8 ms·

What will happen is that the EU will just have access to a dramatically smaller array of sites on the Internet - like a self-imposed Great Firewall. The only s

What will happen is that the EU will just have access to a dramatically smaller array of sites on the Internet - like a self-imposed Great Firewall. The only services that can even afford to attempt to comply and have the necessary liability insurance against fines are massive companies - think Facebook and Google. The problem with that is that if your data is in the hands of a few large players, and you have limited choices for the services they offer, the whole concept of "affirmative consent" is pointless because you have few choices about whom you give that consent to. So it isn't businesses that GDPR hurts (except for those that rely on EU traffic, who will make up for GDPR costs somehow - at your expense), it's actually the EU itself. Consumer choice is a good thing, and this law will dramatically limit it.

craigsmansion 8y ago
> The only services that can even afford to attempt to comply and have the necessary liability insurance Liability for what? You're not going to get sued. At worst you're going to get fined for negligence, probably after after repeated warnings. I don't think you can find insurance against willful repeated misconduct. It's only if your service can't possibly comply without losing your bottom line that you have to worry, in which case the GDPR is working as intended. Find a better business model for EU costumers, or cease your presence there. It's a win-win for EU consumers either way.
- glogla 8y ago
  > Liability for what? You're not going to get sued. Yes, this is the most confusing thing - a lot of posters talk about "being sued because of GDPR" but that's not how it works. And it's always people with the same arguments - small companies, getting sued, crazy money for lawyers, etc. If I was paranoid, I would think this is some kind of organized campaign to spread FUD and have as many people be against GDPR as possible, perhaps as a way to make sure something similar won't happen in the US. It's probably just misinformed people.
  - craigsmansion 8y ago
    > It's probably just misinformed people. Probably. There seems to be a real disconnect between US and EU perception of legal and business landscapes here, with the US worrying about the EU legislation more than those based in the EU, who would be far more affected by it (after all, they can't "shut out" Europe).
  - Silhouette 8y ago
    And it's always people with the same arguments - small companies, getting sued, crazy money for lawyers, etc. One of those things is not like the others. I have no idea where the meme about exploitative lawyers looking for minor non-compliance came from, because the primary means of enforcement under the GDPR is regulatory action. The whole strategy of threatening legal action to prompt a profitable out of court settlement is much less viable under typical EU legal systems than in the US anyway. However, GDPR definitely can cause significant compliance overheads for small organisations, including those who have done nothing wrong. The official guidance is still terrible, and just the uncertainty around several key points is a problem for reasons we've previously discussed at length on HN. Trusting in regulators to do the right thing is also a risky strategy. I write this as someone whose business really did receive a crippling demand for monies never owed direct from an EU government tax office after the VAT changes, with very scary accompanying threats and impossibly short timescales to respond, and there were many thousands of other small businesses similarly attacked just in the incidents I'm personally aware of. From a pragmatic point of view, the regulator in my country is well known to be under-funded and under-staffed, but even that doesn't necessarily help because as with other issues within their remit, it makes smaller organisations easier targets than those with big legal departments to fight back.
- downandout 8y ago
  Liability for what? $20 million in fines that - despite the protestations of everyone that has ever commented in these threads - can be imposed for a first, single violation, without any warnings. If they meant for there to be any safeguards for companies, that language would have been built into the GDPR. But it wasn't. There are no limits, other than $10/$20 million.
  - einarfd 8y ago
    People have tried to have insurance against speeding tickets in my part of the world (Scandinavia), and those have been deemed illegal and stopped from paying out. I would expect a GDPR insurance would end up getting the same treatment. I can't guarantee that this would happen in all of Europe, but I do expect it would. When it comes to getting the max fine at first strike. The GDPR is not the first law in the EU with teeth. There are strict laws about corruption, pollution and antitrust here as well. Do companies get dinged with max penalty from the start violating these laws, not that I've seen. Why should enforcement of the GDPR be different from the current laws?
