19 ms·

So Your Startup Received the Nightmare GDPR Letter

289 points by janvdberg 8y ago

cageface 8y ago
I think the GDPR is well intentioned and has provoked some important and useful conversations about how we make use of users’ data. But reading stuff like this makes me that much more inclined to use that Cloudflare option of IP blocking the whole continent. This feels like a very slippery and dangerous can of worms that’s not worth opening.
- annabellish 8y ago
  There's already a tonne of laws every company has to comply with. The GDPR isn't any more onerous than any of those, it's just new. Even the "nightmare letter" doesn't have anything unreasonable in it and the only reason why it might be difficult for a company to comply with would be that their internal systems and processes were already horrifying - something which we have now collectively deemed that permitting is causing more harm than good.
  - cageface 8y ago
    What other laws do I have to comply with right now that are so vaguely defined and carry such horrifyingly punitive fees? I guess we'll have to wait and see how it's actually enforced but no other legal obligations I've had to consider so far when building products feel this threatening to smaller online businesses. It's bad enough we have to deal with patent trolls. I'm not inclined to add this to my risk profile.
    - fwdpropaganda 8y ago
      > What other laws (...) You can't sell guns and drugs online. If you're taking money, you have to make sure you know your customer (KYC). I would also like to hear other examples.
      - cageface 8y ago
        I feel like I have a pretty clear idea of the rules in the cases you describe. For GDPR I have no such confidence. It seems like the smart thing for US startups to do right now is ignore EU customers until they’ve validated the business idea enough to justify the engineering and legal expenses of taking this on.
        fwdpropaganda 8y ago
        > I feel like I have a pretty clear idea of the rules in the cases you describe. For GDPR I have no such confidence. I seems reasonable, but I would argue it's due to the law being new, not to some intrinsic property of it, no?
        empath75 8y ago
        The alternative is to not collect personal information from your customers.
        JumpCrisscross 8y ago
        > The alternative is to not collect personal information from your customers If that worked I'd embrace GDPR. Problem with "any consumer can make a complaint which requires expensive follow-up" regimes is one doesn't have to do anything wrong to incur costs. Someone can mis-interpret something and make a complaint. Now you have to interface with a regulator, which tends to be risky, expensive and time consuming.
        aninhumer 8y ago
        If you're not collecting any information "interfacing with the regulator" means replying to their email by saying "we're not collecting any information". (Assuming they even got that far, given that they'd likely take a look at your website and notice you aren't collecting any information.) I'm not sure what's risky, expensive or time consuming about that.
        8y ago
    - Fradow 8y ago
      Other laws you had to comply with where the ones the GDPR is replacing. Several EU country had very similar law. Idon't know about the fines about such laws though, since they were not enforced. Enforcement is what's going to matter, I'm pretty sure you could dig up other laws that are vague and have high fines, that are just not enforced and thus don't seem as threatening as the widely publicized GDPR. Of course, I'm not a lawyer, and I may very well be wrong on my assumptions. On the other hand, patent trolls are not part of the risk profile for our industry in the EU, since software is not patentable there. But anyway, it makes perfect business sense for a US startup to just block the EU (or at least state somewhere that they are not complying and thus EU users shouldn't sign up) and focus on their home market until they are big enough to comply with the terms (or are willing to take the risk).
    - tremon 8y ago
      The DMCA?
      - Mirioron 8y ago
        If you don't use copyrighted works then DMCA is going to be a much easier problem to deal with. We have plenty of precedents to look at to assess how the DMCA works as well.
        salvar 8y ago
        > We have plenty of precedents Did these precedents take place before or after the DMCA was enacted?
  - JumpCrisscross 8y ago
    > The GDPR isn't any more onerous than any of those, it's just new It’s different. “Complain and investigate” regulatory regimes are expensive to comply with. That is irrespective of whether one is doing anything wrong. These regimes aren’t inherently faulty. They’re quite good in the American securities business. But they create a palpable incumbency bias, as well as one towards those who can afford lawyers and make a useful phone call. Such a regime would have been ideal if constrained to large companies. Rolling it out for everyone means anyone mis-interpreting something could trigger a regulatory investigation. Even if found innocent at the end, that process is harrowing, expensive and distracting. Every jurisdiction has its costs and benefits. Europe is still a huge market. But if one doesn’t see enough revenues to justify a dedicated compliance person, it’s a market which may now make sense to delay going into.
    - heyoni 8y ago
      How about we just try it? Are you from the EU? File a complaint against my website and I’ll ignore it.
  - 3pt14159 8y ago
    The problem is that there is a lower floor of a $20m fine. Big corps can risk a 4% hit, but for anyone struggling to get a small startup off the ground the fine is too onerous. As far as I'm concerned the process should be like this: 1. EU issues warning and cuts off traffic to the domain after 30 days. 2. Startup fixes GDPR compliance. 3. EU unblocks startup. Only after the company breaks GDPR after getting unblocked should they be hit with this massive fine. For those of us that don't give a shit about Europe it's so frustrating having to worry about how we have to comply. And before someone says something about "it's only for companies targeting the EU" that isn't as clear as people make it out to be. An errant ad, or a single conference talk, or even engagement on social media can be construed into requiring GDPR compliance. But of course the reason the EU didn't want to block corporations flouting the GDPR technically is because they saw the arms race happening in China and decided that they didn't want a second firewall. So instead they went the lazy route and they pushed the whole mess on small startups that aren't the problem in the first place. Large corporations are the problem. The fundamental design of the internet and web is the problem.
    - Tomte 8y ago
      > The problem is that there is a lower floor of a $20m fine I don‘t believe that you truly believe that, after it has been refuted a dozen times in every single GDPR discussion. There is no lower floor. There is not even an obligation to hand out fines.
      - Mirioron 8y ago
        There is nothing stopping them from doing so though. Maybe they're having a bad day or simply don't like you very much. Some of the data protection authorities have like one to two dozen people working at it total.
        Tomte 8y ago
        There is a lot stopping them, namely the law itself and the courts. But that is irrelevant in this thread. There is no lower floor. That was a lie! The authorities can easily fine someone a thousand Euros or a million Euros.
  - Mirioron 8y ago
    >Even the "nightmare letter" doesn't have anything unreasonable in it and the only reason why it might be difficult How about another reason: it simply increases administrative costs. If you have enough users firing these letters off then you could end up spending a significant amount of time simply responding to these letters. Something has to pay for all of that, and it's not like this cost is going to go away at some point, so the entire business model has to be set up in a way where it can just eat this cost.
- robinwarren 8y ago
  Note, I think, you also need to be GDPR compliant for EU users when they are not in the EU. So I don't think IP blocking actually works for 100% of cases. I would suggest not getting too hung up on this, it is showing you the worst outcome and assuming you have made a good effort to be compliant I should think things would be fine even then. No doubt you have Ts and Cs, that document is full of clauses put in place because of things like this, and any of them could probably result in a worse letter from a customer wanting to sue you over something. But I image also that hasn't happened to you yet either?
  - jacquesm 8y ago
    > I think, you also need to be GDPR compliant for EU users when they are not in the EU. What you think does not align with my understanding of the GDPR, what makes you say this?
    - robinwarren 8y ago
      Fair enough, I did read this somewhere but it is obviously wrong now I check it out. Thanks!
  - detaro 8y ago
    > Note, I think, you also need to be GDPR compliant for EU users when they are not in the EU. No, location is what matters. Of course one could argue if IP is a reliable indicator of location, given VPNs, potentially faulty GeoIP databases, ...
    - bulatb 8y ago
      Geoblocking EU users makes it fairly clear you don't intend to serve[0] them, at least in my opinion. If the only reason you could be in scope is offering your service in the Union, and you do your best to avoid that, you should probably be out of scope. We'll see what the regulators think. [0] From Recital 23: "[When deciding whether processing is in scope under Article 3(2)], it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union."
- Gravityloss 8y ago
  Maybe a competitor can do their business according to the GDPR then?
  - michaelsjoeberg 8y ago
    it is the opposite. established companies have no issues with fees, or legal requests. gdpr is to protect the established companies from competition. it is basically a reverse china ban. because china-style banning of competition is still considered bad in the eu.
    - Gravityloss 8y ago
      So you consider it a big burden to a startup, to do business according to the GDPR? I'm no expert on the matter.
      - relics443 8y ago
        Yes. Besides for the administration costs incurred (which is probably the real killer), the list of death points are: 1. Adding a dialog as the first step in an onboarding funnel that's already difficult to get users through 2. Handling non-consent. WTF! So if the user doesn't give consent to something that 99% of the population doesn't understand, I'm not allowed to prevent them from using the app. And so my engineering team needs to waste critical hours figuring out things like how to deal with crashes, or maybe how in the fuck we're supposed to fallback to not using services that we're built on (e.g. Firebase)! 3. Dealing with the fallout of #1 in the form of bad reviews that are the kiss of death to startups
        DmenshunlAnlsis 8y ago
        Handling non-consent. WTF! So if the user doesn't give consent to something that 99% of the population doesn't understand, I'm not allowed to prevent them from using the app. This is like a living, breathing example of why GDPR had to be written the way it was, so that arrogant techbros couldn’t rationalize their way around to screwing everyone over for a quick dollar. It’s also a perfect example of why you get zero sympathy. “But maaaa, it’s hurting my funnel!” Good.
- kerkeslager 8y ago
  > But reading stuff like this makes me that much more inclined to use that Cloudflare option of IP blocking the whole continent. Excellent. Then maybe some competitors will arise with products that are built with privacy in mind from the ground up.
  - hartator 8y ago
    This fake new competitors are called unemployment, low innovation, and low growth. Bureaucracy never created jobs.
    - kerkeslager 8y ago
      I'd love to hear by what mechanism you think eliminating foreign competition will cause unemployment, low innovation, and low growth in European countries.
