7 ms·

Compliance is trivial and involves steps that are already best-practices anyway. You won't need to split any atoms. https://techblog.bozho.net/gdpr-practical-

Compliance is trivial and involves steps that are already best-practices anyway. You won't need to split any atoms. https://techblog.bozho.net/gdpr-practical-guide-developers/ https://techblog.bozho.net/gdpr-practical-guide-developers/ The penalty isn't meant to be something you afford. It's a penalty. (It's a feature, not a bug.) I'm having a really hard time not being sarcastic right now but compliance with the law might also end up being an economical option worth looking into. Cheaper than lawyering-up for being sued by shysters for non-compliance, and cheaper than being penalized for non-compliance. Mind you, taking whatever-it-is off the internet is fine too. I totally understand. What I don't like is all the whiny sanctimony and martyrdom. "Yes I'm taking my thing off the internet, but first I'm going to make a big deal about what a tragedy it is for the world." Um no. The fact that your thing is a "small business" means few people care about it. (Sad to say. More people care about Facebook than about you. That's why they're the big incumbent.) And it emphatically doesn't mean for example, that you're some hallowed, heroic underdog who deserves protection, especially when you won't even afford the same to your own users and their data.

closeparen 9y ago
>Compliance is trivial Compliance depends on how well your understanding of of a bunch of fuzzy terms like "legitimate interest," "level of security appropriate to the risk," "necessary in relation to the purposes for which they are processed," "no longer than necessary," etc. align with 28 different regulators and judiciaries. That's as far from "trivial" as it gets. Bozho.net is not a lawyer, not your lawyer, and even if here were your top-tier lawyer specialized in data privacy he wouldn't have a clue what courts were going to take these things to mean in the context of GDPR, because there aren't any judgements yet. Security and minimization standards are also about "taking into account the state of the art" - do you know what the state of the art is, and is your organization capable of implementing it? An entirely plausible outcome here is that only the most advanced engineering organizations have technology that meets these standards.
- guitarbill 9y ago
  > the most advanced engineering organizations have technology that meets these standards. Horeshit. There is nothing advanced about storing only the data you need. However, if you've been hoarding like crazy and weighed down with technical debt, and haven't used the last two years, then yeah, might be hard. Yes, it's a new law, yes, in practice it will be defined by judgments. How is this different from any other new law, other than this one impacts IT harder? And let me guess what the alternative is: do nothing. Consider also that European law is different to US law. We draft laws and contracts in a conceptual/abstract way, whereas in the US where everything has to be exhaustive, explicit, and over-worked; just in case anybody dare sues. GDPR recognises one-size-fits-all won't work. Yes, that means it has some vague terms. Yes, you might have to show you thought about the implementation, and that you erred on the side of privacy. It's funny how everybody always talks about the maximum fines, not the other sanctions that the GDPR can impose. Guess that's just more sensational.
downandout 9y ago
Mind you, taking whatever-it-is off the internet is fine too We won’t take our services off the Internet. We’ll simply block you and your overbearing friends in the EU from accessing them. You might not miss one of us, but you’ll likely miss hundreds of thousands of us. Enjoy Facebook. That may be the only site you still have access to when the dust settles. Compliance is trivial Since you are saying that, I can guarantee that you haven’t actually read the law or been in charge of trying to make a website compliant. That is an absurdly incorrect statement. Billions are being spent around the world on attempts to comply with it.
ehsankia 9y ago
Here's a story for you. I'm a hobby developer. I once made a tool mostly for myself, but decided to put it online. A couple thousand people use it, and it runs at a loss but I keep it up mostly because it's useful to some people out there. My tiny website isn't hurting anyone or breaking the internet the way Facebook or Google may be. To claim that having to spend my hobby time implementing a bunch of extra features is just "complying with the law" is bullshit, I'm sorry. In terms of scale, it's basically as if I forced you to do full safety test on a toy car you made for your kid, just because GM cars had safety issues. And I'm not special. There are plenty of other small devs like me with thousands of small niche web tools out there, most of which are ran purely as a hobby, out of our own pocket. I may not make a blog post and get it to the top of HN, but devs like us have 0 incentive to keep our sites online. HN loves to complain about things like AMP killing the web, but to me this is orders of magnitude worse.
- notadoc 9y ago
  > To claim that having to spend my hobby time implementing a bunch of extra features is just "complying with the law" is bullshit, I'm sorry 100% agree. And your situation applies to millions of hobbyists, personal websites, projects, startups, and small businesses around the world. GPDR appears to be intentionally burdensome, a classic regulation strategy aimed at protecting large incumbents while stifling small business, innovation, and newcomers, or even side projects like your own.
- Normal_gaussian 9y ago
  What on earth are you doing that could cause a problem? If what you're doing could cause a problem I'm pretty sure I'd rather you didn't without the ability to deal with it.
  - ehsankia 9y ago
    Just like StreetLend, most likely nothing, and it's just a fear, but again you need to realize that this is a site run purely as a hobby. I'm sorry but reading through legalese and combing my website's code to make sure it's compliant isn't part of my hobby. I'm not a company, I don't have millions of users, I just run a small tool that a few people use. Yet apparently I run the risk of being fined $20m...
TomVDB 9y ago
> Compliance is trivial and involves steps that are already best-practices anyway. Isn't that besides the point? You can be 100% compliant and still be sued by somebody. And you'd have to pay some lawyer a lot of money to make it go away. That risk already existed before the GDPR (anybody can sue anyone for whatever reason they can come up with), but GDPR is high profile enough to make people scared. About a decade ago, I ran a website that made heavy use of user uploaded GPS data. I didn't sell any data. The only ad income was Adsense. If I had bothered to restore the server from backups after a HD crash, I'd probably take it down now. Just not worth the potential trouble.
- Angostura 9y ago
  > You can be 100% compliant and still be sued by somebody. No, someone can report you to a member state's compliance organisation.
- brohee 9y ago
  > You can be 100% compliant and still be sued by somebody. And you'd have to pay some lawyer a lot of money to make it go away. I fail to see how GDPR makes that new. You can be sued for any reasons already, being in the right or not. E.g. 99% of useful websites violate some patents (that shouldn't ever have been issued), actual predatory suing about this issue happens, yet no one closes his website because "the patent situation makes it too uncertain".
candiodari 9y ago
> Compliance is trivial. Indeed it is: the first 100 pages of the text detailing what compliance means are a manual for how to read the remaining 5000 pages, and a warning that there will be per-country variants of the law, which I'm sure will all be very clear, made easily available and not at all weird or objectionable, or require being well-versed in the legal intricacies of said member state at all ! /sarcasm
- stevetrewick 9y ago
  You make this assertion elsewhere in the thread. It is incorrect. The entirety of the legislation is 88 pages long and it is really quite straightforward (full link preserved) [1]. Here is a set of (easily available) interactive tools, explainers and guidelines from ICO in the UK which explicitly outline what compliance looks like and what steps you can take to achieve and demonstrate it [2]. It’s available as a 162 page PDF, if you insist on counting pages, but much of it relates to the processing of sensitive data or data relating to children which the majority or orgs can skip. [1] http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&qid=1490179745294&from=en http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... [2] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/whats-new/ https://ico.org.uk/for-organisations/guide-to-the-general-da...

