18 ms·

I'm a Brit. I am the MD of a small IT company. I have two partners and 20 employees. We started in 2000. We turn over about £1.5Mpa. We sell our services t

I'm a Brit. I am the MD of a small IT company. I have two partners and 20 employees. We started in 2000. We turn over about £1.5Mpa. We sell our services to people and organisations. Our backups are now smaller these days (thanks to GDPR). I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR. There is no way on earth that the EU as a whole has looked on your company/project or whatever and decided to screw you. Have a look at the first few paras of this: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... after it says "Whereas". Does the language look a little familiar? Do the sentiments look strangely familiar in some way? GDPR is not about destroying people's livelihoods. It is about protecting basic, fundamental rights that say 30 years ago we never knew needed to exist. After all the knee jerk reactions have calmed down a bit, you may find that you personally have benefited in some way from EU regs. If you find that, then I suggest you fight tooth and nail for similar to be enacted at home. I'll be the first to thank you for that.

datamingle 8y ago
How do you handle developer computers with possible client data on them, even semi-anonymized? Or when communicating issues on the live server, you might transfer client information to other stake holders to debug issue. Are you tracking that communication. Where does the communication data reside, perhaps on a server outside of the EU? There is a lot of complications that arise if you think about the second order/third order consequences of the law.
- gerdesj 8y ago
  I have keyed in and deleted so many efforts at an answer to your question that I have given up and find myself merely asking: "Have you actually read the regs?" http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... My reading of them finds no second/third order anything. The regs are surprisingly clear. I forgot to mention that unless you are trying to abuse EU citizens in some way then you have no problems. A useful side effect of the internet is that deciding whether someone is an EU citizen or not is tricky. That means that most companies have decided to treat all citizens in nearly the same way: For you as a private individual, a foreign power now provides you (indirectly) with way more "rights" than you might have had in the past on the internet. Have a read of the regs, please. The first few paras are a bit "we the people" but then, that is what is required. Then go through the articles. Read them as a person first and then consider them as a company or whatever you do later.
  - sebleon 8y ago
    > surprisingly clear This is an 88 page document with extremely dry language. Just confirming your assertion will be time consuming. No wonder many American services would rather shut out EU users than comply.
    - bardworx 8y ago
      This is a silly and downright crude comment. My mortgage contract was 56 “dry” pages and I found time to read/understand it, to the best of my ability. If you own a business, the cost of reading this document is about 2 days (with consideration for googling terms). To disenfranchise a whole continent because you are inconvenienced is ridiculous. Put it a different way: are you too busy to read docs/specs of the technology you are using or will you abandon it because specs are too dry? American services are just busy because they are doing their best to keep the lights on. Within a week, the handful of companies will comply. They’re just cautious because they have to pay folks and don’t want to make a silly mistake that will shut down their business. Edit: structure
      - gerdesj 8y ago
        "This is a silly and downright crude comment" - easy mate. My ISO 27001 docs are a bit dry as well and I wrote the bloody things as well as the sob ISO 9001 ones. In my opinion you absolutely hit the nail on the head with this: "If you own a business, the cost of reading this document is about 2 days"
      - sebleon 8y ago
        Ha, I actually thought the comment was relevant for an article on blocking EU users with Cloudflare. This regulation calls for legal expertise, trusting google to save on fees seems risky for a business. In all seriousness, biz owners should shell out for expert advice for compliance, or stop doing business in the EU. Google and Fb have already seen litigious groups claim $9.3B in fines on the first day[1]. There will certainly be a cottage industry of lawyers going after online businesses that have erred with GDPR. [1] https://www.cnet.com/news/gdpr-google-and-facebook-face-up-to-9-3-billion-in-fines-on-first-day-of-new-privacy-law/ https://www.cnet.com/news/gdpr-google-and-facebook-face-up-t...
- Spooky23 8y ago
  I don’t know GDPR inside and out, but I have worked at places (not military) where I could be held criminally liable for misuse or negligent disclosure of PII. The answer to “How do you handle...” is that you get your shit together. Separation of duties, build and configuration standards, no customer data on random laptops. When I was in high school, I worked at a sandwich/coffee shop. The precious commodity in that store was cash. We didn’t leave cash on a counter, or on a roll in our pockets it was in a locked register. When there was more than $500, we withdrew down to $250 and put the cash in a safe. At the end of the night, we put the cash in a locked pouch and two of us walked to the bank and put it in a dropbox. Data is no different, just more complex.
  - gerdesj 8y ago
    "The answer to “How do you handle...” is that you get your shit together." Yes it is
  - fanzhang 8y ago
