6 ms·

I think the GDPR is well intentioned and has provoked some important and useful conversations about how we make use of users’ data. But reading stuff like this

I think the GDPR is well intentioned and has provoked some important and useful conversations about how we make use of users’ data. But reading stuff like this makes me that much more inclined to use that Cloudflare option of IP blocking the whole continent. This feels like a very slippery and dangerous can of worms that’s not worth opening.

annabellish 8y ago
There's already a tonne of laws every company has to comply with. The GDPR isn't any more onerous than any of those, it's just new. Even the "nightmare letter" doesn't have anything unreasonable in it and the only reason why it might be difficult for a company to comply with would be that their internal systems and processes were already horrifying - something which we have now collectively deemed that permitting is causing more harm than good.
- cageface 8y ago
  What other laws do I have to comply with right now that are so vaguely defined and carry such horrifyingly punitive fees? I guess we'll have to wait and see how it's actually enforced but no other legal obligations I've had to consider so far when building products feel this threatening to smaller online businesses. It's bad enough we have to deal with patent trolls. I'm not inclined to add this to my risk profile.
  - fwdpropaganda 8y ago
    > What other laws (...) You can't sell guns and drugs online. If you're taking money, you have to make sure you know your customer (KYC). I would also like to hear other examples.
    - cageface 8y ago
      I feel like I have a pretty clear idea of the rules in the cases you describe. For GDPR I have no such confidence. It seems like the smart thing for US startups to do right now is ignore EU customers until they’ve validated the business idea enough to justify the engineering and legal expenses of taking this on.
      - fwdpropaganda 8y ago
        > I feel like I have a pretty clear idea of the rules in the cases you describe. For GDPR I have no such confidence. I seems reasonable, but I would argue it's due to the law being new, not to some intrinsic property of it, no?
      - empath75 8y ago
        The alternative is to not collect personal information from your customers.
        JumpCrisscross 8y ago
        > The alternative is to not collect personal information from your customers If that worked I'd embrace GDPR. Problem with "any consumer can make a complaint which requires expensive follow-up" regimes is one doesn't have to do anything wrong to incur costs. Someone can mis-interpret something and make a complaint. Now you have to interface with a regulator, which tends to be risky, expensive and time consuming.
        aninhumer 8y ago
        If you're not collecting any information "interfacing with the regulator" means replying to their email by saying "we're not collecting any information". (Assuming they even got that far, given that they'd likely take a look at your website and notice you aren't collecting any information.) I'm not sure what's risky, expensive or time consuming about that.
        JumpCrisscross 8y ago
        Consumer says “I think you’re lying” and forwards to their national data regulator. (This is as simple as writing an e-mail.) Data regulator now asks you questions. You must respond. Hopefully they agree with you. But maybe not! Twenty-eight regulators appointed by different political groups are a complex system. You will need to gain expertise on them or hire someone with it. All I’m saying is that time and money might be better used elsewhere. Particularly by someone just making side projects.
    - dwild 8y ago
      > You can't sell guns and drugs online. Don't care about that sphere of activity, never going to do any of theses. > If you're taking money, you have to make sure you know your customer (KYC). Can you be more precise? What are the laws about that and should'nt it be Paypal job to support that? Never wanted to compete with Paypal either.. Data is literally everywhere... that means GDPR apply to almost everything. Which is why you may see some people complains about being able to sell guns online but you will see much more people complains about GDPR.
      - fwdpropaganda 8y ago
        > Don't care about that sphere of activity, never going to do any of theses. > Can you be more precise? What are the laws about that and should'nt it be Paypal job to support that? Never wanted to compete with Paypal either.. So what you're saying is you couldn't care less unless it affects you. Got it. This is part of my point though. You're a perfect example of what I'm talking about. Who the hell doesn't know about KYC? You just woke up to the world and realized "oh shit, regulations exist! Unacceptable!". Yes, regulations exist, and this is just another one. > Data is literally everywhere... that means GDPR apply to almost everything. This isn't about data, it's about PII. And PII isn't everywhere, unless you're collecting it. > Which is why you may see some people complains about being able to sell guns online but you will see much more people complains about GDPR. No, that's not why. The reason why is that one has been around for a long time and people got used to it.