  - relics443 8y ago
    Unfortunately those competitors will crash and burn when their users get pissed off at the opening dialog.
    - kerkeslager 8y ago
      You think that an opening dialog will annoy users more than having a service entirely blocked in their country?
      - relics443 8y ago
        So the rest of the world should get annoyed with the opening dialog, so that the EU doesn't have to get blocked? Sounds like this could be solved by a proper solution, which the GDPR is not.
        kerkeslager 8y ago
        > So the rest of the world should get annoyed with the opening dialog, so that the EU doesn't have to get blocked? Nope. Surely you can think of a technical solution to this problem.
ColinWright 8y ago
I feel like I'm missing something - the site/article/page hasn't loaded for me for the last 40 minutes or so, and yet people are upvoting it. Am I missing something? Is it just me? "Is It Up"[0] says it's up ... Maybe I'll try via a different IP address. Edit: The number of upvotes (twelve and counting) shows it's not just me. I've now changed my IP address and it loaded almost instantly. Jacques - FWIW the IP address that's not working is 92.18.56.74 - it's been failing to load your site for at least the past hour, I have no data from before that. [0] https://isitup.org/jacquesmattheij.com https://isitup.org/jacquesmattheij.com
- jnichols35 8y ago
  It loaded up just fine for me.
  - ColinWright 8y ago
    My comment has two upvotes (now five) almost immediately, so I'd guess I'm not the only one.
- downandout 8y ago
  It is not just you. I had to access it from a proxy. I assume that means he is blocking certain parts of the US, if not the US in its entirety.
  - ColinWright 8y ago
    Yes, but I'm in the UK.
    - ajeet_dhaliwal 8y ago
      I am too and can access it.
      - ColinWright 8y ago
        ... and I can't. Or couldn't. I changed IP address and can now. Many/most people have dynamic IP addresses, and I wonder if Jacques' provider has aggressively blocked addresses that have been abused in the recent past.
amingilani 8y ago
Hey @dang, the article was updated to remove the typo in the heading. Maybe edit the HN title too? Receive => Received
- sctb 8y ago
  Updated. Thank you!
  - amingilani 8y ago
    Thanks Scott!
zwaps 8y ago
I like how the article starts with "the nightmare letter is clearly a troll attempt we need to deal with" and closes with "actually, those are are all valid and reasonable questions that you should have answers to if you were not breaking the law in the last five years. Answering them automatically should be easy If you, no matter what company size, are not dependent on illegally and immorally profiting from personal data, then GDPR may even be good for you." hehehehehehehe
- jacquesm 8y ago
  The letter is clearly a troll attempt because it is engineered to inflict maximum damage even if the claimant has no use for a lot of the information they are requesting. Even so, in isolation and moderation the questions make good sense and answering them properly using an automated system and an updated privacy policy should not be a huge burden.
  - GiuseppaAcciaio 8y ago
    I've been involved in the GDPR-proofing of the company that employs me in the UK, and find that the questions are the same that our consultants put to us when identifying where we stood. Based on my experience (medium sized manufacturing company) I think that the letter really becomes a nightmare when the company receiving it has not looked into it at all, or when their business model relies on being able to ignore consent from users for their processing; in other cases, and especially for any company that sells to businesses rather than individuals, GDPR compliance is really not that bad IMO.
  - gnode 8y ago
    I don't agree that this is trolling, even if it is a fishing expedition. The primary purpose appears to be to probe for GDPR compliance, which is a valid expectation of customers and prospective customers (Europeans at least).
    - jacquesm 8y ago
      You can probe for GDPR compliance without inflicting a large amount of work on the counterparty, assuming that you are on friendly terms. For instance, if you wish to know if they are GDPR compliant you could ask them something along the lines of "Hello there dear valued business relationship, I would like to know if you are aware of the changes in legislation re. privacy and if so whether or not you are at present compliant with that law and if not if you have a time-table when you will be'. To ask for the maximum under threat of reporting a party to the regulator is not aligned with 'probing for GDPR compliance'.
amelius 8y ago
What's the worst that can happen if you reply to this letter with incomplete information? I imagine the client will then send you another letter, to which you reply that you've already sent the information. And so on. In the end, the client may sue you. But in that situation, you make the effort of deleting the information you said you didn't have, and you win the case.
- jacquesm 8y ago
  The claimant could report you to the authorities but a partial answer is better than no answer and you could always accompany the partial answer by an estimate when you think you will have the remainder of the information requested.
- matthewmacleod 8y ago
  The client will report you to their local regulator who will then prod you for more.
- raverbashing 8y ago
  I'd say it would boil down to the client providing evidence the company had such and such information at the time of the request. Had the company had the information at a time in the past doesn't mean they would do now.
- saintPirelli 8y ago
  Is there amy regulation about how the data has to be formatted? Say I send a json string like "this is LITERALLY the data we use", but the avergae Joe is left irritated and annoyed, am I in trouble?
  - jacquesm 8y ago
    JSON or XML would be an excellent way to answer, alternatively you could format it for easier human consumption. Going out of your way to make the response useless is probably not a good idea.
    - 8y ago
GiuseppaAcciaio 8y ago
I have to confess, it's a guilty pleasure of mine to respond with a variant of the Nightmare GDPR letter to SOME companies who sent me the classic "we're sure that you want to access all the amazing benefits of our data processing so if you REALLY want to opt-out you'll need to click on this link and manually remove consent from a couple hundred 3rd party providers" email. I'd never do that to any company (big or small) with whom I have legitimately interacted, but a lot of this drivel has come from random recruitment companies that must have scraped my details from my CV or Linkedin or wherever.
- jacquesm 8y ago
  If you're not legitimately concerned then you are actually devaluing the GDPR by abusing it. If you have a legitimate concern with a particular company I'd send them a custom letter rather than a form letter and I'd try to work with them in order to achieve the desired effect (for instance: for them to delete my data once and for all) rather than to get a bunch of information that I have no further use for.
  - GiuseppaAcciaio 8y ago
    Alright, let me rephrase: I am interested in such companies that somehow have my details on record despite me never contacting them, and who show no understanding of the principles of GDPR; in particular I want to know what they hold about me and what the source of their data is, which is why I send the letter (which I have modified to remove the stuff I am not concerned about). Some of them have since replied with "we've gone ahead and deleted all your data", which could be interpreted in many ways I guess
  - laumars 8y ago
    Anywhere that has made my acceptance an "opt in" I have then sent a polite email asking for my details to be removed. I'm happy to continue to use any services that follow GDPR and use them with the minimum of fuss; but anywhere that feels like they're trying to worm their way around the law feels like the kind of organisation the GDPR is designed to protect us against. Thankfully the responses I've had thus far have been equally amicable.
czardoz 8y ago
So the lawyer provided a letter which demonstrates what would happen in the worst case due to the GDPR. How does that make him dumb?
- jacquesm 8y ago
  Because people then use that letter to increase the burden on companies 'just for kicks', it creates an asymmetry that the law did not intend. It forces attention away from the positive effects of the law and gives companies reasons to say 'see, this is what you get'. It's irresponsible.
  - cm2012 8y ago
    This kind of thing is inevitable though. Within a month there will be online services that auto send an even more annoying version of this letter to every company on your contact list.
    - kasey_junk 8y ago
      They kicked off about a month ago. At work we could see them come online by the form letters they sent.
  - Vinnl 8y ago
    The same happens unfortunately with FOI requests. I've seen a case of someone explicitly stating they're sending FOI requests to a municipality just to spite them, which led to that municipality having to hire four (!) people to process them and find the documents. This in turn led to a restriction of that law, which is a real shame.
    - jacquesm 8y ago
      Yes, we have the same here. The laws have been amended to take care of the 'volume letter writers'. The best part: I'm aware of one such a person and they're unemployed, so they use their state supported life to harass the state to cause damage.
Arathorn 8y ago
We already received one of these for Riot.im; kinda depressing that despite all the GDPR work we’ve done for Matrix (https://matrix.org/blog/2018/05/08/gdpr-compliance-in-matrix/ https://matrix.org/blog/2018/05/08/gdpr-compliance-in-matrix... etc) folks think it’s worth burning yet more of our time in proving it to them (but just to them). So much for writing software and actually making Matrix better...
- lykr0n 8y ago
  Then automate the process or hire an administrator to deal with stuff like this. It's not the requester's fault that you can't handle compliance with a law efficiently.
  - cm2012 8y ago
    That's what he's doing. And it costs a lot of money to do this.
    - wooter 8y ago
      the inability of gdpr advocates to assess or even acknowledge the true cost and negative consequences of this law is extremely unsettling. everything from "its completely easy to implement [even-though i'm not even referring to any particular business model]" to "it requires development of non-product related features but won't hurt startups" to "proving compliance isn't a burdensome cost to completely innocent companies" to "if you can't do it, you shouldn't exist anyways [even-though no one is forcing anyone to use anything]" to "it is vague to give our benevolent regulators ability to enforce it selectively [and somehow always perfectly]" ironically, this very blogger made all the same arguments here: https://jacquesmattheij.com/gdpr-hysteria https://jacquesmattheij.com/gdpr-hysteria his response to his current concern is: "then automate it" as if this is trivial. and "my blog is compliant" as if this means anything for even the most basic business model.
      - Maarten88 8y ago
        > the true cost and negative consequences of this law is extremely unsettling I think the cost of not having this law is much higher. Also, lots companies had few problems automating the dissemination of users personal information to dozens of interested parties, building completely automated markets for this information with derivatives trading etc, all without users (and regulators) knowing or understanding anything about these practices. It is long overdue to put a stop to the excesses, and as a EU citizen I am extremely happy with GDPR. There will be new opportunities for startups, hopefully GDPR can help make sure these opportunities are less detrimental to society than before.
arbuge 8y ago
I have a general question about this. If you have a privacy policy which discusses (amongst other things) the answers to these questions, would it be sufficient to just reply directing the customer to that privacy policy? i.e. let him dig out the answers he "needs" from there.