    And if getting your "act together" is a substantial cost for small companies, no matter? The word choice almost presumes the conclusion, that data privacy rules are obvious, and cheap, and akin to just washing hands after using the toilet. Every regulation has costs and benefits. I also would love to have better worldwide privacy at no or little cost, but the fact that people are blocking the EU shows that some companies just don't see this to be the case. And they're voting with their feet. EU citizens should accept the fact that if they support the law, they will further data privacy protections, which are good, and they will face the music if some innovation leaves or whatever compliance costs may come with it.
    - Spooky23 8y ago
      Data privacy isn’t trivial, but the core concepts are pretty straightforward. Like cash, data is both an asset and liability. The business model of tech insulates the investors completely from liability, so there is no incentive to self-police. The contempt shown for us collectively as users and people is what triggered the regulatory backlash. The 2016 electron demonstrated that better than anything why this is important.
- jholman 8y ago
  If you have developer computers with client data on it, semi-anonymized or not, I want you fined until you stop. What the hell is wrong with that hypothetical business? It's like restaurants putting the toilet in the kitchen. Shut the business down!
bobcostas55 8y ago
It's curious how these "basic, fundamental" rights only apply to select industries, while others are free to completely ignore them (art. 85). What kind of basic, fundamental right is that?
- shabble 8y ago
  Are we reading the same Article 85 here? Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.[1] Not sure how that's 'complete freedom to ignore' exactly, nor is that an exhaustive list, just some examples of where they may need to be balanced against other freedoms. [1] https://gdpr-info.eu/art-85-gdpr/ https://gdpr-info.eu/art-85-gdpr/
- brisance 8y ago
  Even the beloved First Amendment does not protect all forms of speech. Your point…?
  - brisance 8y ago
    Please explain why the parent comment attracted downvotes. In the US Constitution, the first amendment protects Americans' right to free speech. However, not all forms of speech are protected. The same legal principle applies to the GDPR; not all industries need to follow the GDPR, as laid out in the Article 85.
- gerdesj 8y ago
  http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... (see below for my response wrt SS85) I prefer to dwell on things like this: The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity. Below: A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned. Therefore, as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the controller is able to demonstrate, in accordance with the accountability principle, that the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where such notification cannot be achieved within 72 hours, the reasons for the delay should accompany the notification and information may be provided in phases without undue further delay.
seanmcdirmid 8y ago
> There is no way on earth that the EU as a whole has looked on your company/project or whatever and decided to screw you. The rules are enforced via third-party litigation. So its not the "EU", but some lawyer looking for a nice payday that you have to worry about.
- pilsetnieks 8y ago
  While the GDPR allows for third party litigation, the violations are expected to be handled though relevant data protection authorities, and direct litigation is a last recourse if all else fails. If you haven't tried and failed to resolve your GDPR complaint through the relevant authorities, you'll be laughed out of the court, if you try to bring a GDPR case to it. Edit: any replies instead of just downvotes? Yes, it isn't spelled out entirely in the GDPR but it isn't operating in an empty place. The civil law systems of most of EU have certain assumptions in place, like that you will first try to find recourse through proper avenues, and only then try direct litigation. If anything, you might actually try to sue the data protection authority for mishandling your case.
  - seanmcdirmid 8y ago
    Even if true, how are small American companies supposed to know about any of that without investing in a lot in European lawyers? Easier to just not serve the market.
  - sfifs 8y ago
    I'll try to answer. The law doesn't actually say that you can sue only after complaint resolution through authorities have failed. That is merely expected practice and assumptions. Potentially facing a frivolous lawsuit in Europe is high risk for a business which small businesses may not want to take. If that's the intent, it should be codified in law.
eli 8y ago
It's reassuring to hear that the GDPR is not meant to target little startups and projects but I would like it a lot better if it said that in the actual law, rather than just trusting all current and future regulators to treat me kindly. If it's only meant to be used against big companies or extreme offenders, why doesn't it say so? It seems like the spirit of the law and the language of the law are not aligned and in my opinion that's a sign of poorly designed regulation. I object to the idea that small projects should be ok with breaking the law merely because they very likely won't get caught.
- gerdesj 8y ago
  "but I would like it a lot better if it said that in the actual law" Have you read the bloody law! http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... This is legislation designed to protect not only me (as an individual) but you as well (as a probable foreigner) from me!
  - eli 8y ago
    Yes, indeed I have. But if there's something I've missed, I'd surely appreciate a quote or specific reference.
  - fanzhang 8y ago
