6 ms·
Directed or not at large companies, it applies to all companies. It introduces a fixed cost for operating with any user-related data, which effectively kills a
by ucaetano 8y ago
Directed or not at large companies, it applies to all companies.
It introduces a fixed cost for operating with any user-related data, which effectively kills any companies operating below that cost.
- Y_Y 8y agoMaybe companies that are so flimsy didn't have long left anyway. You're required to have a fire safety officer at these companies too, but it's not a full-time position.
- kasey_junk 8y agoI think this is a legitimate cultural difference. I’m fairly left leaning for a US citizen & find the idea that the default should be big companies abhorrent. But I recognize my bias & am not st all convinced it’s in any way objectively correct.
- ucaetano 8y ago> You're required to have a fire safety officer at these companies too, but it's not a full-time position. AFAIK, most of the "safety committee" regulations usually have waivers for small companies.
- Sean1708 8y agoWell that's terrifying...
- skrause 8y agoFrom my German perspective this whole GDPR panic is so interesting. The GDPR is basically a carbon copy of the data protections laws that have evolved in Germany since 1977. Yet we still have many thousands of small companies dealing with data, individuals running web forums etc. It's especially funny when small to medium German companies suddenly panic because of the GDPR and when you look at their situation all you can say is "yeah, you should have implemented that 15 years ago, it's already been German law that long". In Germany not much will change, but at least companies like Facebook can no longer just move to another country with worse privacy laws (like Ireland) and call it a day. For us the GDPR means that protecting user data will no longer be a competitve disadvantage. But if you're a small company and handling data reasonably, the GDPR won't hurt you anyway.
- tobltobs 8y agoData Protection Officer, right to be forgotten, data exportability, ... Can you hint me to one of those German laws which do require one of the above?
- skrause 8y agohttps://de.wikipedia.org/wiki/Bundesdatenschutzgesetz https://de.wikipedia.org/wiki/Bundesdatenschutzgesetz It literally translates to "federal data protection law" and has been German law since 1978. In certain conditions it has also mandated a DPO (https://de.wikipedia.org/wiki/Datenschutzbeauftragter https://de.wikipedia.org/wiki/Datenschutzbeauftragter) since then, but in fact the first DPO position in Germany was created in 1971. The right to be forgotten is mandated by article 35 BDSG (https://www.gesetze-im-internet.de/bdsg_1990/__35.html https://www.gesetze-im-internet.de/bdsg_1990/__35.html). The right to a data export is mandated by article 34 BDSG (https://www.gesetze-im-internet.de/bdsg_1990/__34.html https://www.gesetze-im-internet.de/bdsg_1990/__34.html). It has always been common use this law to get a free copy of the data which our credit reporting agencies have about you, I've done that multiple times.
- tobltobs 8y agoThank you for those detailed links. They are kind of eye opening, and I am German. However, it is hard to understand how stuff like GEZ, Schufa and article 35 can exist concurrently in the same country.
- skrause 8y agoSchufa (the biggest consumer credit reporting agency in Germany) and article 35 can certainly co-exist. In fact you can write to Schufa and request that they delete all your data. However, if you do that, good luck ever getting a mortgage, credit card or other post-paid services ever again if all credit report requests come back with the reponse "no data available". So I wouldn't recommend that.
- jacquesm 8y agoIf your businessmodel does not allow for the proper dealing with the information it collects you shouldn't be in business in the first place.
- ucaetano 8y agoissue isn't the business model, is the size. For a large company, handling GDPR is trivial. For a startup or small company, the cost is prohibitively high. I'm not arguing for or against it, just pointing that the resulting unintended consequence is protecting large companies. Exactly the opposite of the original intent.
- jacquesm 8y ago> For a startup or small company, the cost is prohibitively high. Nonsense. I look at another high tech data driven start-up every week and not a single one has stated that the GDPR costs are 'prohibitively high'. Sure, there are some that need to do more work than others (medical, ad tech). But on the whole companies that were already doing their best to not fuck up with their customers data have very little to do in order to get to where they should be and the remainder has a bit more work but will mostly likely be more-or-less compliant by the 25th and what work remains will be done long before the eye of Sauron will turn their way by virtue of their size. The cost is strongly related to the size of the organization and the amount of sensitive data you hold as well as whether or not you were a bad steward of the data in the past.
- afpx 8y agoIf a company’s margins are so razor thin that they can’t compete (with other regulated companies), then they may want to rethink their business model.
- KirinDave 8y agoWhat do you imagine that fixed cost to be? Delete your logs and don't, you know, make an entire business out of misrepresenting your revenue model and you're most of the way there. Any business that is shut down by GDPR is, to me, a good business to shut down.
- ucaetano 8y ago> What do you imagine that fixed cost to be? Compliance. It doesn't matter if you delete your logs, if you had them in the first place you're subject to compliance. Like the example in the article. Not sure why people are still thinking this doesn't happen, this is exactly what is happening in the article.