13 ms·

I think you and everyone making similar points in this thread are getting tripped up by the difference between rules-based regulation and principles-based regul

I think you and everyone making similar points in this thread are getting tripped up by the difference between rules-based regulation and principles-based regulation. This is unsurprising, given that the US is so heavily rules-based, but the EU (certainly the UK) has a long history of principles-based regulation. In rules-based regulation, all the rules are spelled out in advance, and the regulator is basically an automaton once the rules are set. In principles-based regulation, the rules are extensive rather than complete and you expect the regulator to have some lattitude (and, if the system is well designed, a mechanism of recourse if they do something stupid). An advocate of rules-based regulation would say this can make regulators unpredictable and capricious. An advocate of principles-based regulation would say it is an important safeguard against "rules-lawyering" and regulatory capture (especially the kind that ties new entrants up in check-box compliance that doesn't actually affect your business because all the rules have been worked around). A classic example would be the time PayPal tried to tell the UK regulators they shouldn't be regulated like a financial institution (which is a claim they successfully made in the US). They pointed to chapter and verse of the relevant law, and said that according to subparagraph 2.b.c(iii)... and the relevant regulator essentially told them "shut up, you keep consumers' money for them and will be treated accordingly". As a result, the worst "PayPal took all my money and I can't get it back" stories generally do not come from the UK. (And when they do, they are accompanied by referrals to the Financial Conduct Authority, who have teeth.) You can approve of this way of working or not, but the GDPR is a principles-based regulation, and you'll have to engage with it on those terms.