  - Fradow 8y ago
    Other laws you had to comply with where the ones the GDPR is replacing. Several EU country had very similar law. Idon't know about the fines about such laws though, since they were not enforced. Enforcement is what's going to matter, I'm pretty sure you could dig up other laws that are vague and have high fines, that are just not enforced and thus don't seem as threatening as the widely publicized GDPR. Of course, I'm not a lawyer, and I may very well be wrong on my assumptions. On the other hand, patent trolls are not part of the risk profile for our industry in the EU, since software is not patentable there. But anyway, it makes perfect business sense for a US startup to just block the EU (or at least state somewhere that they are not complying and thus EU users shouldn't sign up) and focus on their home market until they are big enough to comply with the terms (or are willing to take the risk).
  - tremon 8y ago
    The DMCA?
    - Mirioron 8y ago
      If you don't use copyrighted works then DMCA is going to be a much easier problem to deal with. We have plenty of precedents to look at to assess how the DMCA works as well.
      - salvar 8y ago
        > We have plenty of precedents Did these precedents take place before or after the DMCA was enacted?
- JumpCrisscross 8y ago
  > The GDPR isn't any more onerous than any of those, it's just new It’s different. “Complain and investigate” regulatory regimes are expensive to comply with. That is irrespective of whether one is doing anything wrong. These regimes aren’t inherently faulty. They’re quite good in the American securities business. But they create a palpable incumbency bias, as well as one towards those who can afford lawyers and make a useful phone call. Such a regime would have been ideal if constrained to large companies. Rolling it out for everyone means anyone mis-interpreting something could trigger a regulatory investigation. Even if found innocent at the end, that process is harrowing, expensive and distracting. Every jurisdiction has its costs and benefits. Europe is still a huge market. But if one doesn’t see enough revenues to justify a dedicated compliance person, it’s a market which may now make sense to delay going into.
  - heyoni 8y ago
    How about we just try it? Are you from the EU? File a complaint against my website and I’ll ignore it.
- 3pt14159 8y ago
  The problem is that there is a lower floor of a $20m fine. Big corps can risk a 4% hit, but for anyone struggling to get a small startup off the ground the fine is too onerous. As far as I'm concerned the process should be like this: 1. EU issues warning and cuts off traffic to the domain after 30 days. 2. Startup fixes GDPR compliance. 3. EU unblocks startup. Only after the company breaks GDPR after getting unblocked should they be hit with this massive fine. For those of us that don't give a shit about Europe it's so frustrating having to worry about how we have to comply. And before someone says something about "it's only for companies targeting the EU" that isn't as clear as people make it out to be. An errant ad, or a single conference talk, or even engagement on social media can be construed into requiring GDPR compliance. But of course the reason the EU didn't want to block corporations flouting the GDPR technically is because they saw the arms race happening in China and decided that they didn't want a second firewall. So instead they went the lazy route and they pushed the whole mess on small startups that aren't the problem in the first place. Large corporations are the problem. The fundamental design of the internet and web is the problem.
  - Tomte 8y ago
    > The problem is that there is a lower floor of a $20m fine I don‘t believe that you truly believe that, after it has been refuted a dozen times in every single GDPR discussion. There is no lower floor. There is not even an obligation to hand out fines.
    - Mirioron 8y ago
      There is nothing stopping them from doing so though. Maybe they're having a bad day or simply don't like you very much. Some of the data protection authorities have like one to two dozen people working at it total.
      - Tomte 8y ago
        There is a lot stopping them, namely the law itself and the courts. But that is irrelevant in this thread. There is no lower floor. That was a lie! The authorities can easily fine someone a thousand Euros or a million Euros.
- Mirioron 8y ago