  - hluska 8y ago
    Do yourself a favour. Spend some time and read other EU laws with teeth. Look at the theoretical maximum versus the practical. Then come back and try these same arguments.
    - Karunamon 8y ago
      I don't care what the regulators might assess as a fine out of the goodness of their heart or how annoyed they are or how late they ate lunch that day[1]. I care what the law says and provides for. http://blogs.discovermagazine.com/notrocketscience/2011/04/11/justice-is-served-but-more-so-after-lunch-how-food-breaks-sway-the-decisions-of-judges/ http://blogs.discovermagazine.com/notrocketscience/2011/04/1...
      - hluska 8y ago
        Then, you should give articles 58 and 83 a read. 58 details EU powers under GDPR. 83 details the factors that should be taken into account before levying administrative fines. In 83, you'll notice that the character of the infringement and any acts to mitigate the damage of the infringement are relevant. GDPR has strong language around the purpose of fines and the kinds of considerations that should be made before imposing them. Being overly punitive, especially if a company shows good faith effort to comply, would only welcome judicial oversight. What would the EU gain in such a scenario? And what could the EU lose in such a scenario?
- taysic 8y ago
  It wouldn't be a win-win if it results in less services being available in the EU - maybe services that are niche, that don't have the time to adapt to regulations, but would otherwise be useful to some of the people in the EU. Is there a way for a person in the EU to opt out?
  - the_mitsuhiko 8y ago
    > It wouldn't be a win-win if it results in less services being available in the EU I don't think that's necessarily true. If a company does not provide the service in the EU but there is demand for it, someone else will fill the spot.
  - sveme 8y ago
    You want to opt out of laws? Laws are not mailing lists.
  - glogla 8y ago
    > Is there a way for a person in the EU to opt out? No, and for a good reason. Just like if you could opt out of employee protection laws, the "opt out" would soon become mandatory to get a job.
    - stordoff 8y ago
      FWIW, you _can_ opt out of certain employee protection laws: > You can choose to work more than 48 hours a week on average if you’re over 18. This is called ‘opting out’. > Your employer can ask you to opt out, but you can’t be sacked or treated unfairly for refusing to do so. https://www.gov.uk/maximum-weekly-working-hours/weekly-maximum-working-hours-and-opting-out https://www.gov.uk/maximum-weekly-working-hours/weekly-maxim...
    - timrichard 8y ago
      Also FWIW, it’s extremely common for UK recruitment agencies to suggest that contractors opt out of the Agency Workers Regulation. Which many do. Most, if I were to guess.
slimshady94 8y ago
Why can't databases and DBMS systems come out with GDPR-compliant integrations that automatically provide the required data-wipe services? Surely it won't be so difficult to have built-in triggers/scripts that delete data etc automatically? And if the entire ecosystem uses these tools, it'll be better for everyone, and the onboarding/integration even for startups can be easy as well - maybe as easy as simply installing an NPM package.
- drspacemonkey 8y ago
  The more difficult part is deletion from backups, which is also a requirement. IMO, the best solution is per-row encryption with the keys stored in a second database. This second database can still be backed up, with backups that have a maximum lifespan, eg: 30 days. When a user deletes their account, their decryption key is deleted, and is unrecoverable after the backup max life.
  - kelnos 8y ago
    > The more difficult part is deletion from backups, which is also a requirement. How long do you keep your backups? If you just store them for, say, 30 days, that's fine. The EU regulators aren't going to come after you for a 30-day lag for all traces of data to be deleted, as long as that process is documented. There's still one annoyance left: you do need to keep track of accounts/users who have deleted data, so if you have to restore from a backup, you can't restore any data belonging to users who have deleted their data within that window. Otherwise, this is frankly not such a big deal. If you're storing backups for longer than 30 days, why? Where I work, if we had to restore from a 30-day-old backup, it'd be catastrophic for the business given how much data would be lost.
    - portent 8y ago
      Many regulated industries need to store data for multiple years, often in a secure format e.g. WORM storage
      - 8y ago
Barrin92 8y ago
