4 ms·

Exactly. This is a very small startup killer. Who wants to launch a side project and be faced with the prospect of $20M fines if someone from the EU signs up a

Exactly. This is a very small startup killer. Who wants to launch a side project and be faced with the prospect of $20M fines if someone from the EU signs up and decides to blow them in to regulators for whatever obscure way their side project isn’t compliant... What’s worse is that it’s not entirely clear how to comply. I’ve spent countless hours now just trying to figure out what it all means and get specific, actionable ways to comply for my apps. Unfortunately, it has drastically changed the projects I am considering moving forward.

ryanlol 8y ago
>Who wants to launch a side project and be faced with the prospect of $20M fines Either your side projects are tremendously successful or tremendously unethical, can't really tell which. $20M is very ambitious either way.
- tchock23 8y ago
  The side projects I'm considering are straight SaaS plays. The business model is not "let's acquire a bunch of users and sell their data." In fact, if I sold user data I'd be out of business quickly because my customers would revolt. Why should I be punished by GDPR? Every conversation on HN seems to think that people are out selling user data in nefarious ways just to make a buck. Some of us don't do that - and we're pissed that we have to be punished as a result...
  - DanBC 8y ago
    You wouldn't be punished by GDPR, unless you're ignoring industry standard practive to protect that user data. The businesses who use your service have to protect the data of their users or employees. That includes making sure any services they pass data on to are GDPR compliant.
- throwaway2016a 8y ago
  €20M is the fine that would be imposed if they determine you are negligent not what the op is saying is the revenue of their startup. The way the sanctions appear to be define is they are 4% or €20M whichever is HIGHER. Which mean you could be potentially liable for €20 even if you only have a fee thousand dollars in revenue. Now it is yet to be seen who if any they would impose that penalty on but I agree with op it does seem like a very real possibility getting hit with the fine could be devastating. I can see why it could have a chilling effect on startups.
  - ryanlol 8y ago
    >not what the op is saying is the revenue of their startup It seems like OP is suggesting that their side projects revenue would be far higher than 20M, so he could qualify for such a fine. >Now it is yet to be seen who if any they would impose that penalty on but I agree with op it does seem like a very real possibility getting hit with the fine could be devastating Why do you expect the GDPR to be so vastly different from other European regulations?
  - DanBC 8y ago
    We have decades of experience of EU regulation. Please can you link to any cases given the highest fines? The UK's ICO has never imposed the highest fine. The closest the got was imposing £400,000 on TalkTalk. Talktalk's situation was that they'd done nothing to protect user data, and hackers stole over 150,000 people's information. And 15,000 of those included bank details. If your side project exposes 15,000 bank details you need to look after that data. https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/10/talktalk-gets-record-400-000-fine-for-failing-to-prevent-october-2015-attack/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...
madeofpalk 8y ago
If a court determines that your side project needs to be €20M, then I think you'll be able to afford it.
- tchock23 8y ago
  So you would launch a side project that generates no revenue (at first) on the whims of a potential fine from a court in a country you don't reside in?
  - ryanlol 8y ago
    How do you breathe? Write HN comments? Honestly this kind of paranoia doesn't sound healthy at all.

ryanlol 8y ago

>Who wants to launch a side project and be faced with the prospect of $20M fines Either your side projects are tremendously successful or tremendously unethical, can't really tell which. $20M is very ambitious either way.

tchock23 8y ago
The side projects I'm considering are straight SaaS plays. The business model is not "let's acquire a bunch of users and sell their data." In fact, if I sold user data I'd be out of business quickly because my customers would revolt. Why should I be punished by GDPR? Every conversation on HN seems to think that people are out selling user data in nefarious ways just to make a buck. Some of us don't do that - and we're pissed that we have to be punished as a result...
- DanBC 8y ago
  You wouldn't be punished by GDPR, unless you're ignoring industry standard practive to protect that user data. The businesses who use your service have to protect the data of their users or employees. That includes making sure any services they pass data on to are GDPR compliant.
throwaway2016a 8y ago
€20M is the fine that would be imposed if they determine you are negligent not what the op is saying is the revenue of their startup. The way the sanctions appear to be define is they are 4% or €20M whichever is HIGHER. Which mean you could be potentially liable for €20 even if you only have a fee thousand dollars in revenue. Now it is yet to be seen who if any they would impose that penalty on but I agree with op it does seem like a very real possibility getting hit with the fine could be devastating. I can see why it could have a chilling effect on startups.
- ryanlol 8y ago
  >not what the op is saying is the revenue of their startup It seems like OP is suggesting that their side projects revenue would be far higher than 20M, so he could qualify for such a fine. >Now it is yet to be seen who if any they would impose that penalty on but I agree with op it does seem like a very real possibility getting hit with the fine could be devastating Why do you expect the GDPR to be so vastly different from other European regulations?
- DanBC 8y ago
  We have decades of experience of EU regulation. Please can you link to any cases given the highest fines? The UK's ICO has never imposed the highest fine. The closest the got was imposing £400,000 on TalkTalk. Talktalk's situation was that they'd done nothing to protect user data, and hackers stole over 150,000 people's information. And 15,000 of those included bank details. If your side project exposes 15,000 bank details you need to look after that data. https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/10/talktalk-gets-record-400-000-fine-for-failing-to-prevent-october-2015-attack/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...

madeofpalk 8y ago

If a court determines that your side project needs to be €20M, then I think you'll be able to afford it.

tchock23 8y ago
So you would launch a side project that generates no revenue (at first) on the whims of a potential fine from a court in a country you don't reside in?
- ryanlol 8y ago
  How do you breathe? Write HN comments? Honestly this kind of paranoia doesn't sound healthy at all.