10 ms·

I can see why you'd be disappointed - if popular websites started blocking US customers I'd be pretty bummed out as well (even if it was easy to circumvent). A

I can see why you'd be disappointed - if popular websites started blocking US customers I'd be pretty bummed out as well (even if it was easy to circumvent). As a dev though, I also understand the frustration. Creating startups is already time-intensive and stressful. A lot of us are on shoestring budgets. Most startups will fail. To a solo developer in the US, the idea of spending time understanding and complying with GDPR is daunting, it's more than just a hindrance to many. Still, I don't want to break European law, so maybe it's easier to block EU users at first and change policies later if profitable. I think blocking is at least showing you respect the law, compared to just doing nothing and being non compliant.

Panoramix 8y ago
If a company does not understand GDPR it's fair to say I don't want them handling my personal data. And it's not like this is new, there was a 2 year period to prepare for this. "Most startups will fail": I do not see that happening. You will first receive a warning. The EU won't really care if you are a tiny startup. Unless you are running a shady business, there's not much to worry about.
- newman8r 8y ago
  Not wanting to use non-GDPR compliant services is completely fair. I think it should be the user's choice. I think assuming the EU won't care about tiny startups is irrelevant - I want to follow the letter of the law, it's why I'd opt to block EU users instead of just ignoring the existence of the law.
- outside1234 8y ago
  The problem is not with the spirit of GDPR. I am totally with that. The problem is the liability of it - as a small startup it is seriously scary to think that all it takes is one insane customer to pull the fire alarm and we'd have regulators and fines raining down on us even if we believe with all of our hearts we are doing it right. Hence, the blocking of the EU - its better to block at the beginning and then expand to the EU once we have revenue to support someone handling this as an employee.
  - Nursie 8y ago
    > as a small startup it is seriously scary to think that all it takes is one insane customer to pull the fire alarm and we'd have regulators and fines raining down on us even if we believe with all of our hearts we are doing it right. You know this is not what would happen, right, that you'd be given advice and the opportunity to towards an amicable resolution?
    - tlrobinson 8y ago
      Can you point me to where in the GDPR it talks about being given "advice and the opportunity to towards an amicable resolution"? (I'm not being facetious, I'm genuinely curious to read about it, if it exists)
      - semigroupoid 8y ago
        Article 83 in general and specifically Art. 83 (2) state that "the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement" should be taken into account when determining penalties. We'll have to see what this means in practice though.
        newman8r 8y ago
        I wonder if their definition of 'should' is in line with RFC 2119 https://www.ietf.org/rfc/rfc2119.txt https://www.ietf.org/rfc/rfc2119.txt I know nothing about European legal systems though
        stordoff 8y ago
        The GDPR doesn't use "should"; it states that "[w]hen deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to" that factor. Basically, if you can show that they _didn't_ take that into account, or that you tried to cooperate and were stone-walled, you will have good grounds for having the fine overturned.
- cavisne 8y ago
  The challenge is absolutely not technical, so 2 years makes no difference. The challenge is that GDPR is essentially impossible to comply 100% with, and absolutely impossible to comply without incurring extra costs. GDPR is the PCI of the privacy world, 99% of companies will be non compliant if audited, but 99% of companies wont be audited. The difference is unlike PCI anyone can launch claims against companies, including for malicious reasons like taking out a competitor, and political reasons like a eurocrat taking a disliking to a particular company.
  - jacquesm 8y ago
    It's not possible for a financial institution to exist without incurring 'extra costs' for SOX and KYC compliance. And yet they all do. That pesky regulation seems to be useful.
    - mirko22 8y ago
      But isn’t SOX for publicy traded companies only?
      - jacquesm 8y ago
        Yes, but some of it applies to privately held companies as well. Most large banks and insurance companies are listed.
    - Sargos 8y ago
      Actually this has been a big problem in the cryptocurrency space. It's entirely too onerous to comply with the rather extreme regulations in the finance space so exchanges had to ignore them for the longest time. Some exchanges even have to move countries because it would be nearly impossible to operate "legally". Yet their services are still needed and if they didn't have this freedom and flexibility then the cryptocurrency space might not have had the tools it needed to grow and innovate.
    - bsder 8y ago
      Oddly, Sarbanes-Oxley also had implications if you were a 501(c)(3) non-profit. We had two major expenses: liability insurance for meetings and SOX insurance for the officers. Everything else was in the noise.
ams6110 8y ago
As a developer I can understand this point of view, but as a consumer I say it's time to grow up. Internet startups have taken a "move fast and break things" approach that is analogous to early industrial revolution approaches to worker safety, product efficacy and safety, and environmental protection. You're working in the real world, with real consequences if you end up exposing people's personal data. The party is ending. Either deal with it, or find something else to do.
- nordsieck 8y ago
  > You're working in the real world, with real consequences if you end up exposing people's personal data. The party is ending. Either deal with it, or find something else to do. They are dealing with it... by limiting their liability.
  - jacquesm 8y ago
    They are avoiding it. Essentially they are voting themselves off the island to avoid having to play nice with the other inhabitants.
    - matte_black 8y ago
      Companies can choose with whom and where they want to do business. The entire world is not entitled to everything Silicon Valley makes.
      - icebraining 8y ago
        Is anyone denying that they have that right?
      - freeflight 8y ago
        Considering Facebook even actively tracks non-users, where's the "users" choice of not participating in that glorious Silicon Valley invention? As far as I can tell, the "user" doesn't have a whole lot of choice there and Facebook isn't the only company doing that kind of aggregated data collection.

