7 ms·

You can be respective of privacy without complying with GDPR. It requires a lot more than simply being privacy-conscious. (E.g. I don't think Hacker News is doi

You can be respective of privacy without complying with GDPR. It requires a lot more than simply being privacy-conscious. (E.g. I don't think Hacker News is doing anything unethical even though they blatantly violate GDPR) > Legal compliance is a requirement for any business You are required to comply with the laws of your country, not those of other countries.

jacquesm 8y ago
If you are not doing anything shady, if you have your house in order security wise and if you do not collect data that you have no use for you are 95% there. The remainder will maybe require consultation with a lawyer for an hour or two if you want to play it safe but you could also simply wait for a few months to see how it all plays out. If you are respectful of other people's privacy then there is very little chance that you will be found afoul of the law and even if you should be then you will be warned to become compliant long before you will be fined. This whole discussion is beyond ridiculous. Imagine the rest of the world reacting to the DMCA this way which has far wider scope and effect.
- zerostar07 8y ago
  > then you will be warned to become compliant long before you will be fined citation needed > if you do not collect data that you have no use for you are 95% there. I have always been respectful and even never required emails on signups. I am not 95% there because there is a ton more to do. In fact i am at 5% because i have a lot of small scale past projects. Not everyone is a VC-funded startup. That's the kind of emotional reaction that everyone has to GDPR. Yes we like respecting privacy, it's a good thing, but there is a lot that is problematic with this legislation.
  - jacquesm 8y ago
    > citation needed Every statement issued by EU regulators to date. > I have always been respectful and even never required emails on signups. Good. > I am not 95% there because there is a ton more to do. Such as? > In fact i am at 5% because i have a lot of small scale past projects. You've had two full years to get this done. The law came into effect the 14th of April 2016. It is now May 2018. > Not everyone is a VC-funded startup. If you can build it you can also build it in a way that is compliant with the law and if you built it in a way that requires a lot of work to be compliant with the GDPR then you likely were already riding a very fine line with respect to the DPD which has been in effect for much longer. > That's the kind of emotional reaction that everyone has to GDPR. Emotions are a bad guide when it comes to legal stuff. > Yes we like respecting privacy, it's a good thing, but there is a lot that is problematic with this legislation. Such as?
    - zerostar07 8y ago
      > 95% Such as? Everything. Even if you process just an IP you need to document your procedures, change privacy policies. If at any point you ask for anything you need to implement opt ins, a way for (unauthenticated) users to request their data (even if it's just 1 IP) etc. My point is that having negligible private data is not less of a compliance burden than having a lot of private data. > You've had two full years You mean i ve had 2 years to attempt to interpret a vaguely written law. Actionable information is just now coming out, and even that is contradictory (cue this topic). Even the EU parliament's website does not comply yet. > you likely were already riding a very fine line with respect to the DPD First, that is a directive, not a law and compliance can vary widely. Second, gdpr requires new procedures which means it requires amendments anyway > Such as? I have posted another comment
      - jacquesm 8y ago