>What will happen is that the EU will just have access to a dramatically smaller array of sites on the Internet Let's be real here for a second, what's your definition of dramatic? I don't foresee the EU losing access to more than a handful of services, many of which as in the case above provide questionable products. I'm very much doubting that we'll be talking here in a year and the EU somehow finds itself behind the great-GDPRwall. That's just arbitrary panic. >Consumer choice is a good thing, and this law will dramatically limit it. You're neglecting the fact that consumers can make collective choices about the things they do not want to put up with. Abuse of private data is one such domain. There is no iron law of the business world that consumers need to accept every product of any kind on every market. That's up for societies to decide. The law seems to be quite popular from what I can see, so any cost that we European consumers do actually incur, we are apparently happy to endure.
- downandout 8y ago
  Let's be real here for a second, what's your definition of dramatic? I don't foresee the EU losing access to more than a handful of services, many of which as in the case above provide questionable products. As horror stories come out and geoblocking tools become easy to use, I'd say that over the next few years, the vast majority of non-EU sites will have blocked EU traffic. Nobody wants the liability unless they make a large percentage of their revenue from EU countries. Accepting such traffic means exposing your business to instant financial annihilation at the whim of a foreign government.
  - hluska 8y ago
    I'm sorry, but that last phrase "instant financial annihilation at the whim of a foreign government" is so hyperbolic as to border on FUD. Here is a fact. If your business complied with EU data protection laws, GDPR is only an incremental step. And, here is another fact. The EU is nowhere near as litigious as the United States. GDPR may levy some intense fines at repeat offenders, particularly those who haven't been in compliance with any data security/protection law from the last twenty years. But to claim "financial annihilation at the whim of a foreign government"?? That's just poor taste.
gerdesj 8y ago
What will happen is that the EU will just have access to a dramatically smaller array of sites on the Internet Bollocks. I run a small (IT) business in the UK. I will have just as much internet as you post 25 May. The difference may be that my company and others in the EU might automatically be perceived as more trustworthy than those that do not comply with GDPR and hence we may benefit.
- Silhouette 8y ago
  I also have small businesses in the UK, so we also have no choice about complying. The abundance of caution described by downandout here seems excessive, even to me as a confirmed GDPR critic, but to good actors of the kind mentioned, the GDPR is basically just an exercise in bureaucracy, cost overheads, and uncertainty. Things might be different for B2B service providers, but if we make a single extra penny from anything to do with this whole mess in B2C world, I'll be amazed.
  - gerdesj 8y ago
    but if we make a single extra penny from anything to do with this whole mess in B2C world, I'll be amazed. GDPR is not a money making exercise. My company has a wiki page called "Risks and Opportunities". GDPR is definitively under Opp. these days - for us and our customers. I also quite like it as a person - a private individual.
- ocdtrekkie 8y ago
  I will generally indeed be more inclined to interact with EU sites since I know they are GDPR compliant. I'd honestly be really tempted to VPN to Europe so that US companies think I'm an EU citizen too. The most interesting thing to me about this whole ordeal is which companies only comply in Europe, where they're legally required, and those who have gone ahead and made sure they are compliant globally: It defines the difference between people ensuring your privacy rights because they have to, where they have to, and those ensuring your privacy rights globally because it's the right thing to do. Google's AMP project just introduced a whole set of new features not just to mark whether or not an EU user has consented to tracking, but also a new feature to geolocate users, specifically for the purpose of determining if they're legally required to get that consent. Which is sad to me; they should be getting user consent everywhere.
kelnos 8y ago
> The only services that can even afford to attempt to comply and have the necessary liability insurance against fines are massive companies - think Facebook and Google. This is a gross exaggeration. I agree that truly small companies may have issues, but companies way smaller than FB and Google can and are spending the time to comply.
godzillabrennus 8y ago
Short term you are right. Long term our understanding of the law will grow and we will build solutions for the EU market.

