16 ms·

> The only services that can even afford to attempt to comply and have the necessary liability insurance Liability for what? You're not going to get sued. At w

> The only services that can even afford to attempt to comply and have the necessary liability insurance Liability for what? You're not going to get sued. At worst you're going to get fined for negligence, probably after after repeated warnings. I don't think you can find insurance against willful repeated misconduct. It's only if your service can't possibly comply without losing your bottom line that you have to worry, in which case the GDPR is working as intended. Find a better business model for EU costumers, or cease your presence there. It's a win-win for EU consumers either way.

glogla 8y ago
> Liability for what? You're not going to get sued. Yes, this is the most confusing thing - a lot of posters talk about "being sued because of GDPR" but that's not how it works. And it's always people with the same arguments - small companies, getting sued, crazy money for lawyers, etc. If I was paranoid, I would think this is some kind of organized campaign to spread FUD and have as many people be against GDPR as possible, perhaps as a way to make sure something similar won't happen in the US. It's probably just misinformed people.
- craigsmansion 8y ago
  > It's probably just misinformed people. Probably. There seems to be a real disconnect between US and EU perception of legal and business landscapes here, with the US worrying about the EU legislation more than those based in the EU, who would be far more affected by it (after all, they can't "shut out" Europe).
- Silhouette 8y ago
  And it's always people with the same arguments - small companies, getting sued, crazy money for lawyers, etc. One of those things is not like the others. I have no idea where the meme about exploitative lawyers looking for minor non-compliance came from, because the primary means of enforcement under the GDPR is regulatory action. The whole strategy of threatening legal action to prompt a profitable out of court settlement is much less viable under typical EU legal systems than in the US anyway. However, GDPR definitely can cause significant compliance overheads for small organisations, including those who have done nothing wrong. The official guidance is still terrible, and just the uncertainty around several key points is a problem for reasons we've previously discussed at length on HN. Trusting in regulators to do the right thing is also a risky strategy. I write this as someone whose business really did receive a crippling demand for monies never owed direct from an EU government tax office after the VAT changes, with very scary accompanying threats and impossibly short timescales to respond, and there were many thousands of other small businesses similarly attacked just in the incidents I'm personally aware of. From a pragmatic point of view, the regulator in my country is well known to be under-funded and under-staffed, but even that doesn't necessarily help because as with other issues within their remit, it makes smaller organisations easier targets than those with big legal departments to fight back.
downandout 8y ago
Liability for what? $20 million in fines that - despite the protestations of everyone that has ever commented in these threads - can be imposed for a first, single violation, without any warnings. If they meant for there to be any safeguards for companies, that language would have been built into the GDPR. But it wasn't. There are no limits, other than $10/$20 million.
- einarfd 8y ago
  People have tried to have insurance against speeding tickets in my part of the world (Scandinavia), and those have been deemed illegal and stopped from paying out. I would expect a GDPR insurance would end up getting the same treatment. I can't guarantee that this would happen in all of Europe, but I do expect it would. When it comes to getting the max fine at first strike. The GDPR is not the first law in the EU with teeth. There are strict laws about corruption, pollution and antitrust here as well. Do companies get dinged with max penalty from the start violating these laws, not that I've seen. Why should enforcement of the GDPR be different from the current laws?
- hluska 8y ago
  Do yourself a favour. Spend some time and read other EU laws with teeth. Look at the theoretical maximum versus the practical. Then come back and try these same arguments.
  - Karunamon 8y ago
    I don't care what the regulators might assess as a fine out of the goodness of their heart or how annoyed they are or how late they ate lunch that day[1]. I care what the law says and provides for. http://blogs.discovermagazine.com/notrocketscience/2011/04/11/justice-is-served-but-more-so-after-lunch-how-food-breaks-sway-the-decisions-of-judges/ http://blogs.discovermagazine.com/notrocketscience/2011/04/1...
    - hluska 8y ago
      Then, you should give articles 58 and 83 a read. 58 details EU powers under GDPR. 83 details the factors that should be taken into account before levying administrative fines. In 83, you'll notice that the character of the infringement and any acts to mitigate the damage of the infringement are relevant. GDPR has strong language around the purpose of fines and the kinds of considerations that should be made before imposing them. Being overly punitive, especially if a company shows good faith effort to comply, would only welcome judicial oversight. What would the EU gain in such a scenario? And what could the EU lose in such a scenario?
taysic 8y ago
It wouldn't be a win-win if it results in less services being available in the EU - maybe services that are niche, that don't have the time to adapt to regulations, but would otherwise be useful to some of the people in the EU. Is there a way for a person in the EU to opt out?
- the_mitsuhiko 8y ago
  > It wouldn't be a win-win if it results in less services being available in the EU I don't think that's necessarily true. If a company does not provide the service in the EU but there is demand for it, someone else will fill the spot.
- sveme 8y ago
  You want to opt out of laws? Laws are not mailing lists.
- glogla 8y ago
  > Is there a way for a person in the EU to opt out? No, and for a good reason. Just like if you could opt out of employee protection laws, the "opt out" would soon become mandatory to get a job.
  - stordoff 8y ago
    FWIW, you _can_ opt out of certain employee protection laws: > You can choose to work more than 48 hours a week on average if you’re over 18. This is called ‘opting out’. > Your employer can ask you to opt out, but you can’t be sacked or treated unfairly for refusing to do so. https://www.gov.uk/maximum-weekly-working-hours/weekly-maximum-working-hours-and-opting-out https://www.gov.uk/maximum-weekly-working-hours/weekly-maxim...
  - timrichard 8y ago
    Also FWIW, it’s extremely common for UK recruitment agencies to suggest that contractors opt out of the Agency Workers Regulation. Which many do. Most, if I were to guess.