ajeet_dhaliwal 8y ago
This is it. Thank you, I commented about my local experiences with government in Europe and US/Canada but did not know the correct terms and you're right, I think this is the big difference and a driver of fear outside of the EU. In Canada I found the police, by-law enforcers, and almost any official are essentially rules based robots, very much different to my experience in the UK. Thank you for teaching me about rules-based and principles-based regulation. This is one of the big reasons I enjoy living in Europe tbh, a bit of discretion and old 'common sense' is actually quite an awesome thing.
- leereeves 8y ago
  Why should we trust the EU? The EU’s digital commissioner said in 2015 that the EU should use regulation to "replace today’s Web search engines, operating systems and social networks" with EU companies.[1] And they've passed or proposed ridiculous laws like cookie warnings and link taxes. We have reason to be suspicious of their intentions. 1: https://www.wsj.com/articles/eu-digital-chief-urges-regulation-to-nurture-european-internet-platforms-1429009201 https://www.wsj.com/articles/eu-digital-chief-urges-regulati...
  - vanderZwan 8y ago
    You have to keep in mind that the EU is not as integrated as the US on a political level. You need diplomatic leeway to get everyone to agree to do anything: instead of saying "this is what we'll do", it's "this is more or less what we do, everyone gets to fill in the details on their own". Without that level of flexibility and autonomy for individual countries, they would block the legal process even more than they are now. As for the link tax: I would blame the publishers pushing for it, not the EU.
    - gowld 8y ago
      The corpse doesn't care who held the knife.
AmericanChopper 8y ago
>and you'll have to engage with it on those terms Or you can just disengage with Europe all together, which is an obvious choice for many small to medium sized companies, given the risks and costs involved.
- downandout 8y ago
  That's what we've chosen to do. The reality is that most businesses outside the EU will wind up blocking EU traffic, simply because they don't want the liability.
  - AmericanChopper 8y ago
    Same here. EU makes up such a small amount of or customer base, and EU customers spend far less money with us. Which is generally true in most industries, US consumers spend far more than consumers anywhere else in the world. If we ever choose to enter the EU again, it will be a careful and deliberate choice, and will likely only ever happen if our growth slows in other regions.
    - dboreham 8y ago
      As a formerly European person running internet companies in the USA this baffles me. Why the teeth gnashing over being told not to spy on your users?
      - downandout 8y ago
        GDPR and “not spying on your users” are not even remotely related. GDPR is a massive regulation requiring significant resources that most small businesses simply don’t have.
        dboreham 8y ago
        Can you list one or two of those "significant resources" you need and tell us why you need them, and didn't need them last year?
dvdhnt 8y ago
Great explanation. I didn’t know the difference between US and U.K. law was so fundamentally different. Thank you for educating me on the correct terms.
matwood 8y ago
> This is unsurprising, given that the US is so heavily rules-based, but the EU (certainly the UK) has a long history of principles-based regulation. This is a good point, but many people seem to forget that most misdemeanor criminal offenses in the US are punishable by fine and/or up to 30+ days in jail. People do not often get the jail time so most don't even think about it, but it is available as an option to the judge for things like repeat offenders.
- Clubber 8y ago
  Unfortunately in the US, any conviction leads to essentially a work "blacklist," whereby employers do background checks and deny employment for anything they find within 7 years.
  - frockington 8y ago
    Not for non-violent misdemeanors. Unless you're a flagrant offender you will normally be slapped don the wrist and given a stern lecture in the form of a class. Source: was in a fraternity in the US where literally nothing bad happened to anyone I knew with a misdemeanor outside of a fine and class
    - Clubber 8y ago
      A lot of companies won't hire you if you have a criminal record of any kind. Some won't even hire you if you have any record of arrest, regardless of conviction. Which fraternity?
      - frockington 8y ago
        If the court seals the record its nearly impossible for anyone but government agencies to discover
        zajd 8y ago
        wasn't there just a story about background check startups finding these records and using them?
Silhouette 8y ago
An advocate of rules-based regulation would say this can make regulators unpredictable and capricious. Unfortunately, so might students of history. Ask anyone in the UK who was working in the freelance or contract world when IR35 was introduced. In that case, too, the principle was reasonable enough: there was a loophole in tax law where you could decide you're a contractor instead of an employee and pay less money despite for all other practical purposes still being an employee, and this was being actively exploited by some people. In that case, too, the reality was that most people working in the sector probably wouldn't be challenged by the authorities, not least because the enforcers had limited resources. But in that case, too, a given individual's status was often unclear. While some of those who were deterred or subsequently received penalties really were engaging in obvious tax avoidance, other reports described crippling penalties for people whose arrangements appeared to have been quite reasonable but to have fallen foul of someone in government's dubious interpretation. This led to substantial amounts of time and money being collectively spent by the freelance and contractor community incorporating new legalese into contracts and paying for advice and taking out insurance policies. An entire trade body was formed primarily to deal with this threat. Even today, those of us who take on any sort of individual contract or freelance work from time to time have to be careful not to say or do certain otherwise reasonable things, or to allow others to do so, for fear of tipping the balance or giving any appearance that might be subject to challenge. And the irony is that while the law arguably had some effect initially in getting contractors to go back to being permies if they were just using it as a tax dodge, overall it appears that IR35 has raised very little extra tax revenue for the government. It turns out that the vast majority of contractors and freelancers were operating in that fashion legitimately and continue to do so, and most enforcement actions appear to fail to the extent that the government even tries any more. Nevertheless, the rules still hang like a sword of Damocles above the whole sector.
- skummetmaelk 8y ago
  > It turns out that the vast majority of contractors and freelancers were operating in that fashion legitimately and continue to do so Which we know is definitely NOT the case for companies storing your data correctly.
Clubber 8y ago
Wow I wish we had principle-based regulation in the US. It seems like rules are made specifically so that only wealthy, entrenched institutions can follow them without significant burden. When those institutions fail, the fines don't seem relative to profit or size of the company or anything.
- rayiner 8y ago
  I suspect it wouldn’t work in the US. Principles based regulation requires some level of concensus on principles. We don’t have that in the US. Polarization breeds rules worship because you don’t trust the other people to use their discretion. Consider, for example, how every major social issue devolves into a Constitutional litigation. Whereas in Europe people just vote on stuff. And as to regulatory approaches I think you’d be surprised. European regulation is often quite conservative.
  - Clubber 8y ago
    Oh totally agree. Just think about the DMV. The people who work there cite the law word with zero discretion. Most US companies are like that as well. It's quite dystopian. Well lets say it wouldn't work with the current ruling class mindset where everyone they employ is stupid and unable to think critically.
    - myWindoonn 8y ago
      It depends on where you are. In places like Oregon, the DMV is a friendly place full of smiles where expiration dates can slip a few days and you don't have to change your hairstyle for your ID photo.
kodablah 8y ago
