4 ms·

>If that's going to be the sort of business that the GDPR makes unprofitable and unworkable then I'm very proud to be a European citizen. You would you be equa

>If that's going to be the sort of business that the GDPR makes unprofitable and unworkable then I'm very proud to be a European citizen. You would you be equally proud if we sprayed weed-killer chemicals everywhere to wipe out dangerous plants ("If Water Hemlock is the type of plant that RoundUp kills, then I'm very proud to be a Monsanto stock owner") while killing scores of non-harmful plants? Your scope is narrowly framed and misses the big picture.

matthewmacleod 8y ago
What’s the big picture? What business models are being rendered non viable by GDPR that we should support?
- dogma1138 8y ago
  Any business model that has any interaction with anything that the GDPR specified as personal data. Here is an example: I’m a ukulele maker from Argentina I sell 50 ukulele‘s a month to the EU via my webshop and I use PayPal as my payment processor. I collect the following information from you that is considered PII under the GDPR. IP address. Name and Address. Phone number. EMail address. I don’t need to do anything nefarious with that information to have a huge headache and a potentially huge liability under the GDPR if my data leaks or I don’t comply with a request by a EU customer. I’m also out of luck if my local legislation contradicts the GDPR since unlike EU member states I don’t have a DPA and my local laws mean squat to the EU.
  - gerdesj 8y ago
    Leaking data is generally considered shit so quite right - get a grip on your security. Complying with a request to be forgotten is surely not too hard and also you still have a right to hold on to probably all Ukelele sales related data for your reasonable accounting purposes. IP address - maybe not unless you use an IPSEC VPN for support 8) It really is not as bad as you imply. Bear in mind these regs are designed to be complied with by EVERY SINGLE BUSINESS (BIG OR SMALL, TECHNICALLY SOPHISTICATED OR NOT) IN THE ENTIRETY OF THE EU. You are a HN commentator with ~9500 karma - you are probably not stupid and will cope fine. Its not really a bad idea to take a long look at the data you hold and consider its lifecycle in your org. If it helps, I (UK IT business owner) am not frantically removing IP addresses from logs. I am however enjoying the thought that some bloody stupidly large email accounts will become indefensible, post 25 May. Also the stupid "archives" of old customer docs can damn well get deleted, rather than cluttering up my file servers.
    - dogma1138 8y ago
      Have you mapped all the processes through which you collect data? Have you identified the lawful basis for each type processing? Remember consent while required is not a legal basis for processing or collecting information. Have you verified that there are no ways for you to provide a service without collecting / processing a specific set of information (this also includes switching to a different provider within the same domain). Did you check with all your suppliers, business partners etc. about their compliance status? >It really is not as bad as you imply. Bear in mind these regs are designed to be complied with by EVERY SINGLE BUSINESS (BIG OR SMALL, TECHNICALLY SOPHISTICATED OR NOT) IN THE ENTIRETY OF THE EU. You are a HN commentator with ~9500 karma - you are probably not stupid and will cope fine. It actually is I think many individuals as well as small and medium organizations don't realize the full extent yet and the nuances of switching from the DPA to the GDPR. I work for a very large global financial exchange and I've seen estimates from multiple sources of it's impact I've also seen the estimates that LSEG did. And oh boy it will have a much more substantial impact than what most people here predict. In fact will guarantee that if you were to be audited on the 26th of May (well the ICO won't do it on a Sat) by the ICO you would be found in violation of the GDPR in one form or another. I think the GDPR is overreaching and there should be exemptions for small businesses. I think the GDPR needs to have provisions for blockchain and current cryptocurrencies. I think that fact that the EU wants to apply it extrajudicially to non-EU entities and organizations is terrifying and amounts to sheer tyranny since they have no say in how the law is enforced or interpreted nor do they have any representation. And it's clear that you and me think about this on completely different levels, you were making jokes about wiping IP addresses from your logs about using VPN. If we go back to my specific example then how much do you think it would cost me to get a lawyer that could advise me on GDPR in say San Juan vs London or Amsterdam? How much would it cost me to have a mandatory local representative in the EU? In the UK if I need help I'll talk to the ICO, I'll talk to my MP, I'll take to my EU MP, who the hell do I talk to about GDPR as a ukulele maker from San Juan. Do you still not see a problem here? It's terrifying to me that there is already ongoing strong arming to force certain service providers in payment, ecommerce and hosting industries to ensure that all their non EU customers to comply with the GDPR or to face non-compliance which will force businesses to stop offering services to EU residents and or consolidate the already heavily monopolized industry even further by allowing a few companies to dominate the market by providing "GDPR certified" walled gardens.
  - saagarjha 8y ago
    If the data is relevant to your business, and you keep it safe, you'll be fine. But it's not fine if you sell that information to an advertiser.
    - dogma1138 8y ago
      I suggest you read the GDPR or even go through the ICO guided tools first. The anecdotal examples are you bring are irrelevant. If anything than because you can actually do that under the GDPR: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." The problem that this has to be evaluated against "the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller." This is more or less going to be open to the interpretation of the DPA and your local EU memberstate laws, the problem is that non-EU entities don't get a DPA, their legal system isn't part of the decision making and they are now open to 28 different interpretations byu 28 different regulators (DPA in each EUMS) and 28 different legal systems.
- DINKDINK 8y ago
  The big picture is that OP doesn't discuss or realize the policy iatrogenics. It's equivalent of saying: "If we surveil everyone's communications, we can catch all murders and child abusers!" without addressing the fact that oppressive regimes' capabilities are now super charged to kill and oppress dissidents.

