4 ms·

A couple moments though: Google and Facebooks manoeuvring to adapt to the GDPR give a clear road map of the legal requirements. Bluntly, they're not that bad,

A couple moments though: Google and Facebooks manoeuvring to adapt to the GDPR give a clear road map of the legal requirements. Bluntly, they're not that bad, and they're better for a new startup who can adapt to them from the ground up than an established venture who has to find new ways to make money. The reporting requirements of the GDPR can be large, but for most companies most of the time you're dealing with a relatively unchallenging piece of legislation. Most of the requirements are just to be able to explain what happens with user data and handle sporadic deletion requests. Loosely connected, separately stored, IDs are the solution to this (pseudonymization). It's a different style of development, but far from tricky. That's systems development, not legal. This is a legitimate threat to startups reselling user data and overly friendly web-tracking solutions, yeah. To them I say "boo-hoo". For the rest of us? IT regulation with legal teeth is a promising indicator for IT companies. There are more of "them" than there are of "us", and if our legal issues are getting play that means our salesmen will also get play.

T2_t2 8y ago
> for most companies most of the time I know you didn't intend to, but you've nailed the problem: the ambiguity and doubt. Most (<100%) * most (<100%) is a fraction times a fraction, never a good equation if the upside is low. I doubt the StreetLend dude made much cash out of this project, so why bother? It was likely just a convenient excuse to kill a side project that had little value that sucked a lot of time, but still, the ambiguity no doubt helped push him towards this outcome.
- ben_w 8y ago
  The penalties for noncompliance are supposed to be “effective, proportionate and dissuasive”, and can start off with warnings. The law only has the headline figures as upper limits (plus damages, IIUC). This doesn’t feel particularly onerous, especially as any good business plan will include getting public liability insurance for inevitable occasional serious mistakes.
  - leesalminen 8y ago
    In my businesses case, EU revenue was <1% of gross. Even though we never resell, mine nor monetize data, the increased risk of legal action was not acceptable to us. Have you ever filed a claim on an insurance policy? Your premium will certainly go up next time that policy is up for renewal. It’s unfortunate for our users. They’re quite upset that we’ve decided to drop all EU customers. But, we’re not willing to take on any additional risk for such a small revenue source.
    - ben_w 8y ago
      Your call. IIUC, it covers EU citizens not just residents. I only mention this because way you phrased that sounds like you’re dropping the region not just the nationalities.
      - leesalminen 8y ago
        My counsel disagrees with this statement. Some Googling seems to confirm that. https://cybercounsel.co.uk/data-subjects/ https://cybercounsel.co.uk/data-subjects/ 1. A Data Subject under GDPR is anyone within the borders of the EU at the time of processing of their personal data. However, they can also be anyone and anywhere in the context of EU established Data Controllers an Data Processors. 2. If the Data Subject, moves out of the EU border and say becomes an expat, or goes on holiday then their personal data processed under these circumstances is not covered by the GDPR and they are no longer a Data Subject in the context of the GDPR, unless their data is still processed by an organisation “established” in the EU. Luckily, my organization is not “established” in the EU.

T2_t2 8y ago

> for most companies most of the time I know you didn't intend to, but you've nailed the problem: the ambiguity and doubt. Most (<100%) * most (<100%) is a fraction times a fraction, never a good equation if the upside is low. I doubt the StreetLend dude made much cash out of this project, so why bother? It was likely just a convenient excuse to kill a side project that had little value that sucked a lot of time, but still, the ambiguity no doubt helped push him towards this outcome.

ben_w 8y ago
The penalties for noncompliance are supposed to be “effective, proportionate and dissuasive”, and can start off with warnings. The law only has the headline figures as upper limits (plus damages, IIUC). This doesn’t feel particularly onerous, especially as any good business plan will include getting public liability insurance for inevitable occasional serious mistakes.
- leesalminen 8y ago
  In my businesses case, EU revenue was <1% of gross. Even though we never resell, mine nor monetize data, the increased risk of legal action was not acceptable to us. Have you ever filed a claim on an insurance policy? Your premium will certainly go up next time that policy is up for renewal. It’s unfortunate for our users. They’re quite upset that we’ve decided to drop all EU customers. But, we’re not willing to take on any additional risk for such a small revenue source.
  - ben_w 8y ago
    Your call. IIUC, it covers EU citizens not just residents. I only mention this because way you phrased that sounds like you’re dropping the region not just the nationalities.
    - leesalminen 8y ago
      My counsel disagrees with this statement. Some Googling seems to confirm that. https://cybercounsel.co.uk/data-subjects/ https://cybercounsel.co.uk/data-subjects/ 1. A Data Subject under GDPR is anyone within the borders of the EU at the time of processing of their personal data. However, they can also be anyone and anywhere in the context of EU established Data Controllers an Data Processors. 2. If the Data Subject, moves out of the EU border and say becomes an expat, or goes on holiday then their personal data processed under these circumstances is not covered by the GDPR and they are no longer a Data Subject in the context of the GDPR, unless their data is still processed by an organisation “established” in the EU. Luckily, my organization is not “established” in the EU.