3 ms·

Clearly you have a different definition of entrepreneurs/technical people than I do. Those seems like impositions on people who implement bad practice or work

Clearly you have a different definition of entrepreneurs/technical people than I do. Those seems like impositions on people who implement bad practice or work in fields that have morally questionable practices regarding people's data and identification. Many people I know don't engage or work in such industries because of the moral implications of doing so and what people are doing with data. Its not about "just ask your lawyers" or "just call HR". Its about "well don't do dodgy/disrespectful stuff with customer data". And if everyone is doing it or its regarded as "best practice" (as the old joke goes, best practice is just orwellian-speak for average), then that seems like MORE of an arguement why GDPR type activities and policies are required.

jeremyt 8y ago
Again, I was in my early 20s and fresh out of college. I had no idea what I was doing. It’s not that I was trying to cut ethical corners or do things poorly, I just didn’t know what the right way to do things was. Computer science education is often very theoretical and high level and not at all practical . I’ll be the first person to say that I was not the most experienced and or talented programmer in the world, but do we want to prevent such people from starting companies? And secondly, not all PII is the same. We stored names and addresses and phone numbers and websites. Not exactly medical histories or DNA profiles.
- ryanwaggoner 8y ago
  I think that to the hardcore GDPR fans that you're arguing with, this is like asking if we should let someone who is interested in structural engineering go build a skyscraper and figure it out as they go. Or someone who is interested in medicine start doing brain surgery on people. They don't really agree that all PII is not the same. To them, storing their IP address without permission is a horrific violation of their human rights. It strikes me personally as illogical and paranoid to the point of hysteria. However, that's just me, and at the end of the day, I think there's a cultural divide here as to what constitutes privacy, who owns what data, and what power we should trust the government with.
- gkya 8y ago
  > I’ll be the first person to say that I was not the most experienced and or talented programmer in the world, but do we want to prevent such people from starting companies? Yes. You should be fine as long as you're not collecting anybody's data or potentially harming them in any way, but apart from that, there should be established a bar to entry to what has become the fundamental motor of almost every single thing on the earth.
- ACow_Adonis 8y ago
  Perhaps this is a cultural difference, but I've collected names and addresses and phone numbers, and I worked under legislation where I can go to jail if i disclose the information i saw or had access to. Later, outside of that legislation, when I'm collecting it, I deal with the Australian Privacy Principles [0]. It doesn't bother me that much, because I take a "well if we don't need it, we shouldn't be collecting it, and if we are collecting it, we should do so minimally and protect it anyway." I believe under GDPR, if you need it, you can collect it. If you don't need it, why would you be/collecting or holding it? There are certainly legal problems/ambiguities around ip and data collection, and yes, its usually legislated by people who really don't understand tech or information theory or data linking, but frankly I haven't heard very many legitimate ones brought up in relation to GDPR. What I think someone naive and fresh out of college would do, for instance, when asked to delete data is...delete data. And if they think that "delete my data" means go through a database and put a '1' in a delete flag against a record that is still retained, then I think they're not so naive, they picked that up somewhere from someone acting nefariously who told them it was "best practice". And if they picked that up somewhere and it is industry "best practice", that's the kind of bullshit we should be weeding out of the tech industry. If the user can't view/delete their data, that's a dark pattern. Which again, see above: needs to be weeded out of tech. [0] https://www.oaic.gov.au/privacy-law/privacy-act/australian-privacy-principles https://www.oaic.gov.au/privacy-law/privacy-act/australian-p...
4ndrewl 8y ago
+1 to this. GDPR is just the personal data equivalent of the "don't be a dick" principle.
- ComputerGuru 8y ago
  Except it's now codified law, with real punishments based off the ambiguous "don't be a dick" directive. There are serious ambiguities here, and unfortunately no one knows how they'll be handled.
- curun1r 8y ago
  It's that, plus a whole lot of unreasonable demands. Just take the requirement to have an EU representative[0]...even a 1-person US startup that processes data now needs to hire someone in the EU and designate a qualified DPO, which they'll likely need to hire as well. That's way more than not being a dick, it's a huge jobs program that will cost companies millions. One estimate I saw indicated that they expected there would be a need for more than 30,000 DPOs in the EU (and it's that low because a single person can act as a DPO for more than one company). There's a lot in the GDPR that I like, but having just been through a massive compliance effort, there's a lot in there that overreaches and is just there to leech money out of the companies that make an effort to comply. [0] https://gdpr-info.eu/art-27-gdpr/ https://gdpr-info.eu/art-27-gdpr/
  - tdsamardzhiev 8y ago
    How would EU enforce laws on your business there, if you don't have any representation in the EU?
  - MockObject 8y ago
    Dumb question, but how is the EU going to come over here to the US and file charges against me?
    - curun1r 8y ago
      They won't, but they'll levy fines that will be in effect should you ever want to expand into Europe. And they might be able to prevent you from doing business with any company that has an EU presence. If you're making a profit off of EU citizens, there are ways to target that revenue. Look at the ways that the US targeted online poker sites. None of them are in the US and subject to US law. But lots of banks are, and US lawmakers made it illegal for those banks to transfer money into or out of the poker sites and that basically worked.