  >Even the "nightmare letter" doesn't have anything unreasonable in it and the only reason why it might be difficult How about another reason: it simply increases administrative costs. If you have enough users firing these letters off then you could end up spending a significant amount of time simply responding to these letters. Something has to pay for all of that, and it's not like this cost is going to go away at some point, so the entire business model has to be set up in a way where it can just eat this cost.
robinwarren 8y ago
Note, I think, you also need to be GDPR compliant for EU users when they are not in the EU. So I don't think IP blocking actually works for 100% of cases. I would suggest not getting too hung up on this, it is showing you the worst outcome and assuming you have made a good effort to be compliant I should think things would be fine even then. No doubt you have Ts and Cs, that document is full of clauses put in place because of things like this, and any of them could probably result in a worse letter from a customer wanting to sue you over something. But I image also that hasn't happened to you yet either?
- jacquesm 8y ago
  > I think, you also need to be GDPR compliant for EU users when they are not in the EU. What you think does not align with my understanding of the GDPR, what makes you say this?
  - robinwarren 8y ago
    Fair enough, I did read this somewhere but it is obviously wrong now I check it out. Thanks!
- detaro 8y ago
  > Note, I think, you also need to be GDPR compliant for EU users when they are not in the EU. No, location is what matters. Of course one could argue if IP is a reliable indicator of location, given VPNs, potentially faulty GeoIP databases, ...
  - bulatb 8y ago
    Geoblocking EU users makes it fairly clear you don't intend to serve[0] them, at least in my opinion. If the only reason you could be in scope is offering your service in the Union, and you do your best to avoid that, you should probably be out of scope. We'll see what the regulators think. [0] From Recital 23: "[When deciding whether processing is in scope under Article 3(2)], it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union."
Gravityloss 8y ago
Maybe a competitor can do their business according to the GDPR then?
- michaelsjoeberg 8y ago
  it is the opposite. established companies have no issues with fees, or legal requests. gdpr is to protect the established companies from competition. it is basically a reverse china ban. because china-style banning of competition is still considered bad in the eu.
  - Gravityloss 8y ago
    So you consider it a big burden to a startup, to do business according to the GDPR? I'm no expert on the matter.
    - relics443 8y ago
      Yes. Besides for the administration costs incurred (which is probably the real killer), the list of death points are: 1. Adding a dialog as the first step in an onboarding funnel that's already difficult to get users through 2. Handling non-consent. WTF! So if the user doesn't give consent to something that 99% of the population doesn't understand, I'm not allowed to prevent them from using the app. And so my engineering team needs to waste critical hours figuring out things like how to deal with crashes, or maybe how in the fuck we're supposed to fallback to not using services that we're built on (e.g. Firebase)! 3. Dealing with the fallout of #1 in the form of bad reviews that are the kiss of death to startups
      - DmenshunlAnlsis 8y ago
        Handling non-consent. WTF! So if the user doesn't give consent to something that 99% of the population doesn't understand, I'm not allowed to prevent them from using the app. This is like a living, breathing example of why GDPR had to be written the way it was, so that arrogant techbros couldn’t rationalize their way around to screwing everyone over for a quick dollar. It’s also a perfect example of why you get zero sympathy. “But maaaa, it’s hurting my funnel!” Good.
kerkeslager 8y ago
> But reading stuff like this makes me that much more inclined to use that Cloudflare option of IP blocking the whole continent. Excellent. Then maybe some competitors will arise with products that are built with privacy in mind from the ground up.
- hartator 8y ago
  This fake new competitors are called unemployment, low innovation, and low growth. Bureaucracy never created jobs.
  - kerkeslager 8y ago
    I'd love to hear by what mechanism you think eliminating foreign competition will cause unemployment, low innovation, and low growth in European countries.
- relics443 8y ago
  Unfortunately those competitors will crash and burn when their users get pissed off at the opening dialog.
  - kerkeslager 8y ago
    You think that an opening dialog will annoy users more than having a service entirely blocked in their country?
    - relics443 8y ago
      So the rest of the world should get annoyed with the opening dialog, so that the EU doesn't have to get blocked? Sounds like this could be solved by a proper solution, which the GDPR is not.
      - kerkeslager 8y ago
        > So the rest of the world should get annoyed with the opening dialog, so that the EU doesn't have to get blocked? Nope. Surely you can think of a technical solution to this problem.

