3 ms·

I looked up information on how to legally comply with GDPR and it's a lot more complicated than you're making it out to be. You have to show regulators the well

I looked up information on how to legally comply with GDPR and it's a lot more complicated than you're making it out to be. You have to show regulators the well-defined pipeline for any personal data, and justify to them why that data is being collected. There are also extra procedures you have to follow that could be really complicated depending on the business. This is even worse for small businesses. I can definitely understand those people who want to just wash their hands of it, especially if they don't get much business from Europe.

acatton 8y ago
When I read that, I don't know how to answer. As I said other comments, I'm not sure if people on HN have a problem with the GDPR, or just with the concept of regulation itself. Also, when I read about "complicated rules for small businesses". It reminds me about American republican politicians explaining how taxes on the rich will affect the average joe's taxes. The reality is that many rules only apply to big businesses. And small businesses are exempt of many rules. My favorite one is the "Data Protection Officer", everybody on the internet™ says that you need one. The reality? Most small business won't. The article 37 explains that the Data Protection Officer is when a business is "collecting data on a large scale" [1] Second of all, people interpret that as "Hiring somebody", you don't. It's just a role, take your CEO, and now he's your "Data Protection Officer", ... -- [1] https://gdpr-info.eu/art-37-gdpr/ https://gdpr-info.eu/art-37-gdpr/
- takeda 8y ago
  I support GDPR, but to be fair about Data Protection Officer, that position sounds like a liability, no one will want that title unless they are appropriately compensated for it, so most likely this will be a dedicated person who will be paid just to be responsible for things being complaint. Perhaps in early stage of a startup a founder will take the title to save cost, but he/she will want to lose that responsibility as soon as possible.
  - tombone12 8y ago
    So like a CEO, that is liable for all violations employees do that they've not managed to put on someone else?
- mseebach 8y ago
  > It's just a role, take your CEO, and now he's your "Data Protection Officer" Congratulations, you're uncompliant. Thanks for playing "GDPR is easy". > (5) The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39.
  - acatton 8y ago
    I don't see how this is "not compliant". Expert knowledge just mean that he/she read the entire directive. The same way that most employer in europe have read their country's labor law. The reason why they say that is because the "Data Protection Officer" is the person liable for GPDR violation. The same way the CEO is liable for many wrong doing a company could do. They require no certification, no degree for a person to be a "Data Protection Officer."
    - mseebach 8y ago
      The "GDPR is easy" brigade is very keen on telling people that it's easy to just read the actual text, so let's try that. Just having read the GDPR doesn't count for "expert knowledge", it's just knowledge. "Expert" is something more. How much more? Funny you should ask, welcome to GDPR limbo. Also, it doesn't say expert knowledge merely of GDPR, it says expert knowledge of "data protection law", vague and unbounded, certainly not limited to the GDPR. GDPR is probably the most restrictive you have to comply with, but the text literally requires you to have to have expert knowledge of the others, too. Finally, there's the little "and practices". It's not enough to read it, you have to be an expert in how data protection law is used in practice. Before you have processed even a single byte of data, you're literally uncompliant simply by being blasé about how you name your DPO. It seems unlikely that anyone will get busted simply for this, but low likelihood of enforcement is not the same as compliance, and why would they include this paragraph if they didn't feel it was important? People who actually care about being compliant need to think about this.
      - Dylan16807 8y ago

acatton 8y ago

When I read that, I don't know how to answer. As I said other comments, I'm not sure if people on HN have a problem with the GDPR, or just with the concept of regulation itself. Also, when I read about "complicated rules for small businesses". It reminds me about American republican politicians explaining how taxes on the rich will affect the average joe's taxes. The reality is that many rules only apply to big businesses. And small businesses are exempt of many rules. My favorite one is the "Data Protection Officer", everybody on the internet™ says that you need one. The reality? Most small business won't. The article 37 explains that the Data Protection Officer is when a business is "collecting data on a large scale" [1] Second of all, people interpret that as "Hiring somebody", you don't. It's just a role, take your CEO, and now he's your "Data Protection Officer", ... -- [1] https://gdpr-info.eu/art-37-gdpr/ https://gdpr-info.eu/art-37-gdpr/

takeda 8y ago
I support GDPR, but to be fair about Data Protection Officer, that position sounds like a liability, no one will want that title unless they are appropriately compensated for it, so most likely this will be a dedicated person who will be paid just to be responsible for things being complaint. Perhaps in early stage of a startup a founder will take the title to save cost, but he/she will want to lose that responsibility as soon as possible.
- tombone12 8y ago
  So like a CEO, that is liable for all violations employees do that they've not managed to put on someone else?
mseebach 8y ago
> It's just a role, take your CEO, and now he's your "Data Protection Officer" Congratulations, you're uncompliant. Thanks for playing "GDPR is easy". > (5) The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39.
- acatton 8y ago
  I don't see how this is "not compliant". Expert knowledge just mean that he/she read the entire directive. The same way that most employer in europe have read their country's labor law. The reason why they say that is because the "Data Protection Officer" is the person liable for GPDR violation. The same way the CEO is liable for many wrong doing a company could do. They require no certification, no degree for a person to be a "Data Protection Officer."
  - mseebach 8y ago
    The "GDPR is easy" brigade is very keen on telling people that it's easy to just read the actual text, so let's try that. Just having read the GDPR doesn't count for "expert knowledge", it's just knowledge. "Expert" is something more. How much more? Funny you should ask, welcome to GDPR limbo. Also, it doesn't say expert knowledge merely of GDPR, it says expert knowledge of "data protection law", vague and unbounded, certainly not limited to the GDPR. GDPR is probably the most restrictive you have to comply with, but the text literally requires you to have to have expert knowledge of the others, too. Finally, there's the little "and practices". It's not enough to read it, you have to be an expert in how data protection law is used in practice. Before you have processed even a single byte of data, you're literally uncompliant simply by being blasé about how you name your DPO. It seems unlikely that anyone will get busted simply for this, but low likelihood of enforcement is not the same as compliance, and why would they include this paragraph if they didn't feel it was important? People who actually care about being compliant need to think about this.
    - Dylan16807 8y ago