing of protected data). If you're talking about a tiny side project with basic data protection and you're not doing social scraping, GDPR will likely ignore you.

astro_robot 8y ago

This bothers me a lot as well. The EU shouldn't have domain over American companies. There's a reason that there isn't a ton of Tech companies in places like Germany.

BLanen 8y ago
They don't have domain over American companies. Just don't accept European customer's data and you're fine.
- panarky 8y ago
  I'm not a citizen of Pakistan. I don't live in Pakistan. My servers aren't in Pakistan. Pakistan can't force me to comply with their laws just because a Pakistani national uses my site. Same thing with EU laws.
  - roddds 8y ago
    If you want to do business in Pakistan you do.
    - panarky 8y ago
      I'm not doing business in Pakistan or in the EU. The mere fact that a Pakistani or European uses my site doesn't subject me to the laws of Pakistan or the European Union.
      - marak830 8y ago
        The fact that they are using your site means you are doing business with them.
        dzelzs 8y ago
        You know, same could be said for the US, but look how that turned out for Kim Dotcom. Extradition and humongous expenses for him - all because people in a country that was unrelated to the site decided to break their copyright rules and use it :).

tehabe 8y ago

Demanding privacy is not overstepping it is consumer protection. The consumer need to rely that you treat their data responsibly and the GDPR is a rule book what you need to do. And yes, this rule book knows sanctions.

DanBC 8y ago

> It seems overstepping and heavy handed that the EU can enact laws that affect American's and American companies. Unlike eg Kinder Eggs? https://www.cbp.gov/newsroom/national-media-release/dont-be-surprised-kinder-eggs-seizures-double https://www.cbp.gov/newsroom/national-media-release/dont-be-...