annabellish 8y ago

There's already a tonne of laws every company has to comply with. The GDPR isn't any more onerous than any of those, it's just new. Even the "nightmare letter" doesn't have anything unreasonable in it and the only reason why it might be difficult for a company to comply with would be that their internal systems and processes were already horrifying - something which we have now collectively deemed that permitting is causing more harm than good.

cageface 8y ago
What other laws do I have to comply with right now that are so vaguely defined and carry such horrifyingly punitive fees? I guess we'll have to wait and see how it's actually enforced but no other legal obligations I've had to consider so far when building products feel this threatening to smaller online businesses. It's bad enough we have to deal with patent trolls. I'm not inclined to add this to my risk profile.
- fwdpropaganda 8y ago
  > What other laws (...) You can't sell guns and drugs online. If you're taking money, you have to make sure you know your customer (KYC). I would also like to hear other examples.
  - cageface 8y ago
    I feel like I have a pretty clear idea of the rules in the cases you describe. For GDPR I have no such confidence. It seems like the smart thing for US startups to do right now is ignore EU customers until they’ve validated the business idea enough to justify the engineering and legal expenses of taking this on.
    - fwdpropaganda 8y ago
      > I feel like I have a pretty clear idea of the rules in the cases you describe. For GDPR I have no such confidence. I seems reasonable, but I would argue it's due to the law being new, not to some intrinsic property of it, no?
    - empath75 8y ago
      The alternative is to not collect personal information from your customers.
      - JumpCrisscross 8y ago
        > The alternative is to not collect personal information from your customers If that worked I'd embrace GDPR. Problem with "any consumer can make a complaint which requires expensive follow-up" regimes is one doesn't have to do anything wrong to incur costs. Someone can mis-interpret something and make a complaint. Now you have to interface with a regulator, which tends to be risky, expensive and time consuming.
        aninhumer 8y ago
        If you're not collecting any information "interfacing with the regulator" means replying to their email by saying "we're not collecting any information". (Assuming they even got that far, given that they'd likely take a look at your website and notice you aren't collecting any information.) I'm not sure what's risky, expensive or time consuming about that.
        JumpCrisscross 8y ago
        Consumer says “I think you’re lying” and forwards to their national data regulator. (This is as simple as writing an e-mail.) Data regulator now asks you questions. You must respond. Hopefully they agree with you. But maybe not! Twenty-eight regulators appointed by different political groups are a complex system. You will need to gain expertise on them or hire someone with it. All I’m saying is that time and money might be better used elsewhere. Particularly by someone just making side projects.
  - dwild 8y ago
    > You can't sell guns and drugs online. Don't care about that sphere of activity, never going to do any of theses. > If you're taking money, you have to make sure you know your customer (KYC). Can you be more precise? What are the laws about that and should'nt it be Paypal job to support that? Never wanted to compete with Paypal either.. Data is literally everywhere... that means GDPR apply to almost everything. Which is why you may see some people complains about being able to sell guns online but you will see much more people complains about GDPR.
    - fwdpropaganda 8y ago
      > Don't care about that sphere of activity, never going to do any of theses. > Can you be more precise? What are the laws about that and should'nt it be Paypal job to support that? Never wanted to compete with Paypal either.. So what you're saying is you couldn't care less unless it affects you. Got it. This is part of my point though. You're a perfect example of what I'm talking about. Who the hell doesn't know about KYC? You just woke up to the world and realized "oh shit, regulations exist! Unacceptable!". Yes, regulations exist, and this is just another one. > Data is literally everywhere... that means GDPR apply to almost everything. This isn't about data, it's about PII. And PII isn't everywhere, unless you're collecting it. > Which is why you may see some people complains about being able to sell guns online but you will see much more people complains about GDPR. No, that's not why. The reason why is that one has been around for a long time and people got used to it.
- Fradow 8y ago