What you dub principles-based regulation others call trust-based regulation, or randomly-enforced regulation, or we-know-it-when-we-see-it-based regulation. Some don't appreciate this type of regulation. I think the unfortunate thing is that, when the previous/existing incarnations of these protection laws were/remain unenforced, many assumed it was because of lack of "teeth". But those of us familiar with how these principles-based regulatory bodies work know that it's more about confusion and regulator apathy. Nobody here is watching the watchers. Instead, there's a bunch of people foaming at the mouth with pitchforks asking for more laws and dismissing alternative concerns as hysteria or not understanding how laws work. We should be discussing how to solve the problem, yet we continually devolve to discussing the government-led solution presumably because we feel helpless and can't consider better options.
- raverbashing 8y ago
  And rules-based regulation means you commit 3 felonies per day https://www.wsj.com/articles/SB10001424052748704471504574438900830760842 https://www.wsj.com/articles/SB10001424052748704471504574438...
  - kodablah 8y ago
    Going on a bit of a tangent here, I am becoming concerned with how we discuss these things. You're completely either for or against it. And if you're against one way you are automatically for the other. If you think one thing is bad, obviously you need to be corrected that other thing is bad too. And then you'll get extreme examples showing it. Call it whataboutism, appeal to emotion, whatever. Every time these GDPR discussions come up, someone is always quick to say the US is worse, US is getting a taste of its own medicine, that dissenters must want surreptitious data collection, and on and on. Oddly enough, bringing it full circle, the tendencies for humans to argue in these directions instead of stay focused on the issue at hand make me glad to have more strict boundaries that are less subject to the whims of idle thought. Obviously this can't be absolute, so we should craft our rules to limit their scope at least from the outset. It's not about one country/continent vs another, it's about the goals and how they are achieved. Some believe and/or have experienced difficulties conforming to all sorts of government rules, it is a human thing not a location one. IMO, we need to stop deflecting and we need to stop being so absolute. People that are feeling pain of impending laws are not hysterical and laws are not magically OK because other forms/interpretations have downsides.
deleted 8y ago
[deleted]
merinowool 8y ago
Now if the government interpretation of GDPR will differ from a website owner's they'll be able to shut it down with a fine. Since this law can be interpreted in so many ways they can virtually fine any site they don't like, because depending on interpretation every site can be found non complaint. This is huge and dangerous.
dragonwriter 8y ago
> In rules-based regulation, all the rules are spelled out in advance, and the regulator is basically an automaton once the rules are set. Given that description, after a couple decades working in some and dealing daily with the acts of other agencies who which issue and apply regulations on the US, let me assure you that the regulatory system in the US is nothing at all like “rule-based” as you have described it.
- andrewla 8y ago
  I have also been extensively involved in compliance issues at US companies in the financial space and this comment is dead-on. The idea of rule-based regulations is a complete straw man as far as I can tell.
brownbat 8y ago
I don't know, EU members seem perfectly willing to toe literal rules for perverse outcomes in some areas. Open market gamesmanship, for one, such as the proliferation of national standards as a way to exclude 'single' market products. Maybe they are trying a kind of best of both worlds approach?
Moto7451 8y ago
This sort of explanation has been very popular by people who are trying to reduce the overall concern level of the community. You're not wrong. You very well could be right and this could be how it will work. Let me give a view as to why it doesn't matter. The problem with this approach is if you run a large or small company or are a sole proprietorship or simply have a hobby site, you can't write off legitimate fears of heavy handed enforcement. No one wants to be the example. In the former cases, if your company is how people are feeding and clothing their children, do you want to be the person who says "Oh well we tanked the company this year because weren't worried. Someone on the internet told us they'd be gentle! How could we have known they'd be serious about levying the maximum penalty!?" If this law is "no big deal" or "so easy to implement" or any other version of the arguments proposed this week, it would not be causing so much concern. It's neither an unreasonable ask or a trivial one. People are being impacted in large ways. I'm on my company's GDPA compliance team and it is serious business. Our European footprint is small but not insignificant. If we were an unreasonable bunch, we'd just shut the whole thing down and move on. The very expensive very well versed German legal counsel we're paying to help us do this right completely disagrees with what many are saying here. We have no reason to not believe them as they have a lot of experience with the German laws the GDPR is based on. We're paying them far more than the fines we'd see because we believe in doing the right thing. Ergo, we must take the "hard" regulator view rather than your "kid glove" view. Our lawyer's underlying point in every discussion is that this is really really serious business and that they're not fooling around. Adding to that is a GDPR like law is likely to be implemented in Canada and other jurisdictions in the future. We must be ready for that as well. I think GDPR is great for consumers. I think we'd actually be in a better/easier place if it were a requirement in the US since everyone would have to follow the same rules. The problem is that implementing it takes time and effort to do well at scale. To not loose your competitive edge against other large competitors that do not serve the EU and can operate under only US law. These are real concerns that have nothing to do with the regulators and whatever their whims are. So even if you're right, these are the real costs. You're going to be held accountable to the people you let down if you put your company in peril. You're going to be held accountable if you loose marketshare because you got this wrong and an unencumbered competitor outmaneuvers you. And most of all, you simply cannot assume the best case, kid glove, approach is what is going to happen. THIS is what people are frustrated with. I do hope that the EU is fair and equitable (which is my belief) but it would be irresponsible for me to act as if that is the only possibility.
albutr 8y ago
To be honest I know nothing about law enforcement in the EU, but the one thing I have heard about in recent memory is that guy who made a video of his girlfriend's dog saluting hitler, and was subsequently tried for a hate crime, convicted, and was charged with a pretty hefty 800 GBP fine after being found in violation of the Communications Act of 2003[1]. Seems like a pretty poor example of principles-based regulation. Maybe it's just an outlier though, idk. [1] https://en.wikipedia.org/wiki/Mark_Meechan https://en.wikipedia.org/wiki/Mark_Meechan
- CiaranMcNulty 8y ago
  The actual ruling was that him saying 'Gas the Jews' tens of times during the video was calculated to offend, rather than the dog thing
  - albutr 8y ago
    Oh okay, I actually misremembered what I had seen, I thought it was just the saluting thing. I just checked the original again[1], and that being said I still don't see how this isn't a ruling that is overblown; he's saying "wanna gas the jews" in a playful way to his dog over and over, and the dog responds when this is said. The ruling was that this was a hate crime, because it was "menacing, anti-Semitic and racist". I have trouble seeing how a Nazi pug that responds to "gas the jews" is anything other than silly bit of absurd comedy. I can't realistically see this video actually advancing any legitimate hatred, or having any negative consequences other than some people laughing at how silly it is, and some people just thinking it's kind of stupid. [1] https://www.youtube.com/watch?v=5rdWlVyN9es https://www.youtube.com/watch?v=5rdWlVyN9es
    - jacquesm 8y ago
      At a guess you didn't have any family and you don't know anybody that has family that ended up in a gas chamber?
      - albutr 8y ago