closeparen 9y ago

>Compliance is trivial Compliance depends on how well your understanding of of a bunch of fuzzy terms like "legitimate interest," "level of security appropriate to the risk," "necessary in relation to the purposes for which they are processed," "no longer than necessary," etc. align with 28 different regulators and judiciaries. That's as far from "trivial" as it gets. Bozho.net is not a lawyer, not your lawyer, and even if here were your top-tier lawyer specialized in data privacy he wouldn't have a clue what courts were going to take these things to mean in the context of GDPR, because there aren't any judgements yet. Security and minimization standards are also about "taking into account the state of the art" - do you know what the state of the art is, and is your organization capable of implementing it? An entirely plausible outcome here is that only the most advanced engineering organizations have technology that meets these standards.

guitarbill 9y ago
> the most advanced engineering organizations have technology that meets these standards. Horeshit. There is nothing advanced about storing only the data you need. However, if you've been hoarding like crazy and weighed down with technical debt, and haven't used the last two years, then yeah, might be hard. Yes, it's a new law, yes, in practice it will be defined by judgments. How is this different from any other new law, other than this one impacts IT harder? And let me guess what the alternative is: do nothing. Consider also that European law is different to US law. We draft laws and contracts in a conceptual/abstract way, whereas in the US where everything has to be exhaustive, explicit, and over-worked; just in case anybody dare sues. GDPR recognises one-size-fits-all won't work. Yes, that means it has some vague terms. Yes, you might have to show you thought about the implementation, and that you erred on the side of privacy. It's funny how everybody always talks about the maximum fines, not the other sanctions that the GDPR can impose. Guess that's just more sensational.