jeremyt 8y ago

Again, I was in my early 20s and fresh out of college. I had no idea what I was doing. It’s not that I was trying to cut ethical corners or do things poorly, I just didn’t know what the right way to do things was. Computer science education is often very theoretical and high level and not at all practical . I’ll be the first person to say that I was not the most experienced and or talented programmer in the world, but do we want to prevent such people from starting companies? And secondly, not all PII is the same. We stored names and addresses and phone numbers and websites. Not exactly medical histories or DNA profiles.

ryanwaggoner 8y ago
I think that to the hardcore GDPR fans that you're arguing with, this is like asking if we should let someone who is interested in structural engineering go build a skyscraper and figure it out as they go. Or someone who is interested in medicine start doing brain surgery on people. They don't really agree that all PII is not the same. To them, storing their IP address without permission is a horrific violation of their human rights. It strikes me personally as illogical and paranoid to the point of hysteria. However, that's just me, and at the end of the day, I think there's a cultural divide here as to what constitutes privacy, who owns what data, and what power we should trust the government with.
gkya 8y ago
> I’ll be the first person to say that I was not the most experienced and or talented programmer in the world, but do we want to prevent such people from starting companies? Yes. You should be fine as long as you're not collecting anybody's data or potentially harming them in any way, but apart from that, there should be established a bar to entry to what has become the fundamental motor of almost every single thing on the earth.
ACow_Adonis 8y ago
Perhaps this is a cultural difference, but I've collected names and addresses and phone numbers, and I worked under legislation where I can go to jail if i disclose the information i saw or had access to. Later, outside of that legislation, when I'm collecting it, I deal with the Australian Privacy Principles [0]. It doesn't bother me that much, because I take a "well if we don't need it, we shouldn't be collecting it, and if we are collecting it, we should do so minimally and protect it anyway." I believe under GDPR, if you need it, you can collect it. If you don't need it, why would you be/collecting or holding it? There are certainly legal problems/ambiguities around ip and data collection, and yes, its usually legislated by people who really don't understand tech or information theory or data linking, but frankly I haven't heard very many legitimate ones brought up in relation to GDPR. What I think someone naive and fresh out of college would do, for instance, when asked to delete data is...delete data. And if they think that "delete my data" means go through a database and put a '1' in a delete flag against a record that is still retained, then I think they're not so naive, they picked that up somewhere from someone acting nefariously who told them it was "best practice". And if they picked that up somewhere and it is industry "best practice", that's the kind of bullshit we should be weeding out of the tech industry. If the user can't view/delete their data, that's a dark pattern. Which again, see above: needs to be weeded out of tech. [0] https://www.oaic.gov.au/privacy-law/privacy-act/australian-privacy-principles https://www.oaic.gov.au/privacy-law/privacy-act/australian-p...

4ndrewl 8y ago

+1 to this. GDPR is just the personal data equivalent of the "don't be a dick" principle.

ComputerGuru 8y ago
Except it's now codified law, with real punishments based off the ambiguous "don't be a dick" directive. There are serious ambiguities here, and unfortunately no one knows how they'll be handled.
curun1r 8y ago
It's that, plus a whole lot of unreasonable demands. Just take the requirement to have an EU representative[0]...even a 1-person US startup that processes data now needs to hire someone in the EU and designate a qualified DPO, which they'll likely need to hire as well. That's way more than not being a dick, it's a huge jobs program that will cost companies millions. One estimate I saw indicated that they expected there would be a need for more than 30,000 DPOs in the EU (and it's that low because a single person can act as a DPO for more than one company). There's a lot in the GDPR that I like, but having just been through a massive compliance effort, there's a lot in there that overreaches and is just there to leech money out of the companies that make an effort to comply. [0] https://gdpr-info.eu/art-27-gdpr/ https://gdpr-info.eu/art-27-gdpr/
- tdsamardzhiev 8y ago
  How would EU enforce laws on your business there, if you don't have any representation in the EU?
- MockObject 8y ago
  Dumb question, but how is the EU going to come over here to the US and file charges against me?
  - curun1r 8y ago
    They won't, but they'll levy fines that will be in effect should you ever want to expand into Europe. And they might be able to prevent you from doing business with any company that has an EU presence. If you're making a profit off of EU citizens, there are ways to target that revenue. Look at the ways that the US targeted online poker sites. None of them are in the US and subject to US law. But lots of banks are, and US lawmakers made it illegal for those banks to transfer money into or out of the poker sites and that basically worked.