6 ms·

The massive legal team part is indeed the problem as it further entrenches Facebook and Google from competition in that space.

bonesss 8y ago
A couple moments though: Google and Facebooks manoeuvring to adapt to the GDPR give a clear road map of the legal requirements. Bluntly, they're not that bad, and they're better for a new startup who can adapt to them from the ground up than an established venture who has to find new ways to make money. The reporting requirements of the GDPR can be large, but for most companies most of the time you're dealing with a relatively unchallenging piece of legislation. Most of the requirements are just to be able to explain what happens with user data and handle sporadic deletion requests. Loosely connected, separately stored, IDs are the solution to this (pseudonymization). It's a different style of development, but far from tricky. That's systems development, not legal. This is a legitimate threat to startups reselling user data and overly friendly web-tracking solutions, yeah. To them I say "boo-hoo". For the rest of us? IT regulation with legal teeth is a promising indicator for IT companies. There are more of "them" than there are of "us", and if our legal issues are getting play that means our salesmen will also get play.
- T2_t2 8y ago
  > for most companies most of the time I know you didn't intend to, but you've nailed the problem: the ambiguity and doubt. Most (<100%) * most (<100%) is a fraction times a fraction, never a good equation if the upside is low. I doubt the StreetLend dude made much cash out of this project, so why bother? It was likely just a convenient excuse to kill a side project that had little value that sucked a lot of time, but still, the ambiguity no doubt helped push him towards this outcome.
  - ben_w 8y ago
    The penalties for noncompliance are supposed to be “effective, proportionate and dissuasive”, and can start off with warnings. The law only has the headline figures as upper limits (plus damages, IIUC). This doesn’t feel particularly onerous, especially as any good business plan will include getting public liability insurance for inevitable occasional serious mistakes.
    - leesalminen 8y ago
      In my businesses case, EU revenue was <1% of gross. Even though we never resell, mine nor monetize data, the increased risk of legal action was not acceptable to us. Have you ever filed a claim on an insurance policy? Your premium will certainly go up next time that policy is up for renewal. It’s unfortunate for our users. They’re quite upset that we’ve decided to drop all EU customers. But, we’re not willing to take on any additional risk for such a small revenue source.
      - ben_w 8y ago
        Your call. IIUC, it covers EU citizens not just residents. I only mention this because way you phrased that sounds like you’re dropping the region not just the nationalities.
        leesalminen 8y ago
        My counsel disagrees with this statement. Some Googling seems to confirm that. https://cybercounsel.co.uk/data-subjects/ https://cybercounsel.co.uk/data-subjects/ 1. A Data Subject under GDPR is anyone within the borders of the EU at the time of processing of their personal data. However, they can also be anyone and anywhere in the context of EU established Data Controllers an Data Processors. 2. If the Data Subject, moves out of the EU border and say becomes an expat, or goes on holiday then their personal data processed under these circumstances is not covered by the GDPR and they are no longer a Data Subject in the context of the GDPR, unless their data is still processed by an organisation “established” in the EU. Luckily, my organization is not “established” in the EU.
eksemplar 8y ago
The flip side of this argument is that we weren’t seeing a whole lot of new Googles or Facebooks without the GDPR. I don’t think you’re going to disrupt Google or Facebook without trying something new, and the GDPR certainly forces startups to think different.
willvarfar 8y ago
Doesn't seem true on the ground. There isn't even many consultancy opportunities getting companies GDPR-ready. 99.99% of companies are managing just fine getting someone to skim the rules and make some guidelines to put with all the other guidelines and internal docs they already have in a big binder. Its only the end-user-is-product companies that have to have armies of lawyers, and that is no bad thing surely?
- vertex-four 8y ago
  > Its only the end-user-is-product companies that have to have armies of lawyers, and that is no bad thing surely? Note that you're on a site pretty much dedicated to the ongoing viability of end-user-is-product companies, hence the backlash here. My experience, same as yours, is that anyone who provides a service for money isn't having any difficulty at all complying with the GDPR.
mtgx 8y ago
The issue is that after Google and Facebook has abused users' data for so long and made so many tens of billions of dollars from that abuse, they're now allowed to keep that money, so they have a huge head-start on anyone else who can't abuse users' data anymore. The law is needed, otherwise everyone would continue to abuse users' data more and more. So that's clearly not the solution. The ideal solution is fining both Google and Facebook for all the money they've made from that abuse from at least the past 5 years, to level the playing field. People say that capitalism is the "worst economic system, except for all the others", and that's true. But one of the main issues with capitalism and why it gets to be so broken in the end, is that when companies abuse their powers, the punishment almost never fits the crime. If it did, I think capitalism would be a much more optimal economic system. I think this is by far the biggest issue. As an example, Intel made tens of billions from anti-competitive moves against AMD, and it was only fined $1.4 billion, a fine that's still under dispute even a decade later (Intel has yet to pay it). Samsung, and other memory makers have been caught at least once in the past, and now again, doing price fixing. But the fine was and likely will be again much smaller than the profits they made. Then we have the big banks, which also made a ton of money from screwing people over, and again they were fined at "record levels" but still much less than they made in profits. This is how the incumbents keep getting ahead of the others, even when stronger regulations pass - they never have to truly pay for the crime they did in the past, and they get to keep 95% of their profits from that crime. That isn't how things should work - the governments should take all of the profits they made from the crime and the fine should be added on top of that. If a company grows 10x in size in a decade from abusing some law and consumers, then the governments should absolutely take back 90% of its size when it's punished later. That's the deterrent. Now in regards to privacy, the laws weren't that strong before, and I don't really believe in punishing people or companies for laws that didn't exist, which is why governments need to be much more vigilant from the birth of new industries, and not wait until they are mature and most damage has already been done. Maybe my solutions are a little too extreme, but I do believe more needs to be done compared to what governments are doing now. We can't just let companies get away with almost all the profits they made from abusing consumers. Also, there need to be stronger anti-merger laws. That's for sure. We almost never need to let companies merge, and if they do merge, that almost always ends-up not being in the consumers' favor. If some companies can't compete on their own anymore, then so be it - let them go bankrupt. The rest will either become stronger, or new entrants will appear. I think that's still preferable over allowing them to "survive" under a bigger company. Let the creative destruction flourish in the market, as it's supposed to.
kahnpro 8y ago
On the contrary I think that without any regulation, Google and Facebook are able to completely entrench themselves and take advantage of us all in the process.
intended 8y ago
There are finite moves in the game. The best moves liquidates Facebook and google. This is an unviable move. The next best move is to build laws which enforce behavior. This always results in additional complexity which cuts into the profit profile of firms. The same way that health regulations hurt many fly by night operators, and force standards on bigger firms. This is the only outcome in the game which is acceptable to all parties. It is the rational move.