- jacquesm 8y ago
  In part this form letter seems to assume that all the burden is on the company, whereas if the company has already answered these questions in a public medium you could (1) take that as a signal that the claimant is a troll (otherwise they would have read your privacy policy) and (2) that they probably don't care about the answer, they're just looking for a reason to stir the pot, so any deficient answer will be used to contact the regulator. The best way to deal with that is to answer the request in detail (which makes it very unlikely that a regulator would follow up if there was a complaint) and to refer to public resources such as your privacy policy because that's something that indicates that the claimant didn't do their homework, which is something a regulator will use to weigh whether or not to follow up on the complaint.
  - arbuge 8y ago
    > The best way to deal with that is to answer the request in detail I keep hearing this but I think in reality the volume of troll requests will dictate whether that is practical or not for any given company. Small startups might have problems if that volume is not proportionately small.
    - jacquesm 8y ago
      The problem would be in answering just one of these, then the amount of effort would be disproportionately large. But to answer a whole bunch of them is a 'mere matter of programming' unless you've really made a mess of things.
      - arbuge 8y ago
        That assumes the trolls will all use the same form letter with no variations, which might not be the case.
stevoski 8y ago
Jacques, thanks a million for your work on this topic. It makes me feel much more confident about being able to efficiently handle such a nightmare letter if it one day comes.
pawurb 8y ago
I've described how I'm preparing for GDPR as a solo developer running commercial side projects without a legal team to back me up: https://pawelurbanek.com/gdpr-compliance-blog-rails https://pawelurbanek.com/gdpr-compliance-blog-rails
donatj 8y ago
The vagueness of the meaning of "processing" PII is one of my handful of problems with GDPR. Is the mere act of having a unique index on an email address column a form of processing? I'd argue it is. It's can be construed really far.
- bulatb 8y ago
  Processing is defined in Article 4(2): > 2. ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ - BUT - Article 2(1) limits the whole GDPR to personal data "processed" in the context of a filing system, whether electronic or physical. In other words (in my non-lawyer reading): If I have your business card in my pocket, or I leave it on the table, or throw it away, I'm not "processing" your data in a covered way—even though I have it. If I put it in my stack of business cards or add you to my CRM, I am. https://gdpr-info.eu/art-2-gdpr/ https://gdpr-info.eu/art-2-gdpr/
  - JumpCrisscross 8y ago
    > retrieval, consultation, use These three words can mean everything and nothing. It will take years to see how each of the EU's twenty-eight members' regulators take to interpreting them.
    - bulatb 8y ago
      I read this part as being broad, but not vague. Processing personal data means doing anything with it in any way, including simply having it. If the data takes part in a process you have, you're processing that data.
      - lucideer 8y ago
Saaster 8y ago
I updated my web service (solo dev, side project) with a GDPR compliant terms and privacy policy, got this form letter already from a few of my users. I have to tell, it's seriously depressing and I was contemplating shutting the whole side project down over the weekend.
- donatj 8y ago
  I have a tiny project in closed beta right now I've been working on in my spare time for 7 years I'm considering closing to the EU. The idea is even entirely privacy minded with all data save email address being client side encrypted so we never see it unencrypted. I never intended to make real money off it except maybe covering server costs if I'm lucky, but the time it would take dealing with requests like this it enough to scare anyone off.
  - ColinWright 8y ago
    Broadly speaking, and noting that IANAL, etc, etc, ... I'm not sure what the problem is. Your obligation is to keep the data secure, and only keep data that you need. Then you need to respond to requests to (a) tell a person what data you hold on them, (b) tell them what you do with the data, and (c) delete it if asked, unless you have a legitimate reason to keep it. So if someone has given you data for the purpose of you providing a service then all you need to do is treat that data with care, don't do anything your customer doesn't expect you to do, and be able to provide and/or delete it. Fair do, someone disagrees and has down-voted me. Please, having read the actual regulations[0] several times, including the recitals[1], I'd be pleased to see what's missing from that outline, so I can improve my understanding. [0] https://gdpr-info.eu/ https://gdpr-info.eu/ [1] https://gdpr-info.eu/recitals/ https://gdpr-info.eu/recitals/
    - testvox 8y ago
      The problem is you have to do all that or face fines and lawsuits which is outside the risk envelope of most people's side projects.
ashelmire 8y ago
Step 1: be an American company with no European offices or accounts. Step 2: Ignore letters about GDPR. Alternatively, set up a form response to autosend whenever you get an email with some of those keywords.
- pmlnr 8y ago
  So anyone outside of US should ignore DMCA I believe? Just an example.
  - c4h8o3del 8y ago
    Considering the DMCA is harmful and should never have passed? There's an ethical and moral aspect here you're ignoring.
    - pmlnr 8y ago
      I'm not questioning that; it's just one example.
  - dazilcher 8y ago
    So you wouldn't have an issue implementing Chinese regulations?
    - pmlnr 8y ago
      I'm unaware of similar Chinese laws, can you please point me at them? To the official English translation I mean.
  - ashelmire 8y ago
    Are you suggesting that countries outside of the US care about US copyright law? The Russian video streaming site I use sure doesn't. What about the pharma companies in India that copy American drugs (to the great benefit of humans worldwide)? US law does not rule in other sovereign nations.
ainiriand 8y ago
Please folks, GDPR investigations are only undertaken by the EU. No single actor can try to 'sue' you for infringment. The maximum they can do is to complain to the GDPR office in your country. And then, maybe, the office is gonna undertake an investigation. This whole is process can be a matter of years. Don't be afraid, if you receive one of those letters just ignore it.
- vertex-four 8y ago
  If your failure to comply with the GDPR has cost someone damages, they can recover those damages in civil court by suing you, though.
  - gsnedders 8y ago
    But, unlike the US, in most (all?) of the EU, the most you can sue for damages is the total damages incurred (plus court expenses).
    - deleted 8y ago
      [deleted]
  - 0x4f3759df 8y ago
    What's "damages"? Does "emotional distress" count?
    - vertex-four 8y ago
      Emotional distress isn’t a thing in the EU in general, and definitely not out of proportion to actual damages. If someone incurred costs as a result of your failure to comply with the GDPR, those would be damages. If, for some reason, they wound up in therapy as a result of your failure to comply and had to pay money/take holidays from work/etc for that, that’d be the closest thing to emotional distress we have.
  - ainiriand 8y ago
    Fines are not always incurred for GDPR infringements. Sometimes you can be asked to delete the data, to block dealing with EU customers, etc...
kylnew 8y ago
I was having trouble visiting the article so I used a web archive link, in case it’s useful to anyone else https://web.archive.org/web/20180529120012/https://jacquesmattheij.com/so-your-start-up-receive-the-nightmare-gdpr-letter https://web.archive.org/web/20180529120012/https://jacquesma...
beilabs 8y ago
Website is blocked for pretty much everyone but the US? Just accessed from Nepal, blocked.....oh dear... Edit: apparently not blocked, but still can't connect apart from via VPN.
- jacquesm 8y ago
  No, there appear to be some connectivity issues of the non-obvious kind (apparently BGP related), the hosting provider is working on it and there are several work-arounds posted in this thread.
jacquesm 8y ago
Apparently there is some BGP related issue, if you can't reach the site directly here is a google cache link: https://webcache.googleusercontent.com/search?q=cache:QSStS_885I0J:https://jacquesmattheij.com/so-your-start-up-receive-the-nightmare-gdpr-letter+&cd=4&hl=en&ct=clnk&gl=nl https://webcache.googleusercontent.com/search?q=cache:QSStS_...
mlthoughts2018 8y ago
It seems like a lot of the comments are about one issue: - do you believe generally, even for an “upstanding” company you’ve done business with for a while, that commercial entities can be trusted with your data? If yes, you’ll see the template as overbearing and needlessly aggressive outside the context of some specific incident when a company proved to be untrustworthy. Especially if you operate a side project or business of your own, and believe you personally would not abuse consumer data collection, you’ll see it as rude in the best case, trollish resource wasting in the worst case. If you’re a consumer with a general mistrust of all commercial entities, even “upstanding” ones, when it comes to data practices, or if you just happen to believe that the potential risks for data abuse or harm are too high to be offset by anyone’s good intentions or past good behavior, then you’ll see this as a reasonable template, perhaps needing a few modifications for differing contexts, and that jumping straight away to legalese boilerplate just has to be assumed necessary when dealing with self-interested commercial entities.
- jacquesm 8y ago
  Sending boilerplate almost guarantees that a regulator will put your request at the bottom of the pile if you decide to take it to the next level unless the company responds in a way that shows their contempt for the law.
  - mlthoughts2018 8y ago
    I think that will depend on how seriously GDPR non-compliance is treated. I’m hopeful some big corps will be heavily fined to set precedent and to ease concerns that GDPR is a mild form of regulatory capture intended to be misused (regardless of its wording) to asymmetrically inhibit new entrants and small firms.
    - ggg9990 8y ago
      But that’s what the big corps want. They’d gladly each cough up a billion for a permanent state where market entry is harder. Especially the easy to disrupt consumer services like Facebook and Snapchat.
zerostar07 8y ago
Nobody expects the Spanish Inquisition
emiliobumachar 8y ago
The lawyer who published the nightmare letter is not dumb at all, just ambitious and selfish. They're making a name for themselves and do not care about massive externalities.
deleted 8y ago
[deleted]
iaml 8y ago
Can someone tell me is it legal (or even viable) to just automatically completely remove all the information on the person sending those letters? Certainly beats banning whole EU by IP.
cm2012 8y ago
I just want to note how non-obvious compliance with GDPR is. Two experts on GDPR and privacy in this thread (Jacquesm and Ainiriand) have been disagreeing throughout the thread on just the basis of whether one should reply to GDPR complaints like this. Imagine how much up for interpretation the more gritty parts of the law will be.
- msie 8y ago
  And Jacquesm is saying don't be alarmed in some comments while in other comments he admits there could be problems with people trolling with this letter. So I'm even more skeptical of allowing any EU users.
  - salvar 8y ago
    I think it would be best if people like you would just go ahead and block all EU users. There's so much "well I might just block them then!" going around these days, when you should just do it if you think it's the best approach.
  - jacquesm 8y ago
