4 ms·

A strong law like the GPDR would actually shake things up - a lot. As it is, the large players like Facebook, google, Salesforce and a bunch of others like our

A strong law like the GPDR would actually shake things up - a lot. As it is, the large players like Facebook, google, Salesforce and a bunch of others like our banks, credit card companies, internet providers are all extremely well established. A GPDR-like law would open up entirely new ways of doing business partly because these companies could no longer do business the way they are. “Free” services could no longer make their money by selling your data. We could end up with a more “honest” set of services. Like a social network that’s actually free or paid for by individual contributions.

downandout 8y ago
A GPDR-like law would open up entirely new ways of doing business partly because these companies could no longer do business the way they are. “Free” services could no longer make their money by selling your data. You're completely disregarding the fact that it takes significant resources to comply with a law like GDPR. Insurance to defray the costs of potential litigation and fines, development time, ongoing compliance (audits etc.), legal expenses, and on and on. Most startups simply can't afford this. So you may wind up with more "honest" services, but there will be far fewer of them and they'll have more power and leverage than they ever have before because of the lack of competitors and artificial, enormous regulatory barriers to entry. GDPR is a startup killer.
- telchar 8y ago
  I think you're disregarding that these are huge companies whose business models and moats would be significantly disrupted by a GDPR-like law. To quote GoT, chaos is a ladder. This could help new innovative companies compete, at least in the short term, against these established behemoths.
  - downandout 8y ago
    This could help new innovative companies compete, at least in the short term, against these established behemoths. Again, most “new innovative” companies can’t afford to comply with laws like GDPR.
    - Proziam 8y ago
      I have seen this narrative parrotted quite frequently, but it's false. GDPR isn't as crushing as people currently feel it is, but it will force companies to adopt better policies to avoid problems. Startups right now are best positioned to make the transition whereas the behemoths will be forced into significant spends on legal fees or insurance - not to mention scandals such as the Facebook debacle that has so many people up in arms. Disruption is startup paradise.
      - downandout 8y ago
        I have seen this narrative parrotted quite frequently, but it's false. GDPR isn't as crushing as people currently feel it is You’re saying this based on what exactly? Have you actually been in charge of trying to comply? I have. For us, it was going to be a 7 figure endeavor (upfront, and then 6 figures/yr for ongoing compliance, insurance, etc.) and we are pretty small (a few million visitors/mo spread across several sites). We made the decision to just block EU traffic, even though we have been advised that GDPR probably doesn’t apply to us anyway. I can’t have one of the 28 countries that GDPR applies to randomly decide that it applies to me because they’re a little short on tax revenue that month, then have an expensive legal fight that will end in a multimillion-dollar fine anyway.
      - bkanber 8y ago
        Having just lead the GDPR effort at my company, I disagree. It's absolutely a burden. It slows down sales and makes customer relationships more difficult and expensive. Any custom integration we do needs to have a custom data processing agreement put into place and reviewed by a lawyer. I now find myself paying lots of new fees to various places: the ITA, DPA, the Swiss data authority, and organizations like ISSA. It forced us to get a more expensive insurance policy. On top of that, the technical controls were actually expensive to implement. The issue is not that consent is hard to revoke or that data is hard to delete. It's that everything needs to be auditable. Under a strict reading, you need to have an audit trail of every processing activity. Anytime a user profile is edited for any reason, even just an automated removal of whitespace, is supposed to be auditable and made notifiable to the user. Anytime you refresh a user's Instagram stats, you need to have an audit of that. Most companies don't go this far, but it's a huge risk to do anything less because we don't know what fines are going to look like in practice yet. Plus the fact that we just spent $15k in legal fees going over our new privacy policy, data protection policy, updated MSA, updated order form, new user agreement, etc, I can say with confidence that it is indeed expensive and burdensome.
- mgleason_3 8y ago