bonesss 8y ago

A couple moments though: Google and Facebooks manoeuvring to adapt to the GDPR give a clear road map of the legal requirements. Bluntly, they're not that bad, and they're better for a new startup who can adapt to them from the ground up than an established venture who has to find new ways to make money. The reporting requirements of the GDPR can be large, but for most companies most of the time you're dealing with a relatively unchallenging piece of legislation. Most of the requirements are just to be able to explain what happens with user data and handle sporadic deletion requests. Loosely connected, separately stored, IDs are the solution to this (pseudonymization). It's a different style of development, but far from tricky. That's systems development, not legal. This is a legitimate threat to startups reselling user data and overly friendly web-tracking solutions, yeah. To them I say "boo-hoo". For the rest of us? IT regulation with legal teeth is a promising indicator for IT companies. There are more of "them" than there are of "us", and if our legal issues are getting play that means our salesmen will also get play.

T2_t2 8y ago
> for most companies most of the time I know you didn't intend to, but you've nailed the problem: the ambiguity and doubt. Most (<100%) * most (<100%) is a fraction times a fraction, never a good equation if the upside is low. I doubt the StreetLend dude made much cash out of this project, so why bother? It was likely just a convenient excuse to kill a side project that had little value that sucked a lot of time, but still, the ambiguity no doubt helped push him towards this outcome.
- ben_w 8y ago
  The penalties for noncompliance are supposed to be “effective, proportionate and dissuasive”, and can start off with warnings. The law only has the headline figures as upper limits (plus damages, IIUC). This doesn’t feel particularly onerous, especially as any good business plan will include getting public liability insurance for inevitable occasional serious mistakes.
  - leesalminen 8y ago
    In my businesses case, EU revenue was <1% of gross. Even though we never resell, mine nor monetize data, the increased risk of legal action was not acceptable to us. Have you ever filed a claim on an insurance policy? Your premium will certainly go up next time that policy is up for renewal. It’s unfortunate for our users. They’re quite upset that we’ve decided to drop all EU customers. But, we’re not willing to take on any additional risk for such a small revenue source.
    - ben_w 8y ago
      Your call. IIUC, it covers EU citizens not just residents. I only mention this because way you phrased that sounds like you’re dropping the region not just the nationalities.
      - leesalminen 8y ago
        My counsel disagrees with this statement. Some Googling seems to confirm that. https://cybercounsel.co.uk/data-subjects/ https://cybercounsel.co.uk/data-subjects/ 1. A Data Subject under GDPR is anyone within the borders of the EU at the time of processing of their personal data. However, they can also be anyone and anywhere in the context of EU established Data Controllers an Data Processors. 2. If the Data Subject, moves out of the EU border and say becomes an expat, or goes on holiday then their personal data processed under these circumstances is not covered by the GDPR and they are no longer a Data Subject in the context of the GDPR, unless their data is still processed by an organisation “established” in the EU. Luckily, my organization is not “established” in the EU.

