15 ms·

It's reassuring to hear that the GDPR is not meant to target little startups and projects but I would like it a lot better if it said that in the actual law, ra

• gerdesj 8y ago
  "but I would like it a lot better if it said that in the actual law" Have you read the bloody law! http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... This is legislation designed to protect not only me (as an individual) but you as well (as a probable foreigner) from me!
  • eli 8y ago
    Yes, indeed I have. But if there's something I've missed, I'd surely appreciate a quote or specific reference.
  • fanzhang 8y ago
    Reading the law, I only see a single exception for small companies: Article 30.1 and 30.2 doesn't apply for companies less than 250 employees. Out of an 88 page law, 1% of an auxiliary middle of the law is carved out for small companies. I'm not sure that counts as differential application for small companies. In the US at least, large portions of entire key burdensome laws don't apply for employers below size 50, 10, 5, etc. This does not seem to be the case here. Does anyone know whether an official impact study on innovation was even done before its passage?
    • camillomiller 8y ago
      You can be a company of ten people and still turn over millions by selling your users’ data in shadowy ways. Why shouldn’t you be stopped just because you’re small. How can the size a company be used as a rational differentiator in a law like this?
      • deleted 8y ago
        [deleted]
      • Clubber 8y ago
        Because the vast, vast, vast majority of small companies aren't turning over millions of dollars. That's the same logic as, "some people cheat on welfare, so lets defund it." This logic gets pushed around a lot by GOP pundits. The law may be good as a whole but be overly burdensome for small companies. You should at least acknowledge that instead of just dismissing that outright.
    • phicoh 8y ago
      Similar laws have existed for many decades. In The Netherlands, privacy laws date back to the 1970s. At least my reading of the GDRP is that it tries very hard not be a big burden. If you are a small company or organisation and you collect a minimal amount of information (for example to contact them) there is not a lot you have to do. The main thing is, you are not allowed to be sloppy. If you collect personal data, you have to think about whether you should collect it at all, where to store it, process it, and when to delete it. And you have to tell people that before you ask them for personal data. Nothing like, we just collect a bunch of data, give copies to everybody, and have no idea what we collected. That attitude no longer works. If you set up food regulations, are you going to exempt restaurants with only one cook? Or have aviation regulations that do not apply to airlines with only one pilot? Given that the entire GDRP is less then a hundred pages, you can easily read it in one evening and get an idea of what you can do, have to do, and what the corner cases are that you may need to discuss with a lawyer.
      • tripzilch 8y ago
        > If you set up food regulations, are you going to exempt restaurants with only one cook? But restaurants with only one cook can't afford a $300/h lawyer to tell them how to keep their shit hygienic!
        • angus-prune 8y ago
          And in the EU we have a different way of working. In the UK you can literally phone up the ICO and get free advice, specific advice on how to stay compliant. If it turns out that you are in breach, they will write to you with information about what you're doign wrong and how to fix it. In the EU we don't rely on lawyers for a fraction of the stuff you do in the US.
    • tripzilch 8y ago
      > Does anyone know whether an official impact study on innovation was even done before its passage? So if it's "innovative" a small 5-person startup should be able to wreak havoc to my personal data in whatever way they see fit? What is that nonsense. Are you seriously suggesting that "innovation" in startups should be more important than my privacy?
      • arthurofbabylon 8y ago
        Are you seriously proposing that regulations move forward without an understanding of their impacts? No matter what the ultimate decision is, no matter how sensitive the subject matter, impact studies are critical to making smart decisions.
        • Marysville 8y ago
          If a regulation is going to impact "innovative" startups that sell my data, I am totally for it. I don't want more innovative ways to sell my personal information.
          • arthurofbabylon 8y ago
            So without curiosity or concern for any other impact you say yes... I might say yes but I still want an impact study. I prefer governing bodies operate with an awareness of how their actions affect society.
            • Marysville 8y ago
              I don't think we're going to lose as many "well intentioned" websites as much as we'll get rid of bad intentioned businesses.
              • arthurofbabylon 8y ago
                You’re missing the point. One last time: it is ideal to operate with an awareness of consequences.
  • Matticus_Rex 8y ago
    In the history of laws, many of the ones designed with good intentions have been quite harmful. And yes, I've read the law. It's typical of legislation in that it obviously wasn't written by people who knew what it looked like to perform that in a real life business.
    • usr1106 8y ago
      > And yes, I've read the law. Have you read recital 1? https://gdpr-info.eu/recitals/no-1/ https://gdpr-info.eu/recitals/no-1/ ? The starting point of the law is that data protoection is a fundamental human right,. The data subject owns their PII, not some company collecting it. It's all up whether you are willing to accept that as a fundamental right or not. I mean there is a billion of Chinese that live with the fact that free speech is not a fundamental human right. Most Westerners have a problem with that. Now many US based IT professionals seems to have problems with accepting that nobody else can own the data about a human. > It's typical of legislation in that it obviously wasn't written by people who knew what it looked like to perform that in a real life business. That's what a cotton farmer could have said when they made slavery illegal. Obviously respecting other's human rights makes some business models illegal.
