6 ms·

Reading the law, I only see a single exception for small companies: Article 30.1 and 30.2 doesn't apply for companies less than 250 employees. Out of an 88 pag

Reading the law, I only see a single exception for small companies: Article 30.1 and 30.2 doesn't apply for companies less than 250 employees. Out of an 88 page law, 1% of an auxiliary middle of the law is carved out for small companies. I'm not sure that counts as differential application for small companies. In the US at least, large portions of entire key burdensome laws don't apply for employers below size 50, 10, 5, etc. This does not seem to be the case here. Does anyone know whether an official impact study on innovation was even done before its passage?

camillomiller 8y ago
You can be a company of ten people and still turn over millions by selling your users’ data in shadowy ways. Why shouldn’t you be stopped just because you’re small. How can the size a company be used as a rational differentiator in a law like this?
- deleted 8y ago
  [deleted]
- Clubber 8y ago
  Because the vast, vast, vast majority of small companies aren't turning over millions of dollars. That's the same logic as, "some people cheat on welfare, so lets defund it." This logic gets pushed around a lot by GOP pundits. The law may be good as a whole but be overly burdensome for small companies. You should at least acknowledge that instead of just dismissing that outright.
phicoh 8y ago
Similar laws have existed for many decades. In The Netherlands, privacy laws date back to the 1970s. At least my reading of the GDRP is that it tries very hard not be a big burden. If you are a small company or organisation and you collect a minimal amount of information (for example to contact them) there is not a lot you have to do. The main thing is, you are not allowed to be sloppy. If you collect personal data, you have to think about whether you should collect it at all, where to store it, process it, and when to delete it. And you have to tell people that before you ask them for personal data. Nothing like, we just collect a bunch of data, give copies to everybody, and have no idea what we collected. That attitude no longer works. If you set up food regulations, are you going to exempt restaurants with only one cook? Or have aviation regulations that do not apply to airlines with only one pilot? Given that the entire GDRP is less then a hundred pages, you can easily read it in one evening and get an idea of what you can do, have to do, and what the corner cases are that you may need to discuss with a lawyer.
- tripzilch 8y ago
  > If you set up food regulations, are you going to exempt restaurants with only one cook? But restaurants with only one cook can't afford a $300/h lawyer to tell them how to keep their shit hygienic!
  - angus-prune 8y ago
    And in the EU we have a different way of working. In the UK you can literally phone up the ICO and get free advice, specific advice on how to stay compliant. If it turns out that you are in breach, they will write to you with information about what you're doign wrong and how to fix it. In the EU we don't rely on lawyers for a fraction of the stuff you do in the US.
tripzilch 8y ago
> Does anyone know whether an official impact study on innovation was even done before its passage? So if it's "innovative" a small 5-person startup should be able to wreak havoc to my personal data in whatever way they see fit? What is that nonsense. Are you seriously suggesting that "innovation" in startups should be more important than my privacy?
- arthurofbabylon 8y ago
  Are you seriously proposing that regulations move forward without an understanding of their impacts? No matter what the ultimate decision is, no matter how sensitive the subject matter, impact studies are critical to making smart decisions.
  - Marysville 8y ago
    If a regulation is going to impact "innovative" startups that sell my data, I am totally for it. I don't want more innovative ways to sell my personal information.
    - arthurofbabylon 8y ago
      So without curiosity or concern for any other impact you say yes... I might say yes but I still want an impact study. I prefer governing bodies operate with an awareness of how their actions affect society.
      - Marysville 8y ago
        I don't think we're going to lose as many "well intentioned" websites as much as we'll get rid of bad intentioned businesses.
        arthurofbabylon 8y ago
        You’re missing the point. One last time: it is ideal to operate with an awareness of consequences.

camillomiller 8y ago

You can be a company of ten people and still turn over millions by selling your users’ data in shadowy ways. Why shouldn’t you be stopped just because you’re small. How can the size a company be used as a rational differentiator in a law like this?

deleted 8y ago
[deleted]
Clubber 8y ago
Because the vast, vast, vast majority of small companies aren't turning over millions of dollars. That's the same logic as, "some people cheat on welfare, so lets defund it." This logic gets pushed around a lot by GOP pundits. The law may be good as a whole but be overly burdensome for small companies. You should at least acknowledge that instead of just dismissing that outright.

phicoh 8y ago

Similar laws have existed for many decades. In The Netherlands, privacy laws date back to the 1970s. At least my reading of the GDRP is that it tries very hard not be a big burden. If you are a small company or organisation and you collect a minimal amount of information (for example to contact them) there is not a lot you have to do. The main thing is, you are not allowed to be sloppy. If you collect personal data, you have to think about whether you should collect it at all, where to store it, process it, and when to delete it. And you have to tell people that before you ask them for personal data. Nothing like, we just collect a bunch of data, give copies to everybody, and have no idea what we collected. That attitude no longer works. If you set up food regulations, are you going to exempt restaurants with only one cook? Or have aviation regulations that do not apply to airlines with only one pilot? Given that the entire GDRP is less then a hundred pages, you can easily read it in one evening and get an idea of what you can do, have to do, and what the corner cases are that you may need to discuss with a lawyer.

tripzilch 8y ago
> If you set up food regulations, are you going to exempt restaurants with only one cook? But restaurants with only one cook can't afford a $300/h lawyer to tell them how to keep their shit hygienic!
- angus-prune 8y ago
  And in the EU we have a different way of working. In the UK you can literally phone up the ICO and get free advice, specific advice on how to stay compliant. If it turns out that you are in breach, they will write to you with information about what you're doign wrong and how to fix it. In the EU we don't rely on lawyers for a fraction of the stuff you do in the US.

tripzilch 8y ago

> Does anyone know whether an official impact study on innovation was even done before its passage? So if it's "innovative" a small 5-person startup should be able to wreak havoc to my personal data in whatever way they see fit? What is that nonsense. Are you seriously suggesting that "innovation" in startups should be more important than my privacy?

arthurofbabylon 8y ago
Are you seriously proposing that regulations move forward without an understanding of their impacts? No matter what the ultimate decision is, no matter how sensitive the subject matter, impact studies are critical to making smart decisions.
- Marysville 8y ago
  If a regulation is going to impact "innovative" startups that sell my data, I am totally for it. I don't want more innovative ways to sell my personal information.
  - arthurofbabylon 8y ago
    So without curiosity or concern for any other impact you say yes... I might say yes but I still want an impact study. I prefer governing bodies operate with an awareness of how their actions affect society.
    - Marysville 8y ago
      I don't think we're going to lose as many "well intentioned" websites as much as we'll get rid of bad intentioned businesses.
      - arthurofbabylon 8y ago
        You’re missing the point. One last time: it is ideal to operate with an awareness of consequences.