4 ms·

> If you feel that you can discard a whole article because you find one line in it that confirms your prior belief then that's fine with me. The entire spirit

by chx 8y ago

> If you feel that you can discard a whole article because you find one line in it that confirms your prior belief then that's fine with me. The entire spirit of these articles are completely misguided because the adverse reaction to GDPR is not hysteria. Here's the unique nature of this which makes it a recipe for disaster: 1. Every business interacting practically any way with European citizens is affected 2. The potential fees for breaching a very complex regulation are unprecedentedly high. 3. Determining the actual fees for each breach is in the hand of every EU country, including some which today wouldn't be admitted into the EU.

jacquesm 8y ago
The oft bandied around 20 million euro fine is the reason for that particular choice of words. People shutting down their projects without having spent a minimum amount of time on the impact, bloggers worried about having to hire a DPO. I haven't seen this much bullshit since the Y2K days and even then with some work and planning it got taken care of. People were genuinely surprised when the world didn't end. This is going to be just like that. May 25th the world will continue to turn and none of these bogeyman stories will come to pass with anything approaching fidelity. Regulators will target the worst excesses to show they mean business and are severely limited in manpower anyway so the vast majority of interaction that has to do with the GDPR will amount to a change in mindset and some best practices. In edge cases things will get a bit more interesting (someone mentioned federated services and that's a really good question). FWIW I've been looking at companies from the GDPR angle for about a year and a half now, we slowly ratcheted up the push for compliance and it is interesting to see how (EU based) start-ups have adapted to the new legislation. We have also found some companies that were ill prepared but that's to be expected. The worst position to be in is a small (10...20FTE) company operating in the US running a SaaS that stores critical information. That's an expensive affair. For most other companies - including the really large ones - the impact will be mostly a one-time investment in software and inventory of data and processes. After that they will be in much better shape and that's a good thing. Companies that make a business of selling data are expected to be hit hard, and rightly so.
- chx 8y ago
  > Regulators will target the worst excesses Your confidence scares me. What about this, I have the same amount of evidence you have: Some regulators will target the weakest. It's really easy to slap a few tens of thousand of euros fine on a small business. Sure, fining a big company for many tens, hundreds of millions makes news but a few ten thousands is a good income.
  - jacquesm 8y ago
    > Some regulators will target the weakest. Do you have any evidence for this? I have plenty of evidence for the opposite, if you want I will collect it. Here is one sample dataset, NL: https://www.computable.nl/artikel/nieuws/overheid/6345059/250449/privacywaakhond-ap-legde-geen-boetes-op-in-2017.html https://www.computable.nl/artikel/nieuws/overheid/6345059/25... No fines in all of 2017, in spite of 10,009 data leaks that were reported. In one case there was a settlement of 48K, but it is not quite clear what the circumstances were, probably to protect the guilty. "De AP stelt in een samenvatting van het jaarverslag 2017 dat het niet altijd direct een onderzoek start. Het gaat eerst in gesprek met partijen die een overtreding begaan en in veel gevallen leiden die zogenoemde alternatieve interventies niet tot een officieel onderzoek." Rough translation: "The Authority says in the summary of their annual report for 2017 that it does not always immediately starts an investigation. It first tries to talk to the parties that have violated the law and in many cases these so called alternative interventions do not lead to an official inquiry."
    - chx 8y ago
      Proof of what? The GDPR is not yet in force. Proof of Hungarian authorities targeting small businesses for minor or even non existing infractions? Here's one: the tax authority starts garnishing many taxes a few days after the payment deadline -- it's common the entrepreneur realizes they are in trouble when all the cash is gone from their bank account. But if you so want, I can find you any number of horror stories of how small businesses are treated in Hungary, now that they will have a chance to mess with rich westerns (as perceived at least), I have zero doubt they will take this chance.

by chx 8y ago

jacquesm 8y ago

The oft bandied around 20 million euro fine is the reason for that particular choice of words. People shutting down their projects without having spent a minimum amount of time on the impact, bloggers worried about having to hire a DPO. I haven't seen this much bullshit since the Y2K days and even then with some work and planning it got taken care of. People were genuinely surprised when the world didn't end. This is going to be just like that. May 25th the world will continue to turn and none of these bogeyman stories will come to pass with anything approaching fidelity. Regulators will target the worst excesses to show they mean business and are severely limited in manpower anyway so the vast majority of interaction that has to do with the GDPR will amount to a change in mindset and some best practices. In edge cases things will get a bit more interesting (someone mentioned federated services and that's a really good question). FWIW I've been looking at companies from the GDPR angle for about a year and a half now, we slowly ratcheted up the push for compliance and it is interesting to see how (EU based) start-ups have adapted to the new legislation. We have also found some companies that were ill prepared but that's to be expected. The worst position to be in is a small (10...20FTE) company operating in the US running a SaaS that stores critical information. That's an expensive affair. For most other companies - including the really large ones - the impact will be mostly a one-time investment in software and inventory of data and processes. After that they will be in much better shape and that's a good thing. Companies that make a business of selling data are expected to be hit hard, and rightly so.

chx 8y ago
> Regulators will target the worst excesses Your confidence scares me. What about this, I have the same amount of evidence you have: Some regulators will target the weakest. It's really easy to slap a few tens of thousand of euros fine on a small business. Sure, fining a big company for many tens, hundreds of millions makes news but a few ten thousands is a good income.
- jacquesm 8y ago
  > Some regulators will target the weakest. Do you have any evidence for this? I have plenty of evidence for the opposite, if you want I will collect it. Here is one sample dataset, NL: https://www.computable.nl/artikel/nieuws/overheid/6345059/250449/privacywaakhond-ap-legde-geen-boetes-op-in-2017.html https://www.computable.nl/artikel/nieuws/overheid/6345059/25... No fines in all of 2017, in spite of 10,009 data leaks that were reported. In one case there was a settlement of 48K, but it is not quite clear what the circumstances were, probably to protect the guilty. "De AP stelt in een samenvatting van het jaarverslag 2017 dat het niet altijd direct een onderzoek start. Het gaat eerst in gesprek met partijen die een overtreding begaan en in veel gevallen leiden die zogenoemde alternatieve interventies niet tot een officieel onderzoek." Rough translation: "The Authority says in the summary of their annual report for 2017 that it does not always immediately starts an investigation. It first tries to talk to the parties that have violated the law and in many cases these so called alternative interventions do not lead to an official inquiry."
  - chx 8y ago
    Proof of what? The GDPR is not yet in force. Proof of Hungarian authorities targeting small businesses for minor or even non existing infractions? Here's one: the tax authority starts garnishing many taxes a few days after the payment deadline -- it's common the entrepreneur realizes they are in trouble when all the cash is gone from their bank account. But if you so want, I can find you any number of horror stories of how small businesses are treated in Hungary, now that they will have a chance to mess with rich westerns (as perceived at least), I have zero doubt they will take this chance.