5 ms·

> GDPR is so vague and open ended that there's no way they can ever be compliant This is nonsense. I really don't see what's so difficult to understand. Person

by midasz 8y ago

> GDPR is so vague and open ended that there's no way they can ever be compliant This is nonsense. I really don't see what's so difficult to understand. Personal information is information to which the person can be identified.

tchock23 8y ago
The definition of personal information is easy to understand (albeit broad). However, the vagueness seeps in other areas of the regulation. For example, additional restrictions are in place for “large scale” processing of personal information, yet “large scale” is never defined. Is that hundreds, thousands or millions of records? As the owner of a very small SaaS business (that does not sell personal information of its users) I found it tremendously difficult to figure out how to comply given the vagueness of it all.
- midasz 8y ago
  Yeah I get that. I googled around a bit and apparently there were concrete figures in the initial draft. I don't know if the EU has a contactperson to whom you can ask these questions, if they do, you can simply ask them to clarify. If you've done that, you're in the clear because you've put in the effort to comply. But yeah in this case they should just give you a number.
  - pjc50 8y ago
    > I don't know if the EU has a contactperson to whom you can ask these questions, if they do, you can simply ask them to clarify. lol of course there isn't an office you can ring to help you with this! If there were we wouldn't be spending quite so much effort working out what it all means.
    - M2Ys4U 8y ago
      Each of the 28 member states of the EU has a data protection authority. Those are the people one rings to get advice.
    - midasz 8y ago
      Well for my country (NL) we have the AP and with 2 clicks I have their phone number: https://autoriteitpersoonsgegevens.nl/nl/contact-met-de-autoriteit-persoonsgegevens/telefonisch-contact https://autoriteitpersoonsgegevens.nl/nl/contact-met-de-auto... .... > If there were we wouldn't be spending quite so much effort working out what it all means People love drama.
      - repolfx 8y ago
        You don't seem to know much about GDPR. Firstly, no, your national regulators cannot give you binding answers about GDPR. This is one thing the EU Commission has been clear on. They can advise, but their advice has no more weight than this Hacker News thread does - the EU is not required to care about what national regulators said and they have no special powers to interpret the law. Only the EU gets to decide what GDPR means, and they have said explicitly they will not answer questions about it. The only time answers finally come is during legal actions. Secondly, no, people do not "love drama" in the business context, far from it. Maybe you should consider that your own interpretation of the problem is the issue rather than other people just causing drama for the sake of it.
        midasz 8y ago
        k
- jacquesm 8y ago
  > For example, additional restrictions are in place for “large scale” processing of personal information, yet “large scale” is never defined. Is that hundreds, thousands or millions of records? Hundreds or thousands not, millions definitely yes, somewhere in the middle you get to draw a line which to me is an indication that the closer you get to those millions the more you'll have to work and then those additional restrictions kick in. There are companies that store billions of profiles (Google, Facebook), and for those the 'large scale' moniker is a no-brainer. If you're a small company that stores a few hundred to a few tens of thousands of records because you are doing direct business with those people then that would most likely still qualify as small. But from 100K and up I'd make sure the house was in order, not just because of the GDPR but because you are becoming a nice, fat & juicy target for miscreants as well.
  - tchock23 8y ago
    That is the scope I was ballparking mentally (and which fits the scope of processing done in my app), but I just wish they had been explicit about it in the regulation so I could put to rest any apprehension around it.
    - jacquesm 8y ago