glogla 8y ago

> Liability for what? You're not going to get sued. Yes, this is the most confusing thing - a lot of posters talk about "being sued because of GDPR" but that's not how it works. And it's always people with the same arguments - small companies, getting sued, crazy money for lawyers, etc. If I was paranoid, I would think this is some kind of organized campaign to spread FUD and have as many people be against GDPR as possible, perhaps as a way to make sure something similar won't happen in the US. It's probably just misinformed people.

craigsmansion 8y ago
> It's probably just misinformed people. Probably. There seems to be a real disconnect between US and EU perception of legal and business landscapes here, with the US worrying about the EU legislation more than those based in the EU, who would be far more affected by it (after all, they can't "shut out" Europe).
Silhouette 8y ago
And it's always people with the same arguments - small companies, getting sued, crazy money for lawyers, etc. One of those things is not like the others. I have no idea where the meme about exploitative lawyers looking for minor non-compliance came from, because the primary means of enforcement under the GDPR is regulatory action. The whole strategy of threatening legal action to prompt a profitable out of court settlement is much less viable under typical EU legal systems than in the US anyway. However, GDPR definitely can cause significant compliance overheads for small organisations, including those who have done nothing wrong. The official guidance is still terrible, and just the uncertainty around several key points is a problem for reasons we've previously discussed at length on HN. Trusting in regulators to do the right thing is also a risky strategy. I write this as someone whose business really did receive a crippling demand for monies never owed direct from an EU government tax office after the VAT changes, with very scary accompanying threats and impossibly short timescales to respond, and there were many thousands of other small businesses similarly attacked just in the incidents I'm personally aware of. From a pragmatic point of view, the regulator in my country is well known to be under-funded and under-staffed, but even that doesn't necessarily help because as with other issues within their remit, it makes smaller organisations easier targets than those with big legal departments to fight back.

downandout 8y ago

Liability for what? $20 million in fines that - despite the protestations of everyone that has ever commented in these threads - can be imposed for a first, single violation, without any warnings. If they meant for there to be any safeguards for companies, that language would have been built into the GDPR. But it wasn't. There are no limits, other than $10/$20 million.

einarfd 8y ago
People have tried to have insurance against speeding tickets in my part of the world (Scandinavia), and those have been deemed illegal and stopped from paying out. I would expect a GDPR insurance would end up getting the same treatment. I can't guarantee that this would happen in all of Europe, but I do expect it would. When it comes to getting the max fine at first strike. The GDPR is not the first law in the EU with teeth. There are strict laws about corruption, pollution and antitrust here as well. Do companies get dinged with max penalty from the start violating these laws, not that I've seen. Why should enforcement of the GDPR be different from the current laws?
hluska 8y ago
Do yourself a favour. Spend some time and read other EU laws with teeth. Look at the theoretical maximum versus the practical. Then come back and try these same arguments.
- Karunamon 8y ago
  I don't care what the regulators might assess as a fine out of the goodness of their heart or how annoyed they are or how late they ate lunch that day[1]. I care what the law says and provides for. http://blogs.discovermagazine.com/notrocketscience/2011/04/11/justice-is-served-but-more-so-after-lunch-how-food-breaks-sway-the-decisions-of-judges/ http://blogs.discovermagazine.com/notrocketscience/2011/04/1...
  - hluska 8y ago
    Then, you should give articles 58 and 83 a read. 58 details EU powers under GDPR. 83 details the factors that should be taken into account before levying administrative fines. In 83, you'll notice that the character of the infringement and any acts to mitigate the damage of the infringement are relevant. GDPR has strong language around the purpose of fines and the kinds of considerations that should be made before imposing them. Being overly punitive, especially if a company shows good faith effort to comply, would only welcome judicial oversight. What would the EU gain in such a scenario? And what could the EU lose in such a scenario?

taysic 8y ago

It wouldn't be a win-win if it results in less services being available in the EU - maybe services that are niche, that don't have the time to adapt to regulations, but would otherwise be useful to some of the people in the EU. Is there a way for a person in the EU to opt out?

the_mitsuhiko 8y ago
> It wouldn't be a win-win if it results in less services being available in the EU I don't think that's necessarily true. If a company does not provide the service in the EU but there is demand for it, someone else will fill the spot.
sveme 8y ago
You want to opt out of laws? Laws are not mailing lists.
glogla 8y ago
> Is there a way for a person in the EU to opt out? No, and for a good reason. Just like if you could opt out of employee protection laws, the "opt out" would soon become mandatory to get a job.
- stordoff 8y ago
  FWIW, you _can_ opt out of certain employee protection laws: > You can choose to work more than 48 hours a week on average if you’re over 18. This is called ‘opting out’. > Your employer can ask you to opt out, but you can’t be sacked or treated unfairly for refusing to do so. https://www.gov.uk/maximum-weekly-working-hours/weekly-maximum-working-hours-and-opting-out https://www.gov.uk/maximum-weekly-working-hours/weekly-maxim...
- timrichard 8y ago
  Also FWIW, it’s extremely common for UK recruitment agencies to suggest that contractors opt out of the Agency Workers Regulation. Which many do. Most, if I were to guess.