5 ms·

I don't think this is true at all. Compliance in large organisations will be harder than small ones – small organisations should already be fairly well aware of

I don't think this is true at all. Compliance in large organisations will be harder than small ones – small organisations should already be fairly well aware of where their data is, and how to handle it. Larger organisations tend to have mountains of uncontrolled user data which nobody is in charge of.

tzs 8y ago
The costs could be a big deal for small businesses. Take a business about as far away from data as you can imagine. For instance, a business that makes replacement knobs for antique radio restorations. They have a website with an online catalog and a shopping cart where you can order replacement knobs, pay online, and they ship the knobs to you. They collect your name and address for shipping, your email address to contact you if there are any questions or issues with the order and to give you order processing updates, and payment information. If this business is offering their goods to people in the Union, that data collection falls under GDPR, and they have to have a designated representative in the Union. I've not been able to find anything so far on (1) how some random small business in the US goes about finding someone to be their designated representative in the EU, and (2) what they will have to pay that person to take do so.
- jacquesm 8y ago
  The chances of such a shop running their own shopping infrastructure is very small, most likely they will use some kind of partner for the whole shop setup, up to and including fulfillment and they'll be happy doing what they're good at: making knobs. And if they do run their own shopping infrastructure they obviously will have to deal with all the ins and outs of that, including operations, keeping the whole thing up-to-date and secured as well as compliance with the law.
  - tzs 8y ago
    How about customer support? Even if a small business has someone else run their cart, and handle order fulfillment, there is still a good chance they deal directly with customer support, which usually includes collecting and storing customer information. Won't that mean they are still under GDPR and still need to have a designated representative?
    - jacquesm 8y ago
      Yes, in that case they would have to have a designated representative. I'm working on that particular angle at the moment but it is a rather complex affair and I don't want to commit to this before I'm all lawyered up and read up on the responsibilities and the risks.
- DanBC 8y ago
  > and they have to have a designated representative in the Union. Can you point to which bit of GDPR says this please?
  - tzs 8y ago
    Article 27(1): "Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union." Article 3(2) is the one that says GDRP applies to the processing of personal data of data subjects in the Union by controllers or processors not in the Union if the processing activities are related to the offering of goods or services in the Union.
    - cuspycode 8y ago
      A designated DPO is only required for companies that have over 250 employees. Surely that can't be a huge burden? Just appoint the head of security to be the DPO. He can google the GDPR requirements and then be all set after 15 minutes. If you are smaller than that and you outsource processing of the personal data of your customers, then all you have to do is make sure the customers consent to this, and you are good to go with GDPR. It's practically effortless, unless your business model relies on monetizing innocent victimes without their consent.
      - tzs 8y ago
        I'm not talking about the DPO. That's from article 37 and has nothing to do with the representative required under Article 27. The Article 27 representative must be in the Union, which is why it can be problematical for a company whose office and employees are all outside the Union.
        jacquesm 8y ago
        Yes, this is a real problem. In fact, it is the only problem with the GDPR that has no obvious solution - yet - for small businesses.
        8y ago

tzs 8y ago

The costs could be a big deal for small businesses. Take a business about as far away from data as you can imagine. For instance, a business that makes replacement knobs for antique radio restorations. They have a website with an online catalog and a shopping cart where you can order replacement knobs, pay online, and they ship the knobs to you. They collect your name and address for shipping, your email address to contact you if there are any questions or issues with the order and to give you order processing updates, and payment information. If this business is offering their goods to people in the Union, that data collection falls under GDPR, and they have to have a designated representative in the Union. I've not been able to find anything so far on (1) how some random small business in the US goes about finding someone to be their designated representative in the EU, and (2) what they will have to pay that person to take do so.

jacquesm 8y ago
The chances of such a shop running their own shopping infrastructure is very small, most likely they will use some kind of partner for the whole shop setup, up to and including fulfillment and they'll be happy doing what they're good at: making knobs. And if they do run their own shopping infrastructure they obviously will have to deal with all the ins and outs of that, including operations, keeping the whole thing up-to-date and secured as well as compliance with the law.
- tzs 8y ago
  How about customer support? Even if a small business has someone else run their cart, and handle order fulfillment, there is still a good chance they deal directly with customer support, which usually includes collecting and storing customer information. Won't that mean they are still under GDPR and still need to have a designated representative?
  - jacquesm 8y ago
    Yes, in that case they would have to have a designated representative. I'm working on that particular angle at the moment but it is a rather complex affair and I don't want to commit to this before I'm all lawyered up and read up on the responsibilities and the risks.
DanBC 8y ago
> and they have to have a designated representative in the Union. Can you point to which bit of GDPR says this please?
- tzs 8y ago
  Article 27(1): "Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union." Article 3(2) is the one that says GDRP applies to the processing of personal data of data subjects in the Union by controllers or processors not in the Union if the processing activities are related to the offering of goods or services in the Union.
  - cuspycode 8y ago
    A designated DPO is only required for companies that have over 250 employees. Surely that can't be a huge burden? Just appoint the head of security to be the DPO. He can google the GDPR requirements and then be all set after 15 minutes. If you are smaller than that and you outsource processing of the personal data of your customers, then all you have to do is make sure the customers consent to this, and you are good to go with GDPR. It's practically effortless, unless your business model relies on monetizing innocent victimes without their consent.
    - tzs 8y ago
      I'm not talking about the DPO. That's from article 37 and has nothing to do with the representative required under Article 27. The Article 27 representative must be in the Union, which is why it can be problematical for a company whose office and employees are all outside the Union.
      - jacquesm 8y ago
        Yes, this is a real problem. In fact, it is the only problem with the GDPR that has no obvious solution - yet - for small businesses.
      - 8y ago