downandout 9y ago

Mind you, taking whatever-it-is off the internet is fine too We won’t take our services off the Internet. We’ll simply block you and your overbearing friends in the EU from accessing them. You might not miss one of us, but you’ll likely miss hundreds of thousands of us. Enjoy Facebook. That may be the only site you still have access to when the dust settles. Compliance is trivial Since you are saying that, I can guarantee that you haven’t actually read the law or been in charge of trying to make a website compliant. That is an absurdly incorrect statement. Billions are being spent around the world on attempts to comply with it.

ehsankia 9y ago

Here's a story for you. I'm a hobby developer. I once made a tool mostly for myself, but decided to put it online. A couple thousand people use it, and it runs at a loss but I keep it up mostly because it's useful to some people out there. My tiny website isn't hurting anyone or breaking the internet the way Facebook or Google may be. To claim that having to spend my hobby time implementing a bunch of extra features is just "complying with the law" is bullshit, I'm sorry. In terms of scale, it's basically as if I forced you to do full safety test on a toy car you made for your kid, just because GM cars had safety issues. And I'm not special. There are plenty of other small devs like me with thousands of small niche web tools out there, most of which are ran purely as a hobby, out of our own pocket. I may not make a blog post and get it to the top of HN, but devs like us have 0 incentive to keep our sites online. HN loves to complain about things like AMP killing the web, but to me this is orders of magnitude worse.

notadoc 9y ago
> To claim that having to spend my hobby time implementing a bunch of extra features is just "complying with the law" is bullshit, I'm sorry 100% agree. And your situation applies to millions of hobbyists, personal websites, projects, startups, and small businesses around the world. GPDR appears to be intentionally burdensome, a classic regulation strategy aimed at protecting large incumbents while stifling small business, innovation, and newcomers, or even side projects like your own.
Normal_gaussian 9y ago
What on earth are you doing that could cause a problem? If what you're doing could cause a problem I'm pretty sure I'd rather you didn't without the ability to deal with it.
- ehsankia 9y ago
  Just like StreetLend, most likely nothing, and it's just a fear, but again you need to realize that this is a site run purely as a hobby. I'm sorry but reading through legalese and combing my website's code to make sure it's compliant isn't part of my hobby. I'm not a company, I don't have millions of users, I just run a small tool that a few people use. Yet apparently I run the risk of being fined $20m...

TomVDB 9y ago

> Compliance is trivial and involves steps that are already best-practices anyway. Isn't that besides the point? You can be 100% compliant and still be sued by somebody. And you'd have to pay some lawyer a lot of money to make it go away. That risk already existed before the GDPR (anybody can sue anyone for whatever reason they can come up with), but GDPR is high profile enough to make people scared. About a decade ago, I ran a website that made heavy use of user uploaded GPS data. I didn't sell any data. The only ad income was Adsense. If I had bothered to restore the server from backups after a HD crash, I'd probably take it down now. Just not worth the potential trouble.

Angostura 9y ago
> You can be 100% compliant and still be sued by somebody. No, someone can report you to a member state's compliance organisation.
brohee 9y ago
> You can be 100% compliant and still be sued by somebody. And you'd have to pay some lawyer a lot of money to make it go away. I fail to see how GDPR makes that new. You can be sued for any reasons already, being in the right or not. E.g. 99% of useful websites violate some patents (that shouldn't ever have been issued), actual predatory suing about this issue happens, yet no one closes his website because "the patent situation makes it too uncertain".

candiodari 9y ago

> Compliance is trivial. Indeed it is: the first 100 pages of the text detailing what compliance means are a manual for how to read the remaining 5000 pages, and a warning that there will be per-country variants of the law, which I'm sure will all be very clear, made easily available and not at all weird or objectionable, or require being well-versed in the legal intricacies of said member state at all ! /sarcasm

stevetrewick 9y ago
You make this assertion elsewhere in the thread. It is incorrect. The entirety of the legislation is 88 pages long and it is really quite straightforward (full link preserved) [1]. Here is a set of (easily available) interactive tools, explainers and guidelines from ICO in the UK which explicitly outline what compliance looks like and what steps you can take to achieve and demonstrate it [2]. It’s available as a 162 page PDF, if you insist on counting pages, but much of it relates to the processing of sensitive data or data relating to children which the majority or orgs can skip. [1] http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&qid=1490179745294&from=en http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... [2] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/whats-new/ https://ico.org.uk/for-organisations/guide-to-the-general-da...