  I'm not disregarding the cost of compliance. In fact it's implicit in my argument. Some business models would no longer make sense. Others would look more attractive. It would increase the cost of, or completely do away with, doing things certain ways which naturally opens the door to doing things differently. Yes, there likely would be fewer services initially. "Insurance to defray the costs of potential litigation and fines, development time, ongoing compliance...GDPR is a startup killer" That doesn't have to be the case. The law could easily carve-out a "safe harbor" of sorts for companies that commit to not gathering or storing any but the most basic information about their visitors. "... there will be far fewer of them and they'll have more power..." Or existing companies could loose a lot of power and leverage because their business-model doesn't makes sense. New ones could pop-up in their place. I'm more than willing to give up tyrants like Facebook and Equifax for the right to control my own private data. Privacy is good, long live disruption!
  - downandout 8y ago
    I'm more than willing to give up tyrants like Facebook and Equifax for the right to control my own private data. You’re missing the point. These “tyrants” can fully afford to comply (while paying scores of legal staff to scour the law to find and exploit every possible loophole), but startups can’t. That means no competitors will be able to emerge and challenge them. These companies will still be able to do much of whatever they want simply because consumers won’t have a choice. GDRP consolidates market power in the hands of entrenched competitors that can afford to comply. Privacy is good, long live disruption! Privacy is good. Killing the ability for startups to compete is bad.
    - peatmoss 8y ago
      Wait, but if those hypothetically competitive startups can only compete because they can trample my privacy, why the heck do I want them? I mean, it’s not like Facebook and Google aren’t already big enough to smother would-be competition in the cradle. In the other scenario competition may still be smothered, but I still get some regulatory privacy protections. EDIT: Also, as a matter of principle, I’d gladly see dozens of startups burn if it meant broad privacy protection were enacted.
- diplocorp 8y ago
  Citation needed
  - downandout 8y ago
    Citation needed for what? For proving that GDPR compliance is expensive? https://iapp.org/news/a/recent-survey-shows-gdpr-compliance-costing-millions/ https://iapp.org/news/a/recent-survey-shows-gdpr-compliance-... https://www.ft.com/content/0d47ffe4-ccb6-11e7-b781-794ce08b24dc https://www.ft.com/content/0d47ffe4-ccb6-11e7-b781-794ce08b2... https://www.dri.org/home/2018/02/26/gdpr-it-s-coming-it-s-expensive-and-it-s-a-serious-problem-for-american-businesses https://www.dri.org/home/2018/02/26/gdpr-it-s-coming-it-s-ex... https://www.wandera.com/blog/gdpr-expensive-data-breach-penalties/ https://www.wandera.com/blog/gdpr-expensive-data-breach-pena... Those were just on the first page of Google. There are hundreds of others. That's not even counting my own experience with it.
  - bkanber 8y ago
    We're a small business and it cost us about $50k to become compliant, if you add up the legal fees and hours spent on technology. We are also forced to get a more expensive insurance policy.
basch 8y ago
facebook doesnt sell data. facebook sells attention and billboard space. you pay facebook, facebook runs your ad on their platform, and gives you some paramaters for which people are targeted. the data never leaves facebooks black box.
- selestify 8y ago
  Except the data did leave with Cambridge Analytica
  - basch 8y ago
    facebook has two kinds of data - data you give it (birthday, religion, likes) - data it learns about you. (ad tracking, habits, demographics) facebook built a developer tool that let app developers ASK USERS for "data you gave it" users clicked YES when prompted with the question, GIVING the app developers the data. Cambridge Analytica NEVER got to touch "data facebook learned about you." the way the developer tools were designed, when you gave the app access to your facebook account, it could look at things YOUR FRIENDS had made avaliable to YOU. The app could act as you, and see what you see. You can never see "data facebook learned about your friends." The issue is, people couldnt trust their friends not to click "SHARE DATA." The issue is IF its inappropriate for apps I install to see data shared with me by my friends. Once facebook learned this ability was being misused, they shut it down, back in 2014.
outside2344 8y ago
That's an idealist view on how this is going to play out. My contrarian view is that these large firms will have the staff to understand how to comply with these laws without having to substantively change. For example, Facebook is going to force everyone to opt-in to accept the status quo while remaining in GDPR compliance: https://www.independent.co.uk/life-style/gadgets-and-tech/news/facebook-gdpr-latest-data-ad-tracking-opt-out-stop-ads-marketing-a8310031.html https://www.independent.co.uk/life-style/gadgets-and-tech/ne... Good luck doing that if you are a startup!
- jkaplowitz 8y ago
  I expect they'll be ruled as unable to rely on that coerced consent in the end, given how strictly the requirements for acceptable consent are defined. But they will be able to delay such a final ruling for quite a while with appeals, and maybe make arguments to mitigate the possible fines down to a lower level of any.
matchagaucho 8y ago
Salesforce-hosted data can be largely exempted from GDPR because Article 17 allows for the retention of customer billing and accounting data (which are often stored in Salesforce CRM and ERP back office system).