    It's a very consistent position: no need to be alarmed, yes you will have to answer a letter like this, even if it is trolling. But if a letter like this alarms you then you probably have bigger problems.
    - Permit 8y ago
      It's alarming because you describe the letter as analogous to an "exploit toolkit" and we all know no patch is coming. Perhaps proponents of GDPR should have considered this very obvious weaponization of the law...
      - jacquesm 8y ago
        They did consider it, there is a pretty extensive part written on what can go into a DSAR and from what I can see this letter skirts the edge and in some places goes over it but on the whole it is not an unreasonable burden to deal with it as it is. Take into account the lengths to which companies will go to collect data, it stands to reason that in that context there is some balance to be found if a Data Subject makes a request about that collected data. If you don't collect data the request can be answered immediately and without further work.
throwaway13456 8y ago
I've said it many times, GDPR is such a waste of time and resources for startups unless your market is really EU. GDPR is super expensive to remain compliant, simply because of the broadness of the terms used, leading to undefined scope of liability. The cheapest way to stay compliant with GDPR is to completely block access to EU customers. In fact, this is what I did with my business. I redirect to a generic text file (not even a HTML that could trigger a GDPR clause by itself) explaining my stance.
- 3pt14159 8y ago
  What? How does HTML trigger a GDPR while text file does not?
  - throwaway13456 8y ago
    "Sorry, this site is for non-EU users only" something to that effect. A HTML can execute scripts (ie., collect data) while a text file does not, atleast that's my understanding.
    - tome 8y ago
      If that's your understanding then you have bigger problems than the GDPR.
- blub 8y ago
  It would probably be a problem if Google or MS did this, because lots of other companies and institutions (foolishly) depend on them instead of using OSS. I would be disappointed if Apple did it, but I have the feeling this law is an advantage for them. :) The rest of the companies threatening to block the EU are seriously overestimating their importance.
Ralfp 8y ago
What worries me most is how little is being said about private-operated sites. I am little Joe running internet forum about space battles with maybe 5 active users right now and no more than 100 active members historically. Should I sign data processing agreement with Google because I am using Gmail to send E-mails? Should I hire DPO? Am I risking my house being taken from me to cover multimilion fine because user posted their photo or e-mail 5 years ago and I’ve missed it because I don’t delete user-posted content together with their account?
- jacquesm 8y ago
  > What worries me most is how little is being said about private-operated sites. If you want I can research the matter in more detail, someone else came up with federated sites like Mastodon nodes and that's another pretty gray area. > I am little Joe running internet forum about space battles with maybe 5 active users right now and no more than 100 active members historically. Ok. > Should I sign data processing agreement with Google because I am using Gmail to send E-mails? No. You could try to stretch the law to include that particular example but from my reading of it this is perfectly acceptable. > Should I hire DPO? No, but you are the de-facto DPO, so if you receive a DSAR then you probably should answer it, though with your user counts I think the chances of that are very small. > Am I risking my house being taken from me to cover multimilion fine because user posted their photo or e-mail 5 years ago and I’ve missed it because I don’t delete user-posted content together with their account? No. But if a regulator should tell you that you should remove a users data (because you refused to for some reason or other) you probably should. The EU does not 'fine first and ask questions later', they will investigate first, warn and then when ignored they will fine. And for a small entity like yours which is more of a hobby than anything else I highly doubt regulators would even bother but you can't rule it out completely. Better increase you comet insurance as well if that's your main worry :)
  - Mirioron 8y ago
    >No, but you are the de-facto DPO, so if you receive a DSAR then you probably should answer it, though with your user counts I think the chances of that are very small. I think that we might have this view about it right now, but I could easily see a scenario, where somebody targets you for "harassment" through something like this. Maybe you say something somebody else doesn't like on Twitter and they do that to you.
CryptoPunk 8y ago
The fact that you have to respond to an information request letter under the GDPR makes the legislation tyrannical. The idea that information about someone belongs to that person, no matter where it is stored, is a philosophically flawed perspective that if fully implemented, would lead to total global tyranny, by obligating people to do the work of disclosure and information deletion on demand, and ironically, by eradicating all privacy in relation to information people have about other people. You have no moral right to dictate what I remember about you, to compel me to disclose what I know about you, to compel me to disclose what steps I took to disremember you, or to restrict who I may relay the information I remember about you to. The GDPR empowers you to do all of these to me in the context of a web service.
notacoward 8y ago
Won't this DoS the regulators as well as the companies? Carpet-bombing everyone with DSARs is not just annoying but self-defeating. Even though the basic ideas behind GDPR seem pretty reasonable to me, the implementation so far is almost enough to make me join the "regulation is evil" crowd.
- jacquesm 8y ago
  Yes it will, which is why if you are serious sending a form letter is a bad decisions.
omegbule 8y ago
The only response this would get is 'you have been confirmed in our systems and your right to be forgotten has been processed. Thank you.'
cdevs 8y ago
I think the ridiculous thing is every mom and pop site and blog and website needs to be gdpr compliant? insane. If the true intent was to make sure large players have their system in check then they should have simply said if you have 50,000 or more users giving you data a month or something to protect anyone interested in software from being afraid of having 2 users because now they need to read every international law. I know someone will fire back at this but what stop the United States from coming up with some law as well on the internet against how logins should be and then filing a lawsuit against every other country company that doesn’t comply. A business should follow the laws of based on the owners location and if other countries don’t like it then that’s for allies to group up and ask that minority country for change. gdpr to me is of reaching on the internet in a scary way.
- JumpCrisscross 8y ago
  > A business should follow the laws of based on the owners location This cuts against centuries of sovereign tradition and precedent. GDPR's constraint to users in Europe is reasonable. (As is refusing to do business in Europe by blocking the continent.)
  - optimalKEK 8y ago
    EU is great and you anglos don't understand the visionary nature of this law and our leader, Jean-Claude Junker. Additionally, this law will create so many jobs, think about it for a second!
    - JumpCrisscross 8y ago
      Can't tell if you're trolling, here or when you said "authoritarianism is the only way to protect the people from runaway capitalism" [1]. [1] https://news.ycombinator.com/item?id=17099952 https://news.ycombinator.com/item?id=17099952
      - tome 8y ago
        Surely both.
ggg9990 8y ago
“GDPR is great and will cost nobody anything”
cdjk 8y ago
I'm waiting for the first time a GDPR DSAR deletion/retrieval portal is breached. Mass exfiltration or mass deletion are both great attack vectors.
- jacquesm 8y ago
  That's a legitimate concern.
ggg9990 8y ago
When you’re doing shitty work to comply with this shitty law, perhaps you can find some comfort in the fact that people have suffered more from stupid government policies, and that misbehavior of foreign governments is a persistent risk of international business. This is one place where the EU is vexingly successful — if it was just, say, France doing this, most companies under $1 billion would have no trouble just giving France the finger and blocking their users.
rdlecler1 8y ago
How do I know someone didn’t just steal someone’s username and password? I assume I should be asking for personally identifying information such as a password or ID? There is some irony here.
lgregg 8y ago
If only non-Europeans could do these requests. There are a few companies I'd love to know what they are doing with my data.
outside1234 8y ago
My approach for my startup is that if anyone sends me a Subject Access Letter that I thank them for being a customer, cancel their account, and delete their data. I note this in the terms of service up front to be transparent and totally comply with GDPR. Sadly, I think this is the lowest cost approach to dealing with the law, and removes the ability of an insane customer from causing us millions in liability.
- arghwhat 8y ago
  I think you should ask a lawyer about this approach. I would very much consider this to be non-compliant, as this is a form of transparency evasion. If it isn't directly addressed, it might be covered by whether the data handed out should be the data available at the time of the request, in which case it would be prior to you having a chance to delete it.
- arghwhat 8y ago
  I did some quick searching, and my gut feeling would appear to be correct: It is not legal to delete user data in order to avoid fulfilling a subject access request. It is okay if data has been routinely modified or deleted, but it must not be a result of the access request. Quoting the Information Commisioner's Office: Q: We have received a request but need to amend the data before sending out the response. Should we send out the “old” version? A: It is our view that a subject access request relates to the data held at the time the request was received. However, in many cases, routine use of the data may result in it being amended or even deleted while you are dealing with the request. So it would be reasonable for you to supply information you hold when you send out a response, even if this is different to that held when you received the request. However, it is not acceptable to amend or delete the data if you would not otherwise have done so. Under the DP Bill, it is an offence to make any amendment with the intention of preventing its disclosure.
relics443 8y ago
I'm beginning to highly doubt that anyone defending the GDPR has ever had any responsibilities that included: 1. Running a tech company 2. Funnels, conversions, and retentions 3. Writing software Either that or they just want to watch the world burn.
MartinMoore 8y ago
Thanks for the article, the insights are super. With GDPR it's honestly simply funny how people are only now starting to get the basics (if you are one of those - go check this out - https://www.omnisend.com/blog/gdpr-hub/ https://www.omnisend.com/blog/gdpr-hub/) of it, when they were suppose'd to know everything a long time ago. But still good.
dtougas 8y ago
Here's an idea: how about charging more for European users to access your site. If it is a cost issue, how about reflect that cost in the price of your service. So, if your web app is free for North American users, put it behind a paywall for Europeans. It's not ideal, but maybe if enough sites/services did that, it would help reflect the reality of the situation. Consider it a European service tax.
MockObject 8y ago
Am I right that the only risk for a small, side project for non-compliance are the EU legal sanctions should they grow to a significant enough size as to open an EU office? Other than they, why shouldn't a US side project ignore the DSARs?