      The room built in is to ensure that there is some flexibility regarding for instance financial and health information where those restrictions would probably kick in sooner versus some e-commerce company such as a web store where the need to keep the data around on live systems is much less urgent. That way one law will allow banks, insurance companies, hospitals and a mid-sized e-commerce company all to figure out for themselves what their comfort zone is, add a little room for safety and you're most likely going to be good, and even if not you can point at the law and say 'it wasn't explicit', so unless you are purposefully mis-interpreting a few million records as 'small scale' you will likely get away with that. Note the 'likely', this isn't a certainty but in my experience to date everybody that is fear mongering about the GDPR is coming up with the wildest of scenarios rather than to just look at the law as if it was intended well (which I really believe it is).
jcranmer 8y ago
> This is nonsense. I really don't see what's so difficult to understand. Personal information is information to which the person can be identified. Does that include email addresses and IP addresses? If so, that means things like using email addresses to log in for comments or logging IP addresses for traffic analysis causes all sorts of GDPR to kick in. As the OP points out, this means that things like the EU's own websites are in violation of the GDPR.
- jacquesm 8y ago
  > As the OP points out, this means that things like the EU's own websites are in violation of the GDPR. Actually, it doesn't. There are plenty of valid reasons to collect those things. Collecting them to track your users and to spam them to death are not on that list.
  - ghein 8y ago
    The presumption is that it's illegitimate but you can provide an affirmative defense of having a valid reason. Proving this can be expensive and is risky. Who knows what any individual judge in any EU country will decide is "reasonable"? Companies can easily be destroyed by filing multiple charges against them. Guilt, innocence, or reasonableness doesn't come into it: the process is the punishment. Look at Amanda Knox (Americans tend to think she's innocent, Brits tend to think she's guilty) - after appeals the Italian Justice System found her not guilty of the murder of her roommate. She still spent almost four years in prison in her early twenties and had to spend a huge amount of money on lawyers to arrive at this result. Just because you eventually get what you see as the right result doesn't mean you won't go through hell to get there. A major reason why Americans are having such a big problem with GDPR is because the EU system appears to change its interpretations and decisions abruptly, with retrospective effect. You set up companies in certain jurisdictions thanks to their tax rates and how transactions are treated. You follow every aspect of national and EU law. These arrangements are widely known, are accepted as legitimate practice, and they continue for decades. The EU commissioners change - suddenly your corporate arrangements are wildly illegal and you are subject to penalties and back taxes stretching over a decade. If staff changes and they say that they will interpret a rule differently going forward, you can adjust your behavior to comply. New legislation, sure abide by it. But when the rules change and your behavior 15 years ago is now viewed to be illegal you can't do anything. Retroactivity is accepted in Europe but it is explicitly unconstitutional in the US. It's a major reason why the US is not currently part of the UK. So the GDPR is terrifying because of the massive discretion granted to judges and prosecutors in every EU country and their habit for changing their interpretations. On its face it's not too threatening, but the fines are massive, there are no hard rules, and you can't be sure that today's interpretation will be tomorrow's. Facebook and Google will manage - they can write billion dollar checks and get the US government to protect them. Many of us can be completely wiped out by a $20MM fine. Just a court case would be existentially threatening in terms of the resources it requires and its impact on fundraising and gaining customers.

