9 ms·

He is a 1 person team. Given him a break vs. being so aggressive in your comment. There is a cost associated with trying to figure out GDPR regulations, finding

He is a 1 person team. Given him a break vs. being so aggressive in your comment. There is a cost associated with trying to figure out GDPR regulations, finding a lawyer, vetting their feedback, acting to hire folks, changing UI to give user an opt out, implementing that in the system etc. All these things don't drop from the sky. And they are a business. And as a business they have decided to get out of Europe as the above costs weren't worth it to them.

jacquesm 8y ago
> Given him a break vs. trying to me so aggressive in your comment. The article is spreading FUD and inciting others to spread it even further in the comments. > There is a cost associated with trying to figure out GDPR regulations, finding a lawyer, vetting their feedback, acting to hire folks, changing UI to give user an opt out, implementing that in the system etc. The GDPR is online, and has been for a long time, you don't need a lawyer but if you feel that gives you more comfort then fine, you don't need to hire anybody, that is just plain nonsense, and changing the UI to give users an opt out: that should have been done two years ago. > All these things don't drop from the sky. Indeed, this did not drop out of the sky. It has been in the works for years. > And they are a business. And as a business they have decided to get out of Europe as the above costs weren't worth it to them. That's fine with me, the way in which it is presented is not fine with me.
- product50 8y ago
  Well - you haven't refuted any of his core points wrt DPO, Push & XMPP. All your comments have been stated in an aggressive tone which generally is a negative signal. At this point, I feel you need to provide more context to your core points vs. just saying read the GDPR and comply with it (or that you should have already done 2 yrs back). Even companies like Google and FB are complying with it in the past month.
  - jacquesm 8y ago
    I have, just not in this comment. See elsewhere in this thread, it's hard to miss.
  - DanBC 8y ago
    DPO has been thoroughly refuted in this thread. He doesn't need a DPO; if he wants to hire a DPO that can be him.
    - ryanwaggoner 8y ago
      This is the furthest thing from true, like almost every single question about this terrible law. Vague law + faceless bureaucracies + universal application + crippling penalties...sounds like a brilliant combo to destroy people’s lives.
      - deleted 8y ago
        [deleted]
      - riffraff 8y ago
        as usual, the rebuttal is: there have been this kind of laws in Europe for a decade. For example, if you're operating in Italy and don't provide 2 separate checkboxes for managing personal data directly and indirectly at sign up time you're in breach of the law. Do you remember many people's lifes crippled by this?
        tripletao 8y ago
        It's certainly true that even before the GDPR, almost any nontrivial business could reasonably be argued to be violating some mostly-unenforced law. I don't see that as a reason to shrug, and make the problem one step worse. Selective enforcement of commercial law is a routine tool of unfree states--look at something like the tax charges against The Cambodia Daily. To trust in regulatory discretion is to trust that no government in the EU--a continent that within living memory hosted Francisco Franco, Giorgios Papadopoulos, and much worse--will ever be run by people you disagree with. In the extreme, a dictator can always ignore or rewrite the law; but somewhere in the slide from our present democracy to that, I don't think it's unimaginable that the GDPR could be abused. I support privacy regulation. I don't see why it requires us to abandon the rule of law. ETA: Downvote if you trust Viktor Orban, I guess? I'm presuming a strong case of "it can't happen here"....
  - AJ007 8y ago
    There is signifiant disagreement to what extent Facebook and Google are compliant.
    - zaarn 8y ago
      I'm pretty sure the regulatory bodies are thoroughly and wholly excited to take on Google and Facebook with some hefty fines and clarify the GDPR and how it applies. I can't wait either.
