7 ms·

If that's going to be the sort of business that the GDPR makes unprofitable and unworkable then I'm very proud to be a European citizen. This is the sort of bu

If that's going to be the sort of business that the GDPR makes unprofitable and unworkable then I'm very proud to be a European citizen. This is the sort of business that GDPR makes unprofitable and unworkable - but unfortunately it's not the only sort. Normal, everyday services - sites that you might use and enjoy - will also have to close to EU traffic simply to avoid the liability. At my company, we do nothing nefarious with user data. We have a combined total of a few million visitors per month across a handful of sites. After consultation with experts, we had to make the decision to either spend high six/low seven figures to hopefully comply and buy special liability insurance that would help pay any fines (this law is subject to unique interpretations in 28 distinct countries, so nobody can actually know what "full" compliance is), or simply block EU traffic. We chose the latter, and many thousands of other sites that have no intention of doing anything nefarious with your data will as well.

Barrin92 8y ago
I do understand that it might also hit legitimate business models that many users enjoy and that it can be stressful for businesses who deal with userdata in best interests, but on the other hand there really is no way to overhaul important regulation like this without any kind of friction. The laws need to be broad enough to apply to everyone and have the intended effect, which means that especially in the early stages with a lack of clarity and guidelines it's goig to be a little messy. But I look at it like I'd look at a 20th century environmental regulation. Yes, it might impact genuinely good businesses, but at some point you have to do it if you want to advance user interests. I don't really see a better point than now.
- downandout 8y ago
  What will happen is that the EU will just have access to a dramatically smaller array of sites on the Internet - like a self-imposed Great Firewall. The only services that can even afford to attempt to comply and have the necessary liability insurance against fines are massive companies - think Facebook and Google. The problem with that is that if your data is in the hands of a few large players, and you have limited choices for the services they offer, the whole concept of "affirmative consent" is pointless because you have few choices about whom you give that consent to. So it isn't businesses that GDPR hurts (except for those that rely on EU traffic, who will make up for GDPR costs somehow - at your expense), it's actually the EU itself. Consumer choice is a good thing, and this law will dramatically limit it.
  - craigsmansion 8y ago
    > The only services that can even afford to attempt to comply and have the necessary liability insurance Liability for what? You're not going to get sued. At worst you're going to get fined for negligence, probably after after repeated warnings. I don't think you can find insurance against willful repeated misconduct. It's only if your service can't possibly comply without losing your bottom line that you have to worry, in which case the GDPR is working as intended. Find a better business model for EU costumers, or cease your presence there. It's a win-win for EU consumers either way.
    - glogla 8y ago
      > Liability for what? You're not going to get sued. Yes, this is the most confusing thing - a lot of posters talk about "being sued because of GDPR" but that's not how it works. And it's always people with the same arguments - small companies, getting sued, crazy money for lawyers, etc. If I was paranoid, I would think this is some kind of organized campaign to spread FUD and have as many people be against GDPR as possible, perhaps as a way to make sure something similar won't happen in the US. It's probably just misinformed people.
      - craigsmansion 8y ago
        > It's probably just misinformed people. Probably. There seems to be a real disconnect between US and EU perception of legal and business landscapes here, with the US worrying about the EU legislation more than those based in the EU, who would be far more affected by it (after all, they can't "shut out" Europe).
      - Silhouette 8y ago
        And it's always people with the same arguments - small companies, getting sued, crazy money for lawyers, etc. One of those things is not like the others. I have no idea where the meme about exploitative lawyers looking for minor non-compliance came from, because the primary means of enforcement under the GDPR is regulatory action. The whole strategy of threatening legal action to prompt a profitable out of court settlement is much less viable under typical EU legal systems than in the US anyway. However, GDPR definitely can cause significant compliance overheads for small organisations, including those who have done nothing wrong. The official guidance is still terrible, and just the uncertainty around several key points is a problem for reasons we've previously discussed at length on HN. Trusting in regulators to do the right thing is also a risky strategy. I write this as someone whose business really did receive a crippling demand for monies never owed direct from an EU government tax office after the VAT changes, with very scary accompanying threats and impossibly short timescales to respond, and there were many thousands of other small businesses similarly attacked just in the incidents I'm personally aware of. From a pragmatic point of view, the regulator in my country is well known to be under-funded and under-staffed, but even that doesn't necessarily help because as with other issues within their remit, it makes smaller organisations easier targets than those with big legal departments to fight back.