eksemplar 8y ago

The flip side of this argument is that we weren’t seeing a whole lot of new Googles or Facebooks without the GDPR. I don’t think you’re going to disrupt Google or Facebook without trying something new, and the GDPR certainly forces startups to think different.

willvarfar 8y ago

Doesn't seem true on the ground. There isn't even many consultancy opportunities getting companies GDPR-ready. 99.99% of companies are managing just fine getting someone to skim the rules and make some guidelines to put with all the other guidelines and internal docs they already have in a big binder. Its only the end-user-is-product companies that have to have armies of lawyers, and that is no bad thing surely?

vertex-four 8y ago
> Its only the end-user-is-product companies that have to have armies of lawyers, and that is no bad thing surely? Note that you're on a site pretty much dedicated to the ongoing viability of end-user-is-product companies, hence the backlash here. My experience, same as yours, is that anyone who provides a service for money isn't having any difficulty at all complying with the GDPR.

mtgx 8y ago

The issue is that after Google and Facebook has abused users' data for so long and made so many tens of billions of dollars from that abuse, they're now allowed to keep that money, so they have a huge head-start on anyone else who can't abuse users' data anymore. The law is needed, otherwise everyone would continue to abuse users' data more and more. So that's clearly not the solution. The ideal solution is fining both Google and Facebook for all the money they've made from that abuse from at least the past 5 years, to level the playing field. People say that capitalism is the "worst economic system, except for all the others", and that's true. But one of the main issues with capitalism and why it gets to be so broken in the end, is that when companies abuse their powers, the punishment almost never fits the crime. If it did, I think capitalism would be a much more optimal economic system. I think this is by far the biggest issue. As an example, Intel made tens of billions from anti-competitive moves against AMD, and it was only fined $1.4 billion, a fine that's still under dispute even a decade later (Intel has yet to pay it). Samsung, and other memory makers have been caught at least once in the past, and now again, doing price fixing. But the fine was and likely will be again much smaller than the profits they made. Then we have the big banks, which also made a ton of money from screwing people over, and again they were fined at "record levels" but still much less than they made in profits. This is how the incumbents keep getting ahead of the others, even when stronger regulations pass - they never have to truly pay for the crime they did in the past, and they get to keep 95% of their profits from that crime. That isn't how things should work - the governments should take all of the profits they made from the crime and the fine should be added on top of that. If a company grows 10x in size in a decade from abusing some law and consumers, then the governments should absolutely take back 90% of its size when it's punished later. That's the deterrent. Now in regards to privacy, the laws weren't that strong before, and I don't really believe in punishing people or companies for laws that didn't exist, which is why governments need to be much more vigilant from the birth of new industries, and not wait until they are mature and most damage has already been done. Maybe my solutions are a little too extreme, but I do believe more needs to be done compared to what governments are doing now. We can't just let companies get away with almost all the profits they made from abusing consumers. Also, there need to be stronger anti-merger laws. That's for sure. We almost never need to let companies merge, and if they do merge, that almost always ends-up not being in the consumers' favor. If some companies can't compete on their own anymore, then so be it - let them go bankrupt. The rest will either become stronger, or new entrants will appear. I think that's still preferable over allowing them to "survive" under a bigger company. Let the creative destruction flourish in the market, as it's supposed to.

kahnpro 8y ago

On the contrary I think that without any regulation, Google and Facebook are able to completely entrench themselves and take advantage of us all in the process.

intended 8y ago

There are finite moves in the game. The best moves liquidates Facebook and google. This is an unviable move. The next best move is to build laws which enforce behavior. This always results in additional complexity which cuts into the profit profile of firms. The same way that health regulations hurt many fly by night operators, and force standards on bigger firms. This is the only outcome in the game which is acceptable to all parties. It is the rational move.