  - hrktb 8y ago
    Google and Facebook have financial impacts in complying due to the very nature of their business. They comply later than everyone else not because they didn’t see it coming or didn’t prepare for it, just that it wasn’t in their interest to do it earlier
- petercooper 8y ago
  Indeed, this did not drop out of the sky. It has been in the works for years. I run a business that follows EU DP best practices (and so was mostly GDPR compliant already) and the first I heard of it was mid 2017. My country's data protection agency made no attempt at raising awareness despite having my email address on file :-D It's only been frequently hitting non-EU industry news and places like HN since late 2017 so I can appreciate how non-EU folks might feel blindsided by it.
  - jacquesm 8y ago
    I'm probably a bit more in touch with this stuff than most because of the nature of my business but in the last year or so I've seen more and more companies that made real work of their GDPR impact studies (companies with vast amounts of data and/or sensitive data were further along). For all but the largest the impact has been very low, the longer ago they started the lower the amount of work they had to do. That's the price of sitting in your office with your head down though, you can't ignore changes such as these. This is one of the oldest HN mentions about the GDPR I could find: https://news.ycombinator.com/item?id=11764073 https://news.ycombinator.com/item?id=11764073 But it sank without a trace.
  - Silhouette 8y ago
    I run a business that follows EU DP best practices (and so was mostly GDPR compliant already) and the first I heard of it was mid 2017. Likewise. This idea that the GDPR has been in the works for years so it's somehow implausible that very small businesses have only just heard of it doesn't stand up to scrutiny. No owner-run microbusiness is spending the time necessary to keep up with the vagaries of EU debates. Similarly, the idea that the GDPR is plainly readable and so that shouldn't be a burden and no-one needs to consult experts makes no sense. The document is many pages long, there are many more pages of guidance and interpretation produced by both the EU itself and the various national regulators, and it's still fundamentally ambiguous on many significant practical points. It is entirely reasonable for a small business that does relatively little trade with the EU not to want anything to do with this, and it has little if anything to do with how good or bad their practical data protection measures and respect for privacy are. If small businesses are overreacting then that is on the EU for failing to pass better law and provide sufficiently clear, concise and timely publicity and guidance on what it really means. My business interests are in the UK, so we're stuck with this one. However, if we'd realised ahead of time how much trouble the new EU VAT rules would cause a few years back, we would gladly have sacrificed the modest part of our revenue that comes from other EU member states in order to avoid that mess, and it wouldn't have been a close decision. So I find it very hard to criticise anyone running a small business outside the EU for wanting to avoid the latest round of heavyweight EU regulations if they have a way to put themselves outside of their scope.
- jcims 8y ago
  The OP is not the site owner. The decision to exclude a portion of your user community should be explained. Unless you personally know the developer you are making a number of assumptions about their resources and time to deal with this issue. Presumably the developer wants to continue to offer this app and service. His understanding of GDPR and how it affects his service will grow over time and he will likely eventually take action to reintegrate the EU into his service.
  - jacquesm 8y ago
    > His understanding of GDPR and how it affects his service will grow over time and he will likely eventually take action to reintegrate the EU into his service. Unless you personally know the developer you are making a number of assumptions about their resources and time to deal with this issue.
- sunir 8y ago
  You don’t need a lawyer to comply with the law is a weird statement to put out there. You should retract.
  - robin_reala 8y ago
    What? I don’t need a lawyer to tell me I can’t go out and steal someone’s wallet. It’s perfectly possible to comply with the law without one.
    - sunir 8y ago
      Well, the difference is that theft is a natural law. We are born with an instinct it is wrong. Having a data processing officer in the EU for some definition of significant business is not a natural law and requires careful parsing of the legal text.
    - llcoolv 8y ago
      This particular law is 88 pages full of duplicated terms, vague definitions and sometimes contradicting points. A very quick proof of that is the number of misunderstandings on so many points of it just in the comments of this topic - e.g. "do you need a DPO?", "do you need two separate people to avoid CoI?", "does the DPO need to be EU resident?". There are hardly two people with the same interpretation. And if people on HN have a horrible grasp of GDPR, how would an Average Joe be able to understand it idependently? The only thing certain are the insane crippling fines. It is extremely naive to believe you don't need a lawyer for that. You do - the same way as in some of EU's less market-oriented countries, after a VAT reg you need a registered accountant.
