4 ms·

They claim that everyone had a lot of time, but what about the 1-3 person startup that’s been around for 4-5 years who is just getting by and didn’t have the re

They claim that everyone had a lot of time, but what about the 1-3 person startup that’s been around for 4-5 years who is just getting by and didn’t have the resources to re-engineer their entire application or to write up a complex privacy policy or hire an EU Representative (Yes, apparently that is required as well). If the EU does clamp down on forced consent I think the long tail of small startups and publications and side projects will simply block EU visitors because they won’t have the means to become compliant. I’d be interested to hear how problematic this is for new startups who are building GDPR complianance into the systems from scratch. It would seem to amount to needed bespoke permissioning for every user because forced consent is not permitted (although being widely used).

cortesoft 8y ago
If your startup doesn’t have any business in the EU, they can’t go after you.
- oaiey 8y ago
  "Business" means website visit from a US/EU citizen travelling Europe. And even blocking them by IP and logging it is a violation. User can file a complaint against you, resulting in a ruling. Whether you ever see an "invoice" or see police officers is another topic. But you violate the regulation/law in another country.
  - majewsky 8y ago
    Blocking by IP is okay, logging it is the only violation. And why on earth would you have to log those blocks?
    - oaiey 8y ago
      That's right!
    - cortesoft 8y ago
      You would want to log it to make sure you aren't accidentally blocking the wrong people.
rayvd 8y ago
A sometimes unintentional and often intentional side-effect of regulation is helping the big guys fend off competition from the scrappy upstarts. What seems like something aimed to protect the consumer may have unintended consequences further consolidating information into the hands of a few large behemoths.
- dexterdog 8y ago
  The side-effect is almost always completely intentional.
  - deleted 8y ago
    [deleted]
jenscow 8y ago
> hire an EU Representative appoint, not hire.
colonelxc 8y ago
It will certainly depend on the application. Compliance could be as simple for many apps as deleting a user's data manually when you get a support ticket/email from them asking to. You don't need to build automated systems. Same if they ask for the data collected on them. It would be prudent for these companies to spend an afternoon creating a list of all the places where data is being stored about a user. That would just help if it ever becomes necessary to actually delete data. See elsewhere in these comments for information on appointing an EU representative. It is not required in most cases. "Bespoke permissioning" is also required if you have tiers of users with different feature sets (free, basic, premium). So just treat whatever private-data-requiring-thing as a feature that needs consent. Incidently, the evolution of smartphone permissions has also gone in this way, allowing fine grained allowing/disallowing. You have to expect that you wont have all the permissions you want. The GDPR just makes it so that you don't get to say "all or nothing" for the things that don't need permission. But, the good apps were already doing this anyways.
- sb8244 8y ago
  Manual data deletion without an automated process sounds like a recipe for disaster.
lima 8y ago
> hire an EU Representative It's called Data Protection Officer and you only need to appoint one if processing personal data is your core business, which is reasonable. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/ https://ico.org.uk/for-organisations/guide-to-the-general-da... And yes, I expect the EU to enforce the consent rules. It's very central to the GDPR.
- lajhsdfkl 8y ago
  >It's called Data Protection Officer and you only need to appoint one if processing personal data is your core business, which is reasonable. Not commenting on the validity of this statement but it's interesting how I can tell from which continent you are from just by you saying that the regulation forcing a business to hire DPO is reasonable.
  - lima 8y ago
    Yes, I'm from Europe, and it's my opinion that the GDPR is very necessary and mostly reasonable. I say that even though it caused me a lot of work for the past months. The requirement to hire a DPO is not a new thing, by the way - many countries in the EU already required this. This is true for many provisions in the GDPR - in Germany, for example, very little changes from the way it used to be, their data protection law was strict to begin with. The big difference is that companies would just ignore the laws in, say, Germany since they were operating from Ireland, and would claim that the German courts had no jurisdiction. Now, it's the same everywhere in Europe, which makes it much easier to enforce.
    - lajhsdfkl 8y ago
      >The requirement to hire a DPO is not a new thing, by the way - many countries in the EU already required this. This is true for many provisions in the GDPR - in Germany, for example, very little changes from the way it used to be, their data protection law was strict to begin with. Good for those countries? I'm not going to be happy with the idea of hiring some idiot to sit around and do nothing all day.
seszett 8y ago
> hire an EU Representative (Yes, apparently that is required as well) Only for large-scale behaviour tracking operations. It's quite unlikely that this applies to a 1-3 person startup.
bo1024 8y ago
If the 1-3 person startup's application is geared around personal information and it needs a complex privacy policy to describe what it does with data, then yes, it will have to work very hard to comply with GDPR, but that will also result in meaningful improvements in privacy and data control for its customers. Do you have examples of startups where data is not a core business concern, who still find it very onerous to comply with GDPR (and why it is so difficult)? I'm sorry to come off as unsympathetic, but I feel I've seen a lot of complaints about GDPR, as though the impact on their business is accidental or a side-effect, coupled with apparent denial or inability to understand that their business practices are exactly the problem that GDPR intends to fix.
- throwaway974 8y ago
  Here's an example: I have a profitable, bootstrapped SaaS business based in US . It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. It's a trivial application that stores mostly already public data. Only email is required to login so that I can send password reset and other such communication. I've been talking to a very well known giant corporation (also based in US, but has many global offices) for months. The VP and director love my product and want to start using it right away for their department. But their legal team is scared shitless with 4% fines in GDPR. They are putting some draconian clauses (various ISO certifications and such) in the contract that I, as a small company, cannot comply. That's their interpretation of GDPR. It doesn't matter whether it's right or wrong. The VP and Director are really nice people and I've developed very good rapport with them. But I'm afraid their patience will run out soon and they'll go back to using spreadsheets. A lose-lose situation. This is the side-effect of GDPR. I'm all up for GDPR. I have uBlock, have blackholed all Facebook domains, etc. But don't assume that GDPR doesn't affect normal business transactions. Anyone who says, "Oh, how hard could it be?" has no idea what they are talking about.
  - openIce 8y ago
    >It's a trivial application that stores mostly already public data So wtf are you worrying about then? Only shady companies are afraid of GDRP, the fact that you look at GDPR as a problem is a huge let down in trust for your company

