4 ms·

Until your competitors figure out they can sue you for non-compliance in your early stage, then you have to mount a defence proving that your software is in fac

Until your competitors figure out they can sue you for non-compliance in your early stage, then you have to mount a defence proving that your software is in fact compliant, but by then it won't matter - your company is competing with an unrestricted American company that can profit off the data and is ready to acquire your company using the profits.

hvidgaard 9y ago
EU does not work as USA in that regard. No private entity can sue for anything relating to GDPR, that is up to the EU courts and the DPAs. What they can do it highlight issues with the appropriate DPAs and if you make reasonable efforts I doubt that much will come from it.
- leereeves 9y ago
  There are many EU countries with enough corruption that a deep pocketed incumbent could "suggest" that a DPA bring suit.
  - svennek 9y ago
    If you live in such a place, no amount of regulation is going to save you... Neither more or less...
    - leereeves 9y ago
      Am I mistaken in thinking that any country in the EU can pursue any business in the EU for violations of the GDPR? Corruption in one country can affect businesses in other countries.
      - svennek 9y ago
        That would really surprise me. Each country has an independent DPA, and I would expect "foreign" cases has to be redirected to the local DPA. Only EU level stuff usually have interstate mandates...
        svennek 9y ago
        There is also the language barrier and geographical considerations (travel). I am sure you (as a european in country A) could ask your local DPA to assist or forward a complaint to my DPA (country B). The same goes for the financial regulation and lots of other stuff already...
        svennek 9y ago
        ".... This means that if your organisation conducts cross-border data processing, the GDPR will require you to work primarily with the supervisory authority based in the same Member State as your main establishment (usually your EU headquarters) to achieve compliance. This enforcement body will be your ‘lead supervisory authority’ for all privacy related matters.... " https://www2.deloitte.com/nl/nl/pages/risk/articles/gdpr-top-ten-10-one-stop-shop.html https://www2.deloitte.com/nl/nl/pages/risk/articles/gdpr-top...
        leereeves 9y ago
        That sounds more reasonable for European businesses. Curious: why did you reply to yourself instead of editing your post?
        svennek 9y ago
        To keep the history.. I generally don't like to fix post except for typos or unclear passages..
        svennek 9y ago
        And "Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State." Article 55 (1) Most of article 55 and 56 are relevant in this case..
midasz 9y ago
What are you talking about? Competitors cannot sue you over GDPR, this is not the US.

hvidgaard 9y ago

EU does not work as USA in that regard. No private entity can sue for anything relating to GDPR, that is up to the EU courts and the DPAs. What they can do it highlight issues with the appropriate DPAs and if you make reasonable efforts I doubt that much will come from it.

leereeves 9y ago
There are many EU countries with enough corruption that a deep pocketed incumbent could "suggest" that a DPA bring suit.
- svennek 9y ago
  If you live in such a place, no amount of regulation is going to save you... Neither more or less...
  - leereeves 9y ago
    Am I mistaken in thinking that any country in the EU can pursue any business in the EU for violations of the GDPR? Corruption in one country can affect businesses in other countries.
    - svennek 9y ago
      That would really surprise me. Each country has an independent DPA, and I would expect "foreign" cases has to be redirected to the local DPA. Only EU level stuff usually have interstate mandates...
      - svennek 9y ago
        There is also the language barrier and geographical considerations (travel). I am sure you (as a european in country A) could ask your local DPA to assist or forward a complaint to my DPA (country B). The same goes for the financial regulation and lots of other stuff already...
        svennek 9y ago
        ".... This means that if your organisation conducts cross-border data processing, the GDPR will require you to work primarily with the supervisory authority based in the same Member State as your main establishment (usually your EU headquarters) to achieve compliance. This enforcement body will be your ‘lead supervisory authority’ for all privacy related matters.... " https://www2.deloitte.com/nl/nl/pages/risk/articles/gdpr-top-ten-10-one-stop-shop.html https://www2.deloitte.com/nl/nl/pages/risk/articles/gdpr-top...
        leereeves 9y ago
        That sounds more reasonable for European businesses. Curious: why did you reply to yourself instead of editing your post?
        svennek 9y ago
        To keep the history.. I generally don't like to fix post except for typos or unclear passages..
        svennek 9y ago
        And "Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State." Article 55 (1) Most of article 55 and 56 are relevant in this case..

midasz 9y ago

What are you talking about? Competitors cannot sue you over GDPR, this is not the US.