Panoramix 8y ago

If a company does not understand GDPR it's fair to say I don't want them handling my personal data. And it's not like this is new, there was a 2 year period to prepare for this. "Most startups will fail": I do not see that happening. You will first receive a warning. The EU won't really care if you are a tiny startup. Unless you are running a shady business, there's not much to worry about.

newman8r 8y ago
Not wanting to use non-GDPR compliant services is completely fair. I think it should be the user's choice. I think assuming the EU won't care about tiny startups is irrelevant - I want to follow the letter of the law, it's why I'd opt to block EU users instead of just ignoring the existence of the law.
outside1234 8y ago
The problem is not with the spirit of GDPR. I am totally with that. The problem is the liability of it - as a small startup it is seriously scary to think that all it takes is one insane customer to pull the fire alarm and we'd have regulators and fines raining down on us even if we believe with all of our hearts we are doing it right. Hence, the blocking of the EU - its better to block at the beginning and then expand to the EU once we have revenue to support someone handling this as an employee.
- Nursie 8y ago
  > as a small startup it is seriously scary to think that all it takes is one insane customer to pull the fire alarm and we'd have regulators and fines raining down on us even if we believe with all of our hearts we are doing it right. You know this is not what would happen, right, that you'd be given advice and the opportunity to towards an amicable resolution?
  - tlrobinson 8y ago
    Can you point me to where in the GDPR it talks about being given "advice and the opportunity to towards an amicable resolution"? (I'm not being facetious, I'm genuinely curious to read about it, if it exists)
    - semigroupoid 8y ago
      Article 83 in general and specifically Art. 83 (2) state that "the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement" should be taken into account when determining penalties. We'll have to see what this means in practice though.
      - newman8r 8y ago
        I wonder if their definition of 'should' is in line with RFC 2119 https://www.ietf.org/rfc/rfc2119.txt https://www.ietf.org/rfc/rfc2119.txt I know nothing about European legal systems though
        stordoff 8y ago
        The GDPR doesn't use "should"; it states that "[w]hen deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to" that factor. Basically, if you can show that they _didn't_ take that into account, or that you tried to cooperate and were stone-walled, you will have good grounds for having the fine overturned.
cavisne 8y ago
The challenge is absolutely not technical, so 2 years makes no difference. The challenge is that GDPR is essentially impossible to comply 100% with, and absolutely impossible to comply without incurring extra costs. GDPR is the PCI of the privacy world, 99% of companies will be non compliant if audited, but 99% of companies wont be audited. The difference is unlike PCI anyone can launch claims against companies, including for malicious reasons like taking out a competitor, and political reasons like a eurocrat taking a disliking to a particular company.
- jacquesm 8y ago
  It's not possible for a financial institution to exist without incurring 'extra costs' for SOX and KYC compliance. And yet they all do. That pesky regulation seems to be useful.
  - mirko22 8y ago
    But isn’t SOX for publicy traded companies only?
    - jacquesm 8y ago
      Yes, but some of it applies to privately held companies as well. Most large banks and insurance companies are listed.
  - Sargos 8y ago
    Actually this has been a big problem in the cryptocurrency space. It's entirely too onerous to comply with the rather extreme regulations in the finance space so exchanges had to ignore them for the longest time. Some exchanges even have to move countries because it would be nearly impossible to operate "legally". Yet their services are still needed and if they didn't have this freedom and flexibility then the cryptocurrency space might not have had the tools it needed to grow and innovate.
  - bsder 8y ago
    Oddly, Sarbanes-Oxley also had implications if you were a 501(c)(3) non-profit. We had two major expenses: liability insurance for meetings and SOX insurance for the officers. Everything else was in the noise.

ams6110 8y ago

As a developer I can understand this point of view, but as a consumer I say it's time to grow up. Internet startups have taken a "move fast and break things" approach that is analogous to early industrial revolution approaches to worker safety, product efficacy and safety, and environmental protection. You're working in the real world, with real consequences if you end up exposing people's personal data. The party is ending. Either deal with it, or find something else to do.

nordsieck 8y ago
> You're working in the real world, with real consequences if you end up exposing people's personal data. The party is ending. Either deal with it, or find something else to do. They are dealing with it... by limiting their liability.
- jacquesm 8y ago
  They are avoiding it. Essentially they are voting themselves off the island to avoid having to play nice with the other inhabitants.
  - matte_black 8y ago
    Companies can choose with whom and where they want to do business. The entire world is not entitled to everything Silicon Valley makes.
    - icebraining 8y ago
      Is anyone denying that they have that right?
    - freeflight 8y ago
      Considering Facebook even actively tracks non-users, where's the "users" choice of not participating in that glorious Silicon Valley invention? As far as I can tell, the "user" doesn't have a whole lot of choice there and Facebook isn't the only company doing that kind of aggregated data collection.