downandout 8y ago

A GPDR-like law would open up entirely new ways of doing business partly because these companies could no longer do business the way they are. “Free” services could no longer make their money by selling your data. You're completely disregarding the fact that it takes significant resources to comply with a law like GDPR. Insurance to defray the costs of potential litigation and fines, development time, ongoing compliance (audits etc.), legal expenses, and on and on. Most startups simply can't afford this. So you may wind up with more "honest" services, but there will be far fewer of them and they'll have more power and leverage than they ever have before because of the lack of competitors and artificial, enormous regulatory barriers to entry. GDPR is a startup killer.

telchar 8y ago
I think you're disregarding that these are huge companies whose business models and moats would be significantly disrupted by a GDPR-like law. To quote GoT, chaos is a ladder. This could help new innovative companies compete, at least in the short term, against these established behemoths.
- downandout 8y ago
  This could help new innovative companies compete, at least in the short term, against these established behemoths. Again, most “new innovative” companies can’t afford to comply with laws like GDPR.
  - Proziam 8y ago
    I have seen this narrative parrotted quite frequently, but it's false. GDPR isn't as crushing as people currently feel it is, but it will force companies to adopt better policies to avoid problems. Startups right now are best positioned to make the transition whereas the behemoths will be forced into significant spends on legal fees or insurance - not to mention scandals such as the Facebook debacle that has so many people up in arms. Disruption is startup paradise.
    - downandout 8y ago
      I have seen this narrative parrotted quite frequently, but it's false. GDPR isn't as crushing as people currently feel it is You’re saying this based on what exactly? Have you actually been in charge of trying to comply? I have. For us, it was going to be a 7 figure endeavor (upfront, and then 6 figures/yr for ongoing compliance, insurance, etc.) and we are pretty small (a few million visitors/mo spread across several sites). We made the decision to just block EU traffic, even though we have been advised that GDPR probably doesn’t apply to us anyway. I can’t have one of the 28 countries that GDPR applies to randomly decide that it applies to me because they’re a little short on tax revenue that month, then have an expensive legal fight that will end in a multimillion-dollar fine anyway.
    - bkanber 8y ago
      Having just lead the GDPR effort at my company, I disagree. It's absolutely a burden. It slows down sales and makes customer relationships more difficult and expensive. Any custom integration we do needs to have a custom data processing agreement put into place and reviewed by a lawyer. I now find myself paying lots of new fees to various places: the ITA, DPA, the Swiss data authority, and organizations like ISSA. It forced us to get a more expensive insurance policy. On top of that, the technical controls were actually expensive to implement. The issue is not that consent is hard to revoke or that data is hard to delete. It's that everything needs to be auditable. Under a strict reading, you need to have an audit trail of every processing activity. Anytime a user profile is edited for any reason, even just an automated removal of whitespace, is supposed to be auditable and made notifiable to the user. Anytime you refresh a user's Instagram stats, you need to have an audit of that. Most companies don't go this far, but it's a huge risk to do anything less because we don't know what fines are going to look like in practice yet. Plus the fact that we just spent $15k in legal fees going over our new privacy policy, data protection policy, updated MSA, updated order form, new user agreement, etc, I can say with confidence that it is indeed expensive and burdensome.
mgleason_3 8y ago
I'm not disregarding the cost of compliance. In fact it's implicit in my argument. Some business models would no longer make sense. Others would look more attractive. It would increase the cost of, or completely do away with, doing things certain ways which naturally opens the door to doing things differently. Yes, there likely would be fewer services initially. "Insurance to defray the costs of potential litigation and fines, development time, ongoing compliance...GDPR is a startup killer" That doesn't have to be the case. The law could easily carve-out a "safe harbor" of sorts for companies that commit to not gathering or storing any but the most basic information about their visitors. "... there will be far fewer of them and they'll have more power..." Or existing companies could loose a lot of power and leverage because their business-model doesn't makes sense. New ones could pop-up in their place. I'm more than willing to give up tyrants like Facebook and Equifax for the right to control my own private data. Privacy is good, long live disruption!
- downandout 8y ago
  I'm more than willing to give up tyrants like Facebook and Equifax for the right to control my own private data. You’re missing the point. These “tyrants” can fully afford to comply (while paying scores of legal staff to scour the law to find and exploit every possible loophole), but startups can’t. That means no competitors will be able to emerge and challenge them. These companies will still be able to do much of whatever they want simply because consumers won’t have a choice. GDRP consolidates market power in the hands of entrenched competitors that can afford to comply. Privacy is good, long live disruption! Privacy is good. Killing the ability for startups to compete is bad.
  - peatmoss 8y ago
    Wait, but if those hypothetically competitive startups can only compete because they can trample my privacy, why the heck do I want them? I mean, it’s not like Facebook and Google aren’t already big enough to smother would-be competition in the cradle. In the other scenario competition may still be smothered, but I still get some regulatory privacy protections. EDIT: Also, as a matter of principle, I’d gladly see dozens of startups burn if it meant broad privacy protection were enacted.
diplocorp 8y ago
Citation needed
- downandout 8y ago
  Citation needed for what? For proving that GDPR compliance is expensive? https://iapp.org/news/a/recent-survey-shows-gdpr-compliance-costing-millions/ https://iapp.org/news/a/recent-survey-shows-gdpr-compliance-... https://www.ft.com/content/0d47ffe4-ccb6-11e7-b781-794ce08b24dc https://www.ft.com/content/0d47ffe4-ccb6-11e7-b781-794ce08b2... https://www.dri.org/home/2018/02/26/gdpr-it-s-coming-it-s-expensive-and-it-s-a-serious-problem-for-american-businesses https://www.dri.org/home/2018/02/26/gdpr-it-s-coming-it-s-ex... https://www.wandera.com/blog/gdpr-expensive-data-breach-penalties/ https://www.wandera.com/blog/gdpr-expensive-data-breach-pena... Those were just on the first page of Google. There are hundreds of others. That's not even counting my own experience with it.
- bkanber 8y ago
  We're a small business and it cost us about $50k to become compliant, if you add up the legal fees and hours spent on technology. We are also forced to get a more expensive insurance policy.

