5 ms·

Either... 1. Be upfront about what user-data you collect and how you use it. 2. Or try to find ways to not seem like a scummy, unprofessional or unreliable bu

Either... 1. Be upfront about what user-data you collect and how you use it. 2. Or try to find ways to not seem like a scummy, unprofessional or unreliable business partner while randomly blocking customers from your site, because you cant account for their data. You’d think the choice be pretty fucking obvious, no?

RobertRoberts 8y ago
I can't afford the legal costs to prove my innocence against a foreign government anymore than I could afford a $20 million fine. (there's no limit to how many times they can attempt to fine you, even if you are innocent every time)
- mstolpm 8y ago
  You only have to prove "innocence" if your users doubt your statements about PII handling, are so annoyed about your doing that they inform the supervisory authority and that authority has sufficient doubt that they open an investigation. It must be a tricky/dirty/spammy business you're in if you really fear that your users will call the authorities in droves about your procedures. Even for user requests the law states that the user must show that he has a valid reason to act, repeated requests just for the fun of it don't need to be honored and the user can charged for thus a behaviour. And to be honest: Blocking access casts more doubt than being open and ask for consent.
  - RobertRoberts 8y ago
    You are utterly and completely wrong. All it takes is court papers and a lawsuit for _any_ reason at all, and you are done. You seem to be claiming the GDPR dictates who is allowed to sue and what evidence they must provide, and it simply does not. Go look it up, it's a "guilty until proven innocent" system, which guarantees loss to the accused, guilty or not.
    - hadrien01 8y ago
      You obviously don't know how the EU works. If a Data Protection Agency comes to know your wrongdoings, they'll first try to resolve peacefully the matter, by telling you what you're doing wrong. Only if you persist multiple times you'll be in danger of being brought to court.
      - dogma1138 8y ago
        That’s not true at least in the UK and Germany fines are issued essentially on the stop for every violation even questionable ones.
        detaro 8y ago
        Source? From what I know, the German DPAs (they are organized on state level) hand out like 2 fines per month each, generally way below the maxima (under old German law, the max was 300000 €), and concluding the majority of cases without a fine. E.g. from the Bavarian DPA (german doc: https://www.lda.bayern.de/media/baylda_report_07.pdf https://www.lda.bayern.de/media/baylda_report_07.pdf, page 151): in the years 2015-2016 they had 173 proceedings that could involved potential fines. 52 of those resulted in fines. 34 of those fines were <1k€, 13 were <10k€.
      - RobertRoberts 8y ago
        You are so wrong, Google and Facebook are already being sued, the FIRST day the law has been in effect.
        y4mi 8y ago
        No, they aren't. There have been user complaints about them. These complaints can ultimately result in a investigation and finally a court case. That is still far off, however
        RobertRoberts 8y ago
        Yes, they are. http://money.cnn.com/2018/05/25/technology/gdpr-compliance-facebook-google/index.html http://money.cnn.com/2018/05/25/technology/gdpr-compliance-f... >"The suit against Google alleges that users of the company's Android software are forced to turn over personal data to use an Android-powered mobile device. The lawsuit alleges this "forced consent" amounts to a violation of GDPR, which guarantees individuals the right to consent when companies want to collect and process their personal data."
labster 8y ago
Neither of those points address the issues I raised, which is risk of fines. "Just comply" isn't an amazing option when I can't even comprehend the applicable law from every supervisory authority in the Union. Right now, GDPR is like a bet, where if you win you make a small amount of money, and if you lose you lose €20 million, and no one knows what the odds are. In a year's time, you will probably see people drift back into the European market, as we'll have a better idea what the enforcement regime will actually look like.
- josteink 8y ago
  The EU seeks compliance, not lawsuits. As a small actor, chances of getting fined in an initial grace-period where things are sorted out is literally zero.
- mstolpm 8y ago
  So, how many cases do you know where fines are collected from small non-EU businesses? None? Okay. Why do you insist in a sum of €20 million, even if the law states that the fines (if applicable) should be reasonable and take into consideration if the non-compliance was intentional, repeated and massive? But it _is_ intentional if you block EU users you had in the past, continue to store/process/sell their collected PII without their consent and deny them a way to get information about the scope of your doing or a way to request deletion.
  - labster 8y ago
    As an American, it's hard to imagine a regulatory agency going after anyone when they're not seeking a fine. They have to pay for their staff somehow.