289 points by janvdberg 8y ago

I think the GDPR is well intentioned and has provoked some important and useful conversations about how we make use of users’ data. But reading stuff like this makes me that much more inclined to use that Cloudflare option of IP blocking the whole continent. This feels like a very slippery and dangerous can of worms that’s not worth opening.

annabellish 8y ago
There's already a tonne of laws every company has to comply with. The GDPR isn't any more onerous than any of those, it's just new. Even the "nightmare letter" doesn't have anything unreasonable in it and the only reason why it might be difficult for a company to comply with would be that their internal systems and processes were already horrifying - something which we have now collectively deemed that permitting is causing more harm than good.
- cageface 8y ago
  What other laws do I have to comply with right now that are so vaguely defined and carry such horrifyingly punitive fees? I guess we'll have to wait and see how it's actually enforced but no other legal obligations I've had to consider so far when building products feel this threatening to smaller online businesses. It's bad enough we have to deal with patent trolls. I'm not inclined to add this to my risk profile.
  - fwdpropaganda 8y ago
    > What other laws (...) You can't sell guns and drugs online. If you're taking money, you have to make sure you know your customer (KYC). I would also like to hear other examples.
    - cageface 8y ago
      I feel like I have a pretty clear idea of the rules in the cases you describe. For GDPR I have no such confidence. It seems like the smart thing for US startups to do right now is ignore EU customers until they’ve validated the business idea enough to justify the engineering and legal expenses of taking this on.
      - fwdpropaganda 8y ago
        > I feel like I have a pretty clear idea of the rules in the cases you describe. For GDPR I have no such confidence. I seems reasonable, but I would argue it's due to the law being new, not to some intrinsic property of it, no?
      - empath75 8y ago
        The alternative is to not collect personal information from your customers.
        JumpCrisscross 8y ago
        > The alternative is to not collect personal information from your customers If that worked I'd embrace GDPR. Problem with "any consumer can make a complaint which requires expensive follow-up" regimes is one doesn't have to do anything wrong to incur costs. Someone can mis-interpret something and make a complaint. Now you have to interface with a regulator, which tends to be risky, expensive and time consuming.
        aninhumer 8y ago
        If you're not collecting any information "interfacing with the regulator" means replying to their email by saying "we're not collecting any information". (Assuming they even got that far, given that they'd likely take a look at your website and notice you aren't collecting any information.) I'm not sure what's risky, expensive or time consuming about that.
        8y ago
  - Fradow 8y ago
    Other laws you had to comply with where the ones the GDPR is replacing. Several EU country had very similar law. Idon't know about the fines about such laws though, since they were not enforced. Enforcement is what's going to matter, I'm pretty sure you could dig up other laws that are vague and have high fines, that are just not enforced and thus don't seem as threatening as the widely publicized GDPR. Of course, I'm not a lawyer, and I may very well be wrong on my assumptions. On the other hand, patent trolls are not part of the risk profile for our industry in the EU, since software is not patentable there. But anyway, it makes perfect business sense for a US startup to just block the EU (or at least state somewhere that they are not complying and thus EU users shouldn't sign up) and focus on their home market until they are big enough to comply with the terms (or are willing to take the risk).
  - tremon 8y ago
    The DMCA?
    - Mirioron 8y ago
      If you don't use copyrighted works then DMCA is going to be a much easier problem to deal with. We have plenty of precedents to look at to assess how the DMCA works as well.
      - salvar 8y ago
        > We have plenty of precedents Did these precedents take place before or after the DMCA was enacted?
- JumpCrisscross 8y ago
  > The GDPR isn't any more onerous than any of those, it's just new It’s different. “Complain and investigate” regulatory regimes are expensive to comply with. That is irrespective of whether one is doing anything wrong. These regimes aren’t inherently faulty. They’re quite good in the American securities business. But they create a palpable incumbency bias, as well as one towards those who can afford lawyers and make a useful phone call. Such a regime would have been ideal if constrained to large companies. Rolling it out for everyone means anyone mis-interpreting something could trigger a regulatory investigation. Even if found innocent at the end, that process is harrowing, expensive and distracting. Every jurisdiction has its costs and benefits. Europe is still a huge market. But if one doesn’t see enough revenues to justify a dedicated compliance person, it’s a market which may now make sense to delay going into.
  - heyoni 8y ago
    How about we just try it? Are you from the EU? File a complaint against my website and I’ll ignore it.
- 3pt14159 8y ago
  The problem is that there is a lower floor of a $20m fine. Big corps can risk a 4% hit, but for anyone struggling to get a small startup off the ground the fine is too onerous. As far as I'm concerned the process should be like this: 1. EU issues warning and cuts off traffic to the domain after 30 days. 2. Startup fixes GDPR compliance. 3. EU unblocks startup. Only after the company breaks GDPR after getting unblocked should they be hit with this massive fine. For those of us that don't give a shit about Europe it's so frustrating having to worry about how we have to comply. And before someone says something about "it's only for companies targeting the EU" that isn't as clear as people make it out to be. An errant ad, or a single conference talk, or even engagement on social media can be construed into requiring GDPR compliance. But of course the reason the EU didn't want to block corporations flouting the GDPR technically is because they saw the arms race happening in China and decided that they didn't want a second firewall. So instead they went the lazy route and they pushed the whole mess on small startups that aren't the problem in the first place. Large corporations are the problem. The fundamental design of the internet and web is the problem.
  - Tomte 8y ago
    > The problem is that there is a lower floor of a $20m fine I don‘t believe that you truly believe that, after it has been refuted a dozen times in every single GDPR discussion. There is no lower floor. There is not even an obligation to hand out fines.
    - Mirioron 8y ago
      There is nothing stopping them from doing so though. Maybe they're having a bad day or simply don't like you very much. Some of the data protection authorities have like one to two dozen people working at it total.
      - Tomte 8y ago
        There is a lot stopping them, namely the law itself and the courts. But that is irrelevant in this thread. There is no lower floor. That was a lie! The authorities can easily fine someone a thousand Euros or a million Euros.
- Mirioron 8y ago
  >Even the "nightmare letter" doesn't have anything unreasonable in it and the only reason why it might be difficult How about another reason: it simply increases administrative costs. If you have enough users firing these letters off then you could end up spending a significant amount of time simply responding to these letters. Something has to pay for all of that, and it's not like this cost is going to go away at some point, so the entire business model has to be set up in a way where it can just eat this cost.
robinwarren 8y ago
Note, I think, you also need to be GDPR compliant for EU users when they are not in the EU. So I don't think IP blocking actually works for 100% of cases. I would suggest not getting too hung up on this, it is showing you the worst outcome and assuming you have made a good effort to be compliant I should think things would be fine even then. No doubt you have Ts and Cs, that document is full of clauses put in place because of things like this, and any of them could probably result in a worse letter from a customer wanting to sue you over something. But I image also that hasn't happened to you yet either?
- jacquesm 8y ago
  > I think, you also need to be GDPR compliant for EU users when they are not in the EU. What you think does not align with my understanding of the GDPR, what makes you say this?
  - robinwarren 8y ago
    Fair enough, I did read this somewhere but it is obviously wrong now I check it out. Thanks!
- detaro 8y ago
  > Note, I think, you also need to be GDPR compliant for EU users when they are not in the EU. No, location is what matters. Of course one could argue if IP is a reliable indicator of location, given VPNs, potentially faulty GeoIP databases, ...
  - bulatb 8y ago
    Geoblocking EU users makes it fairly clear you don't intend to serve[0] them, at least in my opinion. If the only reason you could be in scope is offering your service in the Union, and you do your best to avoid that, you should probably be out of scope. We'll see what the regulators think. [0] From Recital 23: "[When deciding whether processing is in scope under Article 3(2)], it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union."
Gravityloss 8y ago
Maybe a competitor can do their business according to the GDPR then?
- michaelsjoeberg 8y ago
  it is the opposite. established companies have no issues with fees, or legal requests. gdpr is to protect the established companies from competition. it is basically a reverse china ban. because china-style banning of competition is still considered bad in the eu.
  - Gravityloss 8y ago
    So you consider it a big burden to a startup, to do business according to the GDPR? I'm no expert on the matter.
    - relics443 8y ago
      Yes. Besides for the administration costs incurred (which is probably the real killer), the list of death points are: 1. Adding a dialog as the first step in an onboarding funnel that's already difficult to get users through 2. Handling non-consent. WTF! So if the user doesn't give consent to something that 99% of the population doesn't understand, I'm not allowed to prevent them from using the app. And so my engineering team needs to waste critical hours figuring out things like how to deal with crashes, or maybe how in the fuck we're supposed to fallback to not using services that we're built on (e.g. Firebase)! 3. Dealing with the fallout of #1 in the form of bad reviews that are the kiss of death to startups
      - DmenshunlAnlsis 8y ago
        Handling non-consent. WTF! So if the user doesn't give consent to something that 99% of the population doesn't understand, I'm not allowed to prevent them from using the app. This is like a living, breathing example of why GDPR had to be written the way it was, so that arrogant techbros couldn’t rationalize their way around to screwing everyone over for a quick dollar. It’s also a perfect example of why you get zero sympathy. “But maaaa, it’s hurting my funnel!” Good.
kerkeslager 8y ago
> But reading stuff like this makes me that much more inclined to use that Cloudflare option of IP blocking the whole continent. Excellent. Then maybe some competitors will arise with products that are built with privacy in mind from the ground up.
- hartator 8y ago
  This fake new competitors are called unemployment, low innovation, and low growth. Bureaucracy never created jobs.
  - kerkeslager 8y ago
    I'd love to hear by what mechanism you think eliminating foreign competition will cause unemployment, low innovation, and low growth in European countries.
- relics443 8y ago
  Unfortunately those competitors will crash and burn when their users get pissed off at the opening dialog.
  - kerkeslager 8y ago
    You think that an opening dialog will annoy users more than having a service entirely blocked in their country?
    - relics443 8y ago
      So the rest of the world should get annoyed with the opening dialog, so that the EU doesn't have to get blocked? Sounds like this could be solved by a proper solution, which the GDPR is not.
      - kerkeslager 8y ago
        > So the rest of the world should get annoyed with the opening dialog, so that the EU doesn't have to get blocked? Nope. Surely you can think of a technical solution to this problem.

