3 ms·

> The GDPR is made to protect people from scrupleless companies and practices. This ignores the vast amount of legislation that creates an enormous legal burde

> The GDPR is made to protect people from scrupleless companies and practices. This ignores the vast amount of legislation that creates an enormous legal burden for small companies. > Not all companies are good citizen (Cambridge Analytics comes to mind), and as a european I say "Good riddance". Not all companies in violation of GDPR are bad or negligent. > For normal companies doing normal things with their data, the effort is mostly documentation and good-willed "try to abide the rules". > If you followed the spirit of the pre-GDPR rules, you would almost certainly be compliant without much work even for the GDPR - at least here in Denmark. Until someone sues you and you have to prove that. > But if you business is exploiting data, you collected with questionable methods - then yes, you are going to have a problem... Quite often, data can be both in the "public interest" (not the definition legally defined by GDPR, just that there's no reasonable expectation of privacy by the data creator) and "expoiting" -- such as data derived from pseudonymous sources but could be argued as PII, even though practically speaking, it isn't really. > I would also like to see the graveyard site, mostly because I would then have something to point to when showing that the GDPR works as intented... Most of the sites I've seen that are dead-by-GDPR are small businesses that weren't doing anything any reasonable person would be against, but a single takedown request could be over-burdening for them to respond to as it may have merits by the letter of the law.

svennek 9y ago
If you are an European company, most of this stuff has been the law for decades! Running a project/company means taking on risk. Financially and otherwise. Why is data-care risk so much worse? And sueing is only going to happen in the US. In Europe getting sued is extremely rare. I expect most DPA (gov bodies handling this) starts out with a kindly worded letter. You comply, nothing happened.. (Most other legislation works this way in Europe already). Fines are mostly for repeat-offenders or clearly black sheep. In the US, who knows... Most europeans are baffled by the courts and cases in the US. But I think US companies have to be handled by an EU DPA anyways, so we are back to the letter again.. I run a small company (two employees) and I am not concerned. I know a lot of small companies, they are mostly not concerned. I know a few larger companies, they are not concerned (unless they have data handling as their main business). My own work in this has been somewhere in the neighbourhood of a workweek. Not any worse than complying with tax-law... There is also no "automatic 20M euro fine". Most matters are likely handled by a kindly- or sternly worded letter, or a small fine (in the 5-20k EUR range for small companies, which sucks but shouldn't kill you....
- hvidgaard 9y ago
  I work at a company that stores highly confidential PII. Statements from doctors and the like are just some of the documents our system handle. We're not that concerned. The general consensus is be responsible with the data, make it possible to actually delete something, and show reasonable effort to implement the directives or have a reasonable plan on how and when to implement it reasonably. It's not a big deal as this is how it should have been done in the first place. Only not it's formalized into law.
- Mirioron 9y ago
  You're very naive about this situation. Just because the possibility legally exists already means that you're taking this into account when calculating risk. Also, EU tax-law is one of the reasons that small digital businesses have suffered in recent years. The VAT fiasco was very poorly handled and it's still ongoing.
  - svennek 9y ago
    What? (disclaimer: i don't sell services outside a few countries) There is a solution called One Stop VAT where all comminication and reporting goes to your home-country (given you are an EU company). All your taxes are then calculated at your local rate (as I understand it), execpt for companies with a valid VAT-number, where reverse tax is standard (i.e. zero-rated tax). https://europa.eu/youreurope/business/vat-customs/moss-scheme/index_en.htm https://europa.eu/youreurope/business/vat-customs/moss-schem...
matthewmacleod 9y ago
A single takedown request could be over-burdening for them to respond to If a company is unable to remove your personal data, then by all means let them go under.
- lwansbrough 9y ago
  You pulled that statement out of context, which is that the site may be doing something that is perfectly acceptable, but with the addition of legislation, the claim is now much more serious and requires legal consideration. This is particularly troublesome if the request is made in bad faith, which is a great way to "DDoS" a company/individual. Why, in the case of a single individual running a website, is it suddenly their responsibility to properly manage someone else's PII? Where is the responsibility on the individual whose PII it is? How did the PII get there in the first place? Surely it should be considered negligent to hand out PII to a company whose business model is transparently selling user data.
  - hvidgaard 9y ago
    That is a straw man argument. No matter what I hand over to a business or single person running a website, it's their choice to store this information. It is absolutely their responsibility to do so transparently, securely and allow me to determine when to delete it again if I decide so, and you have no other reasonable reason to store it.
gcatalfamo 9y ago
People are downvoting you because they don’t understand that downvote is not for disagreement, but for a comment that doesn’t add to the conversation while yours clearly does. I am going to be downvoted for saying this but functional illiterates are everywhere.
- majewsky 9y ago
  I downvoted you because you insinuated that the other side is only whining, which in itself is not adding to the conversation.
- bkor 9y ago
  > People are downvoting you because they don’t understand that downvote is not for disagreement For one, downvoting for disagreement is fine, see https://news.ycombinator.com/item?id=117171 https://news.ycombinator.com/item?id=117171 Secondly, guidelines state that talking about voting is frowned upon, see https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