ajeet_dhaliwal 8y ago

This is it. Thank you, I commented about my local experiences with government in Europe and US/Canada but did not know the correct terms and you're right, I think this is the big difference and a driver of fear outside of the EU. In Canada I found the police, by-law enforcers, and almost any official are essentially rules based robots, very much different to my experience in the UK. Thank you for teaching me about rules-based and principles-based regulation. This is one of the big reasons I enjoy living in Europe tbh, a bit of discretion and old 'common sense' is actually quite an awesome thing.

leereeves 8y ago
Why should we trust the EU? The EU’s digital commissioner said in 2015 that the EU should use regulation to "replace today’s Web search engines, operating systems and social networks" with EU companies.[1] And they've passed or proposed ridiculous laws like cookie warnings and link taxes. We have reason to be suspicious of their intentions. 1: https://www.wsj.com/articles/eu-digital-chief-urges-regulation-to-nurture-european-internet-platforms-1429009201 https://www.wsj.com/articles/eu-digital-chief-urges-regulati...
- vanderZwan 8y ago
  You have to keep in mind that the EU is not as integrated as the US on a political level. You need diplomatic leeway to get everyone to agree to do anything: instead of saying "this is what we'll do", it's "this is more or less what we do, everyone gets to fill in the details on their own". Without that level of flexibility and autonomy for individual countries, they would block the legal process even more than they are now. As for the link tax: I would blame the publishers pushing for it, not the EU.
  - gowld 8y ago
    The corpse doesn't care who held the knife.