    Reading the law, I only see a single exception for small companies: Article 30.1 and 30.2 doesn't apply for companies less than 250 employees. Out of an 88 page law, 1% of an auxiliary middle of the law is carved out for small companies. I'm not sure that counts as differential application for small companies. In the US at least, large portions of entire key burdensome laws don't apply for employers below size 50, 10, 5, etc. This does not seem to be the case here. Does anyone know whether an official impact study on innovation was even done before its passage?
    - camillomiller 8y ago
      You can be a company of ten people and still turn over millions by selling your users’ data in shadowy ways. Why shouldn’t you be stopped just because you’re small. How can the size a company be used as a rational differentiator in a law like this?
fanzhang 8y ago
In legal contracts "whereas" often expresses sentiment but it's really the actual terms that matter. Having drafted a number of contracts, I feel most contracts generally have a section that approximates "whereas everyone wants things to go well and everyone to benefit..." That's great that your company works well with GDPR. I imagine many companies will. I'm also sure that the impact on your backups could have been had without the law if you so chose. However, an organisation that works inside the UK (EU) serving many EU paying customers (presuming here) is very different from say, Instapaper, who pulled out of the EU today because they don't make very much money from EU customers. If we pass a regulation that says everyone who is in New York for any amount of time must pass an annual 1 hour health exam (conducted by NY state), I imagine this to be totally acceptable to New Yorkers. It correlates with good public policy: you prevent communicable diseases, and can catch health problem before it gets big. However, if this rule were to be enforced strongly, someone who might stop by once or twice a year probably is better off never coming.
- kennywinker 8y ago
  That’s the wrong analogy. How about “everyone who is in new york for any amount of time had to not be actively harming new yorkers”. Sure some people who want to actively harm new yorkers are going to go away and never come back... but they’ll all be better off for it - and really every other state should probably pass a similar law. Edit: duely noted. Libertarian capitalists of hacker news do not agree.
  - mdpopescu 8y ago
    I find it amazing that you came up with the most one-sided argument you could think of ("not actively harming") and still didn't realize how badly it can misfire. Here's a hint: my dentist is actively harming me when taking out a tooth.
    - kennywinker 8y ago
      > my dentist is actively harming me when taking out a tooth. if that was true you wouldn't pay them to do it. They are causing you pain in the short term, yes. That's not the same as harm.
mark_l_watson 8y ago
Thanks for posting that, makes me feel much better about the spirit of the GPDR. I decided to remove any use of cookies from all of my sites() a week ago. For my business (writer, and sometimes consultant) that makes sense for me but I understand that most businesses need some access to customer data so they have a motivation to properly handle personal data. () except my blog is on blogger - still trying to deal with that - I will probably go back to using Jekyll.
kccqzy 8y ago
> Have a look at the first few paras of this: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX.. http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX.... after it says "Whereas". Does the language look a little familiar? Do the sentiments look strangely familiar in some way? The thing after "Whereas" is just a preamble stating the intentions, not the actual legal text. In this case, I scrolled down no fewer than 31 pages, thinking to myself "The whereas section can't be that long" until I finally found the real start of the legal text "HAVE ADOPTED THIS REGULATION" on page 32 of 88.
chunkyslink 8y ago
Thank you for a sensible and balanced opinion. The Americans seem to be shitting themselves over this, when it is meant to help us all work toward better privacy - not shoot people or put them in prison. That is what years of living in a police state has done to them - turned them into wall building nervous wrecks ! There are no GDPR police looking to shut you down. Calm down.
deleted 8y ago
[deleted]
herbst 8y ago
The thing for me is that it requires me to log additional data. Now I need to know where my users are from, how old they are, and how often and how they access their account. All data I happily ignored so far to increase privacy.
- rypskar 8y ago
  >Now I need to know where my users are from Why do you need to know that? Why don't treat all users with respect?
  - herbst 8y ago
    What respect? Saving additional metadata? I totally get your point. But my product already focuses on privacy. Saving any kind of metadata/communication data is more than I do now.
deleted 8y ago
[deleted]
emilfihlman 8y ago
>It is about protecting basic, fundamental rights that say 30 years ago we never knew needed to exist. No. GDPR is an overreaching and idiotic law, where standard IP logs are illegal.
jeremyt 8y ago
You’re missing the point completely. I’m really glad to hear that I’m not being targeted. However, I don’t much care about what the intent is, I care about what the effect is. And what I see is a law that is vague and enforcement agents are given broad discretion. What this looks like is that each case become “facts and circumstances” case, which is an absolute nightmare from a compliance standpoint. And the additional paperwork and personnel requirements appear to be non-trivial and will add a significant amount to the minimum necessary capital and labor needed to start a startup . The inevitable and undisputable result is that at least some startups on the margin which could’ve made it before the law was passed will not make it after the law was passed. Supporters would argue this is a good thing, but I would argue it is not.

