28 ms·

From the description Streetlend didn’t violate the GDPR in concept though. Addresses are public record, available in public databases, and there is nothing stop

From the description Streetlend didn’t violate the GDPR in concept though. Addresses are public record, available in public databases, and there is nothing stopping you from doing lending eBay. All it needed to do was clear it’s records every 6 months and let people delete their accounts. Except this isn’t really true. Streetlend made its money by selling your privacy data to advertisers through Amazon. So when you put up a power drill for lend, people would see power drills for sale at local shops, based on their online presence harvested through stuff like their Facebook account. The really ironic thing about that this is that streetlab imagined itself “ethical” when it’s entire business model was selling your data... The GDPR isn’t really that hostile to small business and it doesn’t require an understanding of law. You can hire a data protection officer at a legal firm for almost nothing, and as long as you follow their advice on how to pass audits, you’re really not in trouble. That being said, the GDPR is really hostile toward startups trying to make money the same way Facebook and Google does. You need to have a massive legal department to do that, and Streetlend obviously did not. But is that really so terrible? It may call for a new business model for the internet, and that may seem impossible right now. But do you remember when the EU outlawed environmentally shitty lightbuilbs and everyone said we were going dark because it was impossible to do anything else? Today 95% of lightbuilbs are LEDs because of that. Startups will find a way to make money that isn’t selling your data.

