9 ms·

We already received one of these for Riot.im; kinda depressing that despite all the GDPR work we’ve done for Matrix (https://matrix.org/blog/2018/05/08/gdpr-com

We already received one of these for Riot.im; kinda depressing that despite all the GDPR work we’ve done for Matrix (https://matrix.org/blog/2018/05/08/gdpr-compliance-in-matrix/ https://matrix.org/blog/2018/05/08/gdpr-compliance-in-matrix... etc) folks think it’s worth burning yet more of our time in proving it to them (but just to them). So much for writing software and actually making Matrix better...

lykr0n 8y ago
Then automate the process or hire an administrator to deal with stuff like this. It's not the requester's fault that you can't handle compliance with a law efficiently.
- cm2012 8y ago
  That's what he's doing. And it costs a lot of money to do this.
  - wooter 8y ago
    the inability of gdpr advocates to assess or even acknowledge the true cost and negative consequences of this law is extremely unsettling. everything from "its completely easy to implement [even-though i'm not even referring to any particular business model]" to "it requires development of non-product related features but won't hurt startups" to "proving compliance isn't a burdensome cost to completely innocent companies" to "if you can't do it, you shouldn't exist anyways [even-though no one is forcing anyone to use anything]" to "it is vague to give our benevolent regulators ability to enforce it selectively [and somehow always perfectly]" ironically, this very blogger made all the same arguments here: https://jacquesmattheij.com/gdpr-hysteria https://jacquesmattheij.com/gdpr-hysteria his response to his current concern is: "then automate it" as if this is trivial. and "my blog is compliant" as if this means anything for even the most basic business model.
    - Maarten88 8y ago
      > the true cost and negative consequences of this law is extremely unsettling I think the cost of not having this law is much higher. Also, lots companies had few problems automating the dissemination of users personal information to dozens of interested parties, building completely automated markets for this information with derivatives trading etc, all without users (and regulators) knowing or understanding anything about these practices. It is long overdue to put a stop to the excesses, and as a EU citizen I am extremely happy with GDPR. There will be new opportunities for startups, hopefully GDPR can help make sure these opportunities are less detrimental to society than before.
      - deleted 8y ago
        [deleted]
      - wooter 8y ago
        > I think the cost of not having this law is much higher. There is no way you could know this and every indication to the contrary. Many EU countries are struggling with jobs and claiming to want a tech sector. This just made it much less likely. > There will be new opportunities for startups, The barrier to entry was raised. That means that startups which cannot afford proof of compliance will not exist - whether or not they meet your subjective definition of "detrimental to society."
        samdoidge 8y ago
        Why are we down-voting this post? The argument seems logical. Respond with counter-points instead, please..
        Maarten88 8y ago
        >> There is no way you could know this and every indication to the contrary. > Why are we down-voting this post? Responding to that will certainly not lead to new insights or good discussion. I did respond to the other point.
  - Faark 8y ago
    I wonder if there would have been a better middle ground by allowing to charge a fee for such requests, like some freedom of information law does. We wouldn't want to make it a strong deterrent against sending such requests to large companies, though, that should have automated the process anyway.
    - JumpCrisscross 8y ago
      Or just reserve the bulk of the law’s teeth to projects crossing a low global revenue boundary. Somewhere around €1 million per year, on average.
    - jacquesm 8y ago
      > I wonder if there would have been a better middle ground by allowing to charge a fee for such requests In some cases you can, but most GDPR DSARs are going to be free of charge.
- eadmund 8y ago
  > It's not the requester's fault that you can't handle compliance with a law efficiently. No, it's not: it's the government's fault for passing an over-large law.
  - lykr0n 8y ago
    You're right. Why should I have to spend my money to make sure I'm not polluting the environment? Make my products conform to safety regulations? Provide safe working conditions? Pay my taxes? It's all the governments fault for passing regulations that help consumers. Those fuckers.
    - wooter 8y ago
      many people disagree with preemptive, guilty until proven innocent regulation. many people also disagree with taxation in-so-far as they are not proportionate usage fees. And yes, certain regulations are definitely harmful. "But other regulations exist" isn't a valid excuse for any and all ever-increasing regulation.
      - lykr0n 8y ago
        Are you saying that there is no reason for GDPR to exist? None at all? It has nothing to do with all the data leaks that have happened, Facebook and Cambridge Analytica collecting information, invasive targeted ads?
        Godel_unicode 8y ago
        I didn't read their comment to be that black and white, but rather to say that the law is overly vague and hard to comply with. Surely not the first such complaint you've heard.
    - cm2012 8y ago
