6 ms·

This is a terrible move. They had effectively years to prepare for the GDPR and they already have some sort of rudimentary export and delete options. This step

This is a terrible move. They had effectively years to prepare for the GDPR and they already have some sort of rudimentary export and delete options. This step removes all the trust in Instapaper that I had in the past: They either are mismanaged or are not willing to tell the users what data they are collecting and how they use and monetize this data. And it should worry all users, not only users from the EU.

coddingtonbear 8y ago
It could also just be liability concerns -- I know I personally considered turning off a (free & gdpr-compliant) side project I maintain out of concern around what might happen to my bank account were a security incident were to occur affecting EU citizens.
wutbrodo 8y ago
> They either are mismanaged or are not willing to tell the users what data they are collecting and how they use and monetize this data. And it should worry all users, not only users from the EU. I don't know a ton about GDPR, but the article makes it look like it has less to do with Instapaper (aside from risk tolerance) and more to do with the ambiguity of the law. Some relevant quotes: > it’s more than likely to be the GDPR’s data subject access request, which allows any EU resident to request any and all data collected and stored about them. As The Verge reported yesterday, that’s causing companies trouble because it’s not entirely clear right now what information residents will request, what format that information needs to be in, how to locate it and package it, and whether new infrastructure needs to be created to manage this request pipeline. Personal info is a somewhat nebulous concept, and the fact that experts are describing the GDPR as “staggeringly complex” is not making it easy to cover all the bases. > It’s clear that few companies, if any, will be 100 percent compliant when the law goes into effect. But because the fines are so steep — violating GDPR will cost a company 4 percent of its global turnover or $20 million, whichever is larger — no one really wants to be caught non-compliant. So that’s why companies are rushing and, in the case of Instapaper, literally shutting down.
- djhworld 8y ago
  What...data are they collecting? It's a site that pins articles people have saved, the only piece of user data they should hold would be email address and maybe IP address? Simple to put in policies to expire the IP address data after a reasonable amount of time.
  - bthdonohue 8y ago
    We detail the types of information we collect and how we use the data in our privacy policy here: https://www.instapaper.com/privacy https://www.instapaper.com/privacy
    - dmitriid 8y ago
      If that's the only info you collect, it would take you way less than two years to get compliant with GDPR. So there's something you're not telling.
      - deleted 8y ago
        [deleted]
- TomK32 8y ago
  An email-address to send requests to and someone setting up a process for those requests along with a definition of which data to be returned to the user, all that isn't hard to implement. GDPR has caused some panic that's unnecessary. The violations won't be fined with 4%/€20m (€ not $) right away, there's more steps before that, starting with "a warning in writing in cases of first and non-intentional noncompliance"
  - brownbat 8y ago
    > GDPR has caused some panic that's unnecessary. Maybe some companies have overreacted, but dismissing them feels a bit like blaming the user for bad UX. Couldn't you argue that a law that causes a panicked overreaction was a poorly written law in at least one respect, given that laws have a communicative function? Especially if all these complaints were raised well in advance of the passage of the law, so that the drafters had plenty of warning that several groups were struggling to understand the text?
dspillett 8y ago
> effectively years Not quite. LITERALLY years. Two of them. A bit more if they were keeping an eye on the matter while the regulation was being drafted (though I doubt very many were, I know I wasn't).

coddingtonbear 8y ago

It could also just be liability concerns -- I know I personally considered turning off a (free & gdpr-compliant) side project I maintain out of concern around what might happen to my bank account were a security incident were to occur affecting EU citizens.

wutbrodo 8y ago

> They either are mismanaged or are not willing to tell the users what data they are collecting and how they use and monetize this data. And it should worry all users, not only users from the EU. I don't know a ton about GDPR, but the article makes it look like it has less to do with Instapaper (aside from risk tolerance) and more to do with the ambiguity of the law. Some relevant quotes: > it’s more than likely to be the GDPR’s data subject access request, which allows any EU resident to request any and all data collected and stored about them. As The Verge reported yesterday, that’s causing companies trouble because it’s not entirely clear right now what information residents will request, what format that information needs to be in, how to locate it and package it, and whether new infrastructure needs to be created to manage this request pipeline. Personal info is a somewhat nebulous concept, and the fact that experts are describing the GDPR as “staggeringly complex” is not making it easy to cover all the bases. > It’s clear that few companies, if any, will be 100 percent compliant when the law goes into effect. But because the fines are so steep — violating GDPR will cost a company 4 percent of its global turnover or $20 million, whichever is larger — no one really wants to be caught non-compliant. So that’s why companies are rushing and, in the case of Instapaper, literally shutting down.

djhworld 8y ago
What...data are they collecting? It's a site that pins articles people have saved, the only piece of user data they should hold would be email address and maybe IP address? Simple to put in policies to expire the IP address data after a reasonable amount of time.
- bthdonohue 8y ago
  We detail the types of information we collect and how we use the data in our privacy policy here: https://www.instapaper.com/privacy https://www.instapaper.com/privacy
  - dmitriid 8y ago
    If that's the only info you collect, it would take you way less than two years to get compliant with GDPR. So there's something you're not telling.
    - deleted 8y ago
      [deleted]
TomK32 8y ago
An email-address to send requests to and someone setting up a process for those requests along with a definition of which data to be returned to the user, all that isn't hard to implement. GDPR has caused some panic that's unnecessary. The violations won't be fined with 4%/€20m (€ not $) right away, there's more steps before that, starting with "a warning in writing in cases of first and non-intentional noncompliance"
- brownbat 8y ago
  > GDPR has caused some panic that's unnecessary. Maybe some companies have overreacted, but dismissing them feels a bit like blaming the user for bad UX. Couldn't you argue that a law that causes a panicked overreaction was a poorly written law in at least one respect, given that laws have a communicative function? Especially if all these complaints were raised well in advance of the passage of the law, so that the drafters had plenty of warning that several groups were struggling to understand the text?

dspillett 8y ago

> effectively years Not quite. LITERALLY years. Two of them. A bit more if they were keeping an eye on the matter while the regulation was being drafted (though I doubt very many were, I know I wasn't).