datamingle 8y ago

How do you handle developer computers with possible client data on them, even semi-anonymized? Or when communicating issues on the live server, you might transfer client information to other stake holders to debug issue. Are you tracking that communication. Where does the communication data reside, perhaps on a server outside of the EU? There is a lot of complications that arise if you think about the second order/third order consequences of the law.

gerdesj 8y ago
I have keyed in and deleted so many efforts at an answer to your question that I have given up and find myself merely asking: "Have you actually read the regs?" http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... My reading of them finds no second/third order anything. The regs are surprisingly clear. I forgot to mention that unless you are trying to abuse EU citizens in some way then you have no problems. A useful side effect of the internet is that deciding whether someone is an EU citizen or not is tricky. That means that most companies have decided to treat all citizens in nearly the same way: For you as a private individual, a foreign power now provides you (indirectly) with way more "rights" than you might have had in the past on the internet. Have a read of the regs, please. The first few paras are a bit "we the people" but then, that is what is required. Then go through the articles. Read them as a person first and then consider them as a company or whatever you do later.
- sebleon 8y ago
  > surprisingly clear This is an 88 page document with extremely dry language. Just confirming your assertion will be time consuming. No wonder many American services would rather shut out EU users than comply.
  - bardworx 8y ago
    This is a silly and downright crude comment. My mortgage contract was 56 “dry” pages and I found time to read/understand it, to the best of my ability. If you own a business, the cost of reading this document is about 2 days (with consideration for googling terms). To disenfranchise a whole continent because you are inconvenienced is ridiculous. Put it a different way: are you too busy to read docs/specs of the technology you are using or will you abandon it because specs are too dry? American services are just busy because they are doing their best to keep the lights on. Within a week, the handful of companies will comply. They’re just cautious because they have to pay folks and don’t want to make a silly mistake that will shut down their business. Edit: structure
    - gerdesj 8y ago
      "This is a silly and downright crude comment" - easy mate. My ISO 27001 docs are a bit dry as well and I wrote the bloody things as well as the sob ISO 9001 ones. In my opinion you absolutely hit the nail on the head with this: "If you own a business, the cost of reading this document is about 2 days"
    - sebleon 8y ago
      Ha, I actually thought the comment was relevant for an article on blocking EU users with Cloudflare. This regulation calls for legal expertise, trusting google to save on fees seems risky for a business. In all seriousness, biz owners should shell out for expert advice for compliance, or stop doing business in the EU. Google and Fb have already seen litigious groups claim $9.3B in fines on the first day[1]. There will certainly be a cottage industry of lawyers going after online businesses that have erred with GDPR. [1] https://www.cnet.com/news/gdpr-google-and-facebook-face-up-to-9-3-billion-in-fines-on-first-day-of-new-privacy-law/ https://www.cnet.com/news/gdpr-google-and-facebook-face-up-t...
Spooky23 8y ago
I don’t know GDPR inside and out, but I have worked at places (not military) where I could be held criminally liable for misuse or negligent disclosure of PII. The answer to “How do you handle...” is that you get your shit together. Separation of duties, build and configuration standards, no customer data on random laptops. When I was in high school, I worked at a sandwich/coffee shop. The precious commodity in that store was cash. We didn’t leave cash on a counter, or on a roll in our pockets it was in a locked register. When there was more than $500, we withdrew down to $250 and put the cash in a safe. At the end of the night, we put the cash in a locked pouch and two of us walked to the bank and put it in a dropbox. Data is no different, just more complex.
- gerdesj 8y ago
  "The answer to “How do you handle...” is that you get your shit together." Yes it is
- fanzhang 8y ago
  And if getting your "act together" is a substantial cost for small companies, no matter? The word choice almost presumes the conclusion, that data privacy rules are obvious, and cheap, and akin to just washing hands after using the toilet. Every regulation has costs and benefits. I also would love to have better worldwide privacy at no or little cost, but the fact that people are blocking the EU shows that some companies just don't see this to be the case. And they're voting with their feet. EU citizens should accept the fact that if they support the law, they will further data privacy protections, which are good, and they will face the music if some innovation leaves or whatever compliance costs may come with it.
  - Spooky23 8y ago
    Data privacy isn’t trivial, but the core concepts are pretty straightforward. Like cash, data is both an asset and liability. The business model of tech insulates the investors completely from liability, so there is no incentive to self-police. The contempt shown for us collectively as users and people is what triggered the regulatory backlash. The 2016 electron demonstrated that better than anything why this is important.
jholman 8y ago
If you have developer computers with client data on it, semi-anonymized or not, I want you fined until you stop. What the hell is wrong with that hypothetical business? It's like restaurants putting the toilet in the kitchen. Shut the business down!