- tokyodude 8y ago
  > Indeed, this did not drop out of the sky. It has been in the works for years. VOGON CAPTAIN: [On Speakers] People of Earth your attention please. This is Prostectic Vogon Jeltz of the Galactic Hyperspace Planet Council. As you no doubt will be aware, the plans for the development of the outlying regions of the western spiral arm of the galaxy require the building of a hyperspace express route through your star system and, regrettably, your planet is one of those scheduled for demolition. The process will take slightly less than two of your Earth minutes thank you very much. MANKIND: [Yells of protest] VOGON CAPTAIN: There’s no point in acting all surprised about it. All the planning charts and demolition orders have been on display at your local planning department in Alpha Centauri for fifty of your Earth years so you’ve had plenty of time to lodge any formal complaints and its far too late to start making a fuss about it now. From "Hitchhiker's Guide to the Galaxy" by Douglas Adams sorry I couldn't resist
  - zaarn 8y ago
    I smirked a bit, the EU certainly didn't advertise it in the last two years but it was definitely around. But just like in HGttG there isn't much use in yelling in protest now, grab a towel and grab something safe. (I should sent out my towel reminders to some of my users since I updated a few pages)
  - jacquesm 8y ago
    I saw that one coming a mile away, thank you for the quote though :) And no, this is not about demolishing our way of life, the town we live in or the planet, it's about respecting the privacy of your users, which - for a change - is actually a positive thing. Unless of course you weren't going to do that in the first place you should welcome the development, I imagine that in a just world the Vogons would be on the receiving end of it. Oh, and in this case the plans were not on display in the locked filing cabinet in a basement of a building where the lights had gone off and where the stairs were missing. A handy URL has been provided for a long long time and all the debates have been recorded in public as well.
    - tokyodude 8y ago
      Im already respecting my users privacy. I should’t have to spend time and money to prove it any more than i should have to prove I didn’t rob your house. Sure make it illegal to mistreat user data then punish those who fail. Don’t punish everyone up front
- deleted 8y ago
  [deleted]
e12e 8y ago
> changing UI to give user an opt out Opt out is illegal under the GDPR - it needs to be opt in.

jacquesm 8y ago

> Given him a break vs. trying to me so aggressive in your comment. The article is spreading FUD and inciting others to spread it even further in the comments. > There is a cost associated with trying to figure out GDPR regulations, finding a lawyer, vetting their feedback, acting to hire folks, changing UI to give user an opt out, implementing that in the system etc. The GDPR is online, and has been for a long time, you don't need a lawyer but if you feel that gives you more comfort then fine, you don't need to hire anybody, that is just plain nonsense, and changing the UI to give users an opt out: that should have been done two years ago. > All these things don't drop from the sky. Indeed, this did not drop out of the sky. It has been in the works for years. > And they are a business. And as a business they have decided to get out of Europe as the above costs weren't worth it to them. That's fine with me, the way in which it is presented is not fine with me.

product50 8y ago
Well - you haven't refuted any of his core points wrt DPO, Push & XMPP. All your comments have been stated in an aggressive tone which generally is a negative signal. At this point, I feel you need to provide more context to your core points vs. just saying read the GDPR and comply with it (or that you should have already done 2 yrs back). Even companies like Google and FB are complying with it in the past month.
- jacquesm 8y ago
  I have, just not in this comment. See elsewhere in this thread, it's hard to miss.
- DanBC 8y ago
  DPO has been thoroughly refuted in this thread. He doesn't need a DPO; if he wants to hire a DPO that can be him.
  - ryanwaggoner 8y ago
    This is the furthest thing from true, like almost every single question about this terrible law. Vague law + faceless bureaucracies + universal application + crippling penalties...sounds like a brilliant combo to destroy people’s lives.
