5 ms·

If someone's business is no longer profitable after complying with GDPR, this is a reasonable step to make. I know that to many that means you have a bad/scummy

by sidibe 8y ago

If someone's business is no longer profitable after complying with GDPR, this is a reasonable step to make. I know that to many that means you have a bad/scummy business model, but in any case if you are in this category it definitely makes sense to block EU visitors. I think there are probably a lot of sites in this category as targeted ads are ubiquitous and the source of income of lots of sites. We may see some that are complying now give up if enough people start opting out.

labster 8y ago
It's more the level of risk. I help run a small nonprofit that uses no advertising and sells no data. If we fail to comply with the GDPR, we're subject to a €20M fine. If it was 4% of global revenue I'd just pay the $80, but no, it's the greater amount. It's a reasonable choice for someone not doing anything scummy to avoid the chance of an impossible debt.
- josteink 8y ago
  Either... 1. Be upfront about what user-data you collect and how you use it. 2. Or try to find ways to not seem like a scummy, unprofessional or unreliable business partner while randomly blocking customers from your site, because you cant account for their data. You’d think the choice be pretty fucking obvious, no?
  - RobertRoberts 8y ago
    I can't afford the legal costs to prove my innocence against a foreign government anymore than I could afford a $20 million fine. (there's no limit to how many times they can attempt to fine you, even if you are innocent every time)
    - mstolpm 8y ago
      You only have to prove "innocence" if your users doubt your statements about PII handling, are so annoyed about your doing that they inform the supervisory authority and that authority has sufficient doubt that they open an investigation. It must be a tricky/dirty/spammy business you're in if you really fear that your users will call the authorities in droves about your procedures. Even for user requests the law states that the user must show that he has a valid reason to act, repeated requests just for the fun of it don't need to be honored and the user can charged for thus a behaviour. And to be honest: Blocking access casts more doubt than being open and ask for consent.
      - RobertRoberts 8y ago
        You are utterly and completely wrong. All it takes is court papers and a lawsuit for _any_ reason at all, and you are done. You seem to be claiming the GDPR dictates who is allowed to sue and what evidence they must provide, and it simply does not. Go look it up, it's a "guilty until proven innocent" system, which guarantees loss to the accused, guilty or not.
        hadrien01 8y ago
        You obviously don't know how the EU works. If a Data Protection Agency comes to know your wrongdoings, they'll first try to resolve peacefully the matter, by telling you what you're doing wrong. Only if you persist multiple times you'll be in danger of being brought to court.
        dogma1138 8y ago
        That’s not true at least in the UK and Germany fines are issued essentially on the stop for every violation even questionable ones.
        detaro 8y ago
        Source? From what I know, the German DPAs (they are organized on state level) hand out like 2 fines per month each, generally way below the maxima (under old German law, the max was 300000 €), and concluding the majority of cases without a fine. E.g. from the Bavarian DPA (german doc: https://www.lda.bayern.de/media/baylda_report_07.pdf https://www.lda.bayern.de/media/baylda_report_07.pdf, page 151): in the years 2015-2016 they had 173 proceedings that could involved potential fines. 52 of those resulted in fines. 34 of those fines were <1k€, 13 were <10k€.
        RobertRoberts 8y ago
        You are so wrong, Google and Facebook are already being sued, the FIRST day the law has been in effect.
  - labster 8y ago
    Neither of those points address the issues I raised, which is risk of fines. "Just comply" isn't an amazing option when I can't even comprehend the applicable law from every supervisory authority in the Union. Right now, GDPR is like a bet, where if you win you make a small amount of money, and if you lose you lose €20 million, and no one knows what the odds are. In a year's time, you will probably see people drift back into the European market, as we'll have a better idea what the enforcement regime will actually look like.
    - josteink 8y ago
      The EU seeks compliance, not lawsuits. As a small actor, chances of getting fined in an initial grace-period where things are sorted out is literally zero.
    - mstolpm 8y ago
      So, how many cases do you know where fines are collected from small non-EU businesses? None? Okay. Why do you insist in a sum of €20 million, even if the law states that the fines (if applicable) should be reasonable and take into consideration if the non-compliance was intentional, repeated and massive? But it _is_ intentional if you block EU users you had in the past, continue to store/process/sell their collected PII without their consent and deny them a way to get information about the scope of your doing or a way to request deletion.
      - labster 8y ago
        As an American, it's hard to imagine a regulatory agency going after anyone when they're not seeking a fine. They have to pay for their staff somehow.
deleted 8y ago
[deleted]

by sidibe 8y ago

labster 8y ago

It's more the level of risk. I help run a small nonprofit that uses no advertising and sells no data. If we fail to comply with the GDPR, we're subject to a €20M fine. If it was 4% of global revenue I'd just pay the $80, but no, it's the greater amount. It's a reasonable choice for someone not doing anything scummy to avoid the chance of an impossible debt.