craigsmansion 8y ago

> The only services that can even afford to attempt to comply and have the necessary liability insurance Liability for what? You're not going to get sued. At worst you're going to get fined for negligence, probably after after repeated warnings. I don't think you can find insurance against willful repeated misconduct. It's only if your service can't possibly comply without losing your bottom line that you have to worry, in which case the GDPR is working as intended. Find a better business model for EU costumers, or cease your presence there. It's a win-win for EU consumers either way.

glogla 8y ago
> Liability for what? You're not going to get sued. Yes, this is the most confusing thing - a lot of posters talk about "being sued because of GDPR" but that's not how it works. And it's always people with the same arguments - small companies, getting sued, crazy money for lawyers, etc. If I was paranoid, I would think this is some kind of organized campaign to spread FUD and have as many people be against GDPR as possible, perhaps as a way to make sure something similar won't happen in the US. It's probably just misinformed people.
- craigsmansion 8y ago
  > It's probably just misinformed people. Probably. There seems to be a real disconnect between US and EU perception of legal and business landscapes here, with the US worrying about the EU legislation more than those based in the EU, who would be far more affected by it (after all, they can't "shut out" Europe).
- Silhouette 8y ago
  And it's always people with the same arguments - small companies, getting sued, crazy money for lawyers, etc. One of those things is not like the others. I have no idea where the meme about exploitative lawyers looking for minor non-compliance came from, because the primary means of enforcement under the GDPR is regulatory action. The whole strategy of threatening legal action to prompt a profitable out of court settlement is much less viable under typical EU legal systems than in the US anyway. However, GDPR definitely can cause significant compliance overheads for small organisations, including those who have done nothing wrong. The official guidance is still terrible, and just the uncertainty around several key points is a problem for reasons we've previously discussed at length on HN. Trusting in regulators to do the right thing is also a risky strategy. I write this as someone whose business really did receive a crippling demand for monies never owed direct from an EU government tax office after the VAT changes, with very scary accompanying threats and impossibly short timescales to respond, and there were many thousands of other small businesses similarly attacked just in the incidents I'm personally aware of. From a pragmatic point of view, the regulator in my country is well known to be under-funded and under-staffed, but even that doesn't necessarily help because as with other issues within their remit, it makes smaller organisations easier targets than those with big legal departments to fight back.
downandout 8y ago
Liability for what? $20 million in fines that - despite the protestations of everyone that has ever commented in these threads - can be imposed for a first, single violation, without any warnings. If they meant for there to be any safeguards for companies, that language would have been built into the GDPR. But it wasn't. There are no limits, other than $10/$20 million.
- einarfd 8y ago
  People have tried to have insurance against speeding tickets in my part of the world (Scandinavia), and those have been deemed illegal and stopped from paying out. I would expect a GDPR insurance would end up getting the same treatment. I can't guarantee that this would happen in all of Europe, but I do expect it would. When it comes to getting the max fine at first strike. The GDPR is not the first law in the EU with teeth. There are strict laws about corruption, pollution and antitrust here as well. Do companies get dinged with max penalty from the start violating these laws, not that I've seen. Why should enforcement of the GDPR be different from the current laws?
- hluska 8y ago
  Do yourself a favour. Spend some time and read other EU laws with teeth. Look at the theoretical maximum versus the practical. Then come back and try these same arguments.
  - Karunamon 8y ago
    I don't care what the regulators might assess as a fine out of the goodness of their heart or how annoyed they are or how late they ate lunch that day[1]. I care what the law says and provides for. http://blogs.discovermagazine.com/notrocketscience/2011/04/11/justice-is-served-but-more-so-after-lunch-how-food-breaks-sway-the-decisions-of-judges/ http://blogs.discovermagazine.com/notrocketscience/2011/04/1...
    - hluska 8y ago
      Then, you should give articles 58 and 83 a read. 58 details EU powers under GDPR. 83 details the factors that should be taken into account before levying administrative fines. In 83, you'll notice that the character of the infringement and any acts to mitigate the damage of the infringement are relevant. GDPR has strong language around the purpose of fines and the kinds of considerations that should be made before imposing them. Being overly punitive, especially if a company shows good faith effort to comply, would only welcome judicial oversight. What would the EU gain in such a scenario? And what could the EU lose in such a scenario?
taysic 8y ago
It wouldn't be a win-win if it results in less services being available in the EU - maybe services that are niche, that don't have the time to adapt to regulations, but would otherwise be useful to some of the people in the EU. Is there a way for a person in the EU to opt out?
- the_mitsuhiko 8y ago
  > It wouldn't be a win-win if it results in less services being available in the EU I don't think that's necessarily true. If a company does not provide the service in the EU but there is demand for it, someone else will fill the spot.
- sveme 8y ago
  You want to opt out of laws? Laws are not mailing lists.
- glogla 8y ago
  > Is there a way for a person in the EU to opt out? No, and for a good reason. Just like if you could opt out of employee protection laws, the "opt out" would soon become mandatory to get a job.
  - stordoff 8y ago
    FWIW, you _can_ opt out of certain employee protection laws: > You can choose to work more than 48 hours a week on average if you’re over 18. This is called ‘opting out’. > Your employer can ask you to opt out, but you can’t be sacked or treated unfairly for refusing to do so. https://www.gov.uk/maximum-weekly-working-hours/weekly-maximum-working-hours-and-opting-out https://www.gov.uk/maximum-weekly-working-hours/weekly-maxim...
  - timrichard 8y ago
    Also FWIW, it’s extremely common for UK recruitment agencies to suggest that contractors opt out of the Agency Workers Regulation. Which many do. Most, if I were to guess.

slimshady94 8y ago

Why can't databases and DBMS systems come out with GDPR-compliant integrations that automatically provide the required data-wipe services? Surely it won't be so difficult to have built-in triggers/scripts that delete data etc automatically? And if the entire ecosystem uses these tools, it'll be better for everyone, and the onboarding/integration even for startups can be easy as well - maybe as easy as simply installing an NPM package.