bobcostas55 8y ago

It's curious how these "basic, fundamental" rights only apply to select industries, while others are free to completely ignore them (art. 85). What kind of basic, fundamental right is that?

shabble 8y ago
Are we reading the same Article 85 here? Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.[1] Not sure how that's 'complete freedom to ignore' exactly, nor is that an exhaustive list, just some examples of where they may need to be balanced against other freedoms. [1] https://gdpr-info.eu/art-85-gdpr/ https://gdpr-info.eu/art-85-gdpr/
brisance 8y ago
Even the beloved First Amendment does not protect all forms of speech. Your point…?
- brisance 8y ago
  Please explain why the parent comment attracted downvotes. In the US Constitution, the first amendment protects Americans' right to free speech. However, not all forms of speech are protected. The same legal principle applies to the GDPR; not all industries need to follow the GDPR, as laid out in the Article 85.
gerdesj 8y ago
http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... (see below for my response wrt SS85) I prefer to dwell on things like this: The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity. Below: A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned. Therefore, as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the controller is able to demonstrate, in accordance with the accountability principle, that the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where such notification cannot be achieved within 72 hours, the reasons for the delay should accompany the notification and information may be provided in phases without undue further delay.

seanmcdirmid 8y ago

> There is no way on earth that the EU as a whole has looked on your company/project or whatever and decided to screw you. The rules are enforced via third-party litigation. So its not the "EU", but some lawyer looking for a nice payday that you have to worry about.

pilsetnieks 8y ago
While the GDPR allows for third party litigation, the violations are expected to be handled though relevant data protection authorities, and direct litigation is a last recourse if all else fails. If you haven't tried and failed to resolve your GDPR complaint through the relevant authorities, you'll be laughed out of the court, if you try to bring a GDPR case to it. Edit: any replies instead of just downvotes? Yes, it isn't spelled out entirely in the GDPR but it isn't operating in an empty place. The civil law systems of most of EU have certain assumptions in place, like that you will first try to find recourse through proper avenues, and only then try direct litigation. If anything, you might actually try to sue the data protection authority for mishandling your case.
- seanmcdirmid 8y ago
  Even if true, how are small American companies supposed to know about any of that without investing in a lot in European lawyers? Easier to just not serve the market.
- sfifs 8y ago
  I'll try to answer. The law doesn't actually say that you can sue only after complaint resolution through authorities have failed. That is merely expected practice and assumptions. Potentially facing a frivolous lawsuit in Europe is high risk for a business which small businesses may not want to take. If that's the intent, it should be codified in law.

eli 8y ago

It's reassuring to hear that the GDPR is not meant to target little startups and projects but I would like it a lot better if it said that in the actual law, rather than just trusting all current and future regulators to treat me kindly. If it's only meant to be used against big companies or extreme offenders, why doesn't it say so? It seems like the spirit of the law and the language of the law are not aligned and in my opinion that's a sign of poorly designed regulation. I object to the idea that small projects should be ok with breaking the law merely because they very likely won't get caught.

gerdesj 8y ago
"but I would like it a lot better if it said that in the actual law" Have you read the bloody law! http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... This is legislation designed to protect not only me (as an individual) but you as well (as a probable foreigner) from me!
- eli 8y ago
  Yes, indeed I have. But if there's something I've missed, I'd surely appreciate a quote or specific reference.
- fanzhang 8y ago
  Reading the law, I only see a single exception for small companies: Article 30.1 and 30.2 doesn't apply for companies less than 250 employees. Out of an 88 page law, 1% of an auxiliary middle of the law is carved out for small companies. I'm not sure that counts as differential application for small companies. In the US at least, large portions of entire key burdensome laws don't apply for employers below size 50, 10, 5, etc. This does not seem to be the case here. Does anyone know whether an official impact study on innovation was even done before its passage?
  - camillomiller 8y ago
    You can be a company of ten people and still turn over millions by selling your users’ data in shadowy ways. Why shouldn’t you be stopped just because you’re small. How can the size a company be used as a rational differentiator in a law like this?