tchock23 8y ago
Could you share the name of a legal firm charging ‘almost nothing’ for a data protection officer? Because the ones I’m finding definitely cost more than ‘almost nothing.’
_o_ 8y ago
Unfortunately there is no more site to prove it, but I would imagine something like this. GDPR on its own shouldn't be a problem for Streetlend, there was something more, users data releated and how to make money off them.
yellow_postit 8y ago
The massive legal team part is indeed the problem as it further entrenches Facebook and Google from competition in that space.
- bonesss 8y ago
  A couple moments though: Google and Facebooks manoeuvring to adapt to the GDPR give a clear road map of the legal requirements. Bluntly, they're not that bad, and they're better for a new startup who can adapt to them from the ground up than an established venture who has to find new ways to make money. The reporting requirements of the GDPR can be large, but for most companies most of the time you're dealing with a relatively unchallenging piece of legislation. Most of the requirements are just to be able to explain what happens with user data and handle sporadic deletion requests. Loosely connected, separately stored, IDs are the solution to this (pseudonymization). It's a different style of development, but far from tricky. That's systems development, not legal. This is a legitimate threat to startups reselling user data and overly friendly web-tracking solutions, yeah. To them I say "boo-hoo". For the rest of us? IT regulation with legal teeth is a promising indicator for IT companies. There are more of "them" than there are of "us", and if our legal issues are getting play that means our salesmen will also get play.
  - T2_t2 8y ago
    > for most companies most of the time I know you didn't intend to, but you've nailed the problem: the ambiguity and doubt. Most (<100%) * most (<100%) is a fraction times a fraction, never a good equation if the upside is low. I doubt the StreetLend dude made much cash out of this project, so why bother? It was likely just a convenient excuse to kill a side project that had little value that sucked a lot of time, but still, the ambiguity no doubt helped push him towards this outcome.
    - ben_w 8y ago
      The penalties for noncompliance are supposed to be “effective, proportionate and dissuasive”, and can start off with warnings. The law only has the headline figures as upper limits (plus damages, IIUC). This doesn’t feel particularly onerous, especially as any good business plan will include getting public liability insurance for inevitable occasional serious mistakes.
cft 8y ago
Here in the US you mostly see fluorescent energy saving bulbs, even though incandescent bulbs are widely available in the pharmacies and in the supermarkets. And that is because they are cheaper to operate: the market decided that, rather than a regulator. >Startups will find a way to make money that isn’t selling your data. It's hard to argue with statements like that. What if they don't? There are plenty of startups providing extremely valuable or fun services (like flightradar24 for example) that are supported by ads. After GM, Ford and Chrystler there were basically no successful auto startups in the US for 70 years. This regulation makes life for startups disproportionately harder than for Google and FB that already have an army of EU lawyers on payroll.
- deleted 8y ago
  [deleted]
- dnomad 8y ago
  > And that is because they are cheaper to operate: the market decided that, rather than a regulator. This is not true. The US has parallel regulation that encourages the phase out of incandescent bulbs [1]. True to form it's a lot weaker than the EU regulation but it sends the same message. > This regulation makes life for startups disproportionately harder than for Google and FB that already have an army of EU lawyers on payroll. This is not true. In fact the GDPR makes it clear that for small businesses (<250 employees) most of the control burden is relieved. [1] https://www.epa.gov/cfl/how-energy-independence-and-security-act-2007-affects-light-bulbs https://www.epa.gov/cfl/how-energy-independence-and-security...
  - makomk 8y ago
    Both the US and EU regulations were widely flouted; it was easy to get incandescent bulbs in practice. There's actually one in the room I'm in now for the simple reason that getting any other kind of bulb to work with dimmers was a nightmare; until a year or so ago, nearly all the dimmers sold in the UK were designed for incandescent bulbs only. The EU had, and still has, no interest in actually fixing this. Instead of making LED bulbs more practical to use they plan to crack down even more strictly on the alternatives, including new efficiency restrictions that effectively ban most stage lighting used by theatres and concerts.
tobltobs 8y ago
> You can hire a data protection officer at a legal firm for almost nothing, Failed reality check.
- simonswords82 8y ago
  Thank you for highlighting this gross misinformation. A Data Protection Officer, especially from a law firm, is not in any way imaginable "almost nothing" regards the cost.
  - astura 8y ago
    Especially when Streetlends is literally already operating at a loss. I can't imagine it's a cost less than five figures.
  - leesalminen 8y ago
    Seriously. What world does this person live in? When I think “lawyer”, “almost nothing” isn’t the first thing that comes to mind.
return1 8y ago
> the EU outlawed environmentally shitty lightbuilbs when did that happen?
- dvfjsdhgfv 8y ago
  https://en.wikipedia.org/wiki/Phase-out_of_incandescent_light_bulbs#European_Union https://en.wikipedia.org/wiki/Phase-out_of_incandescent_ligh...
  - deleted 8y ago
    [deleted]
cbeach 8y ago
> Except this isn’t really true. Streetlend made its money by selling your privacy data to advertisers through Amazon. So when you put up a power drill for lend, people would see power drills for sale at local shops, based on their online presence harvested through stuff like their Facebook account. Founder here. Streetlend never passed personal data to Amazon. It used the search term eg “ladder” and showed ladders on sale from Amazon. No personal data was passed.
- annabellish 8y ago
  Then what's the problem? I have to be honest here, this smells far more of FUD than anything based in reality. Nothing in the linked post is talking about anything which the GDPR makes harder. Unless you're doing something shady with user data (and you _know_ if you are) the GDPR essentially comprises having _some way_ of giving a user all the data you store on them, and _some way_ of deleting that data. In this case both of those appear trivial to automate, and even more trivial to just do if somebody actually wants those things. Shit, dropping email login and only accepting federated auth would get you there in one step, unless you're doing things you're not saying.
  - syshum 8y ago
    >>>Then what's the problem? Clearly you have no understanding of any legal system in the world works if you believe only people that are guilty of violating the law are sued and ruined by the law.
    - annabellish 8y ago
      So should we... not have laws? I don't understand this point, why is that any more true for the GDPR than any other law?
      - omginternets 8y ago
        >why is that any more true for the GDPR than any other law? Because the GDPR is extraordinarily ambiguous.
