4 ms·

Of course I'm missing all kinds of key context, but going off of your description I'd seriously consider letting him leave. Come up with some sort of deal that

Of course I'm missing all kinds of key context, but going off of your description I'd seriously consider letting him leave. Come up with some sort of deal that you're both satisfied by - money, a loan, converting his shares into non voting shares, whatever, but let him go. I say this as the technical co-founder of an EU based messaging startup with the vast majority of users and customers being subject to the GDPR. If your co-founder finds a little bit of legislation to be so troublesome that he wants to quit, then he's going to be worthless when things actually get difficult. Even if the worst case is true, in legal terms, and you decide that you're forced to redesign the system to make the right to be forgotten (and while I'm not a lawyer I really doubt that that is a sane explanation of the GDPR), then it's just some refactoring work. It's not fundamental to the design or business model of your app (you're a messaging app, not a "sell user data app") - it's just an efficiency thing. If your co-founder can't even deal with that, then I worry that he defibitely can't deal with the emotional rollercoaster that will start when you actually launch. That said, and IANAL, but I really wouldn't sweat it. If you can run a custom query to delete user data when requested then you're all good. Use that to see how many right-to-be-forgotten requests you actually get and consider automating things only after you know that it's going to pay off.

ralston 8y ago
> ven if the worst case is true, in legal terms, and you decide that you're forced to redesign the system to make the right to be forgotten (and while I'm not a lawyer I really doubt that that is a sane explanation of the GDPR), then it's just some refactoring work. It's not fundamental to the design or business model of your app (you're a messaging app, not a "sell user data app") Exactly. Unless the business model is built around collecting and reselling user data, then (without anymore context) it sounds like this should be a (slight) refactor, not an entire redesign.
repolfx 8y ago
Even if the worst case is true, in legal terms, and you decide that you're forced to redesign the system to make the right to be forgotten (and while I'm not a lawyer I really doubt that that is a sane explanation of the GDPR) Well, this example of deleting messages sent to other people has come up in other contexts before, it's one of the first questions people think of when asking about the RTBF. And as far as I know there's no canonical answer, like everything else it's open to interpretation. You don't think it's "sane" but your entire argument is predicated on the assumption that GDPR is a sane law. IF you agree that such an interpretation would be insane, can you show that it's clearly wrong? And if not, would that change your opinion of the law?

ralston 8y ago

> ven if the worst case is true, in legal terms, and you decide that you're forced to redesign the system to make the right to be forgotten (and while I'm not a lawyer I really doubt that that is a sane explanation of the GDPR), then it's just some refactoring work. It's not fundamental to the design or business model of your app (you're a messaging app, not a "sell user data app") Exactly. Unless the business model is built around collecting and reselling user data, then (without anymore context) it sounds like this should be a (slight) refactor, not an entire redesign.

repolfx 8y ago

Even if the worst case is true, in legal terms, and you decide that you're forced to redesign the system to make the right to be forgotten (and while I'm not a lawyer I really doubt that that is a sane explanation of the GDPR) Well, this example of deleting messages sent to other people has come up in other contexts before, it's one of the first questions people think of when asking about the RTBF. And as far as I know there's no canonical answer, like everything else it's open to interpretation. You don't think it's "sane" but your entire argument is predicated on the assumption that GDPR is a sane law. IF you agree that such an interpretation would be insane, can you show that it's clearly wrong? And if not, would that change your opinion of the law?