- oneeyedpigeon 8y ago
  The biggest issue for me is the punitive fines: 4% of revenue or €20 million whichever is greater. That just punishes small companies disproportionately.
  - TazeTSchnitzel 8y ago
    This is a maximum fine. You would not be fined that for a first, unintended offence. You would be warned.
    - downandout 8y ago
      This is a maximum fine. You would not be fined that for a first, unintended offence. You would be warned. You don't know that. Show me where, written in the GDPR, it says that warnings must be issued or that there are any circumstances under which the maximum fine must not be imposed. I'll save you some time. It's not there.
      - egourlao 8y ago
        Article 83: > When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to [...] the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement. https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/
        downandout 8y ago
        That doesn't limit their ability to impose the maximum fine for a first, single violation. It says they should consider some things. But it does not limit their statutory ability to impose the maximum without warning.
        Latty 8y ago
        In terms of liability insurance, which is the claim here though, the reality is the insurer knows that the EU isn't going to dump 20 million fines on every small company making a first offence. The idea that they are going to treat it like that's the likely outcome is insane.
dvfjsdhgfv 8y ago
> After consultation with experts, we had to make the decision to either spend high six/low seven figures to hopefully comply and buy insurance Change your experts. If you really aren't doing anything nefarious with the data as you say, the adjustments are relatively easy to understand, and very often also to implement. In fact, many subregulations of the GDPR were already implemented in many companies in Europe, so what's happening it's shocking much more to American companies, not so much the European ones.
- downandout 8y ago
  People who say this quite simply haven't looked at the law or tried to comply themselves. There was someone else in another thread spouting something about how easy the law was to comply with, having helped implement GDPR for his employer. When I visited his employer's site - through an EU proxy no less - I found an undisclosed Google Analytics and Facebook pixel automatically loaded on the page. In 20 days, that 1 visit could mean a $20 million fine for them.
  - the_mitsuhiko 8y ago
    > I found an undisclosed Google Analytics and Facebook pixel automatically loaded on the page. In 20 days, that 1 visit could mean a $20 million fine for them. You will not be fined 20 million for that. This argument is beyond absurd.
    - downandout 8y ago
      It is absurd, but the letter of the law says they can do it, and there is nothing stopping them from doing it.
      - dvfjsdhgfv 8y ago
        Your statement is false. What it is is the upper bound. The letter of the law clearly says the punishment must be adequate.
  - 8y ago
lucb1e 8y ago
I've heard this sentiment being expressed by at least one person in all of these threads, but you're one of the first that actually mentions having consulted with a lawyer. The thing I keep asking is: what is new? I have yet to hear anything non-trivial which a company suddenly has to do, which wasn't required by any EU country before. The only new thing seems to be higher fines and aligning laws in all EU countries, rather than having different implementations of roughly the same thing. But if you don't comply with GDPR, odds are that you should never have been able to do business with a lot of European countries. To the best of my knowledge, you should have geoblocked the Netherlands long ago (the only country I know the laws well enough of, to say that there is truly only a small difference between the 2002 WBP and the new GDPR) if you have to close to the EU for GDPR.
- downandout 8y ago
  The biggest 2 issues (at least for non-EU companies) are the extraterritorial reach, and the absurd maximum fines that can indeed be assessed for a first, single violation. Whether or not that is the public's understanding of the law, that is how it is written, and when it comes to enforcement, the letter of the law is the only thing that matters. So we have a foreign government (to us) that has asserted authority to reach beyond its borders and into our pockets with an absurdly complex regulation, where a single violation would financially destroy the company. Since I don't have $20 million to give to them, and the families of my employees depend on their income for things like food and housing, I have to either carry expensive liability insurance to protect against that, or block EU traffic. For us, and I suspect most other sites on the planet, that's an easy decision to make. I'll take a 5%-10% hit in revenue from the loss of EU traffic and be able to sleep at night knowing that someone in a country I've never been to isn't out there filing documents that have the ability to destroy my and my employees' livelihoods. I won't go into the minutiae of why it's so easy to violate and why most of the experts we have spoken to agree that being compliant is an uncertain endeavor at best, even if you want to comply, because that would be a very long winded comment. But if you do a Google search, you'll see the gist of the problems.
  - lucb1e 8y ago
switch007 8y ago
> ...will also have to close to EU traffic simply to avoid the liability. Hopefully not permanently. Maybe over time the law will be clarified. I can definitely see EU customers more or less funding GDPR compliance in the long term, though (see EU intervening in roaming charges - https://www.theguardian.com/money/2018/apr/30/three-mobile-rises-out-of-contract-charges-pay-monthly-customers https://www.theguardian.com/money/2018/apr/30/three-mobile-r...).
