5 ms·

GDPR is significant because for the first time in this history of the Internet an (EU) user no longer has a marginal cost of zero. The cost to write an applicat

GDPR is significant because for the first time in this history of the Internet an (EU) user no longer has a marginal cost of zero. The cost to write an application to be GDPR compliant is high and frankly will not be worth it for many entepreurs developing an MVP.

fastball 8y ago
That's not true at all. It's really easy to build an MVP that complies with GDPR.
- rdlecler1 8y ago
  Really? Do you have an EU representative for your MVP? Did you hire a legal team to review your site and write up your terms of service? Send me your MVP and I’ll show you 10 thing a that are wrong with it and if you are complaint somehow then I doubt the product will be viable at all.
  - matwood 8y ago
    So my MVP is an imaginary service that does X for you. It charges $5/month and it uses your email as the log in. It captures no data other than what you give it to do said service. Other than good data practices which should be followed anyway, please described the huge GDPR hurdles that will make this service not viable.
    - ithkuil 8y ago
      Apparently you need to appoint a Data Protection Officier and you cannot just be e.g. CEO, developer and DPO at the same time. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/ https://ico.org.uk/for-organisations/guide-to-the-general-da... > Basically this means the DPO cannot hold a position within your organisation that leads him or her to determine the purposes and the means of the processing of personal data Are there exemptions for very small companies? If you can prove you don't process any user data, at all, does this exempt you from having to appoint a DPO?
      - colonelxc 8y ago
        From the same site: """ Under the GDPR, you must appoint a DPO if: you are a public authority (except for courts acting in their judicial capacity); your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking); or your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences. """ So if you're not doing 'large scale behaviour tracking', you would not need one. A simple company that sells a subscription service should not need one, unless they are also selling targeted ads, and maybe if they are doing identifiable tracking of how a given user uses the service. Aggregated metrics with no identifiable data do not count (This feature has been used X times). If you are, then it becomes a question of what is 'large scale' in terms of the GDPR.
        paulddraper 8y ago
        > 'large scale' in terms of the GDPR. I have no idea what that means. If my B2B business has a lot of revenue but few customers, am I 'large scale'? If my B2C business has little revenue but a lot of customers, am I 'large scale'? Or maybe 'large scale' applies to the number of servers I use? I have no idea the criteria.
        Karrot_Kream 8y ago
        The keyword here is "large scale behavior tracking". Let's not elide over that.
      - adrianmsmith 8y ago
        > Are there exemptions for very small companies? If you can prove you don't process any user data, at all, does this exempt you from having to appoint a DPO? From the site: > Under the GDPR, you must appoint a DPO if: > * you are a public authority (except for courts acting in their judicial capacity); > * your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking); or > * your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences. So as far as I can see, yes, for small companies or side projects (i.e. not a public authorities, not working with large scale monitoring of individuals, not dealing with criminal convictions) you don't need a DPO.
    - CodesInChaos 8y ago
      Add invoices which contain personal data in the recipient address and must be stored for 10 years safe from manipulation (and then deleted). Combine that with a deletion request, and now you need to delete some data about a customer and keep the rest, which is pretty annoying (yay referential integrity), especially if you're changing existing software, and don't develop from scratch. Of course for the data you can't delete, you now have to restrict access as much as possible, so for every feature in your software you have to figure out if it should use the censored or full data. Then you have to figure out how much of the order history (up/downgrades etc.) you need to keep so you can keep track of who changed what in case of disputes, etc. You need to keep track of payments and invoices for accounting and tax purposes, and of course accounting records must be immutable. Then write documentation describing all the ways you process data and ensure you have a valid updated data privacy contract with all your service providers.