    - deleted 8y ago
      [deleted]
    - riffraff 8y ago
      as usual, the rebuttal is: there have been this kind of laws in Europe for a decade. For example, if you're operating in Italy and don't provide 2 separate checkboxes for managing personal data directly and indirectly at sign up time you're in breach of the law. Do you remember many people's lifes crippled by this?
      - tripletao 8y ago
        It's certainly true that even before the GDPR, almost any nontrivial business could reasonably be argued to be violating some mostly-unenforced law. I don't see that as a reason to shrug, and make the problem one step worse. Selective enforcement of commercial law is a routine tool of unfree states--look at something like the tax charges against The Cambodia Daily. To trust in regulatory discretion is to trust that no government in the EU--a continent that within living memory hosted Francisco Franco, Giorgios Papadopoulos, and much worse--will ever be run by people you disagree with. In the extreme, a dictator can always ignore or rewrite the law; but somewhere in the slide from our present democracy to that, I don't think it's unimaginable that the GDPR could be abused. I support privacy regulation. I don't see why it requires us to abandon the rule of law. ETA: Downvote if you trust Viktor Orban, I guess? I'm presuming a strong case of "it can't happen here"....
- AJ007 8y ago
  There is signifiant disagreement to what extent Facebook and Google are compliant.
  - zaarn 8y ago
    I'm pretty sure the regulatory bodies are thoroughly and wholly excited to take on Google and Facebook with some hefty fines and clarify the GDPR and how it applies. I can't wait either.
- hrktb 8y ago
  Google and Facebook have financial impacts in complying due to the very nature of their business. They comply later than everyone else not because they didn’t see it coming or didn’t prepare for it, just that it wasn’t in their interest to do it earlier
petercooper 8y ago
Indeed, this did not drop out of the sky. It has been in the works for years. I run a business that follows EU DP best practices (and so was mostly GDPR compliant already) and the first I heard of it was mid 2017. My country's data protection agency made no attempt at raising awareness despite having my email address on file :-D It's only been frequently hitting non-EU industry news and places like HN since late 2017 so I can appreciate how non-EU folks might feel blindsided by it.
- jacquesm 8y ago
  I'm probably a bit more in touch with this stuff than most because of the nature of my business but in the last year or so I've seen more and more companies that made real work of their GDPR impact studies (companies with vast amounts of data and/or sensitive data were further along). For all but the largest the impact has been very low, the longer ago they started the lower the amount of work they had to do. That's the price of sitting in your office with your head down though, you can't ignore changes such as these. This is one of the oldest HN mentions about the GDPR I could find: https://news.ycombinator.com/item?id=11764073 https://news.ycombinator.com/item?id=11764073 But it sank without a trace.
- Silhouette 8y ago
  I run a business that follows EU DP best practices (and so was mostly GDPR compliant already) and the first I heard of it was mid 2017. Likewise. This idea that the GDPR has been in the works for years so it's somehow implausible that very small businesses have only just heard of it doesn't stand up to scrutiny. No owner-run microbusiness is spending the time necessary to keep up with the vagaries of EU debates. Similarly, the idea that the GDPR is plainly readable and so that shouldn't be a burden and no-one needs to consult experts makes no sense. The document is many pages long, there are many more pages of guidance and interpretation produced by both the EU itself and the various national regulators, and it's still fundamentally ambiguous on many significant practical points. It is entirely reasonable for a small business that does relatively little trade with the EU not to want anything to do with this, and it has little if anything to do with how good or bad their practical data protection measures and respect for privacy are. If small businesses are overreacting then that is on the EU for failing to pass better law and provide sufficiently clear, concise and timely publicity and guidance on what it really means. My business interests are in the UK, so we're stuck with this one. However, if we'd realised ahead of time how much trouble the new EU VAT rules would cause a few years back, we would gladly have sacrificed the modest part of our revenue that comes from other EU member states in order to avoid that mess, and it wouldn't have been a close decision. So I find it very hard to criticise anyone running a small business outside the EU for wanting to avoid the latest round of heavyweight EU regulations if they have a way to put themselves outside of their scope.
jcims 8y ago
The OP is not the site owner. The decision to exclude a portion of your user community should be explained. Unless you personally know the developer you are making a number of assumptions about their resources and time to deal with this issue. Presumably the developer wants to continue to offer this app and service. His understanding of GDPR and how it affects his service will grow over time and he will likely eventually take action to reintegrate the EU into his service.
