>I would follow other prominent players in the space. Facebook can afford to play fast-and-loose with the rules. They have an army of lawyers waiting to contes

>I would follow other prominent players in the space. Facebook can afford to play fast-and-loose with the rules. They have an army of lawyers waiting to contest any ruling from a supervisory authority. They have an army of developers ready to redesign their product if they're ordered to do so. They have an army of DBAs and CSRs to manage deletion requests and subject access requests. If you're running a startup that collects and processes lots of personal data and your resources are rather more limited than Facebook, it's sensible to interpret the GDPR cautiously. The more data you collect and store, the greater your potential liabilities. We're habituated to hoarding personal data, because the cost of storage is effectively nil and it might be useful at some point in the future. GDPR makes Schneier's argument that "data is a toxic asset" into a business reality. https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...