matthewmacleod 8y ago

What’s the big picture? What business models are being rendered non viable by GDPR that we should support?

dogma1138 8y ago
Any business model that has any interaction with anything that the GDPR specified as personal data. Here is an example: I’m a ukulele maker from Argentina I sell 50 ukulele‘s a month to the EU via my webshop and I use PayPal as my payment processor. I collect the following information from you that is considered PII under the GDPR. IP address. Name and Address. Phone number. EMail address. I don’t need to do anything nefarious with that information to have a huge headache and a potentially huge liability under the GDPR if my data leaks or I don’t comply with a request by a EU customer. I’m also out of luck if my local legislation contradicts the GDPR since unlike EU member states I don’t have a DPA and my local laws mean squat to the EU.
- gerdesj 8y ago
  Leaking data is generally considered shit so quite right - get a grip on your security. Complying with a request to be forgotten is surely not too hard and also you still have a right to hold on to probably all Ukelele sales related data for your reasonable accounting purposes. IP address - maybe not unless you use an IPSEC VPN for support 8) It really is not as bad as you imply. Bear in mind these regs are designed to be complied with by EVERY SINGLE BUSINESS (BIG OR SMALL, TECHNICALLY SOPHISTICATED OR NOT) IN THE ENTIRETY OF THE EU. You are a HN commentator with ~9500 karma - you are probably not stupid and will cope fine. Its not really a bad idea to take a long look at the data you hold and consider its lifecycle in your org. If it helps, I (UK IT business owner) am not frantically removing IP addresses from logs. I am however enjoying the thought that some bloody stupidly large email accounts will become indefensible, post 25 May. Also the stupid "archives" of old customer docs can damn well get deleted, rather than cluttering up my file servers.
  - dogma1138 8y ago
    Have you mapped all the processes through which you collect data? Have you identified the lawful basis for each type processing? Remember consent while required is not a legal basis for processing or collecting information. Have you verified that there are no ways for you to provide a service without collecting / processing a specific set of information (this also includes switching to a different provider within the same domain). Did you check with all your suppliers, business partners etc. about their compliance status? >It really is not as bad as you imply. Bear in mind these regs are designed to be complied with by EVERY SINGLE BUSINESS (BIG OR SMALL, TECHNICALLY SOPHISTICATED OR NOT) IN THE ENTIRETY OF THE EU. You are a HN commentator with ~9500 karma - you are probably not stupid and will cope fine. It actually is I think many individuals as well as small and medium organizations don't realize the full extent yet and the nuances of switching from the DPA to the GDPR. I work for a very large global financial exchange and I've seen estimates from multiple sources of it's impact I've also seen the estimates that LSEG did. And oh boy it will have a much more substantial impact than what most people here predict. In fact will guarantee that if you were to be audited on the 26th of May (well the ICO won't do it on a Sat) by the ICO you would be found in violation of the GDPR in one form or another. I think the GDPR is overreaching and there should be exemptions for small businesses. I think the GDPR needs to have provisions for blockchain and current cryptocurrencies. I think that fact that the EU wants to apply it extrajudicially to non-EU entities and organizations is terrifying and amounts to sheer tyranny since they have no say in how the law is enforced or interpreted nor do they have any representation. And it's clear that you and me think about this on completely different levels, you were making jokes about wiping IP addresses from your logs about using VPN. If we go back to my specific example then how much do you think it would cost me to get a lawyer that could advise me on GDPR in say San Juan vs London or Amsterdam? How much would it cost me to have a mandatory local representative in the EU? In the UK if I need help I'll talk to the ICO, I'll talk to my MP, I'll take to my EU MP, who the hell do I talk to about GDPR as a ukulele maker from San Juan. Do you still not see a problem here? It's terrifying to me that there is already ongoing strong arming to force certain service providers in payment, ecommerce and hosting industries to ensure that all their non EU customers to comply with the GDPR or to face non-compliance which will force businesses to stop offering services to EU residents and or consolidate the already heavily monopolized industry even further by allowing a few companies to dominate the market by providing "GDPR certified" walled gardens.
- saagarjha 8y ago
  If the data is relevant to your business, and you keep it safe, you'll be fine. But it's not fine if you sell that information to an advertiser.
  - dogma1138 8y ago
    I suggest you read the GDPR or even go through the ICO guided tools first. The anecdotal examples are you bring are irrelevant. If anything than because you can actually do that under the GDPR: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." The problem that this has to be evaluated against "the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller." This is more or less going to be open to the interpretation of the DPA and your local EU memberstate laws, the problem is that non-EU entities don't get a DPA, their legal system isn't part of the decision making and they are now open to 28 different interpretations byu 28 different regulators (DPA in each EUMS) and 28 different legal systems.
DINKDINK 8y ago
The big picture is that OP doesn't discuss or realize the policy iatrogenics. It's equivalent of saying: "If we surveil everyone's communications, we can catch all murders and child abusers!" without addressing the fact that oppressive regimes' capabilities are now super charged to kill and oppress dissidents.