7 ms·

If a company does not understand GDPR it's fair to say I don't want them handling my personal data. And it's not like this is new, there was a 2 year period to

If a company does not understand GDPR it's fair to say I don't want them handling my personal data. And it's not like this is new, there was a 2 year period to prepare for this. "Most startups will fail": I do not see that happening. You will first receive a warning. The EU won't really care if you are a tiny startup. Unless you are running a shady business, there's not much to worry about.

newman8r 8y ago
Not wanting to use non-GDPR compliant services is completely fair. I think it should be the user's choice. I think assuming the EU won't care about tiny startups is irrelevant - I want to follow the letter of the law, it's why I'd opt to block EU users instead of just ignoring the existence of the law.
outside1234 8y ago
The problem is not with the spirit of GDPR. I am totally with that. The problem is the liability of it - as a small startup it is seriously scary to think that all it takes is one insane customer to pull the fire alarm and we'd have regulators and fines raining down on us even if we believe with all of our hearts we are doing it right. Hence, the blocking of the EU - its better to block at the beginning and then expand to the EU once we have revenue to support someone handling this as an employee.
- Nursie 8y ago
  > as a small startup it is seriously scary to think that all it takes is one insane customer to pull the fire alarm and we'd have regulators and fines raining down on us even if we believe with all of our hearts we are doing it right. You know this is not what would happen, right, that you'd be given advice and the opportunity to towards an amicable resolution?
  - tlrobinson 8y ago
    Can you point me to where in the GDPR it talks about being given "advice and the opportunity to towards an amicable resolution"? (I'm not being facetious, I'm genuinely curious to read about it, if it exists)
    - semigroupoid 8y ago
      Article 83 in general and specifically Art. 83 (2) state that "the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement" should be taken into account when determining penalties. We'll have to see what this means in practice though.
      - newman8r 8y ago
        I wonder if their definition of 'should' is in line with RFC 2119 https://www.ietf.org/rfc/rfc2119.txt https://www.ietf.org/rfc/rfc2119.txt I know nothing about European legal systems though
        stordoff 8y ago
        The GDPR doesn't use "should"; it states that "[w]hen deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to" that factor. Basically, if you can show that they _didn't_ take that into account, or that you tried to cooperate and were stone-walled, you will have good grounds for having the fine overturned.
  - balfirevic 8y ago
    No, he doesn't know that. And you don't either, although you might believe you do.
  - overkalix 8y ago
    My understanding is that the measures taken against GDPR infringements will very much depend on the good will of the relevant national authority. And as a member of a EU country that for the last year has been constantly bending (when not breaking) the rules to repress and attack legitimate political reivindications, the relativism in the application of GDPR is something that I find very worrying.
  - professorgerm 8y ago
    That's an optimistic view of dealing with government, that they would actually be reasonable and helpful. Many in the US have a decidedly pessimistic view of dealing with regulations and bureaucracy. Uber versus Night School is an example of this. Uber: Ignore taxi regulations, get tons of VC, get rich while being awful people. Night School: try to work with government and play by the rules, fail, get used as a cautionary tale. Source: https://psmag.com/economics/night-school-failed-because-it-followed-law https://psmag.com/economics/night-school-failed-because-it-f... I think something akin to GDPR is necessary and good, but GDPR as written probably isn't it. I look forward to seeing how it works out in practice, and how it develops/is replaced, and in the meantime feel bad for the developers and customers that suffer through the unintended consequences and misfeatures of it. After the law gets clarified some, I think you're right that it won't be bad for small players. But I wouldn't want to be one of the test cases.