basch 8y ago

facebook doesnt sell data. facebook sells attention and billboard space. you pay facebook, facebook runs your ad on their platform, and gives you some paramaters for which people are targeted. the data never leaves facebooks black box.

selestify 8y ago
Except the data did leave with Cambridge Analytica
- basch 8y ago
  facebook has two kinds of data - data you give it (birthday, religion, likes) - data it learns about you. (ad tracking, habits, demographics) facebook built a developer tool that let app developers ASK USERS for "data you gave it" users clicked YES when prompted with the question, GIVING the app developers the data. Cambridge Analytica NEVER got to touch "data facebook learned about you." the way the developer tools were designed, when you gave the app access to your facebook account, it could look at things YOUR FRIENDS had made avaliable to YOU. The app could act as you, and see what you see. You can never see "data facebook learned about your friends." The issue is, people couldnt trust their friends not to click "SHARE DATA." The issue is IF its inappropriate for apps I install to see data shared with me by my friends. Once facebook learned this ability was being misused, they shut it down, back in 2014.

outside2344 8y ago

That's an idealist view on how this is going to play out. My contrarian view is that these large firms will have the staff to understand how to comply with these laws without having to substantively change. For example, Facebook is going to force everyone to opt-in to accept the status quo while remaining in GDPR compliance: https://www.independent.co.uk/life-style/gadgets-and-tech/news/facebook-gdpr-latest-data-ad-tracking-opt-out-stop-ads-marketing-a8310031.html https://www.independent.co.uk/life-style/gadgets-and-tech/ne... Good luck doing that if you are a startup!

jkaplowitz 8y ago
I expect they'll be ruled as unable to rely on that coerced consent in the end, given how strictly the requirements for acceptable consent are defined. But they will be able to delay such a final ruling for quite a while with appeals, and maybe make arguments to mitigate the possible fines down to a lower level of any.

matchagaucho 8y ago

Salesforce-hosted data can be largely exempted from GDPR because Article 17 allows for the retention of customer billing and accounting data (which are often stored in Salesforce CRM and ERP back office system).