svennek 9y ago

If you are an European company, most of this stuff has been the law for decades! Running a project/company means taking on risk. Financially and otherwise. Why is data-care risk so much worse? And sueing is only going to happen in the US. In Europe getting sued is extremely rare. I expect most DPA (gov bodies handling this) starts out with a kindly worded letter. You comply, nothing happened.. (Most other legislation works this way in Europe already). Fines are mostly for repeat-offenders or clearly black sheep. In the US, who knows... Most europeans are baffled by the courts and cases in the US. But I think US companies have to be handled by an EU DPA anyways, so we are back to the letter again.. I run a small company (two employees) and I am not concerned. I know a lot of small companies, they are mostly not concerned. I know a few larger companies, they are not concerned (unless they have data handling as their main business). My own work in this has been somewhere in the neighbourhood of a workweek. Not any worse than complying with tax-law... There is also no "automatic 20M euro fine". Most matters are likely handled by a kindly- or sternly worded letter, or a small fine (in the 5-20k EUR range for small companies, which sucks but shouldn't kill you....

hvidgaard 9y ago
I work at a company that stores highly confidential PII. Statements from doctors and the like are just some of the documents our system handle. We're not that concerned. The general consensus is be responsible with the data, make it possible to actually delete something, and show reasonable effort to implement the directives or have a reasonable plan on how and when to implement it reasonably. It's not a big deal as this is how it should have been done in the first place. Only not it's formalized into law.
Mirioron 9y ago
You're very naive about this situation. Just because the possibility legally exists already means that you're taking this into account when calculating risk. Also, EU tax-law is one of the reasons that small digital businesses have suffered in recent years. The VAT fiasco was very poorly handled and it's still ongoing.
- svennek 9y ago
  What? (disclaimer: i don't sell services outside a few countries) There is a solution called One Stop VAT where all comminication and reporting goes to your home-country (given you are an EU company). All your taxes are then calculated at your local rate (as I understand it), execpt for companies with a valid VAT-number, where reverse tax is standard (i.e. zero-rated tax). https://europa.eu/youreurope/business/vat-customs/moss-scheme/index_en.htm https://europa.eu/youreurope/business/vat-customs/moss-schem...

matthewmacleod 9y ago

A single takedown request could be over-burdening for them to respond to If a company is unable to remove your personal data, then by all means let them go under.

lwansbrough 9y ago
You pulled that statement out of context, which is that the site may be doing something that is perfectly acceptable, but with the addition of legislation, the claim is now much more serious and requires legal consideration. This is particularly troublesome if the request is made in bad faith, which is a great way to "DDoS" a company/individual. Why, in the case of a single individual running a website, is it suddenly their responsibility to properly manage someone else's PII? Where is the responsibility on the individual whose PII it is? How did the PII get there in the first place? Surely it should be considered negligent to hand out PII to a company whose business model is transparently selling user data.
- hvidgaard 9y ago
  That is a straw man argument. No matter what I hand over to a business or single person running a website, it's their choice to store this information. It is absolutely their responsibility to do so transparently, securely and allow me to determine when to delete it again if I decide so, and you have no other reasonable reason to store it.

gcatalfamo 9y ago

People are downvoting you because they don’t understand that downvote is not for disagreement, but for a comment that doesn’t add to the conversation while yours clearly does. I am going to be downvoted for saying this but functional illiterates are everywhere.

majewsky 9y ago
I downvoted you because you insinuated that the other side is only whining, which in itself is not adding to the conversation.
bkor 9y ago
> People are downvoting you because they don’t understand that downvote is not for disagreement For one, downvoting for disagreement is fine, see https://news.ycombinator.com/item?id=117171 https://news.ycombinator.com/item?id=117171 Secondly, guidelines state that talking about voting is frowned upon, see https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html