- jacquesm 8y ago
  > His understanding of GDPR and how it affects his service will grow over time and he will likely eventually take action to reintegrate the EU into his service. Unless you personally know the developer you are making a number of assumptions about their resources and time to deal with this issue.
sunir 8y ago
You don’t need a lawyer to comply with the law is a weird statement to put out there. You should retract.
- robin_reala 8y ago
  What? I don’t need a lawyer to tell me I can’t go out and steal someone’s wallet. It’s perfectly possible to comply with the law without one.
  - sunir 8y ago
    Well, the difference is that theft is a natural law. We are born with an instinct it is wrong. Having a data processing officer in the EU for some definition of significant business is not a natural law and requires careful parsing of the legal text.
  - llcoolv 8y ago
    This particular law is 88 pages full of duplicated terms, vague definitions and sometimes contradicting points. A very quick proof of that is the number of misunderstandings on so many points of it just in the comments of this topic - e.g. "do you need a DPO?", "do you need two separate people to avoid CoI?", "does the DPO need to be EU resident?". There are hardly two people with the same interpretation. And if people on HN have a horrible grasp of GDPR, how would an Average Joe be able to understand it idependently? The only thing certain are the insane crippling fines. It is extremely naive to believe you don't need a lawyer for that. You do - the same way as in some of EU's less market-oriented countries, after a VAT reg you need a registered accountant.
tokyodude 8y ago
> Indeed, this did not drop out of the sky. It has been in the works for years. VOGON CAPTAIN: [On Speakers] People of Earth your attention please. This is Prostectic Vogon Jeltz of the Galactic Hyperspace Planet Council. As you no doubt will be aware, the plans for the development of the outlying regions of the western spiral arm of the galaxy require the building of a hyperspace express route through your star system and, regrettably, your planet is one of those scheduled for demolition. The process will take slightly less than two of your Earth minutes thank you very much. MANKIND: [Yells of protest] VOGON CAPTAIN: There’s no point in acting all surprised about it. All the planning charts and demolition orders have been on display at your local planning department in Alpha Centauri for fifty of your Earth years so you’ve had plenty of time to lodge any formal complaints and its far too late to start making a fuss about it now. From "Hitchhiker's Guide to the Galaxy" by Douglas Adams sorry I couldn't resist
- zaarn 8y ago
  I smirked a bit, the EU certainly didn't advertise it in the last two years but it was definitely around. But just like in HGttG there isn't much use in yelling in protest now, grab a towel and grab something safe. (I should sent out my towel reminders to some of my users since I updated a few pages)
- jacquesm 8y ago
  I saw that one coming a mile away, thank you for the quote though :) And no, this is not about demolishing our way of life, the town we live in or the planet, it's about respecting the privacy of your users, which - for a change - is actually a positive thing. Unless of course you weren't going to do that in the first place you should welcome the development, I imagine that in a just world the Vogons would be on the receiving end of it. Oh, and in this case the plans were not on display in the locked filing cabinet in a basement of a building where the lights had gone off and where the stairs were missing. A handy URL has been provided for a long long time and all the debates have been recorded in public as well.
  - tokyodude 8y ago
    Im already respecting my users privacy. I should’t have to spend time and money to prove it any more than i should have to prove I didn’t rob your house. Sure make it illegal to mistreat user data then punish those who fail. Don’t punish everyone up front
deleted 8y ago
[deleted]

e12e 8y ago

> changing UI to give user an opt out Opt out is illegal under the GDPR - it needs to be opt in.