kk_cz 8y ago
so is every site that uses affilate links selling your data? I didn't see anything else mentioned in the description.
hartator 8y ago
> The GDPR isn’t really that hostile to small business and it doesn’t require an understanding of law. You can hire a data protection officer at a legal firm for almost nothing, and as long as you follow their advice on how to pass audits, you’re really not in trouble. So many contradictions in one paragraph.
- misja111 8y ago
  This. GDPR is a huge burden for small companies. The extra work for implementing the new GDPR requirements can completely halt any new development if you only have a small team of developers. For big companies the workload is relatively much smaller.
  - kahnpro 8y ago
    If your business model is based on something that will violate the GDPR, like streetlend selling user data to advertisers, then should you really be opening that business in the first place?
    - tchock23 8y ago
      What about small companies that don’t sell data as a business model? GDPR punishes the vast majority of businesses that do not have business models reliant on selling user data in favor of trying to catch the ones that do. Unfortunately, I fear this regulation will do absolutely nothing to stop the bad actors from selling data as they do now.
    - TheRealPomax 8y ago
      Other way around. This business was opened half a decade ago, with users being perfectly fine with it (or it wouldn't have stuck around). The GDPR on the other hand has flown under the radar and only suddenly became a thing that service providers (generic "service", not "internet service providers") were made aware of in legal context. So if we're raising eyebrows, it's at the EU and the GDPR. Not at sites that have operated to user's satisfaction for five+ years.
stef25 8y ago
> Streetlend made its money by selling your privacy data to advertisers through Amazon. So when you put up a power drill for lend, people would see power drills for sale at local shops, based on their online presence harvested through stuff like their Facebook account. If you mean he just slapped some Amazon ads on his site to support his side project, then accusing that guy of "selling your privacy data" requires quite a bit of mental gymnastics and is a pretty dishonest description of the facts. The blame here is wholly with the users for putting their data online in the first place (really, you can go a very long way with my.fake.name@gmail.com!) and especially Facebook for providing the framework that enables this all. *edited for grammar
- rtpg 8y ago
  If Amazon and FB make unethical tracking tools and you put them on the website, you are most definitely an accomplice to their acts. "But it's such a small site/ the person's side project" all the more reason to stay away from this. Having a code of ethics where you end up using the most profitable option anyways is not a real code of ethics The point of ethical judgement is that it's _not_ the best choice by other factors
  - stef25 8y ago
    How do you go from Amazon ads for ladders to unethical tracking tool? He's not making a profit. Meaning he's actually paying out of pocket to allow neighbours to lend stuff to each other. Yet he's abandoned his code of ethics?
    - megaman22 8y ago
      It's mind-boggling that people are trying to cast some Amazon affiliate links into a nefarious invasion of privacy. On the advertising scale, from 1 to late-90s, I'm-probably-going-to-catch-a-virus-from-a-shady-ActiveX-component, this is maybe a two.
      - s73v3r_ 8y ago
Trundle 8y ago
>almost nothing Yeah, I'll just get a small loan from my father.
Illniyar 8y ago
If what it says on the blog is correct then he is using affiliate links for amazon for similar products to what you search. At it's core it is the most ethical a free service can make money (aside from donations). He isn't selling the data or showing personally targeted ads. (Of course it could be using some amazon plugin that does it anyway for convenience or from ignorance, but he can do it without it through amazon apis)
richardknop 8y ago
>> You can hire a data protection officer at a legal firm for almost nothing What? Define almost nothing. For small businesses it is a wishful thinking they can hire anybody from a legal firm. They probably don't even have a lawyer or a legal department as they can't afford such luxury.
tomxor 8y ago
> But do you remember when the EU outlawed environmentally shitty lightbuilbs and everyone said we were going dark because it was impossible to do anything else? Today 95% of lightbuilbs are LEDs because of that. And now we are finding out LED lights are bad for our eyes and our sleep, so we may go blind sooner and die sooner. Ok that might be a bit extreme, and besides there is an efficient incandescent tech that will probably come back and save us (and you can argue the EU helped that too)... but my point is the EU has good intents but their creations seem polarised into either extremely preemptive or extremely reflexive and are often premature and poorly thought out, fighting for something for the people but often without thought for how they will directly hurt the people. For tech the EU isn't exactly unique in this respect though, the UK for instance recently tried to inact some pretty rediculous laws that undermine basic technologies that make the internet work.
jboogie77 8y ago
“can hire a data protection officer at a legal firm for almost nothing” Out of touch with reality much?
smileypete 8y ago
Ugh, sorry but no, the EU can't claim any credit for the success of LED lightbulbs. They can take some credit for the dim and dimmer mercury containing CFLs, and the ludicrously expensive and somewhat unreliable early LEDs, if they like.
Lapsed 8y ago
I think your misunderstanding how his site worked. Where did you get that it sold private data to Amazon?
chiefalchemist 8y ago
> You said: "From the description Streetlend didn’t violate the GDPR in concept though. Addresses are public record, available in public databases, and there is nothing stopping you from doing lending eBay. All it needed to do was clear it’s records every 6 months and let people delete their accounts." > But the comment you commented on said: "The problem is what happens if a legal firm or an agency targets you. Even if you adhered to the spirit of the law, they can dig up evidence that you didn't obey the letter of the law (since GDPR is quite loose and ambiguous)." The issue seems to be that the resources required to resolve a delta - from Streetlend's pov - are perceived as excessive. Too much risk; not enough reward. Look at what happened with Thiel and Gawker. Right or wrong is irrelevant if the opposition has deeper pockets and can bleed you to death (in legal fees). > Startups will find a way to make money that isn’t selling your data. Perhaps, that could be true. But plenty will not want to be caught in the crossfire in the meantime. And that too is a biz decision.
sabarn01 8y ago
You have to identify your data class which takes a lawyer. You have to assure that no data is held longer than 48 hours even telemetry without providing an export and delete function. You have to support level 4 data requests which will take a lawyer. Just like all regulation its very doable but its way more cost effective for the big players.