glogla 8y ago
> At my company, we do nothing nefarious with user data. Then why do you need millions of dollars to make it reasonable and transparent? This is no different to environmental regulation or something like this. Yes, making you stop pour acid into river will make your business more difficult. No, it does not matter. You say "we don't do bad stuff to environment but complying with 'stop pouring acid into rivers' legislation will cost us spend high six/low seven figures"? That kind of seems like you're not exactly telling us the truth, doesn't it? Thinking about this, we should probably compile a list of companies that do this, so we can name and shame them.
- downandout 8y ago
  Then why do you need millions of dollars to make it reasonable and transparent? Reasonable and transparent would be fine. That may be the spirit of GDPR, and I'm sure it's been sold to the EU public like this. But the wording is anything but reasonable. You are talking about things you obviously haven't personally evaluated.
  - the_mitsuhiko 8y ago
    > That may be the spirit of GDPR, but the wording is anything but reasonable. What specifically is not reasonable? GDPR is by european law texts one of the most readable ones.
    - downandout 8y ago
      I'm not going to get into a long discussion about the fine points of the GDPR. I've engaged in several, and they go on for countless comments with self proclaimed HN GDPR experts saying how each thing is easily overcome, followed by a deluge of downvotes for every comment saying that they are (legitimately) wrong. But here's just one place to get you started: https://www.exchangewire.com/blog/2016/07/07/an-american-perspective-the-three-worst-things-about-the-eu-gdpr/ https://www.exchangewire.com/blog/2016/07/07/an-american-per...
      - 8y ago
throwaway413 8y ago
You don’t explicitly state what you DO do with your users’ data, and that makes me skeptical that your use case is non-controversial.
- tzahola 8y ago
  This. I’ve become rather interested in their innocent business model that’s somehow still against the spirit of GDPR.
jotm 8y ago
Clearly, you don't make much profit off EU citizens, so good decision.
tzahola 8y ago
>we do nothing nefarious with user data If that was true then you would already be GDPR-compliant, by definition.
- downandout 8y ago
  Whatever public education campaign they are running over there must be incredibly misleading. Read it. It doesn’t just say “hey guys, stop doing nefarious things with people’s data*. That may be how it was sold (and is now apparently being explained) to the public, but that’s not how it was implemented.
  - tzahola 8y ago
    Your argument would be much more convincing if you shared with us what your company is doing with its users’ data. The fact that you’ve failed to do so suggests that your use case might not be that innocent, in which case it’s a good thing that GDPR makes you cease it.
    - downandout 8y ago
      We let people log in. That’s pretty much it.
einarfd 8y ago
I wonder what kind of lawyer your company consulted with. Are you sure they are experience with EU law? If they where American lawyers with no international law experience. Asking them would probably be as helpful as asking a Common Lisp expert about help with your Java application, if you are lucky it might work out, but probably not. In the same way not all programing languages are the same, nor is all law the same.
- dogma1138 8y ago
  The irony is is that that’s is exactly one fo the manor problems with the GDPR. And the GP sounds like a large business a small business that maybe has 50 orders a month form EU customers won’t be able to afford a top tier international firm, hire a mandatory local representative and open themselves to this level of liability. The irony is that the companies that can both comply and abuse the GDPR to their benefit are the ones that regulation such as the GDPR was supposed to protect us from.
YeGoblynQueenne 8y ago
>> (this law is subject to unique interpretations in 28 distinct countries, so nobody can actually know what "full" compliance is) As has been discussed before, the GDPR is an EU regulation and as such does not require national governments to pass any enabling legislation and is directly binding and applicable, therefore it is is not subject to "unique interpretation" of any kind. In fact, that was the whole point of making it a regulation, rather than a directive (like the previous Data Protection Directive). Furthermore, the regulation establishes a European Data Protection Board, tasked with ensuring the consistent application of the GDPR. Articles 55 to 63 of the regulation are devoted to cooperation and consistency, with procedures for multiple Data Protection Authoritiess to coordinate investigations and promote consistent decisions and policies reviewed by the Board and reported to the European Commission. Now, can we please stop it with the entirely unsubstantiated statements about how everyone will interpret the GDPR as they please?
- joejerryronnie 8y ago
  Seeing as the EU passes retroactive laws which make things that used to be perfectly legal all of a sudden illegal and subject to huge fines - I would say your viewpoint of one unifying interpretation of GDPR that companies can rely on is extremely naive.
  - deleted 8y ago
    [deleted]
  - YeGoblynQueenne 8y ago
    >> Seeing as the EU passes retroactive laws which make things that used to be perfectly legal all of a sudden illegal and subject to huge fines When has that happened?