by midasz 8y ago

tchock23 8y ago

The definition of personal information is easy to understand (albeit broad). However, the vagueness seeps in other areas of the regulation. For example, additional restrictions are in place for “large scale” processing of personal information, yet “large scale” is never defined. Is that hundreds, thousands or millions of records? As the owner of a very small SaaS business (that does not sell personal information of its users) I found it tremendously difficult to figure out how to comply given the vagueness of it all.

midasz 8y ago
Yeah I get that. I googled around a bit and apparently there were concrete figures in the initial draft. I don't know if the EU has a contactperson to whom you can ask these questions, if they do, you can simply ask them to clarify. If you've done that, you're in the clear because you've put in the effort to comply. But yeah in this case they should just give you a number.
- pjc50 8y ago
  > I don't know if the EU has a contactperson to whom you can ask these questions, if they do, you can simply ask them to clarify. lol of course there isn't an office you can ring to help you with this! If there were we wouldn't be spending quite so much effort working out what it all means.
  - M2Ys4U 8y ago
    Each of the 28 member states of the EU has a data protection authority. Those are the people one rings to get advice.
  - midasz 8y ago
    Well for my country (NL) we have the AP and with 2 clicks I have their phone number: https://autoriteitpersoonsgegevens.nl/nl/contact-met-de-autoriteit-persoonsgegevens/telefonisch-contact https://autoriteitpersoonsgegevens.nl/nl/contact-met-de-auto... .... > If there were we wouldn't be spending quite so much effort working out what it all means People love drama.
    - repolfx 8y ago
      You don't seem to know much about GDPR. Firstly, no, your national regulators cannot give you binding answers about GDPR. This is one thing the EU Commission has been clear on. They can advise, but their advice has no more weight than this Hacker News thread does - the EU is not required to care about what national regulators said and they have no special powers to interpret the law. Only the EU gets to decide what GDPR means, and they have said explicitly they will not answer questions about it. The only time answers finally come is during legal actions. Secondly, no, people do not "love drama" in the business context, far from it. Maybe you should consider that your own interpretation of the problem is the issue rather than other people just causing drama for the sake of it.
      - midasz 8y ago
        k
jacquesm 8y ago
> For example, additional restrictions are in place for “large scale” processing of personal information, yet “large scale” is never defined. Is that hundreds, thousands or millions of records? Hundreds or thousands not, millions definitely yes, somewhere in the middle you get to draw a line which to me is an indication that the closer you get to those millions the more you'll have to work and then those additional restrictions kick in. There are companies that store billions of profiles (Google, Facebook), and for those the 'large scale' moniker is a no-brainer. If you're a small company that stores a few hundred to a few tens of thousands of records because you are doing direct business with those people then that would most likely still qualify as small. But from 100K and up I'd make sure the house was in order, not just because of the GDPR but because you are becoming a nice, fat & juicy target for miscreants as well.
- tchock23 8y ago
  That is the scope I was ballparking mentally (and which fits the scope of processing done in my app), but I just wish they had been explicit about it in the regulation so I could put to rest any apprehension around it.
  - jacquesm 8y ago
    The room built in is to ensure that there is some flexibility regarding for instance financial and health information where those restrictions would probably kick in sooner versus some e-commerce company such as a web store where the need to keep the data around on live systems is much less urgent. That way one law will allow banks, insurance companies, hospitals and a mid-sized e-commerce company all to figure out for themselves what their comfort zone is, add a little room for safety and you're most likely going to be good, and even if not you can point at the law and say 'it wasn't explicit', so unless you are purposefully mis-interpreting a few million records as 'small scale' you will likely get away with that. Note the 'likely', this isn't a certainty but in my experience to date everybody that is fear mongering about the GDPR is coming up with the wildest of scenarios rather than to just look at the law as if it was intended well (which I really believe it is).

jcranmer 8y ago

> This is nonsense. I really don't see what's so difficult to understand. Personal information is information to which the person can be identified. Does that include email addresses and IP addresses? If so, that means things like using email addresses to log in for comments or logging IP addresses for traffic analysis causes all sorts of GDPR to kick in. As the OP points out, this means that things like the EU's own websites are in violation of the GDPR.

jacquesm 8y ago
> As the OP points out, this means that things like the EU's own websites are in violation of the GDPR. Actually, it doesn't. There are plenty of valid reasons to collect those things. Collecting them to track your users and to spam them to death are not on that list.
- ghein 8y ago
  The presumption is that it's illegitimate but you can provide an affirmative defense of having a valid reason. Proving this can be expensive and is risky. Who knows what any individual judge in any EU country will decide is "reasonable"? Companies can easily be destroyed by filing multiple charges against them. Guilt, innocence, or reasonableness doesn't come into it: the process is the punishment. Look at Amanda Knox (Americans tend to think she's innocent, Brits tend to think she's guilty) - after appeals the Italian Justice System found her not guilty of the murder of her roommate. She still spent almost four years in prison in her early twenties and had to spend a huge amount of money on lawyers to arrive at this result. Just because you eventually get what you see as the right result doesn't mean you won't go through hell to get there. A major reason why Americans are having such a big problem with GDPR is because the EU system appears to change its interpretations and decisions abruptly, with retrospective effect. You set up companies in certain jurisdictions thanks to their tax rates and how transactions are treated. You follow every aspect of national and EU law. These arrangements are widely known, are accepted as legitimate practice, and they continue for decades. The EU commissioners change - suddenly your corporate arrangements are wildly illegal and you are subject to penalties and back taxes stretching over a decade. If staff changes and they say that they will interpret a rule differently going forward, you can adjust your behavior to comply. New legislation, sure abide by it. But when the rules change and your behavior 15 years ago is now viewed to be illegal you can't do anything. Retroactivity is accepted in Europe but it is explicitly unconstitutional in the US. It's a major reason why the US is not currently part of the UK. So the GDPR is terrifying because of the massive discretion granted to judges and prosecutors in every EU country and their habit for changing their interpretations. On its face it's not too threatening, but the fines are massive, there are no hard rules, and you can't be sure that today's interpretation will be tomorrow's. Facebook and Google will manage - they can write billion dollar checks and get the US government to protect them. Many of us can be completely wiped out by a $20MM fine. Just a court case would be existentially threatening in terms of the resources it requires and its impact on fundraising and gaining customers.