tchock23 8y ago

Could you share the name of a legal firm charging ‘almost nothing’ for a data protection officer? Because the ones I’m finding definitely cost more than ‘almost nothing.’

_o_ 8y ago

Unfortunately there is no more site to prove it, but I would imagine something like this. GDPR on its own shouldn't be a problem for Streetlend, there was something more, users data releated and how to make money off them.

yellow_postit 8y ago

The massive legal team part is indeed the problem as it further entrenches Facebook and Google from competition in that space.

bonesss 8y ago
A couple moments though: Google and Facebooks manoeuvring to adapt to the GDPR give a clear road map of the legal requirements. Bluntly, they're not that bad, and they're better for a new startup who can adapt to them from the ground up than an established venture who has to find new ways to make money. The reporting requirements of the GDPR can be large, but for most companies most of the time you're dealing with a relatively unchallenging piece of legislation. Most of the requirements are just to be able to explain what happens with user data and handle sporadic deletion requests. Loosely connected, separately stored, IDs are the solution to this (pseudonymization). It's a different style of development, but far from tricky. That's systems development, not legal. This is a legitimate threat to startups reselling user data and overly friendly web-tracking solutions, yeah. To them I say "boo-hoo". For the rest of us? IT regulation with legal teeth is a promising indicator for IT companies. There are more of "them" than there are of "us", and if our legal issues are getting play that means our salesmen will also get play.
- T2_t2 8y ago
  > for most companies most of the time I know you didn't intend to, but you've nailed the problem: the ambiguity and doubt. Most (<100%) * most (<100%) is a fraction times a fraction, never a good equation if the upside is low. I doubt the StreetLend dude made much cash out of this project, so why bother? It was likely just a convenient excuse to kill a side project that had little value that sucked a lot of time, but still, the ambiguity no doubt helped push him towards this outcome.
  - ben_w 8y ago
    The penalties for noncompliance are supposed to be “effective, proportionate and dissuasive”, and can start off with warnings. The law only has the headline figures as upper limits (plus damages, IIUC). This doesn’t feel particularly onerous, especially as any good business plan will include getting public liability insurance for inevitable occasional serious mistakes.

cft 8y ago

Here in the US you mostly see fluorescent energy saving bulbs, even though incandescent bulbs are widely available in the pharmacies and in the supermarkets. And that is because they are cheaper to operate: the market decided that, rather than a regulator. >Startups will find a way to make money that isn’t selling your data. It's hard to argue with statements like that. What if they don't? There are plenty of startups providing extremely valuable or fun services (like flightradar24 for example) that are supported by ads. After GM, Ford and Chrystler there were basically no successful auto startups in the US for 70 years. This regulation makes life for startups disproportionately harder than for Google and FB that already have an army of EU lawyers on payroll.

deleted 8y ago
[deleted]
dnomad 8y ago
> And that is because they are cheaper to operate: the market decided that, rather than a regulator. This is not true. The US has parallel regulation that encourages the phase out of incandescent bulbs [1]. True to form it's a lot weaker than the EU regulation but it sends the same message. > This regulation makes life for startups disproportionately harder than for Google and FB that already have an army of EU lawyers on payroll. This is not true. In fact the GDPR makes it clear that for small businesses (<250 employees) most of the control burden is relieved. [1] https://www.epa.gov/cfl/how-energy-independence-and-security-act-2007-affects-light-bulbs https://www.epa.gov/cfl/how-energy-independence-and-security...
- makomk 8y ago
  Both the US and EU regulations were widely flouted; it was easy to get incandescent bulbs in practice. There's actually one in the room I'm in now for the simple reason that getting any other kind of bulb to work with dimmers was a nightmare; until a year or so ago, nearly all the dimmers sold in the UK were designed for incandescent bulbs only. The EU had, and still has, no interest in actually fixing this. Instead of making LED bulbs more practical to use they plan to crack down even more strictly on the alternatives, including new efficiency restrictions that effectively ban most stage lighting used by theatres and concerts.