Barrin92 8y ago

I do understand that it might also hit legitimate business models that many users enjoy and that it can be stressful for businesses who deal with userdata in best interests, but on the other hand there really is no way to overhaul important regulation like this without any kind of friction. The laws need to be broad enough to apply to everyone and have the intended effect, which means that especially in the early stages with a lack of clarity and guidelines it's goig to be a little messy. But I look at it like I'd look at a 20th century environmental regulation. Yes, it might impact genuinely good businesses, but at some point you have to do it if you want to advance user interests. I don't really see a better point than now.

downandout 8y ago
What will happen is that the EU will just have access to a dramatically smaller array of sites on the Internet - like a self-imposed Great Firewall. The only services that can even afford to attempt to comply and have the necessary liability insurance against fines are massive companies - think Facebook and Google. The problem with that is that if your data is in the hands of a few large players, and you have limited choices for the services they offer, the whole concept of "affirmative consent" is pointless because you have few choices about whom you give that consent to. So it isn't businesses that GDPR hurts (except for those that rely on EU traffic, who will make up for GDPR costs somehow - at your expense), it's actually the EU itself. Consumer choice is a good thing, and this law will dramatically limit it.
- craigsmansion 8y ago
  > The only services that can even afford to attempt to comply and have the necessary liability insurance Liability for what? You're not going to get sued. At worst you're going to get fined for negligence, probably after after repeated warnings. I don't think you can find insurance against willful repeated misconduct. It's only if your service can't possibly comply without losing your bottom line that you have to worry, in which case the GDPR is working as intended. Find a better business model for EU costumers, or cease your presence there. It's a win-win for EU consumers either way.
  - glogla 8y ago
    > Liability for what? You're not going to get sued. Yes, this is the most confusing thing - a lot of posters talk about "being sued because of GDPR" but that's not how it works. And it's always people with the same arguments - small companies, getting sued, crazy money for lawyers, etc. If I was paranoid, I would think this is some kind of organized campaign to spread FUD and have as many people be against GDPR as possible, perhaps as a way to make sure something similar won't happen in the US. It's probably just misinformed people.
    - craigsmansion 8y ago
      > It's probably just misinformed people. Probably. There seems to be a real disconnect between US and EU perception of legal and business landscapes here, with the US worrying about the EU legislation more than those based in the EU, who would be far more affected by it (after all, they can't "shut out" Europe).
    - Silhouette 8y ago
      And it's always people with the same arguments - small companies, getting sued, crazy money for lawyers, etc. One of those things is not like the others. I have no idea where the meme about exploitative lawyers looking for minor non-compliance came from, because the primary means of enforcement under the GDPR is regulatory action. The whole strategy of threatening legal action to prompt a profitable out of court settlement is much less viable under typical EU legal systems than in the US anyway. However, GDPR definitely can cause significant compliance overheads for small organisations, including those who have done nothing wrong. The official guidance is still terrible, and just the uncertainty around several key points is a problem for reasons we've previously discussed at length on HN. Trusting in regulators to do the right thing is also a risky strategy. I write this as someone whose business really did receive a crippling demand for monies never owed direct from an EU government tax office after the VAT changes, with very scary accompanying threats and impossibly short timescales to respond, and there were many thousands of other small businesses similarly attacked just in the incidents I'm personally aware of. From a pragmatic point of view, the regulator in my country is well known to be under-funded and under-staffed, but even that doesn't necessarily help because as with other issues within their remit, it makes smaller organisations easier targets than those with big legal departments to fight back.
oneeyedpigeon 8y ago
The biggest issue for me is the punitive fines: 4% of revenue or €20 million whichever is greater. That just punishes small companies disproportionately.
- TazeTSchnitzel 8y ago
  This is a maximum fine. You would not be fined that for a first, unintended offence. You would be warned.
  - downandout 8y ago
    This is a maximum fine. You would not be fined that for a first, unintended offence. You would be warned. You don't know that. Show me where, written in the GDPR, it says that warnings must be issued or that there are any circumstances under which the maximum fine must not be imposed. I'll save you some time. It's not there.
    - egourlao 8y ago
      Article 83: > When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to [...] the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement. https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/
      - downandout 8y ago
        That doesn't limit their ability to impose the maximum fine for a first, single violation. It says they should consider some things. But it does not limit their statutory ability to impose the maximum without warning.
        Latty 8y ago
        In terms of liability insurance, which is the claim here though, the reality is the insurer knows that the EU isn't going to dump 20 million fines on every small company making a first offence. The idea that they are going to treat it like that's the likely outcome is insane.