ColinWright 8y ago

I feel like I'm missing something - the site/article/page hasn't loaded for me for the last 40 minutes or so, and yet people are upvoting it. Am I missing something? Is it just me? "Is It Up"[0] says it's up ... Maybe I'll try via a different IP address. Edit: The number of upvotes (twelve and counting) shows it's not just me. I've now changed my IP address and it loaded almost instantly. Jacques - FWIW the IP address that's not working is 92.18.56.74 - it's been failing to load your site for at least the past hour, I have no data from before that. [0] https://isitup.org/jacquesmattheij.com https://isitup.org/jacquesmattheij.com

jnichols35 8y ago
It loaded up just fine for me.
- ColinWright 8y ago
  My comment has two upvotes (now five) almost immediately, so I'd guess I'm not the only one.
downandout 8y ago
It is not just you. I had to access it from a proxy. I assume that means he is blocking certain parts of the US, if not the US in its entirety.
- ColinWright 8y ago
  Yes, but I'm in the UK.
  - ajeet_dhaliwal 8y ago
    I am too and can access it.
    - ColinWright 8y ago
      ... and I can't. Or couldn't. I changed IP address and can now. Many/most people have dynamic IP addresses, and I wonder if Jacques' provider has aggressively blocked addresses that have been abused in the recent past.

amingilani 8y ago

Hey @dang, the article was updated to remove the typo in the heading. Maybe edit the HN title too? Receive => Received

sctb 8y ago
Updated. Thank you!
- amingilani 8y ago
  Thanks Scott!

zwaps 8y ago

I like how the article starts with "the nightmare letter is clearly a troll attempt we need to deal with" and closes with "actually, those are are all valid and reasonable questions that you should have answers to if you were not breaking the law in the last five years. Answering them automatically should be easy If you, no matter what company size, are not dependent on illegally and immorally profiting from personal data, then GDPR may even be good for you." hehehehehehehe

jacquesm 8y ago
The letter is clearly a troll attempt because it is engineered to inflict maximum damage even if the claimant has no use for a lot of the information they are requesting. Even so, in isolation and moderation the questions make good sense and answering them properly using an automated system and an updated privacy policy should not be a huge burden.
- GiuseppaAcciaio 8y ago
  I've been involved in the GDPR-proofing of the company that employs me in the UK, and find that the questions are the same that our consultants put to us when identifying where we stood. Based on my experience (medium sized manufacturing company) I think that the letter really becomes a nightmare when the company receiving it has not looked into it at all, or when their business model relies on being able to ignore consent from users for their processing; in other cases, and especially for any company that sells to businesses rather than individuals, GDPR compliance is really not that bad IMO.
- gnode 8y ago
  I don't agree that this is trolling, even if it is a fishing expedition. The primary purpose appears to be to probe for GDPR compliance, which is a valid expectation of customers and prospective customers (Europeans at least).
  - jacquesm 8y ago
    You can probe for GDPR compliance without inflicting a large amount of work on the counterparty, assuming that you are on friendly terms. For instance, if you wish to know if they are GDPR compliant you could ask them something along the lines of "Hello there dear valued business relationship, I would like to know if you are aware of the changes in legislation re. privacy and if so whether or not you are at present compliant with that law and if not if you have a time-table when you will be'. To ask for the maximum under threat of reporting a party to the regulator is not aligned with 'probing for GDPR compliance'.

amelius 8y ago

What's the worst that can happen if you reply to this letter with incomplete information? I imagine the client will then send you another letter, to which you reply that you've already sent the information. And so on. In the end, the client may sue you. But in that situation, you make the effort of deleting the information you said you didn't have, and you win the case.

jacquesm 8y ago
The claimant could report you to the authorities but a partial answer is better than no answer and you could always accompany the partial answer by an estimate when you think you will have the remainder of the information requested.
matthewmacleod 8y ago
The client will report you to their local regulator who will then prod you for more.
raverbashing 8y ago
I'd say it would boil down to the client providing evidence the company had such and such information at the time of the request. Had the company had the information at a time in the past doesn't mean they would do now.
saintPirelli 8y ago
Is there amy regulation about how the data has to be formatted? Say I send a json string like "this is LITERALLY the data we use", but the avergae Joe is left irritated and annoyed, am I in trouble?
- jacquesm 8y ago
  JSON or XML would be an excellent way to answer, alternatively you could format it for easier human consumption. Going out of your way to make the response useless is probably not a good idea.
  - 8y ago

GiuseppaAcciaio 8y ago

I have to confess, it's a guilty pleasure of mine to respond with a variant of the Nightmare GDPR letter to SOME companies who sent me the classic "we're sure that you want to access all the amazing benefits of our data processing so if you REALLY want to opt-out you'll need to click on this link and manually remove consent from a couple hundred 3rd party providers" email. I'd never do that to any company (big or small) with whom I have legitimately interacted, but a lot of this drivel has come from random recruitment companies that must have scraped my details from my CV or Linkedin or wherever.

jacquesm 8y ago
If you're not legitimately concerned then you are actually devaluing the GDPR by abusing it. If you have a legitimate concern with a particular company I'd send them a custom letter rather than a form letter and I'd try to work with them in order to achieve the desired effect (for instance: for them to delete my data once and for all) rather than to get a bunch of information that I have no further use for.
- GiuseppaAcciaio 8y ago
  Alright, let me rephrase: I am interested in such companies that somehow have my details on record despite me never contacting them, and who show no understanding of the principles of GDPR; in particular I want to know what they hold about me and what the source of their data is, which is why I send the letter (which I have modified to remove the stuff I am not concerned about). Some of them have since replied with "we've gone ahead and deleted all your data", which could be interpreted in many ways I guess
- laumars 8y ago
  Anywhere that has made my acceptance an "opt in" I have then sent a polite email asking for my details to be removed. I'm happy to continue to use any services that follow GDPR and use them with the minimum of fuss; but anywhere that feels like they're trying to worm their way around the law feels like the kind of organisation the GDPR is designed to protect us against. Thankfully the responses I've had thus far have been equally amicable.

czardoz 8y ago

So the lawyer provided a letter which demonstrates what would happen in the worst case due to the GDPR. How does that make him dumb?

jacquesm 8y ago
Because people then use that letter to increase the burden on companies 'just for kicks', it creates an asymmetry that the law did not intend. It forces attention away from the positive effects of the law and gives companies reasons to say 'see, this is what you get'. It's irresponsible.
- cm2012 8y ago
  This kind of thing is inevitable though. Within a month there will be online services that auto send an even more annoying version of this letter to every company on your contact list.
  - kasey_junk 8y ago
    They kicked off about a month ago. At work we could see them come online by the form letters they sent.
- Vinnl 8y ago
  The same happens unfortunately with FOI requests. I've seen a case of someone explicitly stating they're sending FOI requests to a municipality just to spite them, which led to that municipality having to hire four (!) people to process them and find the documents. This in turn led to a restriction of that law, which is a real shame.
  - jacquesm 8y ago
    Yes, we have the same here. The laws have been amended to take care of the 'volume letter writers'. The best part: I'm aware of one such a person and they're unemployed, so they use their state supported life to harass the state to cause damage.

Arathorn 8y ago

We already received one of these for Riot.im; kinda depressing that despite all the GDPR work we’ve done for Matrix (https://matrix.org/blog/2018/05/08/gdpr-compliance-in-matrix/ https://matrix.org/blog/2018/05/08/gdpr-compliance-in-matrix... etc) folks think it’s worth burning yet more of our time in proving it to them (but just to them). So much for writing software and actually making Matrix better...

lykr0n 8y ago
Then automate the process or hire an administrator to deal with stuff like this. It's not the requester's fault that you can't handle compliance with a law efficiently.
- cm2012 8y ago
  That's what he's doing. And it costs a lot of money to do this.
  - wooter 8y ago
    the inability of gdpr advocates to assess or even acknowledge the true cost and negative consequences of this law is extremely unsettling. everything from "its completely easy to implement [even-though i'm not even referring to any particular business model]" to "it requires development of non-product related features but won't hurt startups" to "proving compliance isn't a burdensome cost to completely innocent companies" to "if you can't do it, you shouldn't exist anyways [even-though no one is forcing anyone to use anything]" to "it is vague to give our benevolent regulators ability to enforce it selectively [and somehow always perfectly]" ironically, this very blogger made all the same arguments here: https://jacquesmattheij.com/gdpr-hysteria https://jacquesmattheij.com/gdpr-hysteria his response to his current concern is: "then automate it" as if this is trivial. and "my blog is compliant" as if this means anything for even the most basic business model.
    - Maarten88 8y ago
      > the true cost and negative consequences of this law is extremely unsettling I think the cost of not having this law is much higher. Also, lots companies had few problems automating the dissemination of users personal information to dozens of interested parties, building completely automated markets for this information with derivatives trading etc, all without users (and regulators) knowing or understanding anything about these practices. It is long overdue to put a stop to the excesses, and as a EU citizen I am extremely happy with GDPR. There will be new opportunities for startups, hopefully GDPR can help make sure these opportunities are less detrimental to society than before.

arbuge 8y ago

I have a general question about this. If you have a privacy policy which discusses (amongst other things) the answers to these questions, would it be sufficient to just reply directing the customer to that privacy policy? i.e. let him dig out the answers he "needs" from there.