      • manigandham 8y ago
        We're going in circles. Let me repeat: nobody has a problem with increased data protection and privacy. We're all better off for it. But the laws regarding it are not clear for an actual operating business. Instead of being simple and straightforward to implement, they are an ambiguous mess that are wasteful and misplaced. Laws designed that way almost never actually accomplish what they set out to do.
        • usr1106 8y ago
          > Instead of being simple and straightforward to implement, I am not sure I can fully follow you here. If implementers accepted that they only collect what is absolutely necessary and they delete what the they are not legally requited to keep things would be much easier. Problems start when the business model is that customers'/users' data is our product/an asset and we somehow try the find the minimum possible implementation that just meets the requirements of the law while still using all loopholes it might possibly leave. I agree that the law is not very clear for how you should code it. Nor very detailed what you can do with a certain piece of data. So it depends on your approach: If you take a conservative approach that if in doubt, we don't keep the data it suddenly gets much clearer. If you start fiddling maybe I could still do it if we did it like this and that you end up in endless work. And of course if you have an existing system that never had the requirement of deleting anything there is a lot of work. But the law has been in force for 2 years, so businesses that wake up now when the transition period has ended it can be a mess. >Laws designed that way almost never actually accomplish what they set out to do. How would you have written the law? Do you have counter-examples of laws being written so clearly that you could recommend them? The key point really is: Many business models and practices on the internet are incompatible with the spirit of GDPR. It's a fundamental right that the users own their data and businesses are not allowed to do with it whatever they want. Lawmakers did not want it write it that so clearly, because lobbyists would not have accepted it. And business owners still don't want to accept any suich fundamental right. So complaining about the law being too complicated is somewhat canting.
  • Myrmornis 8y ago
    Please point to the specific section you’re referring to.
• raverbashing 8y ago
  > If it's only meant to be used against big companies or extreme offenders, why doesn't it say so? Because, and this has been repeated millions of times on HN, Europe and the US follow different systems in writing laws
  • 23443463455 8y ago
    Trust the benevolent dictates of the undemocratic EU, right?
  • emilfihlman 8y ago
    Perhaps we should then take some lessons from how they in USA write laws.
    • Ar-Curunir 8y ago
      Lol hell no, the US is horrible at writing laws that are good for the common person. I'd rather trust the the EU with its clumsy but well-intentioned laws over the USA's malicious, designed-by-companies laws
      • TomMarius 8y ago
        In the Czech Republic, small companies and self employed people are commonly fined for breaking extremely complex and unclear laws, some of them set by the EU (e.g. VAT) - without any malicious intent, ready to pay whatever should've been paid. It's the big companies that get to make deals with the government and avoid punishment. They also consistently favour big companies over small ones with tax breaks, dotations etc. I don't trust the EU in the slightest.
        • Clubber 8y ago
          Most regulation seems to fall into that category in the US too. Big companies have the money to combat it and still make a windfall of profits, while the small guy trying to build a company gets crushed because some regulatory prosecutor is trying to make a name for himself. Tax law is probably the most common example of this.
• beojan 8y ago
  Because if your business model is based on selling user data, it doesn't matter if you're a small startup, it absolutely is meant to target you. If you aren't competent at responsibly handling personal data and you want to build a project or startup, pick one that doesn't handle personal data, or put in the effort to learn how to do things properly.
  • hennsen 8y ago
    How does for example a small yoga studio’s email list fit in your examples? Or even just it’s website? Without cookies and login even - the IP adress in the log files alone is considered potential personal data that basically puts people in the need of consulting a lawyer about how to safely deal with that. And makes you a potential target to being sued and getting a lot of hassle. Even found nit guilty in the end, no one will pay days of time and energy needed for defense. And then: What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost? You either have no option to reset passwords, or must do it by phone, which is extremely expensive.
    • beojan 8y ago
      > the IP adress in the log files alone is considered potential personal data Stop logging the IP address then. Hopefully default settings in web servers will change. > What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost? That means you have a legitimate interest, so long as you don't send marketing emails to those addresses, or sell them, and so long as you delete them if someone deletes their account. > How does for example a small yoga studio’s email list fit in your examples? If someone signs up to your email list, they've consented to receiving emails. Just don't sell the list, and remove people if they unsubscribe. The only real complication (if you're in the UK, I don't know about other countries) is that there is a fee to register as a data controller. https://ico.org.uk/for-organisations/data-protection-fee/ https://ico.org.uk/for-organisations/data-protection-fee/
      • hennsen 8y ago
• jrnichols 8y ago
  I'm sure a whole cottage industry around GDPR compliance will be up and running by the 26th. :| We're a small agency and all of the legal worries around the GDPR have essentially put one of our revenue streams on hold until we sort out the legalities. Like the comment above, we simply do not have $300/hr available for lawyers to go over everything.
• Mirioron 8y ago
  He's talking a nice talk, but history has shown us that when EU makes regulations/laws then they just don't care about the consequences or the collateral. As evidence I would bring the completely useless cookie law and the completely botched "digital VAT" change. In the latter it just confounds me that the legislators set up a situation, where a small business in the UK is better off not selling a digital good (that you can make infinite copies of) to a buyer in Malta, because the bureaucracy would cost more than the sale would pay. You can't have a "single market" like that.