AmericanChopper 8y ago

>and you'll have to engage with it on those terms Or you can just disengage with Europe all together, which is an obvious choice for many small to medium sized companies, given the risks and costs involved.

downandout 8y ago
That's what we've chosen to do. The reality is that most businesses outside the EU will wind up blocking EU traffic, simply because they don't want the liability.
- AmericanChopper 8y ago
  Same here. EU makes up such a small amount of or customer base, and EU customers spend far less money with us. Which is generally true in most industries, US consumers spend far more than consumers anywhere else in the world. If we ever choose to enter the EU again, it will be a careful and deliberate choice, and will likely only ever happen if our growth slows in other regions.
  - dboreham 8y ago
    As a formerly European person running internet companies in the USA this baffles me. Why the teeth gnashing over being told not to spy on your users?
    - downandout 8y ago
      GDPR and “not spying on your users” are not even remotely related. GDPR is a massive regulation requiring significant resources that most small businesses simply don’t have.
      - dboreham 8y ago
        Can you list one or two of those "significant resources" you need and tell us why you need them, and didn't need them last year?

dvdhnt 8y ago

Great explanation. I didn’t know the difference between US and U.K. law was so fundamentally different. Thank you for educating me on the correct terms.

matwood 8y ago

> This is unsurprising, given that the US is so heavily rules-based, but the EU (certainly the UK) has a long history of principles-based regulation. This is a good point, but many people seem to forget that most misdemeanor criminal offenses in the US are punishable by fine and/or up to 30+ days in jail. People do not often get the jail time so most don't even think about it, but it is available as an option to the judge for things like repeat offenders.

Clubber 8y ago
Unfortunately in the US, any conviction leads to essentially a work "blacklist," whereby employers do background checks and deny employment for anything they find within 7 years.
- frockington 8y ago
  Not for non-violent misdemeanors. Unless you're a flagrant offender you will normally be slapped don the wrist and given a stern lecture in the form of a class. Source: was in a fraternity in the US where literally nothing bad happened to anyone I knew with a misdemeanor outside of a fine and class
  - Clubber 8y ago
    A lot of companies won't hire you if you have a criminal record of any kind. Some won't even hire you if you have any record of arrest, regardless of conviction. Which fraternity?
    - frockington 8y ago
      If the court seals the record its nearly impossible for anyone but government agencies to discover
      - zajd 8y ago
        wasn't there just a story about background check startups finding these records and using them?

Silhouette 8y ago

An advocate of rules-based regulation would say this can make regulators unpredictable and capricious. Unfortunately, so might students of history. Ask anyone in the UK who was working in the freelance or contract world when IR35 was introduced. In that case, too, the principle was reasonable enough: there was a loophole in tax law where you could decide you're a contractor instead of an employee and pay less money despite for all other practical purposes still being an employee, and this was being actively exploited by some people. In that case, too, the reality was that most people working in the sector probably wouldn't be challenged by the authorities, not least because the enforcers had limited resources. But in that case, too, a given individual's status was often unclear. While some of those who were deterred or subsequently received penalties really were engaging in obvious tax avoidance, other reports described crippling penalties for people whose arrangements appeared to have been quite reasonable but to have fallen foul of someone in government's dubious interpretation. This led to substantial amounts of time and money being collectively spent by the freelance and contractor community incorporating new legalese into contracts and paying for advice and taking out insurance policies. An entire trade body was formed primarily to deal with this threat. Even today, those of us who take on any sort of individual contract or freelance work from time to time have to be careful not to say or do certain otherwise reasonable things, or to allow others to do so, for fear of tipping the balance or giving any appearance that might be subject to challenge. And the irony is that while the law arguably had some effect initially in getting contractors to go back to being permies if they were just using it as a tax dodge, overall it appears that IR35 has raised very little extra tax revenue for the government. It turns out that the vast majority of contractors and freelancers were operating in that fashion legitimately and continue to do so, and most enforcement actions appear to fail to the extent that the government even tries any more. Nevertheless, the rules still hang like a sword of Damocles above the whole sector.

skummetmaelk 8y ago
> It turns out that the vast majority of contractors and freelancers were operating in that fashion legitimately and continue to do so Which we know is definitely NOT the case for companies storing your data correctly.