  - huehehue 8y ago
    Really disappointed when I see these kinds of scare tactics. Compliance (or at least a good-faith attempt at compliance) is quite easy for small/new projects. I'm willing to bet that courts aren't out to make an example of every small infringement, and there's really no reason to discourage people from starting new projects.
    - rdlecler1 8y ago
      Please send me a link to your project for analysis before you say it’s easy.
    - king_phil 8y ago
      Exactly. I have been in contact with the regulation authority a few times to make sure we're compliant and in all cases we found that they are super-helpful. And the GDPR is - while being CEO of an ecommerce comppany for 15 years now - the easiest and most well-written ecommerce law I have seen. Everything in it makes sense if you just read the freaking law and the recitals included in the law. Period.
- Symmetry 8y ago
  Regardless of whether the app has a cost in and of itself, the process of appointing a compliance officer and making sure that they understand their responsibilities under EU law is a necessary cost unless you happen to be developing the app yourself and already understand everything involved.
  - stordoff 8y ago
    Read Article 27(2). There's a good chance that you don't need an EU representative unless your product is based around the processing of personal data. Also read Article 37(1), you _don't_ need a compliance officer unless you are dealing with one of the special classes of personal data or performing "regular and systematic monitoring". https://gdpr-info.eu/art-27-gdpr/ https://gdpr-info.eu/art-27-gdpr/ / https://gdpr-info.eu/art-37-gdpr/ https://gdpr-info.eu/art-37-gdpr/
    - tzs 8y ago
      > Read Article 27(2). There's a good chance that you don't need an EU representative unless your product is based around the processing of personal data. To fall under that, the processing has to be "occasional". I've not been able to find any authoritative guidance on what that means.
matthewmacleod 8y ago
No; the cost of supporting GDPR for a new product is essentially zero over good data management in the first place.
- kaslai 8y ago
  Sort of. The technical cost is effectively zero, as everything technical which is required by GDPR ought to be done anyways. However, there are a lot of non-technical compliance issues in meatspace that have a very real cost. Most of that cost may be deferred until the first GDPR-based request, however that just means you're kicking the can down the road. The cost is still there.
riantogo 8y ago
Last night I fired up my laptop to go shut down my side project. But I came up with a band-aid solution that might hold up for now: https://medium.com/@riantogo/gdpr-band-aid-b619d0b17e5b https://medium.com/@riantogo/gdpr-band-aid-b619d0b17e5b I don’t need email addresses any more than, say, Pinterest. But now it is one more barrier to entry for side projects. It is definitely not easy to be compliant as many here suggest.
- BonesJustice 8y ago
  I wonder if it's really necessary to stop using e-mail addresses as usernames / unique identifiers. Presumably you need some sort of unique identifier for each user, and such an identifier can, by definition, be tied to an individual. Would such an identifier not fall under "data required to provide the service"?. And since any such identifier is effectively PII, does it really matter if you use an e-mail address vs. some other user name?
  - rstupek 8y ago
    Not using an email address will effectively ensure the person can never recover their account.
    - BonesJustice 8y ago
      You could also use a hash of the email so that you don't retain and can't reconstruct the original address. Then the recovery process can look for a valid account based on the provided email's hash, and if one is found, a recovery email can be sent to the provided address. Include an expiring, one-time-use token in the recovery link so you can immediately forget the address again.
- sbuk 8y ago
  You can collect email addresses still, so long as you have a legitimate reason to, you seek consent, you store them securely and remove them if consent is withdrawn. These are things that you should be doing anyway! Even if it's an open source side project.
tomtimtall 8y ago
GDPR is significant but not for the reasons you mention. If you want to have European users you have to comply with European laws. That was the case before GDPR as well.