josteink 8y ago
Either... 1. Be upfront about what user-data you collect and how you use it. 2. Or try to find ways to not seem like a scummy, unprofessional or unreliable business partner while randomly blocking customers from your site, because you cant account for their data. You’d think the choice be pretty fucking obvious, no?
- RobertRoberts 8y ago
  I can't afford the legal costs to prove my innocence against a foreign government anymore than I could afford a $20 million fine. (there's no limit to how many times they can attempt to fine you, even if you are innocent every time)
  - mstolpm 8y ago
    You only have to prove "innocence" if your users doubt your statements about PII handling, are so annoyed about your doing that they inform the supervisory authority and that authority has sufficient doubt that they open an investigation. It must be a tricky/dirty/spammy business you're in if you really fear that your users will call the authorities in droves about your procedures. Even for user requests the law states that the user must show that he has a valid reason to act, repeated requests just for the fun of it don't need to be honored and the user can charged for thus a behaviour. And to be honest: Blocking access casts more doubt than being open and ask for consent.
    - RobertRoberts 8y ago
      You are utterly and completely wrong. All it takes is court papers and a lawsuit for _any_ reason at all, and you are done. You seem to be claiming the GDPR dictates who is allowed to sue and what evidence they must provide, and it simply does not. Go look it up, it's a "guilty until proven innocent" system, which guarantees loss to the accused, guilty or not.
      - hadrien01 8y ago
        You obviously don't know how the EU works. If a Data Protection Agency comes to know your wrongdoings, they'll first try to resolve peacefully the matter, by telling you what you're doing wrong. Only if you persist multiple times you'll be in danger of being brought to court.
        dogma1138 8y ago
        That’s not true at least in the UK and Germany fines are issued essentially on the stop for every violation even questionable ones.
        detaro 8y ago
        Source? From what I know, the German DPAs (they are organized on state level) hand out like 2 fines per month each, generally way below the maxima (under old German law, the max was 300000 €), and concluding the majority of cases without a fine. E.g. from the Bavarian DPA (german doc: https://www.lda.bayern.de/media/baylda_report_07.pdf https://www.lda.bayern.de/media/baylda_report_07.pdf, page 151): in the years 2015-2016 they had 173 proceedings that could involved potential fines. 52 of those resulted in fines. 34 of those fines were <1k€, 13 were <10k€.
        RobertRoberts 8y ago
        You are so wrong, Google and Facebook are already being sued, the FIRST day the law has been in effect.
- labster 8y ago
  Neither of those points address the issues I raised, which is risk of fines. "Just comply" isn't an amazing option when I can't even comprehend the applicable law from every supervisory authority in the Union. Right now, GDPR is like a bet, where if you win you make a small amount of money, and if you lose you lose €20 million, and no one knows what the odds are. In a year's time, you will probably see people drift back into the European market, as we'll have a better idea what the enforcement regime will actually look like.
  - josteink 8y ago
    The EU seeks compliance, not lawsuits. As a small actor, chances of getting fined in an initial grace-period where things are sorted out is literally zero.
  - mstolpm 8y ago
    So, how many cases do you know where fines are collected from small non-EU businesses? None? Okay. Why do you insist in a sum of €20 million, even if the law states that the fines (if applicable) should be reasonable and take into consideration if the non-compliance was intentional, repeated and massive? But it _is_ intentional if you block EU users you had in the past, continue to store/process/sell their collected PII without their consent and deny them a way to get information about the scope of your doing or a way to request deletion.
    - labster 8y ago
      As an American, it's hard to imagine a regulatory agency going after anyone when they're not seeking a fine. They have to pay for their staff somehow.

deleted 8y ago

[deleted]