        > Even if you hold just an IP you need to document your procedures, change privacy policies. So don't hold IPs if you can't be bothered to know where the might end up and if you don't want to update your privacy policy. Why would you? > My point is that having negligible private data is no less compliance burden than having a lot of private data. And no data means no compliance burden. Note that holding data already has costs associated with it no matter what you do: you need to secure that data, you need to back it up, you need to process it and eventually you will need to get rid of it. All of those cost money and effort. > You mean i ve had 2 years to attempt to interpret a vaguely written law. As laws come the GDPR is surprisingly clear. I was quite skeptical until I actually got a copy of the draft and I was positively surprised. They actually got it mostly right, there are some minor things that I would have liked to see different but on the whole I am not complaining. > Actionable information is just now coming out, and even that is contradictory (cue this topic). The hysteria is ridiculous. Anybody that has spent even so much as a couple of hours on this subject - and from a somewhat serious point of view rather than the ridiculous fear mongering - knows enough to not have written a silly blog post like the one on display here. > Even the EU parliament's website does not comply yet. That article was not exactly enlightened to put it mildly. > First, that is a directive, not a law and compliance can vary widely. Yes, but if you did take it serious then you are well underway. > Second, gdpr requires new procedures which means it requires amendments anyway Yes, there is some overhead. But this is mostly to ensure that the law will not be ignored like what happened with the DPD. As you say 'it was a directive' which many companies interpreted as 'can be ignored'. What they failed to realize is that if you don't self regulate after a directive is issued that there will be a version of the directive with teeth that has the strength of law. Congratulations, we are there.
  - DanBC 8y ago
    > citation needed The 20 years of data protection enforcement we've had.
- iamnothere 8y ago
  > Imagine the rest of the world reacting to the DMCA this way which has far wider scope and effect. That would have been a wonderful thing to see. The DMCA has had a chilling effect on speech worldwide, and has created difficult barriers for small businesses to deal with if they want to host user-created content. I think you unintentionally made your opponent's point!
cyphar 8y ago
> You are required to comply with the laws of your country, not those of other countries. No, you are required to comply with the laws of any country you do business with. This applies to any type of business, and I don't see why "it's on the internet" appears to be the main counter-argument. If I buy something from you (via snail-mail or on the internet) and it doesn't follow the requirements of the consumer law in my country, I can ask you to comply with the laws of my country. If you refuse, I can report you and you will be fined (if you don't pay, then you can have your right to do business in my country revoked). In practice most cases won't escalate that far, but the principle is the same.
- zerostar07 8y ago
  You can be fined if there is international or bilateral law or if somehow else the fine can be domesticated. There is no international regulation (not even consensus) on privacy so the law is not directly enforced here. However you are also not required to apply another country's law to all your customers, and if you don't want to you should (but are not really enforced to) block the EU.
  - cyphar 8y ago
    Considering that most online businesses are (effectively) a form of international trade, I wonder whether GDPR fines could be seen as a form of customs fine (which definitely is something that foreign companies can be forced to pay, as you've said).
    - deleted 8y ago
      [deleted]
- leereeves 8y ago
  > and I don't see why "it's on the internet" appears to be the main counter-argument. Because by default any web site has, in the past, been open to people from any country that doesn't censor the web. Regulations like GDPR are making doing business in more than one country more difficult and encouraging a Balkanized web.