fastball 8y ago

That's not true at all. It's really easy to build an MVP that complies with GDPR.

rdlecler1 8y ago
Really? Do you have an EU representative for your MVP? Did you hire a legal team to review your site and write up your terms of service? Send me your MVP and I’ll show you 10 thing a that are wrong with it and if you are complaint somehow then I doubt the product will be viable at all.
- matwood 8y ago
  So my MVP is an imaginary service that does X for you. It charges $5/month and it uses your email as the log in. It captures no data other than what you give it to do said service. Other than good data practices which should be followed anyway, please described the huge GDPR hurdles that will make this service not viable.
  - ithkuil 8y ago
    Apparently you need to appoint a Data Protection Officier and you cannot just be e.g. CEO, developer and DPO at the same time. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/ https://ico.org.uk/for-organisations/guide-to-the-general-da... > Basically this means the DPO cannot hold a position within your organisation that leads him or her to determine the purposes and the means of the processing of personal data Are there exemptions for very small companies? If you can prove you don't process any user data, at all, does this exempt you from having to appoint a DPO?
    - colonelxc 8y ago
      From the same site: """ Under the GDPR, you must appoint a DPO if: you are a public authority (except for courts acting in their judicial capacity); your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking); or your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences. """ So if you're not doing 'large scale behaviour tracking', you would not need one. A simple company that sells a subscription service should not need one, unless they are also selling targeted ads, and maybe if they are doing identifiable tracking of how a given user uses the service. Aggregated metrics with no identifiable data do not count (This feature has been used X times). If you are, then it becomes a question of what is 'large scale' in terms of the GDPR.
      - paulddraper 8y ago
        > 'large scale' in terms of the GDPR. I have no idea what that means. If my B2B business has a lot of revenue but few customers, am I 'large scale'? If my B2C business has little revenue but a lot of customers, am I 'large scale'? Or maybe 'large scale' applies to the number of servers I use? I have no idea the criteria.
        Karrot_Kream 8y ago
        The keyword here is "large scale behavior tracking". Let's not elide over that.
    - adrianmsmith 8y ago
      > Are there exemptions for very small companies? If you can prove you don't process any user data, at all, does this exempt you from having to appoint a DPO? From the site: > Under the GDPR, you must appoint a DPO if: > * you are a public authority (except for courts acting in their judicial capacity); > * your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking); or > * your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences. So as far as I can see, yes, for small companies or side projects (i.e. not a public authorities, not working with large scale monitoring of individuals, not dealing with criminal convictions) you don't need a DPO.
  - CodesInChaos 8y ago
    Add invoices which contain personal data in the recipient address and must be stored for 10 years safe from manipulation (and then deleted). Combine that with a deletion request, and now you need to delete some data about a customer and keep the rest, which is pretty annoying (yay referential integrity), especially if you're changing existing software, and don't develop from scratch. Of course for the data you can't delete, you now have to restrict access as much as possible, so for every feature in your software you have to figure out if it should use the censored or full data. Then you have to figure out how much of the order history (up/downgrades etc.) you need to keep so you can keep track of who changed what in case of disputes, etc. You need to keep track of payments and invoices for accounting and tax purposes, and of course accounting records must be immutable. Then write documentation describing all the ways you process data and ensure you have a valid updated data privacy contract with all your service providers.
- huehehue 8y ago
  Really disappointed when I see these kinds of scare tactics. Compliance (or at least a good-faith attempt at compliance) is quite easy for small/new projects. I'm willing to bet that courts aren't out to make an example of every small infringement, and there's really no reason to discourage people from starting new projects.
  - rdlecler1 8y ago
    Please send me a link to your project for analysis before you say it’s easy.
  - king_phil 8y ago
    Exactly. I have been in contact with the regulation authority a few times to make sure we're compliant and in all cases we found that they are super-helpful. And the GDPR is - while being CEO of an ecommerce comppany for 15 years now - the easiest and most well-written ecommerce law I have seen. Everything in it makes sense if you just read the freaking law and the recitals included in the law. Period.
Symmetry 8y ago
Regardless of whether the app has a cost in and of itself, the process of appointing a compliance officer and making sure that they understand their responsibilities under EU law is a necessary cost unless you happen to be developing the app yourself and already understand everything involved.
- stordoff 8y ago
  Read Article 27(2). There's a good chance that you don't need an EU representative unless your product is based around the processing of personal data. Also read Article 37(1), you _don't_ need a compliance officer unless you are dealing with one of the special classes of personal data or performing "regular and systematic monitoring". https://gdpr-info.eu/art-27-gdpr/ https://gdpr-info.eu/art-27-gdpr/ / https://gdpr-info.eu/art-37-gdpr/ https://gdpr-info.eu/art-37-gdpr/
  - tzs 8y ago
    > Read Article 27(2). There's a good chance that you don't need an EU representative unless your product is based around the processing of personal data. To fall under that, the processing has to be "occasional". I've not been able to find any authoritative guidance on what that means.

matthewmacleod 8y ago

No; the cost of supporting GDPR for a new product is essentially zero over good data management in the first place.

kaslai 8y ago
Sort of. The technical cost is effectively zero, as everything technical which is required by GDPR ought to be done anyways. However, there are a lot of non-technical compliance issues in meatspace that have a very real cost. Most of that cost may be deferred until the first GDPR-based request, however that just means you're kicking the can down the road. The cost is still there.

riantogo 8y ago

Last night I fired up my laptop to go shut down my side project. But I came up with a band-aid solution that might hold up for now: https://medium.com/@riantogo/gdpr-band-aid-b619d0b17e5b https://medium.com/@riantogo/gdpr-band-aid-b619d0b17e5b I don’t need email addresses any more than, say, Pinterest. But now it is one more barrier to entry for side projects. It is definitely not easy to be compliant as many here suggest.

BonesJustice 8y ago
I wonder if it's really necessary to stop using e-mail addresses as usernames / unique identifiers. Presumably you need some sort of unique identifier for each user, and such an identifier can, by definition, be tied to an individual. Would such an identifier not fall under "data required to provide the service"?. And since any such identifier is effectively PII, does it really matter if you use an e-mail address vs. some other user name?
- rstupek 8y ago
  Not using an email address will effectively ensure the person can never recover their account.
  - BonesJustice 8y ago
    You could also use a hash of the email so that you don't retain and can't reconstruct the original address. Then the recovery process can look for a valid account based on the provided email's hash, and if one is found, a recovery email can be sent to the provided address. Include an expiring, one-time-use token in the recovery link so you can immediately forget the address again.
sbuk 8y ago
You can collect email addresses still, so long as you have a legitimate reason to, you seek consent, you store them securely and remove them if consent is withdrawn. These are things that you should be doing anyway! Even if it's an open source side project.

tomtimtall 8y ago

GDPR is significant but not for the reasons you mention. If you want to have European users you have to comply with European laws. That was the case before GDPR as well.