    - Tomte 8y ago
      > That's an optimistic view of dealing with government Calling the data protection agencies "government" may be correct in some very legalistic sense, but is utterly wrong under any colloquial meaning of the word.
      - Semiapies 8y ago
        Perhaps in Europe, but "government" has meant "the state" in the US for most of two centuries.
      - barry-cotter 8y ago
        If they’re set up pursuant to legislation and paid for by taxes they’re the government.
  - icelancer 8y ago
    >> You know this is not what would happen You don't know this.
    - pgeorgi 8y ago
      We have 20+ years of dealing with tons of national and regional DPAs following national rules. Now these DPAs play by a single rule book, but other than that, little changes. How many $300kEUR fines (the maximum in Germany until yesterday) served by a German DPA (we have 17: one federal, one per state) have you heard about in the last 5 years?
      - Tomte 8y ago
        I haven't found the statistic about fines levelled by the Hamburg DPA that I read recently, but just found something about the Saxony DPA: From April 2015 to March 2017 there were 124 proceedings, with 47 leading to fines. The aggregate sum of all those 47 fines was... 174.226 Euros.
      - mdpopescu 8y ago
        You mean like [1] or [2]? [1] http://www.dw.com/en/germany-fines-man-208000-for-stealing-calf-liver/a-42651516 http://www.dw.com/en/germany-fines-man-208000-for-stealing-c... [2] https://www.thelocal.de/20170405/germany-to-fine-social-media-giants-up-to-50-million-for-hate-speech https://www.thelocal.de/20170405/germany-to-fine-social-medi...
        germanier 8y ago
        The first one was handed out by a court based on criminal law. This is not comparable to administrative fines. He got fined 260 days of his income (which is the basis on which such fines are assessed). He had two previous, very recent convictions. I'd say this is not a very harsh sentence but your opinion might vary. The second one is a law very much like GDPR (notice the little words "up to"?). Not a single fine has been given based on that, not even a small one.
cavisne 8y ago
The challenge is absolutely not technical, so 2 years makes no difference. The challenge is that GDPR is essentially impossible to comply 100% with, and absolutely impossible to comply without incurring extra costs. GDPR is the PCI of the privacy world, 99% of companies will be non compliant if audited, but 99% of companies wont be audited. The difference is unlike PCI anyone can launch claims against companies, including for malicious reasons like taking out a competitor, and political reasons like a eurocrat taking a disliking to a particular company.
- jacquesm 8y ago
  It's not possible for a financial institution to exist without incurring 'extra costs' for SOX and KYC compliance. And yet they all do. That pesky regulation seems to be useful.
  - mirko22 8y ago
    But isn’t SOX for publicy traded companies only?
    - jacquesm 8y ago
      Yes, but some of it applies to privately held companies as well. Most large banks and insurance companies are listed.
  - Sargos 8y ago
    Actually this has been a big problem in the cryptocurrency space. It's entirely too onerous to comply with the rather extreme regulations in the finance space so exchanges had to ignore them for the longest time. Some exchanges even have to move countries because it would be nearly impossible to operate "legally". Yet their services are still needed and if they didn't have this freedom and flexibility then the cryptocurrency space might not have had the tools it needed to grow and innovate.
  - bsder 8y ago
    Oddly, Sarbanes-Oxley also had implications if you were a 501(c)(3) non-profit. We had two major expenses: liability insurance for meetings and SOX insurance for the officers. Everything else was in the noise.

