6 ms·

I think that Jacques Mattheij has some thoughts about this that you can think about it in the abstractions that he gives. Note that IANAL and YMMV. EDIT: Also

I think that Jacques Mattheij has some thoughts about this that you can think about it in the abstractions that he gives. Note that IANAL and YMMV. EDIT: Also Jacques is not a Lawyer either. 1: https://jacquesmattheij.com/gdpr-hysteria https://jacquesmattheij.com/gdpr-hysteria

ryanwaggoner 8y ago
Yeah, Jacques is not a lawyer either. As far as I can tell, he’s just a random GDPR fan and armchair lawyer with a blog and an incredibly biased and unrealistic view of the GDPR. You’d be foolish to rely on his advice if you’re possibly in a situation where it matters. Consult an actual expert.
- zerostar07 8y ago
  To be fair there are no experts able to guarantee their advice is good. They often disagree as the law is incredibly vague. And the EU DPAs are not ready to apply the law. Relevant laws have not even passed in many EU countries: https://www.reuters.com/article/us-europe-privacy-analysis/european-regulators-were-not-ready-for-new-privacy-law-idUSKBN1I915X https://www.reuters.com/article/us-europe-privacy-analysis/e...
  - ryanwaggoner 8y ago
    I am the first to agree that this is a terrible law, incredibly vague, overly broad, poorly written, etc. The difference between actual experts and people like Jacques is that credible experts recognize the complexity and will be honest about it. Granted, it’s in their interest to do so, but still, at least the better ones won’t lie and tell you it’s simple just because they wish it was. Not to mention accusing you of bad intent and doing shady things if you don’t quickly agree that the law is perfectly clear and simple and that any compliance costs are worth it if you’re honest. After all, only an evil person would avoid the EU market with the stated reason that the compliance costs seem too high or the law too vague, because random blogger Jacques already cleared that up for us :)
    - jimnotgym 8y ago
      > terrible law, incredibly vague, overly broad, poorly written, Or it could be a well meaning law, that has been drafted in good faith to incrementally extend an existing directive, one that IMHO has worked rather well up to the point that organisations outside of the EU have felt they can ignore it, even when acting in EU countries. GDPR is certainly making overseas firms take our laws seriously now... It has been mentioned a number of times, but EU law is principles-based not rules-based like in the US. I can see how it might appear vague to US eyes, but to my eyes I see a flexible law that will live on while the technology changes. I also felt it was written in plain, straight-forward language, and not poorly-written at all, I personally can live without 'here-on-ins'. I guess if I lived in the US and had a similar law, and had US prosecutors I might be scared, but the law of European countries has survived on being principle based rather longer than the US has existed. I once had to compare and contrast both systems for an exam, and of course they both work in practice! I note however that Europe is a much less litigious place than the US, and I personally prefer that.
      - ryanwaggoner 8y ago
        I actually agree with almost 100% of this. The EU should pass laws however they want according to whatever legal framework they want. And companies wishing to do business there should comply. I still think it’s a poorly written and vague law, but perhaps that’s just my distrust of bureaucracy speaking. My real issue with the law is primarily that the EU thinks that it can assert that it has global jurisdiction with regard to the GDPR. This is so undemocratic and dangerous, it boggles my mind that fans of the GDPR can’t see it. Just because you like the intent of the law doesn’t mean you can admit that it goes too far, or sets bad precedent, or is likely to be abused. If Saudi Arabia passes anti-blasphemy laws and says they apply globally if a citizen of theirs visits your website, should anyone care? GDPR is being taken seriously by firms with enforcement exposure. My hope is that every other organization in the world just ignores it. It’s a dangerous precedent. And then there’s my issue with the fans of the law who will read the above and come back with the vapid response: “well, if you’re not going to comply then clearly you’re shady and I hope you do go out of business.”
- downandout 8y ago
  Wait...you mean that referring to the people in charge of GDPR as "good natured enforcers" who will "first warn you with a notice that you are not in compliance with the law, give you some period of time to become compliant and will - if you ignore them - fine you," even though no requirement for warnings exists in GDPR, might be unrealistic? Perish the thought. /s
  - jimnotgym 8y ago
    You could however look at the MO of the agencies themselves. They have existed for a long time and have not attempted to overreach. In fact the opposite is true.
    - downandout 8y ago
      They have also never had the power to collect from any but the largest of companies outside their own borders. Now they are at least claiming that they do have this power. That sets a dangerous precedent and opens up the floodgates of abuse, because they don't have to deal with the PR or economic damage that the fines they assess internationally will cause - they import the money and export the problems. They simply see a massive inflow of money and get to hobble foreign competitors of local companies. It's a protectionist law, with the added bonus of extreme financial incentives for aggressive enforcement.
      - jimnotgym 8y ago
        > They simply see a massive inflow of money and get to hobble foreign competitors of local companies. That appears to be a baseless comment. > It's a protectionist law Or another way to look at it the US tech sector is no longer going to pick and choose which of our laws apply to it.
        downandout 8y ago
        That appears to be a baseless comment. I'm intrigued. How is it baseless to say that a given EU country, say Germany, would not see a massive inflow of foreign money and a bunch of hobbled foreign competitors of German companies if they chose to engage in aggressive enforcement of GDPR against foreign companies?
- deleted 8y ago
  [deleted]
oldcynic 8y ago
The most rational piece on GDPR I've yet seen. So of course you are being downvoted.
- zitterbewegung 8y ago
  I have been downvoted for both reasons on HN. I don't feel bad about it at all I think its funny.