jacquesm 8y ago

If you are not doing anything shady, if you have your house in order security wise and if you do not collect data that you have no use for you are 95% there. The remainder will maybe require consultation with a lawyer for an hour or two if you want to play it safe but you could also simply wait for a few months to see how it all plays out. If you are respectful of other people's privacy then there is very little chance that you will be found afoul of the law and even if you should be then you will be warned to become compliant long before you will be fined. This whole discussion is beyond ridiculous. Imagine the rest of the world reacting to the DMCA this way which has far wider scope and effect.

zerostar07 8y ago
> then you will be warned to become compliant long before you will be fined citation needed > if you do not collect data that you have no use for you are 95% there. I have always been respectful and even never required emails on signups. I am not 95% there because there is a ton more to do. In fact i am at 5% because i have a lot of small scale past projects. Not everyone is a VC-funded startup. That's the kind of emotional reaction that everyone has to GDPR. Yes we like respecting privacy, it's a good thing, but there is a lot that is problematic with this legislation.
- jacquesm 8y ago
  > citation needed Every statement issued by EU regulators to date. > I have always been respectful and even never required emails on signups. Good. > I am not 95% there because there is a ton more to do. Such as? > In fact i am at 5% because i have a lot of small scale past projects. You've had two full years to get this done. The law came into effect the 14th of April 2016. It is now May 2018. > Not everyone is a VC-funded startup. If you can build it you can also build it in a way that is compliant with the law and if you built it in a way that requires a lot of work to be compliant with the GDPR then you likely were already riding a very fine line with respect to the DPD which has been in effect for much longer. > That's the kind of emotional reaction that everyone has to GDPR. Emotions are a bad guide when it comes to legal stuff. > Yes we like respecting privacy, it's a good thing, but there is a lot that is problematic with this legislation. Such as?
  - zerostar07 8y ago
    > 95% Such as? Everything. Even if you process just an IP you need to document your procedures, change privacy policies. If at any point you ask for anything you need to implement opt ins, a way for (unauthenticated) users to request their data (even if it's just 1 IP) etc. My point is that having negligible private data is not less of a compliance burden than having a lot of private data. > You've had two full years You mean i ve had 2 years to attempt to interpret a vaguely written law. Actionable information is just now coming out, and even that is contradictory (cue this topic). Even the EU parliament's website does not comply yet. > you likely were already riding a very fine line with respect to the DPD First, that is a directive, not a law and compliance can vary widely. Second, gdpr requires new procedures which means it requires amendments anyway > Such as? I have posted another comment
    - jacquesm 8y ago
      > Even if you hold just an IP you need to document your procedures, change privacy policies. So don't hold IPs if you can't be bothered to know where the might end up and if you don't want to update your privacy policy. Why would you? > My point is that having negligible private data is no less compliance burden than having a lot of private data. And no data means no compliance burden. Note that holding data already has costs associated with it no matter what you do: you need to secure that data, you need to back it up, you need to process it and eventually you will need to get rid of it. All of those cost money and effort. > You mean i ve had 2 years to attempt to interpret a vaguely written law. As laws come the GDPR is surprisingly clear. I was quite skeptical until I actually got a copy of the draft and I was positively surprised. They actually got it mostly right, there are some minor things that I would have liked to see different but on the whole I am not complaining. > Actionable information is just now coming out, and even that is contradictory (cue this topic). The hysteria is ridiculous. Anybody that has spent even so much as a couple of hours on this subject - and from a somewhat serious point of view rather than the ridiculous fear mongering - knows enough to not have written a silly blog post like the one on display here. > Even the EU parliament's website does not comply yet. That article was not exactly enlightened to put it mildly. > First, that is a directive, not a law and compliance can vary widely. Yes, but if you did take it serious then you are well underway. > Second, gdpr requires new procedures which means it requires amendments anyway Yes, there is some overhead. But this is mostly to ensure that the law will not be ignored like what happened with the DPD. As you say 'it was a directive' which many companies interpreted as 'can be ignored'. What they failed to realize is that if you don't self regulate after a directive is issued that there will be a version of the directive with teeth that has the strength of law. Congratulations, we are there.
- DanBC 8y ago
  > citation needed The 20 years of data protection enforcement we've had.
iamnothere 8y ago
> Imagine the rest of the world reacting to the DMCA this way which has far wider scope and effect. That would have been a wonderful thing to see. The DMCA has had a chilling effect on speech worldwide, and has created difficult barriers for small businesses to deal with if they want to host user-created content. I think you unintentionally made your opponent's point!

cyphar 8y ago

> You are required to comply with the laws of your country, not those of other countries. No, you are required to comply with the laws of any country you do business with. This applies to any type of business, and I don't see why "it's on the internet" appears to be the main counter-argument. If I buy something from you (via snail-mail or on the internet) and it doesn't follow the requirements of the consumer law in my country, I can ask you to comply with the laws of my country. If you refuse, I can report you and you will be fined (if you don't pay, then you can have your right to do business in my country revoked). In practice most cases won't escalate that far, but the principle is the same.

zerostar07 8y ago
You can be fined if there is international or bilateral law or if somehow else the fine can be domesticated. There is no international regulation (not even consensus) on privacy so the law is not directly enforced here. However you are also not required to apply another country's law to all your customers, and if you don't want to you should (but are not really enforced to) block the EU.
- cyphar 8y ago
  Considering that most online businesses are (effectively) a form of international trade, I wonder whether GDPR fines could be seen as a form of customs fine (which definitely is something that foreign companies can be forced to pay, as you've said).
  - deleted 8y ago
    [deleted]
leereeves 8y ago
> and I don't see why "it's on the internet" appears to be the main counter-argument. Because by default any web site has, in the past, been open to people from any country that doesn't censor the web. Regulations like GDPR are making doing business in more than one country more difficult and encouraging a Balkanized web.