newman8r 8y ago

Not wanting to use non-GDPR compliant services is completely fair. I think it should be the user's choice. I think assuming the EU won't care about tiny startups is irrelevant - I want to follow the letter of the law, it's why I'd opt to block EU users instead of just ignoring the existence of the law.

outside1234 8y ago

The problem is not with the spirit of GDPR. I am totally with that. The problem is the liability of it - as a small startup it is seriously scary to think that all it takes is one insane customer to pull the fire alarm and we'd have regulators and fines raining down on us even if we believe with all of our hearts we are doing it right. Hence, the blocking of the EU - its better to block at the beginning and then expand to the EU once we have revenue to support someone handling this as an employee.

Nursie 8y ago
> as a small startup it is seriously scary to think that all it takes is one insane customer to pull the fire alarm and we'd have regulators and fines raining down on us even if we believe with all of our hearts we are doing it right. You know this is not what would happen, right, that you'd be given advice and the opportunity to towards an amicable resolution?
- tlrobinson 8y ago
  Can you point me to where in the GDPR it talks about being given "advice and the opportunity to towards an amicable resolution"? (I'm not being facetious, I'm genuinely curious to read about it, if it exists)
  - semigroupoid 8y ago
    Article 83 in general and specifically Art. 83 (2) state that "the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement" should be taken into account when determining penalties. We'll have to see what this means in practice though.
    - newman8r 8y ago
      I wonder if their definition of 'should' is in line with RFC 2119 https://www.ietf.org/rfc/rfc2119.txt https://www.ietf.org/rfc/rfc2119.txt I know nothing about European legal systems though
      - stordoff 8y ago
        The GDPR doesn't use "should"; it states that "[w]hen deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to" that factor. Basically, if you can show that they _didn't_ take that into account, or that you tried to cooperate and were stone-walled, you will have good grounds for having the fine overturned.
- balfirevic 8y ago
  No, he doesn't know that. And you don't either, although you might believe you do.
- overkalix 8y ago
  My understanding is that the measures taken against GDPR infringements will very much depend on the good will of the relevant national authority. And as a member of a EU country that for the last year has been constantly bending (when not breaking) the rules to repress and attack legitimate political reivindications, the relativism in the application of GDPR is something that I find very worrying.
- professorgerm 8y ago
  That's an optimistic view of dealing with government, that they would actually be reasonable and helpful. Many in the US have a decidedly pessimistic view of dealing with regulations and bureaucracy. Uber versus Night School is an example of this. Uber: Ignore taxi regulations, get tons of VC, get rich while being awful people. Night School: try to work with government and play by the rules, fail, get used as a cautionary tale. Source: https://psmag.com/economics/night-school-failed-because-it-followed-law https://psmag.com/economics/night-school-failed-because-it-f... I think something akin to GDPR is necessary and good, but GDPR as written probably isn't it. I look forward to seeing how it works out in practice, and how it develops/is replaced, and in the meantime feel bad for the developers and customers that suffer through the unintended consequences and misfeatures of it. After the law gets clarified some, I think you're right that it won't be bad for small players. But I wouldn't want to be one of the test cases.
  - Tomte 8y ago
    > That's an optimistic view of dealing with government Calling the data protection agencies "government" may be correct in some very legalistic sense, but is utterly wrong under any colloquial meaning of the word.
    - Semiapies 8y ago
      Perhaps in Europe, but "government" has meant "the state" in the US for most of two centuries.
    - barry-cotter 8y ago
      If they’re set up pursuant to legislation and paid for by taxes they’re the government.
- icelancer 8y ago
  >> You know this is not what would happen You don't know this.
  - pgeorgi 8y ago
    We have 20+ years of dealing with tons of national and regional DPAs following national rules. Now these DPAs play by a single rule book, but other than that, little changes. How many $300kEUR fines (the maximum in Germany until yesterday) served by a German DPA (we have 17: one federal, one per state) have you heard about in the last 5 years?
    - Tomte 8y ago
      I haven't found the statistic about fines levelled by the Hamburg DPA that I read recently, but just found something about the Saxony DPA: From April 2015 to March 2017 there were 124 proceedings, with 47 leading to fines. The aggregate sum of all those 47 fines was... 174.226 Euros.
    - mdpopescu 8y ago
      You mean like [1] or [2]? [1] http://www.dw.com/en/germany-fines-man-208000-for-stealing-calf-liver/a-42651516 http://www.dw.com/en/germany-fines-man-208000-for-stealing-c... [2] https://www.thelocal.de/20170405/germany-to-fine-social-media-giants-up-to-50-million-for-hate-speech https://www.thelocal.de/20170405/germany-to-fine-social-medi...
      - germanier 8y ago
        The first one was handed out by a court based on criminal law. This is not comparable to administrative fines. He got fined 260 days of his income (which is the basis on which such fines are assessed). He had two previous, very recent convictions. I'd say this is not a very harsh sentence but your opinion might vary. The second one is a law very much like GDPR (notice the little words "up to"?). Not a single fine has been given based on that, not even a small one.

cavisne 8y ago

The challenge is absolutely not technical, so 2 years makes no difference. The challenge is that GDPR is essentially impossible to comply 100% with, and absolutely impossible to comply without incurring extra costs. GDPR is the PCI of the privacy world, 99% of companies will be non compliant if audited, but 99% of companies wont be audited. The difference is unlike PCI anyone can launch claims against companies, including for malicious reasons like taking out a competitor, and political reasons like a eurocrat taking a disliking to a particular company.

jacquesm 8y ago
It's not possible for a financial institution to exist without incurring 'extra costs' for SOX and KYC compliance. And yet they all do. That pesky regulation seems to be useful.
- mirko22 8y ago
  But isn’t SOX for publicy traded companies only?
  - jacquesm 8y ago
    Yes, but some of it applies to privately held companies as well. Most large banks and insurance companies are listed.
- Sargos 8y ago
  Actually this has been a big problem in the cryptocurrency space. It's entirely too onerous to comply with the rather extreme regulations in the finance space so exchanges had to ignore them for the longest time. Some exchanges even have to move countries because it would be nearly impossible to operate "legally". Yet their services are still needed and if they didn't have this freedom and flexibility then the cryptocurrency space might not have had the tools it needed to grow and innovate.
- bsder 8y ago
  Oddly, Sarbanes-Oxley also had implications if you were a 501(c)(3) non-profit. We had two major expenses: liability insurance for meetings and SOX insurance for the officers. Everything else was in the noise.