tobltobs 8y ago

> You can hire a data protection officer at a legal firm for almost nothing, Failed reality check.

simonswords82 8y ago
Thank you for highlighting this gross misinformation. A Data Protection Officer, especially from a law firm, is not in any way imaginable "almost nothing" regards the cost.
- astura 8y ago
  Especially when Streetlends is literally already operating at a loss. I can't imagine it's a cost less than five figures.
- leesalminen 8y ago
  Seriously. What world does this person live in? When I think “lawyer”, “almost nothing” isn’t the first thing that comes to mind.

return1 8y ago

> the EU outlawed environmentally shitty lightbuilbs when did that happen?

dvfjsdhgfv 8y ago
https://en.wikipedia.org/wiki/Phase-out_of_incandescent_light_bulbs#European_Union https://en.wikipedia.org/wiki/Phase-out_of_incandescent_ligh...
- deleted 8y ago
  [deleted]

cbeach 8y ago

> Except this isn’t really true. Streetlend made its money by selling your privacy data to advertisers through Amazon. So when you put up a power drill for lend, people would see power drills for sale at local shops, based on their online presence harvested through stuff like their Facebook account. Founder here. Streetlend never passed personal data to Amazon. It used the search term eg “ladder” and showed ladders on sale from Amazon. No personal data was passed.

annabellish 8y ago
Then what's the problem? I have to be honest here, this smells far more of FUD than anything based in reality. Nothing in the linked post is talking about anything which the GDPR makes harder. Unless you're doing something shady with user data (and you _know_ if you are) the GDPR essentially comprises having _some way_ of giving a user all the data you store on them, and _some way_ of deleting that data. In this case both of those appear trivial to automate, and even more trivial to just do if somebody actually wants those things. Shit, dropping email login and only accepting federated auth would get you there in one step, unless you're doing things you're not saying.
- syshum 8y ago
  >>>Then what's the problem? Clearly you have no understanding of any legal system in the world works if you believe only people that are guilty of violating the law are sued and ruined by the law.
  - annabellish 8y ago
    So should we... not have laws? I don't understand this point, why is that any more true for the GDPR than any other law?
    - omginternets 8y ago
      >why is that any more true for the GDPR than any other law? Because the GDPR is extraordinarily ambiguous.

kk_cz 8y ago

so is every site that uses affilate links selling your data? I didn't see anything else mentioned in the description.

hartator 8y ago

> The GDPR isn’t really that hostile to small business and it doesn’t require an understanding of law. You can hire a data protection officer at a legal firm for almost nothing, and as long as you follow their advice on how to pass audits, you’re really not in trouble. So many contradictions in one paragraph.

misja111 8y ago
This. GDPR is a huge burden for small companies. The extra work for implementing the new GDPR requirements can completely halt any new development if you only have a small team of developers. For big companies the workload is relatively much smaller.
- kahnpro 8y ago
  If your business model is based on something that will violate the GDPR, like streetlend selling user data to advertisers, then should you really be opening that business in the first place?
  - tchock23 8y ago
    What about small companies that don’t sell data as a business model? GDPR punishes the vast majority of businesses that do not have business models reliant on selling user data in favor of trying to catch the ones that do. Unfortunately, I fear this regulation will do absolutely nothing to stop the bad actors from selling data as they do now.
  - TheRealPomax 8y ago
    Other way around. This business was opened half a decade ago, with users being perfectly fine with it (or it wouldn't have stuck around). The GDPR on the other hand has flown under the radar and only suddenly became a thing that service providers (generic "service", not "internet service providers") were made aware of in legal context. So if we're raising eyebrows, it's at the EU and the GDPR. Not at sites that have operated to user's satisfaction for five+ years.