dvfjsdhgfv 8y ago

> After consultation with experts, we had to make the decision to either spend high six/low seven figures to hopefully comply and buy insurance Change your experts. If you really aren't doing anything nefarious with the data as you say, the adjustments are relatively easy to understand, and very often also to implement. In fact, many subregulations of the GDPR were already implemented in many companies in Europe, so what's happening it's shocking much more to American companies, not so much the European ones.

downandout 8y ago
People who say this quite simply haven't looked at the law or tried to comply themselves. There was someone else in another thread spouting something about how easy the law was to comply with, having helped implement GDPR for his employer. When I visited his employer's site - through an EU proxy no less - I found an undisclosed Google Analytics and Facebook pixel automatically loaded on the page. In 20 days, that 1 visit could mean a $20 million fine for them.
- the_mitsuhiko 8y ago
  > I found an undisclosed Google Analytics and Facebook pixel automatically loaded on the page. In 20 days, that 1 visit could mean a $20 million fine for them. You will not be fined 20 million for that. This argument is beyond absurd.
  - downandout 8y ago
    It is absurd, but the letter of the law says they can do it, and there is nothing stopping them from doing it.
    - dvfjsdhgfv 8y ago
      Your statement is false. What it is is the upper bound. The letter of the law clearly says the punishment must be adequate.
- 8y ago

lucb1e 8y ago

I've heard this sentiment being expressed by at least one person in all of these threads, but you're one of the first that actually mentions having consulted with a lawyer. The thing I keep asking is: what is new? I have yet to hear anything non-trivial which a company suddenly has to do, which wasn't required by any EU country before. The only new thing seems to be higher fines and aligning laws in all EU countries, rather than having different implementations of roughly the same thing. But if you don't comply with GDPR, odds are that you should never have been able to do business with a lot of European countries. To the best of my knowledge, you should have geoblocked the Netherlands long ago (the only country I know the laws well enough of, to say that there is truly only a small difference between the 2002 WBP and the new GDPR) if you have to close to the EU for GDPR.

downandout 8y ago
The biggest 2 issues (at least for non-EU companies) are the extraterritorial reach, and the absurd maximum fines that can indeed be assessed for a first, single violation. Whether or not that is the public's understanding of the law, that is how it is written, and when it comes to enforcement, the letter of the law is the only thing that matters. So we have a foreign government (to us) that has asserted authority to reach beyond its borders and into our pockets with an absurdly complex regulation, where a single violation would financially destroy the company. Since I don't have $20 million to give to them, and the families of my employees depend on their income for things like food and housing, I have to either carry expensive liability insurance to protect against that, or block EU traffic. For us, and I suspect most other sites on the planet, that's an easy decision to make. I'll take a 5%-10% hit in revenue from the loss of EU traffic and be able to sleep at night knowing that someone in a country I've never been to isn't out there filing documents that have the ability to destroy my and my employees' livelihoods. I won't go into the minutiae of why it's so easy to violate and why most of the experts we have spoken to agree that being compliant is an uncertain endeavor at best, even if you want to comply, because that would be a very long winded comment. But if you do a Google search, you'll see the gist of the problems.
- lucb1e 8y ago

switch007 8y ago

> ...will also have to close to EU traffic simply to avoid the liability. Hopefully not permanently. Maybe over time the law will be clarified. I can definitely see EU customers more or less funding GDPR compliance in the long term, though (see EU intervening in roaming charges - https://www.theguardian.com/money/2018/apr/30/three-mobile-rises-out-of-contract-charges-pay-monthly-customers https://www.theguardian.com/money/2018/apr/30/three-mobile-r...).