drspacemonkey 8y ago
The more difficult part is deletion from backups, which is also a requirement. IMO, the best solution is per-row encryption with the keys stored in a second database. This second database can still be backed up, with backups that have a maximum lifespan, eg: 30 days. When a user deletes their account, their decryption key is deleted, and is unrecoverable after the backup max life.
- kelnos 8y ago
  > The more difficult part is deletion from backups, which is also a requirement. How long do you keep your backups? If you just store them for, say, 30 days, that's fine. The EU regulators aren't going to come after you for a 30-day lag for all traces of data to be deleted, as long as that process is documented. There's still one annoyance left: you do need to keep track of accounts/users who have deleted data, so if you have to restore from a backup, you can't restore any data belonging to users who have deleted their data within that window. Otherwise, this is frankly not such a big deal. If you're storing backups for longer than 30 days, why? Where I work, if we had to restore from a 30-day-old backup, it'd be catastrophic for the business given how much data would be lost.
  - portent 8y ago
    Many regulated industries need to store data for multiple years, often in a secure format e.g. WORM storage
    - 8y ago

Barrin92 8y ago

>What will happen is that the EU will just have access to a dramatically smaller array of sites on the Internet Let's be real here for a second, what's your definition of dramatic? I don't foresee the EU losing access to more than a handful of services, many of which as in the case above provide questionable products. I'm very much doubting that we'll be talking here in a year and the EU somehow finds itself behind the great-GDPRwall. That's just arbitrary panic. >Consumer choice is a good thing, and this law will dramatically limit it. You're neglecting the fact that consumers can make collective choices about the things they do not want to put up with. Abuse of private data is one such domain. There is no iron law of the business world that consumers need to accept every product of any kind on every market. That's up for societies to decide. The law seems to be quite popular from what I can see, so any cost that we European consumers do actually incur, we are apparently happy to endure.

downandout 8y ago
Let's be real here for a second, what's your definition of dramatic? I don't foresee the EU losing access to more than a handful of services, many of which as in the case above provide questionable products. As horror stories come out and geoblocking tools become easy to use, I'd say that over the next few years, the vast majority of non-EU sites will have blocked EU traffic. Nobody wants the liability unless they make a large percentage of their revenue from EU countries. Accepting such traffic means exposing your business to instant financial annihilation at the whim of a foreign government.
- hluska 8y ago
  I'm sorry, but that last phrase "instant financial annihilation at the whim of a foreign government" is so hyperbolic as to border on FUD. Here is a fact. If your business complied with EU data protection laws, GDPR is only an incremental step. And, here is another fact. The EU is nowhere near as litigious as the United States. GDPR may levy some intense fines at repeat offenders, particularly those who haven't been in compliance with any data security/protection law from the last twenty years. But to claim "financial annihilation at the whim of a foreign government"?? That's just poor taste.

gerdesj 8y ago

What will happen is that the EU will just have access to a dramatically smaller array of sites on the Internet Bollocks. I run a small (IT) business in the UK. I will have just as much internet as you post 25 May. The difference may be that my company and others in the EU might automatically be perceived as more trustworthy than those that do not comply with GDPR and hence we may benefit.

Silhouette 8y ago
I also have small businesses in the UK, so we also have no choice about complying. The abundance of caution described by downandout here seems excessive, even to me as a confirmed GDPR critic, but to good actors of the kind mentioned, the GDPR is basically just an exercise in bureaucracy, cost overheads, and uncertainty. Things might be different for B2B service providers, but if we make a single extra penny from anything to do with this whole mess in B2C world, I'll be amazed.
- gerdesj 8y ago
  but if we make a single extra penny from anything to do with this whole mess in B2C world, I'll be amazed. GDPR is not a money making exercise. My company has a wiki page called "Risks and Opportunities". GDPR is definitively under Opp. these days - for us and our customers. I also quite like it as a person - a private individual.
ocdtrekkie 8y ago
I will generally indeed be more inclined to interact with EU sites since I know they are GDPR compliant. I'd honestly be really tempted to VPN to Europe so that US companies think I'm an EU citizen too. The most interesting thing to me about this whole ordeal is which companies only comply in Europe, where they're legally required, and those who have gone ahead and made sure they are compliant globally: It defines the difference between people ensuring your privacy rights because they have to, where they have to, and those ensuring your privacy rights globally because it's the right thing to do. Google's AMP project just introduced a whole set of new features not just to mark whether or not an EU user has consented to tracking, but also a new feature to geolocate users, specifically for the purpose of determining if they're legally required to get that consent. Which is sad to me; they should be getting user consent everywhere.

kelnos 8y ago

> The only services that can even afford to attempt to comply and have the necessary liability insurance against fines are massive companies - think Facebook and Google. This is a gross exaggeration. I agree that truly small companies may have issues, but companies way smaller than FB and Google can and are spending the time to comply.

godzillabrennus 8y ago

Short term you are right. Long term our understanding of the law will grow and we will build solutions for the EU market.