stef25 8y ago

> Streetlend made its money by selling your privacy data to advertisers through Amazon. So when you put up a power drill for lend, people would see power drills for sale at local shops, based on their online presence harvested through stuff like their Facebook account. If you mean he just slapped some Amazon ads on his site to support his side project, then accusing that guy of "selling your privacy data" requires quite a bit of mental gymnastics and is a pretty dishonest description of the facts. The blame here is wholly with the users for putting their data online in the first place (really, you can go a very long way with my.fake.name@gmail.com!) and especially Facebook for providing the framework that enables this all. *edited for grammar

rtpg 8y ago
If Amazon and FB make unethical tracking tools and you put them on the website, you are most definitely an accomplice to their acts. "But it's such a small site/ the person's side project" all the more reason to stay away from this. Having a code of ethics where you end up using the most profitable option anyways is not a real code of ethics The point of ethical judgement is that it's _not_ the best choice by other factors
- stef25 8y ago
  How do you go from Amazon ads for ladders to unethical tracking tool? He's not making a profit. Meaning he's actually paying out of pocket to allow neighbours to lend stuff to each other. Yet he's abandoned his code of ethics?
  - megaman22 8y ago
    It's mind-boggling that people are trying to cast some Amazon affiliate links into a nefarious invasion of privacy. On the advertising scale, from 1 to late-90s, I'm-probably-going-to-catch-a-virus-from-a-shady-ActiveX-component, this is maybe a two.
    - s73v3r_ 8y ago

Trundle 8y ago

>almost nothing Yeah, I'll just get a small loan from my father.

Illniyar 8y ago

If what it says on the blog is correct then he is using affiliate links for amazon for similar products to what you search. At it's core it is the most ethical a free service can make money (aside from donations). He isn't selling the data or showing personally targeted ads. (Of course it could be using some amazon plugin that does it anyway for convenience or from ignorance, but he can do it without it through amazon apis)

richardknop 8y ago

>> You can hire a data protection officer at a legal firm for almost nothing What? Define almost nothing. For small businesses it is a wishful thinking they can hire anybody from a legal firm. They probably don't even have a lawyer or a legal department as they can't afford such luxury.

tomxor 8y ago

> But do you remember when the EU outlawed environmentally shitty lightbuilbs and everyone said we were going dark because it was impossible to do anything else? Today 95% of lightbuilbs are LEDs because of that. And now we are finding out LED lights are bad for our eyes and our sleep, so we may go blind sooner and die sooner. Ok that might be a bit extreme, and besides there is an efficient incandescent tech that will probably come back and save us (and you can argue the EU helped that too)... but my point is the EU has good intents but their creations seem polarised into either extremely preemptive or extremely reflexive and are often premature and poorly thought out, fighting for something for the people but often without thought for how they will directly hurt the people. For tech the EU isn't exactly unique in this respect though, the UK for instance recently tried to inact some pretty rediculous laws that undermine basic technologies that make the internet work.

jboogie77 8y ago

“can hire a data protection officer at a legal firm for almost nothing” Out of touch with reality much?

smileypete 8y ago

Ugh, sorry but no, the EU can't claim any credit for the success of LED lightbulbs. They can take some credit for the dim and dimmer mercury containing CFLs, and the ludicrously expensive and somewhat unreliable early LEDs, if they like.

Lapsed 8y ago

I think your misunderstanding how his site worked. Where did you get that it sold private data to Amazon?

chiefalchemist 8y ago

> You said: "From the description Streetlend didn’t violate the GDPR in concept though. Addresses are public record, available in public databases, and there is nothing stopping you from doing lending eBay. All it needed to do was clear it’s records every 6 months and let people delete their accounts." > But the comment you commented on said: "The problem is what happens if a legal firm or an agency targets you. Even if you adhered to the spirit of the law, they can dig up evidence that you didn't obey the letter of the law (since GDPR is quite loose and ambiguous)." The issue seems to be that the resources required to resolve a delta - from Streetlend's pov - are perceived as excessive. Too much risk; not enough reward. Look at what happened with Thiel and Gawker. Right or wrong is irrelevant if the opposition has deeper pockets and can bleed you to death (in legal fees). > Startups will find a way to make money that isn’t selling your data. Perhaps, that could be true. But plenty will not want to be caught in the crossfire in the meantime. And that too is a biz decision.

sabarn01 8y ago

You have to identify your data class which takes a lawyer. You have to assure that no data is held longer than 48 hours even telemetry without providing an export and delete function. You have to support level 4 data requests which will take a lawyer. Just like all regulation its very doable but its way more cost effective for the big players.