ryanwaggoner 8y ago

Yeah, Jacques is not a lawyer either. As far as I can tell, he’s just a random GDPR fan and armchair lawyer with a blog and an incredibly biased and unrealistic view of the GDPR. You’d be foolish to rely on his advice if you’re possibly in a situation where it matters. Consult an actual expert.

zerostar07 8y ago
To be fair there are no experts able to guarantee their advice is good. They often disagree as the law is incredibly vague. And the EU DPAs are not ready to apply the law. Relevant laws have not even passed in many EU countries: https://www.reuters.com/article/us-europe-privacy-analysis/european-regulators-were-not-ready-for-new-privacy-law-idUSKBN1I915X https://www.reuters.com/article/us-europe-privacy-analysis/e...
- ryanwaggoner 8y ago
  I am the first to agree that this is a terrible law, incredibly vague, overly broad, poorly written, etc. The difference between actual experts and people like Jacques is that credible experts recognize the complexity and will be honest about it. Granted, it’s in their interest to do so, but still, at least the better ones won’t lie and tell you it’s simple just because they wish it was. Not to mention accusing you of bad intent and doing shady things if you don’t quickly agree that the law is perfectly clear and simple and that any compliance costs are worth it if you’re honest. After all, only an evil person would avoid the EU market with the stated reason that the compliance costs seem too high or the law too vague, because random blogger Jacques already cleared that up for us :)
  - jimnotgym 8y ago
    > terrible law, incredibly vague, overly broad, poorly written, Or it could be a well meaning law, that has been drafted in good faith to incrementally extend an existing directive, one that IMHO has worked rather well up to the point that organisations outside of the EU have felt they can ignore it, even when acting in EU countries. GDPR is certainly making overseas firms take our laws seriously now... It has been mentioned a number of times, but EU law is principles-based not rules-based like in the US. I can see how it might appear vague to US eyes, but to my eyes I see a flexible law that will live on while the technology changes. I also felt it was written in plain, straight-forward language, and not poorly-written at all, I personally can live without 'here-on-ins'. I guess if I lived in the US and had a similar law, and had US prosecutors I might be scared, but the law of European countries has survived on being principle based rather longer than the US has existed. I once had to compare and contrast both systems for an exam, and of course they both work in practice! I note however that Europe is a much less litigious place than the US, and I personally prefer that.
    - ryanwaggoner 8y ago
      I actually agree with almost 100% of this. The EU should pass laws however they want according to whatever legal framework they want. And companies wishing to do business there should comply. I still think it’s a poorly written and vague law, but perhaps that’s just my distrust of bureaucracy speaking. My real issue with the law is primarily that the EU thinks that it can assert that it has global jurisdiction with regard to the GDPR. This is so undemocratic and dangerous, it boggles my mind that fans of the GDPR can’t see it. Just because you like the intent of the law doesn’t mean you can admit that it goes too far, or sets bad precedent, or is likely to be abused. If Saudi Arabia passes anti-blasphemy laws and says they apply globally if a citizen of theirs visits your website, should anyone care? GDPR is being taken seriously by firms with enforcement exposure. My hope is that every other organization in the world just ignores it. It’s a dangerous precedent. And then there’s my issue with the fans of the law who will read the above and come back with the vapid response: “well, if you’re not going to comply then clearly you’re shady and I hope you do go out of business.”
downandout 8y ago
Wait...you mean that referring to the people in charge of GDPR as "good natured enforcers" who will "first warn you with a notice that you are not in compliance with the law, give you some period of time to become compliant and will - if you ignore them - fine you," even though no requirement for warnings exists in GDPR, might be unrealistic? Perish the thought. /s
- jimnotgym 8y ago
  You could however look at the MO of the agencies themselves. They have existed for a long time and have not attempted to overreach. In fact the opposite is true.
  - downandout 8y ago
    They have also never had the power to collect from any but the largest of companies outside their own borders. Now they are at least claiming that they do have this power. That sets a dangerous precedent and opens up the floodgates of abuse, because they don't have to deal with the PR or economic damage that the fines they assess internationally will cause - they import the money and export the problems. They simply see a massive inflow of money and get to hobble foreign competitors of local companies. It's a protectionist law, with the added bonus of extreme financial incentives for aggressive enforcement.
    - jimnotgym 8y ago
      > They simply see a massive inflow of money and get to hobble foreign competitors of local companies. That appears to be a baseless comment. > It's a protectionist law Or another way to look at it the US tech sector is no longer going to pick and choose which of our laws apply to it.
      - downandout 8y ago
        That appears to be a baseless comment. I'm intrigued. How is it baseless to say that a given EU country, say Germany, would not see a massive inflow of foreign money and a bunch of hobbled foreign competitors of German companies if they chose to engage in aggressive enforcement of GDPR against foreign companies?
deleted 8y ago
[deleted]

oldcynic 8y ago

The most rational piece on GDPR I've yet seen. So of course you are being downvoted.

zitterbewegung 8y ago
I have been downvoted for both reasons on HN. I don't feel bad about it at all I think its funny.