  Other laws you had to comply with where the ones the GDPR is replacing. Several EU country had very similar law. Idon't know about the fines about such laws though, since they were not enforced. Enforcement is what's going to matter, I'm pretty sure you could dig up other laws that are vague and have high fines, that are just not enforced and thus don't seem as threatening as the widely publicized GDPR. Of course, I'm not a lawyer, and I may very well be wrong on my assumptions. On the other hand, patent trolls are not part of the risk profile for our industry in the EU, since software is not patentable there. But anyway, it makes perfect business sense for a US startup to just block the EU (or at least state somewhere that they are not complying and thus EU users shouldn't sign up) and focus on their home market until they are big enough to comply with the terms (or are willing to take the risk).
- tremon 8y ago
  The DMCA?
  - Mirioron 8y ago
    If you don't use copyrighted works then DMCA is going to be a much easier problem to deal with. We have plenty of precedents to look at to assess how the DMCA works as well.
    - salvar 8y ago
      > We have plenty of precedents Did these precedents take place before or after the DMCA was enacted?
JumpCrisscross 8y ago
> The GDPR isn't any more onerous than any of those, it's just new It’s different. “Complain and investigate” regulatory regimes are expensive to comply with. That is irrespective of whether one is doing anything wrong. These regimes aren’t inherently faulty. They’re quite good in the American securities business. But they create a palpable incumbency bias, as well as one towards those who can afford lawyers and make a useful phone call. Such a regime would have been ideal if constrained to large companies. Rolling it out for everyone means anyone mis-interpreting something could trigger a regulatory investigation. Even if found innocent at the end, that process is harrowing, expensive and distracting. Every jurisdiction has its costs and benefits. Europe is still a huge market. But if one doesn’t see enough revenues to justify a dedicated compliance person, it’s a market which may now make sense to delay going into.
- heyoni 8y ago
  How about we just try it? Are you from the EU? File a complaint against my website and I’ll ignore it.
3pt14159 8y ago
The problem is that there is a lower floor of a $20m fine. Big corps can risk a 4% hit, but for anyone struggling to get a small startup off the ground the fine is too onerous. As far as I'm concerned the process should be like this: 1. EU issues warning and cuts off traffic to the domain after 30 days. 2. Startup fixes GDPR compliance. 3. EU unblocks startup. Only after the company breaks GDPR after getting unblocked should they be hit with this massive fine. For those of us that don't give a shit about Europe it's so frustrating having to worry about how we have to comply. And before someone says something about "it's only for companies targeting the EU" that isn't as clear as people make it out to be. An errant ad, or a single conference talk, or even engagement on social media can be construed into requiring GDPR compliance. But of course the reason the EU didn't want to block corporations flouting the GDPR technically is because they saw the arms race happening in China and decided that they didn't want a second firewall. So instead they went the lazy route and they pushed the whole mess on small startups that aren't the problem in the first place. Large corporations are the problem. The fundamental design of the internet and web is the problem.
- Tomte 8y ago
  > The problem is that there is a lower floor of a $20m fine I don‘t believe that you truly believe that, after it has been refuted a dozen times in every single GDPR discussion. There is no lower floor. There is not even an obligation to hand out fines.
  - Mirioron 8y ago
    There is nothing stopping them from doing so though. Maybe they're having a bad day or simply don't like you very much. Some of the data protection authorities have like one to two dozen people working at it total.
    - Tomte 8y ago
      There is a lot stopping them, namely the law itself and the courts. But that is irrelevant in this thread. There is no lower floor. That was a lie! The authorities can easily fine someone a thousand Euros or a million Euros.
Mirioron 8y ago
>Even the "nightmare letter" doesn't have anything unreasonable in it and the only reason why it might be difficult How about another reason: it simply increases administrative costs. If you have enough users firing these letters off then you could end up spending a significant amount of time simply responding to these letters. Something has to pay for all of that, and it's not like this cost is going to go away at some point, so the entire business model has to be set up in a way where it can just eat this cost.