Clubber 8y ago

Wow I wish we had principle-based regulation in the US. It seems like rules are made specifically so that only wealthy, entrenched institutions can follow them without significant burden. When those institutions fail, the fines don't seem relative to profit or size of the company or anything.

rayiner 8y ago
I suspect it wouldn’t work in the US. Principles based regulation requires some level of concensus on principles. We don’t have that in the US. Polarization breeds rules worship because you don’t trust the other people to use their discretion. Consider, for example, how every major social issue devolves into a Constitutional litigation. Whereas in Europe people just vote on stuff. And as to regulatory approaches I think you’d be surprised. European regulation is often quite conservative.
- Clubber 8y ago
  Oh totally agree. Just think about the DMV. The people who work there cite the law word with zero discretion. Most US companies are like that as well. It's quite dystopian. Well lets say it wouldn't work with the current ruling class mindset where everyone they employ is stupid and unable to think critically.
  - myWindoonn 8y ago
    It depends on where you are. In places like Oregon, the DMV is a friendly place full of smiles where expiration dates can slip a few days and you don't have to change your hairstyle for your ID photo.

kodablah 8y ago

What you dub principles-based regulation others call trust-based regulation, or randomly-enforced regulation, or we-know-it-when-we-see-it-based regulation. Some don't appreciate this type of regulation. I think the unfortunate thing is that, when the previous/existing incarnations of these protection laws were/remain unenforced, many assumed it was because of lack of "teeth". But those of us familiar with how these principles-based regulatory bodies work know that it's more about confusion and regulator apathy. Nobody here is watching the watchers. Instead, there's a bunch of people foaming at the mouth with pitchforks asking for more laws and dismissing alternative concerns as hysteria or not understanding how laws work. We should be discussing how to solve the problem, yet we continually devolve to discussing the government-led solution presumably because we feel helpless and can't consider better options.

raverbashing 8y ago
And rules-based regulation means you commit 3 felonies per day https://www.wsj.com/articles/SB10001424052748704471504574438900830760842 https://www.wsj.com/articles/SB10001424052748704471504574438...
- kodablah 8y ago
  Going on a bit of a tangent here, I am becoming concerned with how we discuss these things. You're completely either for or against it. And if you're against one way you are automatically for the other. If you think one thing is bad, obviously you need to be corrected that other thing is bad too. And then you'll get extreme examples showing it. Call it whataboutism, appeal to emotion, whatever. Every time these GDPR discussions come up, someone is always quick to say the US is worse, US is getting a taste of its own medicine, that dissenters must want surreptitious data collection, and on and on. Oddly enough, bringing it full circle, the tendencies for humans to argue in these directions instead of stay focused on the issue at hand make me glad to have more strict boundaries that are less subject to the whims of idle thought. Obviously this can't be absolute, so we should craft our rules to limit their scope at least from the outset. It's not about one country/continent vs another, it's about the goals and how they are achieved. Some believe and/or have experienced difficulties conforming to all sorts of government rules, it is a human thing not a location one. IMO, we need to stop deflecting and we need to stop being so absolute. People that are feeling pain of impending laws are not hysterical and laws are not magically OK because other forms/interpretations have downsides.

deleted 8y ago

[deleted]

merinowool 8y ago

Now if the government interpretation of GDPR will differ from a website owner's they'll be able to shut it down with a fine. Since this law can be interpreted in so many ways they can virtually fine any site they don't like, because depending on interpretation every site can be found non complaint. This is huge and dangerous.

dragonwriter 8y ago

> In rules-based regulation, all the rules are spelled out in advance, and the regulator is basically an automaton once the rules are set. Given that description, after a couple decades working in some and dealing daily with the acts of other agencies who which issue and apply regulations on the US, let me assure you that the regulatory system in the US is nothing at all like “rule-based” as you have described it.

andrewla 8y ago
I have also been extensively involved in compliance issues at US companies in the financial space and this comment is dead-on. The idea of rule-based regulations is a complete straw man as far as I can tell.

brownbat 8y ago

I don't know, EU members seem perfectly willing to toe literal rules for perverse outcomes in some areas. Open market gamesmanship, for one, such as the proliferation of national standards as a way to exclude 'single' market products. Maybe they are trying a kind of best of both worlds approach?