RobertRoberts 8y ago

I can't afford the legal costs to prove my innocence against a foreign government anymore than I could afford a $20 million fine. (there's no limit to how many times they can attempt to fine you, even if you are innocent every time)

mstolpm 8y ago
You only have to prove "innocence" if your users doubt your statements about PII handling, are so annoyed about your doing that they inform the supervisory authority and that authority has sufficient doubt that they open an investigation. It must be a tricky/dirty/spammy business you're in if you really fear that your users will call the authorities in droves about your procedures. Even for user requests the law states that the user must show that he has a valid reason to act, repeated requests just for the fun of it don't need to be honored and the user can charged for thus a behaviour. And to be honest: Blocking access casts more doubt than being open and ask for consent.
- RobertRoberts 8y ago
  You are utterly and completely wrong. All it takes is court papers and a lawsuit for _any_ reason at all, and you are done. You seem to be claiming the GDPR dictates who is allowed to sue and what evidence they must provide, and it simply does not. Go look it up, it's a "guilty until proven innocent" system, which guarantees loss to the accused, guilty or not.
  - hadrien01 8y ago
    You obviously don't know how the EU works. If a Data Protection Agency comes to know your wrongdoings, they'll first try to resolve peacefully the matter, by telling you what you're doing wrong. Only if you persist multiple times you'll be in danger of being brought to court.
    - dogma1138 8y ago
      That’s not true at least in the UK and Germany fines are issued essentially on the stop for every violation even questionable ones.
      - detaro 8y ago
        Source? From what I know, the German DPAs (they are organized on state level) hand out like 2 fines per month each, generally way below the maxima (under old German law, the max was 300000 €), and concluding the majority of cases without a fine. E.g. from the Bavarian DPA (german doc: https://www.lda.bayern.de/media/baylda_report_07.pdf https://www.lda.bayern.de/media/baylda_report_07.pdf, page 151): in the years 2015-2016 they had 173 proceedings that could involved potential fines. 52 of those resulted in fines. 34 of those fines were <1k€, 13 were <10k€.
    - RobertRoberts 8y ago
      You are so wrong, Google and Facebook are already being sued, the FIRST day the law has been in effect.
      - y4mi 8y ago
        No, they aren't. There have been user complaints about them. These complaints can ultimately result in a investigation and finally a court case. That is still far off, however
        RobertRoberts 8y ago
        Yes, they are. http://money.cnn.com/2018/05/25/technology/gdpr-compliance-facebook-google/index.html http://money.cnn.com/2018/05/25/technology/gdpr-compliance-f... >"The suit against Google alleges that users of the company's Android software are forced to turn over personal data to use an Android-powered mobile device. The lawsuit alleges this "forced consent" amounts to a violation of GDPR, which guarantees individuals the right to consent when companies want to collect and process their personal data."

labster 8y ago

Neither of those points address the issues I raised, which is risk of fines. "Just comply" isn't an amazing option when I can't even comprehend the applicable law from every supervisory authority in the Union. Right now, GDPR is like a bet, where if you win you make a small amount of money, and if you lose you lose €20 million, and no one knows what the odds are. In a year's time, you will probably see people drift back into the European market, as we'll have a better idea what the enforcement regime will actually look like.

josteink 8y ago
The EU seeks compliance, not lawsuits. As a small actor, chances of getting fined in an initial grace-period where things are sorted out is literally zero.
mstolpm 8y ago
So, how many cases do you know where fines are collected from small non-EU businesses? None? Okay. Why do you insist in a sum of €20 million, even if the law states that the fines (if applicable) should be reasonable and take into consideration if the non-compliance was intentional, repeated and massive? But it _is_ intentional if you block EU users you had in the past, continue to store/process/sell their collected PII without their consent and deny them a way to get information about the scope of your doing or a way to request deletion.
- labster 8y ago
  As an American, it's hard to imagine a regulatory agency going after anyone when they're not seeking a fine. They have to pay for their staff somehow.