jacquesm 8y ago
In part this form letter seems to assume that all the burden is on the company, whereas if the company has already answered these questions in a public medium you could (1) take that as a signal that the claimant is a troll (otherwise they would have read your privacy policy) and (2) that they probably don't care about the answer, they're just looking for a reason to stir the pot, so any deficient answer will be used to contact the regulator. The best way to deal with that is to answer the request in detail (which makes it very unlikely that a regulator would follow up if there was a complaint) and to refer to public resources such as your privacy policy because that's something that indicates that the claimant didn't do their homework, which is something a regulator will use to weigh whether or not to follow up on the complaint.
- arbuge 8y ago
  > The best way to deal with that is to answer the request in detail I keep hearing this but I think in reality the volume of troll requests will dictate whether that is practical or not for any given company. Small startups might have problems if that volume is not proportionately small.
  - jacquesm 8y ago
    The problem would be in answering just one of these, then the amount of effort would be disproportionately large. But to answer a whole bunch of them is a 'mere matter of programming' unless you've really made a mess of things.
    - arbuge 8y ago
      That assumes the trolls will all use the same form letter with no variations, which might not be the case.

stevoski 8y ago

Jacques, thanks a million for your work on this topic. It makes me feel much more confident about being able to efficiently handle such a nightmare letter if it one day comes.

pawurb 8y ago

I've described how I'm preparing for GDPR as a solo developer running commercial side projects without a legal team to back me up: https://pawelurbanek.com/gdpr-compliance-blog-rails https://pawelurbanek.com/gdpr-compliance-blog-rails

donatj 8y ago

The vagueness of the meaning of "processing" PII is one of my handful of problems with GDPR. Is the mere act of having a unique index on an email address column a form of processing? I'd argue it is. It's can be construed really far.

bulatb 8y ago
Processing is defined in Article 4(2): > 2. ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ - BUT - Article 2(1) limits the whole GDPR to personal data "processed" in the context of a filing system, whether electronic or physical. In other words (in my non-lawyer reading): If I have your business card in my pocket, or I leave it on the table, or throw it away, I'm not "processing" your data in a covered way—even though I have it. If I put it in my stack of business cards or add you to my CRM, I am. https://gdpr-info.eu/art-2-gdpr/ https://gdpr-info.eu/art-2-gdpr/
- JumpCrisscross 8y ago
  > retrieval, consultation, use These three words can mean everything and nothing. It will take years to see how each of the EU's twenty-eight members' regulators take to interpreting them.
  - bulatb 8y ago
    I read this part as being broad, but not vague. Processing personal data means doing anything with it in any way, including simply having it. If the data takes part in a process you have, you're processing that data.
    - lucideer 8y ago

Saaster 8y ago

I updated my web service (solo dev, side project) with a GDPR compliant terms and privacy policy, got this form letter already from a few of my users. I have to tell, it's seriously depressing and I was contemplating shutting the whole side project down over the weekend.

donatj 8y ago
I have a tiny project in closed beta right now I've been working on in my spare time for 7 years I'm considering closing to the EU. The idea is even entirely privacy minded with all data save email address being client side encrypted so we never see it unencrypted. I never intended to make real money off it except maybe covering server costs if I'm lucky, but the time it would take dealing with requests like this it enough to scare anyone off.
- ColinWright 8y ago
  Broadly speaking, and noting that IANAL, etc, etc, ... I'm not sure what the problem is. Your obligation is to keep the data secure, and only keep data that you need. Then you need to respond to requests to (a) tell a person what data you hold on them, (b) tell them what you do with the data, and (c) delete it if asked, unless you have a legitimate reason to keep it. So if someone has given you data for the purpose of you providing a service then all you need to do is treat that data with care, don't do anything your customer doesn't expect you to do, and be able to provide and/or delete it. Fair do, someone disagrees and has down-voted me. Please, having read the actual regulations[0] several times, including the recitals[1], I'd be pleased to see what's missing from that outline, so I can improve my understanding. [0] https://gdpr-info.eu/ https://gdpr-info.eu/ [1] https://gdpr-info.eu/recitals/ https://gdpr-info.eu/recitals/
  - testvox 8y ago
    The problem is you have to do all that or face fines and lawsuits which is outside the risk envelope of most people's side projects.

ashelmire 8y ago

Step 1: be an American company with no European offices or accounts. Step 2: Ignore letters about GDPR. Alternatively, set up a form response to autosend whenever you get an email with some of those keywords.

pmlnr 8y ago
So anyone outside of US should ignore DMCA I believe? Just an example.
- c4h8o3del 8y ago
  Considering the DMCA is harmful and should never have passed? There's an ethical and moral aspect here you're ignoring.
  - pmlnr 8y ago
    I'm not questioning that; it's just one example.
- dazilcher 8y ago
  So you wouldn't have an issue implementing Chinese regulations?
  - pmlnr 8y ago
    I'm unaware of similar Chinese laws, can you please point me at them? To the official English translation I mean.
- ashelmire 8y ago
  Are you suggesting that countries outside of the US care about US copyright law? The Russian video streaming site I use sure doesn't. What about the pharma companies in India that copy American drugs (to the great benefit of humans worldwide)? US law does not rule in other sovereign nations.

ainiriand 8y ago

Please folks, GDPR investigations are only undertaken by the EU. No single actor can try to 'sue' you for infringment. The maximum they can do is to complain to the GDPR office in your country. And then, maybe, the office is gonna undertake an investigation. This whole is process can be a matter of years. Don't be afraid, if you receive one of those letters just ignore it.

vertex-four 8y ago
If your failure to comply with the GDPR has cost someone damages, they can recover those damages in civil court by suing you, though.
- gsnedders 8y ago
  But, unlike the US, in most (all?) of the EU, the most you can sue for damages is the total damages incurred (plus court expenses).
  - deleted 8y ago
    [deleted]
- 0x4f3759df 8y ago
  What's "damages"? Does "emotional distress" count?
  - vertex-four 8y ago
    Emotional distress isn’t a thing in the EU in general, and definitely not out of proportion to actual damages. If someone incurred costs as a result of your failure to comply with the GDPR, those would be damages. If, for some reason, they wound up in therapy as a result of your failure to comply and had to pay money/take holidays from work/etc for that, that’d be the closest thing to emotional distress we have.
- ainiriand 8y ago
  Fines are not always incurred for GDPR infringements. Sometimes you can be asked to delete the data, to block dealing with EU customers, etc...

kylnew 8y ago

I was having trouble visiting the article so I used a web archive link, in case it’s useful to anyone else https://web.archive.org/web/20180529120012/https://jacquesmattheij.com/so-your-start-up-receive-the-nightmare-gdpr-letter https://web.archive.org/web/20180529120012/https://jacquesma...

beilabs 8y ago

Website is blocked for pretty much everyone but the US? Just accessed from Nepal, blocked.....oh dear... Edit: apparently not blocked, but still can't connect apart from via VPN.

jacquesm 8y ago
No, there appear to be some connectivity issues of the non-obvious kind (apparently BGP related), the hosting provider is working on it and there are several work-arounds posted in this thread.

jacquesm 8y ago

Apparently there is some BGP related issue, if you can't reach the site directly here is a google cache link: https://webcache.googleusercontent.com/search?q=cache:QSStS_885I0J:https://jacquesmattheij.com/so-your-start-up-receive-the-nightmare-gdpr-letter+&cd=4&hl=en&ct=clnk&gl=nl https://webcache.googleusercontent.com/search?q=cache:QSStS_...

mlthoughts2018 8y ago

It seems like a lot of the comments are about one issue: - do you believe generally, even for an “upstanding” company you’ve done business with for a while, that commercial entities can be trusted with your data? If yes, you’ll see the template as overbearing and needlessly aggressive outside the context of some specific incident when a company proved to be untrustworthy. Especially if you operate a side project or business of your own, and believe you personally would not abuse consumer data collection, you’ll see it as rude in the best case, trollish resource wasting in the worst case. If you’re a consumer with a general mistrust of all commercial entities, even “upstanding” ones, when it comes to data practices, or if you just happen to believe that the potential risks for data abuse or harm are too high to be offset by anyone’s good intentions or past good behavior, then you’ll see this as a reasonable template, perhaps needing a few modifications for differing contexts, and that jumping straight away to legalese boilerplate just has to be assumed necessary when dealing with self-interested commercial entities.

jacquesm 8y ago
Sending boilerplate almost guarantees that a regulator will put your request at the bottom of the pile if you decide to take it to the next level unless the company responds in a way that shows their contempt for the law.
- mlthoughts2018 8y ago
  I think that will depend on how seriously GDPR non-compliance is treated. I’m hopeful some big corps will be heavily fined to set precedent and to ease concerns that GDPR is a mild form of regulatory capture intended to be misused (regardless of its wording) to asymmetrically inhibit new entrants and small firms.
  - ggg9990 8y ago
    But that’s what the big corps want. They’d gladly each cough up a billion for a permanent state where market entry is harder. Especially the easy to disrupt consumer services like Facebook and Snapchat.

zerostar07 8y ago

Nobody expects the Spanish Inquisition

emiliobumachar 8y ago

The lawyer who published the nightmare letter is not dumb at all, just ambitious and selfish. They're making a name for themselves and do not care about massive externalities.

deleted 8y ago

[deleted]

iaml 8y ago

Can someone tell me is it legal (or even viable) to just automatically completely remove all the information on the person sending those letters? Certainly beats banning whole EU by IP.

cm2012 8y ago

I just want to note how non-obvious compliance with GDPR is. Two experts on GDPR and privacy in this thread (Jacquesm and Ainiriand) have been disagreeing throughout the thread on just the basis of whether one should reply to GDPR complaints like this. Imagine how much up for interpretation the more gritty parts of the law will be.