Moto7451 8y ago

This sort of explanation has been very popular by people who are trying to reduce the overall concern level of the community. You're not wrong. You very well could be right and this could be how it will work. Let me give a view as to why it doesn't matter. The problem with this approach is if you run a large or small company or are a sole proprietorship or simply have a hobby site, you can't write off legitimate fears of heavy handed enforcement. No one wants to be the example. In the former cases, if your company is how people are feeding and clothing their children, do you want to be the person who says "Oh well we tanked the company this year because weren't worried. Someone on the internet told us they'd be gentle! How could we have known they'd be serious about levying the maximum penalty!?" If this law is "no big deal" or "so easy to implement" or any other version of the arguments proposed this week, it would not be causing so much concern. It's neither an unreasonable ask or a trivial one. People are being impacted in large ways. I'm on my company's GDPA compliance team and it is serious business. Our European footprint is small but not insignificant. If we were an unreasonable bunch, we'd just shut the whole thing down and move on. The very expensive very well versed German legal counsel we're paying to help us do this right completely disagrees with what many are saying here. We have no reason to not believe them as they have a lot of experience with the German laws the GDPR is based on. We're paying them far more than the fines we'd see because we believe in doing the right thing. Ergo, we must take the "hard" regulator view rather than your "kid glove" view. Our lawyer's underlying point in every discussion is that this is really really serious business and that they're not fooling around. Adding to that is a GDPR like law is likely to be implemented in Canada and other jurisdictions in the future. We must be ready for that as well. I think GDPR is great for consumers. I think we'd actually be in a better/easier place if it were a requirement in the US since everyone would have to follow the same rules. The problem is that implementing it takes time and effort to do well at scale. To not loose your competitive edge against other large competitors that do not serve the EU and can operate under only US law. These are real concerns that have nothing to do with the regulators and whatever their whims are. So even if you're right, these are the real costs. You're going to be held accountable to the people you let down if you put your company in peril. You're going to be held accountable if you loose marketshare because you got this wrong and an unencumbered competitor outmaneuvers you. And most of all, you simply cannot assume the best case, kid glove, approach is what is going to happen. THIS is what people are frustrated with. I do hope that the EU is fair and equitable (which is my belief) but it would be irresponsible for me to act as if that is the only possibility.

albutr 8y ago

To be honest I know nothing about law enforcement in the EU, but the one thing I have heard about in recent memory is that guy who made a video of his girlfriend's dog saluting hitler, and was subsequently tried for a hate crime, convicted, and was charged with a pretty hefty 800 GBP fine after being found in violation of the Communications Act of 2003[1]. Seems like a pretty poor example of principles-based regulation. Maybe it's just an outlier though, idk. [1] https://en.wikipedia.org/wiki/Mark_Meechan https://en.wikipedia.org/wiki/Mark_Meechan

CiaranMcNulty 8y ago
The actual ruling was that him saying 'Gas the Jews' tens of times during the video was calculated to offend, rather than the dog thing
- albutr 8y ago
  Oh okay, I actually misremembered what I had seen, I thought it was just the saluting thing. I just checked the original again[1], and that being said I still don't see how this isn't a ruling that is overblown; he's saying "wanna gas the jews" in a playful way to his dog over and over, and the dog responds when this is said. The ruling was that this was a hate crime, because it was "menacing, anti-Semitic and racist". I have trouble seeing how a Nazi pug that responds to "gas the jews" is anything other than silly bit of absurd comedy. I can't realistically see this video actually advancing any legitimate hatred, or having any negative consequences other than some people laughing at how silly it is, and some people just thinking it's kind of stupid. [1] https://www.youtube.com/watch?v=5rdWlVyN9es https://www.youtube.com/watch?v=5rdWlVyN9es
  - jacquesm 8y ago
    At a guess you didn't have any family and you don't know anybody that has family that ended up in a gas chamber?
    - albutr 8y ago