cortesoft 8y ago

If your startup doesn’t have any business in the EU, they can’t go after you.

oaiey 8y ago
"Business" means website visit from a US/EU citizen travelling Europe. And even blocking them by IP and logging it is a violation. User can file a complaint against you, resulting in a ruling. Whether you ever see an "invoice" or see police officers is another topic. But you violate the regulation/law in another country.
- majewsky 8y ago
  Blocking by IP is okay, logging it is the only violation. And why on earth would you have to log those blocks?
  - oaiey 8y ago
    That's right!
  - cortesoft 8y ago
    You would want to log it to make sure you aren't accidentally blocking the wrong people.

rayvd 8y ago

A sometimes unintentional and often intentional side-effect of regulation is helping the big guys fend off competition from the scrappy upstarts. What seems like something aimed to protect the consumer may have unintended consequences further consolidating information into the hands of a few large behemoths.

dexterdog 8y ago
The side-effect is almost always completely intentional.
- deleted 8y ago
  [deleted]

jenscow 8y ago

> hire an EU Representative appoint, not hire.

colonelxc 8y ago

It will certainly depend on the application. Compliance could be as simple for many apps as deleting a user's data manually when you get a support ticket/email from them asking to. You don't need to build automated systems. Same if they ask for the data collected on them. It would be prudent for these companies to spend an afternoon creating a list of all the places where data is being stored about a user. That would just help if it ever becomes necessary to actually delete data. See elsewhere in these comments for information on appointing an EU representative. It is not required in most cases. "Bespoke permissioning" is also required if you have tiers of users with different feature sets (free, basic, premium). So just treat whatever private-data-requiring-thing as a feature that needs consent. Incidently, the evolution of smartphone permissions has also gone in this way, allowing fine grained allowing/disallowing. You have to expect that you wont have all the permissions you want. The GDPR just makes it so that you don't get to say "all or nothing" for the things that don't need permission. But, the good apps were already doing this anyways.