msie 8y ago
And Jacquesm is saying don't be alarmed in some comments while in other comments he admits there could be problems with people trolling with this letter. So I'm even more skeptical of allowing any EU users.
- salvar 8y ago
  I think it would be best if people like you would just go ahead and block all EU users. There's so much "well I might just block them then!" going around these days, when you should just do it if you think it's the best approach.
- jacquesm 8y ago
  It's a very consistent position: no need to be alarmed, yes you will have to answer a letter like this, even if it is trolling. But if a letter like this alarms you then you probably have bigger problems.
  - Permit 8y ago
    It's alarming because you describe the letter as analogous to an "exploit toolkit" and we all know no patch is coming. Perhaps proponents of GDPR should have considered this very obvious weaponization of the law...
    - jacquesm 8y ago
      They did consider it, there is a pretty extensive part written on what can go into a DSAR and from what I can see this letter skirts the edge and in some places goes over it but on the whole it is not an unreasonable burden to deal with it as it is. Take into account the lengths to which companies will go to collect data, it stands to reason that in that context there is some balance to be found if a Data Subject makes a request about that collected data. If you don't collect data the request can be answered immediately and without further work.

throwaway13456 8y ago

I've said it many times, GDPR is such a waste of time and resources for startups unless your market is really EU. GDPR is super expensive to remain compliant, simply because of the broadness of the terms used, leading to undefined scope of liability. The cheapest way to stay compliant with GDPR is to completely block access to EU customers. In fact, this is what I did with my business. I redirect to a generic text file (not even a HTML that could trigger a GDPR clause by itself) explaining my stance.

3pt14159 8y ago
What? How does HTML trigger a GDPR while text file does not?
- throwaway13456 8y ago
  "Sorry, this site is for non-EU users only" something to that effect. A HTML can execute scripts (ie., collect data) while a text file does not, atleast that's my understanding.
  - tome 8y ago
    If that's your understanding then you have bigger problems than the GDPR.
blub 8y ago
It would probably be a problem if Google or MS did this, because lots of other companies and institutions (foolishly) depend on them instead of using OSS. I would be disappointed if Apple did it, but I have the feeling this law is an advantage for them. :) The rest of the companies threatening to block the EU are seriously overestimating their importance.

Ralfp 8y ago

What worries me most is how little is being said about private-operated sites. I am little Joe running internet forum about space battles with maybe 5 active users right now and no more than 100 active members historically. Should I sign data processing agreement with Google because I am using Gmail to send E-mails? Should I hire DPO? Am I risking my house being taken from me to cover multimilion fine because user posted their photo or e-mail 5 years ago and I’ve missed it because I don’t delete user-posted content together with their account?

jacquesm 8y ago
> What worries me most is how little is being said about private-operated sites. If you want I can research the matter in more detail, someone else came up with federated sites like Mastodon nodes and that's another pretty gray area. > I am little Joe running internet forum about space battles with maybe 5 active users right now and no more than 100 active members historically. Ok. > Should I sign data processing agreement with Google because I am using Gmail to send E-mails? No. You could try to stretch the law to include that particular example but from my reading of it this is perfectly acceptable. > Should I hire DPO? No, but you are the de-facto DPO, so if you receive a DSAR then you probably should answer it, though with your user counts I think the chances of that are very small. > Am I risking my house being taken from me to cover multimilion fine because user posted their photo or e-mail 5 years ago and I’ve missed it because I don’t delete user-posted content together with their account? No. But if a regulator should tell you that you should remove a users data (because you refused to for some reason or other) you probably should. The EU does not 'fine first and ask questions later', they will investigate first, warn and then when ignored they will fine. And for a small entity like yours which is more of a hobby than anything else I highly doubt regulators would even bother but you can't rule it out completely. Better increase you comet insurance as well if that's your main worry :)
- Mirioron 8y ago
  >No, but you are the de-facto DPO, so if you receive a DSAR then you probably should answer it, though with your user counts I think the chances of that are very small. I think that we might have this view about it right now, but I could easily see a scenario, where somebody targets you for "harassment" through something like this. Maybe you say something somebody else doesn't like on Twitter and they do that to you.

CryptoPunk 8y ago

The fact that you have to respond to an information request letter under the GDPR makes the legislation tyrannical. The idea that information about someone belongs to that person, no matter where it is stored, is a philosophically flawed perspective that if fully implemented, would lead to total global tyranny, by obligating people to do the work of disclosure and information deletion on demand, and ironically, by eradicating all privacy in relation to information people have about other people. You have no moral right to dictate what I remember about you, to compel me to disclose what I know about you, to compel me to disclose what steps I took to disremember you, or to restrict who I may relay the information I remember about you to. The GDPR empowers you to do all of these to me in the context of a web service.

notacoward 8y ago

Won't this DoS the regulators as well as the companies? Carpet-bombing everyone with DSARs is not just annoying but self-defeating. Even though the basic ideas behind GDPR seem pretty reasonable to me, the implementation so far is almost enough to make me join the "regulation is evil" crowd.

jacquesm 8y ago
Yes it will, which is why if you are serious sending a form letter is a bad decisions.

omegbule 8y ago

The only response this would get is 'you have been confirmed in our systems and your right to be forgotten has been processed. Thank you.'

cdevs 8y ago

I think the ridiculous thing is every mom and pop site and blog and website needs to be gdpr compliant? insane. If the true intent was to make sure large players have their system in check then they should have simply said if you have 50,000 or more users giving you data a month or something to protect anyone interested in software from being afraid of having 2 users because now they need to read every international law. I know someone will fire back at this but what stop the United States from coming up with some law as well on the internet against how logins should be and then filing a lawsuit against every other country company that doesn’t comply. A business should follow the laws of based on the owners location and if other countries don’t like it then that’s for allies to group up and ask that minority country for change. gdpr to me is of reaching on the internet in a scary way.

JumpCrisscross 8y ago
> A business should follow the laws of based on the owners location This cuts against centuries of sovereign tradition and precedent. GDPR's constraint to users in Europe is reasonable. (As is refusing to do business in Europe by blocking the continent.)
- optimalKEK 8y ago
  EU is great and you anglos don't understand the visionary nature of this law and our leader, Jean-Claude Junker. Additionally, this law will create so many jobs, think about it for a second!
  - JumpCrisscross 8y ago
    Can't tell if you're trolling, here or when you said "authoritarianism is the only way to protect the people from runaway capitalism" [1]. [1] https://news.ycombinator.com/item?id=17099952 https://news.ycombinator.com/item?id=17099952
    - tome 8y ago
      Surely both.

ggg9990 8y ago

“GDPR is great and will cost nobody anything”

cdjk 8y ago

I'm waiting for the first time a GDPR DSAR deletion/retrieval portal is breached. Mass exfiltration or mass deletion are both great attack vectors.

jacquesm 8y ago
That's a legitimate concern.

ggg9990 8y ago

When you’re doing shitty work to comply with this shitty law, perhaps you can find some comfort in the fact that people have suffered more from stupid government policies, and that misbehavior of foreign governments is a persistent risk of international business. This is one place where the EU is vexingly successful — if it was just, say, France doing this, most companies under $1 billion would have no trouble just giving France the finger and blocking their users.

rdlecler1 8y ago

How do I know someone didn’t just steal someone’s username and password? I assume I should be asking for personally identifying information such as a password or ID? There is some irony here.

lgregg 8y ago

If only non-Europeans could do these requests. There are a few companies I'd love to know what they are doing with my data.

outside1234 8y ago

My approach for my startup is that if anyone sends me a Subject Access Letter that I thank them for being a customer, cancel their account, and delete their data. I note this in the terms of service up front to be transparent and totally comply with GDPR. Sadly, I think this is the lowest cost approach to dealing with the law, and removes the ability of an insane customer from causing us millions in liability.

arghwhat 8y ago
I think you should ask a lawyer about this approach. I would very much consider this to be non-compliant, as this is a form of transparency evasion. If it isn't directly addressed, it might be covered by whether the data handed out should be the data available at the time of the request, in which case it would be prior to you having a chance to delete it.
arghwhat 8y ago
I did some quick searching, and my gut feeling would appear to be correct: It is not legal to delete user data in order to avoid fulfilling a subject access request. It is okay if data has been routinely modified or deleted, but it must not be a result of the access request. Quoting the Information Commisioner's Office: Q: We have received a request but need to amend the data before sending out the response. Should we send out the “old” version? A: It is our view that a subject access request relates to the data held at the time the request was received. However, in many cases, routine use of the data may result in it being amended or even deleted while you are dealing with the request. So it would be reasonable for you to supply information you hold when you send out a response, even if this is different to that held when you received the request. However, it is not acceptable to amend or delete the data if you would not otherwise have done so. Under the DP Bill, it is an offence to make any amendment with the intention of preventing its disclosure.

relics443 8y ago

I'm beginning to highly doubt that anyone defending the GDPR has ever had any responsibilities that included: 1. Running a tech company 2. Funnels, conversions, and retentions 3. Writing software Either that or they just want to watch the world burn.

MartinMoore 8y ago

Thanks for the article, the insights are super. With GDPR it's honestly simply funny how people are only now starting to get the basics (if you are one of those - go check this out - https://www.omnisend.com/blog/gdpr-hub/ https://www.omnisend.com/blog/gdpr-hub/) of it, when they were suppose'd to know everything a long time ago. But still good.

dtougas 8y ago

Here's an idea: how about charging more for European users to access your site. If it is a cost issue, how about reflect that cost in the price of your service. So, if your web app is free for North American users, put it behind a paywall for Europeans. It's not ideal, but maybe if enough sites/services did that, it would help reflect the reality of the situation. Consider it a European service tax.

MockObject 8y ago

Am I right that the only risk for a small, side project for non-compliance are the EU legal sanctions should they grow to a significant enough size as to open an EU office? Other than they, why shouldn't a US side project ignore the DSARs?