glogla 8y ago

> At my company, we do nothing nefarious with user data. Then why do you need millions of dollars to make it reasonable and transparent? This is no different to environmental regulation or something like this. Yes, making you stop pour acid into river will make your business more difficult. No, it does not matter. You say "we don't do bad stuff to environment but complying with 'stop pouring acid into rivers' legislation will cost us spend high six/low seven figures"? That kind of seems like you're not exactly telling us the truth, doesn't it? Thinking about this, we should probably compile a list of companies that do this, so we can name and shame them.

downandout 8y ago
Then why do you need millions of dollars to make it reasonable and transparent? Reasonable and transparent would be fine. That may be the spirit of GDPR, and I'm sure it's been sold to the EU public like this. But the wording is anything but reasonable. You are talking about things you obviously haven't personally evaluated.
- the_mitsuhiko 8y ago
  > That may be the spirit of GDPR, but the wording is anything but reasonable. What specifically is not reasonable? GDPR is by european law texts one of the most readable ones.
  - downandout 8y ago
    I'm not going to get into a long discussion about the fine points of the GDPR. I've engaged in several, and they go on for countless comments with self proclaimed HN GDPR experts saying how each thing is easily overcome, followed by a deluge of downvotes for every comment saying that they are (legitimately) wrong. But here's just one place to get you started: https://www.exchangewire.com/blog/2016/07/07/an-american-perspective-the-three-worst-things-about-the-eu-gdpr/ https://www.exchangewire.com/blog/2016/07/07/an-american-per...
    - 8y ago

throwaway413 8y ago

You don’t explicitly state what you DO do with your users’ data, and that makes me skeptical that your use case is non-controversial.

tzahola 8y ago
This. I’ve become rather interested in their innocent business model that’s somehow still against the spirit of GDPR.

jotm 8y ago

Clearly, you don't make much profit off EU citizens, so good decision.

tzahola 8y ago

>we do nothing nefarious with user data If that was true then you would already be GDPR-compliant, by definition.

downandout 8y ago
Whatever public education campaign they are running over there must be incredibly misleading. Read it. It doesn’t just say “hey guys, stop doing nefarious things with people’s data*. That may be how it was sold (and is now apparently being explained) to the public, but that’s not how it was implemented.
- tzahola 8y ago
  Your argument would be much more convincing if you shared with us what your company is doing with its users’ data. The fact that you’ve failed to do so suggests that your use case might not be that innocent, in which case it’s a good thing that GDPR makes you cease it.
  - downandout 8y ago
    We let people log in. That’s pretty much it.

einarfd 8y ago

I wonder what kind of lawyer your company consulted with. Are you sure they are experience with EU law? If they where American lawyers with no international law experience. Asking them would probably be as helpful as asking a Common Lisp expert about help with your Java application, if you are lucky it might work out, but probably not. In the same way not all programing languages are the same, nor is all law the same.

dogma1138 8y ago
The irony is is that that’s is exactly one fo the manor problems with the GDPR. And the GP sounds like a large business a small business that maybe has 50 orders a month form EU customers won’t be able to afford a top tier international firm, hire a mandatory local representative and open themselves to this level of liability. The irony is that the companies that can both comply and abuse the GDPR to their benefit are the ones that regulation such as the GDPR was supposed to protect us from.

YeGoblynQueenne 8y ago

>> (this law is subject to unique interpretations in 28 distinct countries, so nobody can actually know what "full" compliance is) As has been discussed before, the GDPR is an EU regulation and as such does not require national governments to pass any enabling legislation and is directly binding and applicable, therefore it is is not subject to "unique interpretation" of any kind. In fact, that was the whole point of making it a regulation, rather than a directive (like the previous Data Protection Directive). Furthermore, the regulation establishes a European Data Protection Board, tasked with ensuring the consistent application of the GDPR. Articles 55 to 63 of the regulation are devoted to cooperation and consistency, with procedures for multiple Data Protection Authoritiess to coordinate investigations and promote consistent decisions and policies reviewed by the Board and reported to the European Commission. Now, can we please stop it with the entirely unsubstantiated statements about how everyone will interpret the GDPR as they please?

joejerryronnie 8y ago
Seeing as the EU passes retroactive laws which make things that used to be perfectly legal all of a sudden illegal and subject to huge fines - I would say your viewpoint of one unifying interpretation of GDPR that companies can rely on is extremely naive.
- deleted 8y ago
  [deleted]
- YeGoblynQueenne 8y ago
  >> Seeing as the EU passes retroactive laws which make things that used to be perfectly legal all of a sudden illegal and subject to huge fines When has that happened?