robinwarren 8y ago

Note, I think, you also need to be GDPR compliant for EU users when they are not in the EU. So I don't think IP blocking actually works for 100% of cases. I would suggest not getting too hung up on this, it is showing you the worst outcome and assuming you have made a good effort to be compliant I should think things would be fine even then. No doubt you have Ts and Cs, that document is full of clauses put in place because of things like this, and any of them could probably result in a worse letter from a customer wanting to sue you over something. But I image also that hasn't happened to you yet either?

jacquesm 8y ago
> I think, you also need to be GDPR compliant for EU users when they are not in the EU. What you think does not align with my understanding of the GDPR, what makes you say this?
- robinwarren 8y ago
  Fair enough, I did read this somewhere but it is obviously wrong now I check it out. Thanks!
detaro 8y ago
> Note, I think, you also need to be GDPR compliant for EU users when they are not in the EU. No, location is what matters. Of course one could argue if IP is a reliable indicator of location, given VPNs, potentially faulty GeoIP databases, ...
- bulatb 8y ago
  Geoblocking EU users makes it fairly clear you don't intend to serve[0] them, at least in my opinion. If the only reason you could be in scope is offering your service in the Union, and you do your best to avoid that, you should probably be out of scope. We'll see what the regulators think. [0] From Recital 23: "[When deciding whether processing is in scope under Article 3(2)], it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union."

Gravityloss 8y ago

Maybe a competitor can do their business according to the GDPR then?

michaelsjoeberg 8y ago
it is the opposite. established companies have no issues with fees, or legal requests. gdpr is to protect the established companies from competition. it is basically a reverse china ban. because china-style banning of competition is still considered bad in the eu.
- Gravityloss 8y ago
  So you consider it a big burden to a startup, to do business according to the GDPR? I'm no expert on the matter.
  - relics443 8y ago
    Yes. Besides for the administration costs incurred (which is probably the real killer), the list of death points are: 1. Adding a dialog as the first step in an onboarding funnel that's already difficult to get users through 2. Handling non-consent. WTF! So if the user doesn't give consent to something that 99% of the population doesn't understand, I'm not allowed to prevent them from using the app. And so my engineering team needs to waste critical hours figuring out things like how to deal with crashes, or maybe how in the fuck we're supposed to fallback to not using services that we're built on (e.g. Firebase)! 3. Dealing with the fallout of #1 in the form of bad reviews that are the kiss of death to startups
    - DmenshunlAnlsis 8y ago
      Handling non-consent. WTF! So if the user doesn't give consent to something that 99% of the population doesn't understand, I'm not allowed to prevent them from using the app. This is like a living, breathing example of why GDPR had to be written the way it was, so that arrogant techbros couldn’t rationalize their way around to screwing everyone over for a quick dollar. It’s also a perfect example of why you get zero sympathy. “But maaaa, it’s hurting my funnel!” Good.

kerkeslager 8y ago

> But reading stuff like this makes me that much more inclined to use that Cloudflare option of IP blocking the whole continent. Excellent. Then maybe some competitors will arise with products that are built with privacy in mind from the ground up.

hartator 8y ago
This fake new competitors are called unemployment, low innovation, and low growth. Bureaucracy never created jobs.
- kerkeslager 8y ago
  I'd love to hear by what mechanism you think eliminating foreign competition will cause unemployment, low innovation, and low growth in European countries.
relics443 8y ago
Unfortunately those competitors will crash and burn when their users get pissed off at the opening dialog.
- kerkeslager 8y ago
  You think that an opening dialog will annoy users more than having a service entirely blocked in their country?
  - relics443 8y ago
    So the rest of the world should get annoyed with the opening dialog, so that the EU doesn't have to get blocked? Sounds like this could be solved by a proper solution, which the GDPR is not.
    - kerkeslager 8y ago
      > So the rest of the world should get annoyed with the opening dialog, so that the EU doesn't have to get blocked? Nope. Surely you can think of a technical solution to this problem.