sb8244 8y ago
Manual data deletion without an automated process sounds like a recipe for disaster.

lima 8y ago

> hire an EU Representative It's called Data Protection Officer and you only need to appoint one if processing personal data is your core business, which is reasonable. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/ https://ico.org.uk/for-organisations/guide-to-the-general-da... And yes, I expect the EU to enforce the consent rules. It's very central to the GDPR.

lajhsdfkl 8y ago
>It's called Data Protection Officer and you only need to appoint one if processing personal data is your core business, which is reasonable. Not commenting on the validity of this statement but it's interesting how I can tell from which continent you are from just by you saying that the regulation forcing a business to hire DPO is reasonable.
- lima 8y ago
  Yes, I'm from Europe, and it's my opinion that the GDPR is very necessary and mostly reasonable. I say that even though it caused me a lot of work for the past months. The requirement to hire a DPO is not a new thing, by the way - many countries in the EU already required this. This is true for many provisions in the GDPR - in Germany, for example, very little changes from the way it used to be, their data protection law was strict to begin with. The big difference is that companies would just ignore the laws in, say, Germany since they were operating from Ireland, and would claim that the German courts had no jurisdiction. Now, it's the same everywhere in Europe, which makes it much easier to enforce.
  - lajhsdfkl 8y ago
    >The requirement to hire a DPO is not a new thing, by the way - many countries in the EU already required this. This is true for many provisions in the GDPR - in Germany, for example, very little changes from the way it used to be, their data protection law was strict to begin with. Good for those countries? I'm not going to be happy with the idea of hiring some idiot to sit around and do nothing all day.

seszett 8y ago

> hire an EU Representative (Yes, apparently that is required as well) Only for large-scale behaviour tracking operations. It's quite unlikely that this applies to a 1-3 person startup.

bo1024 8y ago

If the 1-3 person startup's application is geared around personal information and it needs a complex privacy policy to describe what it does with data, then yes, it will have to work very hard to comply with GDPR, but that will also result in meaningful improvements in privacy and data control for its customers. Do you have examples of startups where data is not a core business concern, who still find it very onerous to comply with GDPR (and why it is so difficult)? I'm sorry to come off as unsympathetic, but I feel I've seen a lot of complaints about GDPR, as though the impact on their business is accidental or a side-effect, coupled with apparent denial or inability to understand that their business practices are exactly the problem that GDPR intends to fix.

throwaway974 8y ago
Here's an example: I have a profitable, bootstrapped SaaS business based in US . It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. It's a trivial application that stores mostly already public data. Only email is required to login so that I can send password reset and other such communication. I've been talking to a very well known giant corporation (also based in US, but has many global offices) for months. The VP and director love my product and want to start using it right away for their department. But their legal team is scared shitless with 4% fines in GDPR. They are putting some draconian clauses (various ISO certifications and such) in the contract that I, as a small company, cannot comply. That's their interpretation of GDPR. It doesn't matter whether it's right or wrong. The VP and Director are really nice people and I've developed very good rapport with them. But I'm afraid their patience will run out soon and they'll go back to using spreadsheets. A lose-lose situation. This is the side-effect of GDPR. I'm all up for GDPR. I have uBlock, have blackholed all Facebook domains, etc. But don't assume that GDPR doesn't affect normal business transactions. Anyone who says, "Oh, how hard could it be?" has no idea what they are talking about.
- openIce 8y ago
  >It's a trivial application that stores mostly already public data So wtf are you worrying about then? Only shady companies are afraid of GDRP, the fact that you look at GDPR as a problem is a huge let down in trust for your company