fanzhang 8y ago

In legal contracts "whereas" often expresses sentiment but it's really the actual terms that matter. Having drafted a number of contracts, I feel most contracts generally have a section that approximates "whereas everyone wants things to go well and everyone to benefit..." That's great that your company works well with GDPR. I imagine many companies will. I'm also sure that the impact on your backups could have been had without the law if you so chose. However, an organisation that works inside the UK (EU) serving many EU paying customers (presuming here) is very different from say, Instapaper, who pulled out of the EU today because they don't make very much money from EU customers. If we pass a regulation that says everyone who is in New York for any amount of time must pass an annual 1 hour health exam (conducted by NY state), I imagine this to be totally acceptable to New Yorkers. It correlates with good public policy: you prevent communicable diseases, and can catch health problem before it gets big. However, if this rule were to be enforced strongly, someone who might stop by once or twice a year probably is better off never coming.

kennywinker 8y ago
That’s the wrong analogy. How about “everyone who is in new york for any amount of time had to not be actively harming new yorkers”. Sure some people who want to actively harm new yorkers are going to go away and never come back... but they’ll all be better off for it - and really every other state should probably pass a similar law. Edit: duely noted. Libertarian capitalists of hacker news do not agree.
- mdpopescu 8y ago
  I find it amazing that you came up with the most one-sided argument you could think of ("not actively harming") and still didn't realize how badly it can misfire. Here's a hint: my dentist is actively harming me when taking out a tooth.
  - kennywinker 8y ago
    > my dentist is actively harming me when taking out a tooth. if that was true you wouldn't pay them to do it. They are causing you pain in the short term, yes. That's not the same as harm.

mark_l_watson 8y ago

Thanks for posting that, makes me feel much better about the spirit of the GPDR. I decided to remove any use of cookies from all of my sites() a week ago. For my business (writer, and sometimes consultant) that makes sense for me but I understand that most businesses need some access to customer data so they have a motivation to properly handle personal data. () except my blog is on blogger - still trying to deal with that - I will probably go back to using Jekyll.

kccqzy 8y ago

> Have a look at the first few paras of this: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX.. http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX.... after it says "Whereas". Does the language look a little familiar? Do the sentiments look strangely familiar in some way? The thing after "Whereas" is just a preamble stating the intentions, not the actual legal text. In this case, I scrolled down no fewer than 31 pages, thinking to myself "The whereas section can't be that long" until I finally found the real start of the legal text "HAVE ADOPTED THIS REGULATION" on page 32 of 88.

chunkyslink 8y ago

Thank you for a sensible and balanced opinion. The Americans seem to be shitting themselves over this, when it is meant to help us all work toward better privacy - not shoot people or put them in prison. That is what years of living in a police state has done to them - turned them into wall building nervous wrecks ! There are no GDPR police looking to shut you down. Calm down.

deleted 8y ago

[deleted]

herbst 8y ago

The thing for me is that it requires me to log additional data. Now I need to know where my users are from, how old they are, and how often and how they access their account. All data I happily ignored so far to increase privacy.

rypskar 8y ago
>Now I need to know where my users are from Why do you need to know that? Why don't treat all users with respect?
- herbst 8y ago
  What respect? Saving additional metadata? I totally get your point. But my product already focuses on privacy. Saving any kind of metadata/communication data is more than I do now.

deleted 8y ago

[deleted]

emilfihlman 8y ago

>It is about protecting basic, fundamental rights that say 30 years ago we never knew needed to exist. No. GDPR is an overreaching and idiotic law, where standard IP logs are illegal.

jeremyt 8y ago

You’re missing the point completely. I’m really glad to hear that I’m not being targeted. However, I don’t much care about what the intent is, I care about what the effect is. And what I see is a law that is vague and enforcement agents are given broad discretion. What this looks like is that each case become “facts and circumstances” case, which is an absolute nightmare from a compliance standpoint. And the additional paperwork and personnel requirements appear to be non-trivial and will add a significant amount to the minimum necessary capital and labor needed to start a startup . The inevitable and undisputable result is that at least some startups on the margin which could’ve made it before the law was passed will not make it after the law was passed. Supporters would argue this is a good thing, but I would argue it is not.