      If GDPR was an environment law, it would say, "Hurting the environment means you can be subject to a $20,000,000 fine." Which sounds great! Except the biggest thing most people can do to hurt the environment, by far, is international flights. And everyone is wondering if the law meant to cover flights. And lots of people are saying, "You shouldn't be flying far anyway." And one expert is saying, obviously flights are excluded, and another is saying, fines are very likely. Etc etc.
- mrlatinos 8y ago
  > It's not the requester's fault that you can't handle compliance with a law efficiently. You're right, it's the EU's.
ainiriand 8y ago
The letters are FUD. Take a look at the process: https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-role-edpb_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d...
- jacquesm 8y ago
  Please stop spreading incorrect (and identical) advice all over this thread. https://news.ycombinator.com/item?id=17178562 https://news.ycombinator.com/item?id=17178562
  - ainiriand 8y ago
    I only want to help users and creators. They should not be afraid of the GDPR. There is a lot of FUD around this topic and I guess that most of the people didn't even read the law. But I'm gonna take your advice anyways. There is plenty of information already for anyone concerned.
    - JumpCrisscross 8y ago
      You’re spreading patently false information. After being corrected in one thread, you repeat it in another. I’ve read the law, myself and with a lawyer. This is complicated stuff. Ignoring letters is a bad idea.
- dnomad 8y ago
  The letters aren't even smart FUD. This sort of stuff gets made up by dumb people to validate the fears of other dumb people. It's a kind of self-propaganda. The idea that rando customers can ask for arbitrary information like backup policies and safe-guards or the location of your servers is just silly. The SARs have clear, well-defined limits [1] and the response can and should be automated (once identity has been verified). [1] https://ico.org.uk/media/for-organisations/documents/2014223.. https://ico.org.uk/media/for-organisations/documents/2014223....
  - 8y ago
galieos_ghost 8y ago
Wouldn't be surprised to see some blackhat services come out that offer to drown competitors with these requests.
- ggg9990 8y ago
  I’ve already had my sister send one to the chief competitor of my side project.
  - deleted 8y ago
    [deleted]
  - specializeded 8y ago
    Cant see a reason not to honestly, especially if it’s valid. Swings and roundabouts innit
    - relics443 8y ago
      I think you mean "can't see a reason not to honestly, ONLY if it's valid". And even that's morally ambiguous.
Matticus_Rex 8y ago
Woke up to my second one today from a user who literally only had their name and email address in one entry in our system. And now, they still have their name and email in one entry in our system, but it's the record that we deleted the first entry at their request. Thanks for wasting half an hour of my day checking our systems, jerk.
- gcthomas 8y ago
  You had two years to sort out a quick procedure for doing this process, and it still took an hour and a half. Didn't you have a script to do that semi-automatically?
  - Matticus_Rex 8y ago
    Half an hour*. And I got hired when my US company figured out the GDPR was important about seven months ago. We're in a bunch of verticals with a lot of different systems that can't all be made to talk to one another. Some of it is semi-automatic, some can't be, and some could be but would require a ton of developer time.
    - gcthomas 8y ago
      Oh, only seven months to look at it? What were the lawyers doing all that time before then? IT techs here have been training for GDPR for the four years since the law was first designed.
      - wooter 8y ago
        > What were the lawyers doing all that time before then? IT techs here have been training for GDPR for the four years since the law was first designed. wow, and people claim this won't just destroy totally innocent startups.
        gcthomas 8y ago
        Any business trading internationally has to have a care over the regulatory environment of the target country. Why is internet trading any different? What I meant by the 'four years' comment was not that it takes that long to train, but that GDPR has been included in the training for that long. A four year run-up is plenty long enough for even start-ups to get themselves up to speed and design their systems for privacy by design.
DmenshunlAnlsis 8y ago
It’s the most self-inflicted wound in history, as an industry. Abusive practices, constant leaks, intrusive marketing, have all been building to a hefty backlash. It’s a shame that you’ve been caught up in the riptide, through no particular fault of your own, but this was inevitable. A whole industry can’t dick over the world’s population without blowback. The time for reasonable negotiations and slow change was probably a decade ago, not twenty years of abuse in. At this point nobody outside of the industry cares if people in the industry are hurting, they just want some privacy back.
- relics443 8y ago
  Really? Most of what I've seen from outside the industry is akin to "GET THIS ING DIALOG OFF MY SCREEN I HATE IT WHEN THE FIRST THING AN APP DOES IS SHOW A ING POINTLESS DIALOG WHEN I JUST WANT TO USE THE APP"

lykr0n 8y ago

Then automate the process or hire an administrator to deal with stuff like this. It's not the requester's fault that you can't handle compliance with a law efficiently.

cm2012 8y ago
That's what he's doing. And it costs a lot of money to do this.
- wooter 8y ago
  the inability of gdpr advocates to assess or even acknowledge the true cost and negative consequences of this law is extremely unsettling. everything from "its completely easy to implement [even-though i'm not even referring to any particular business model]" to "it requires development of non-product related features but won't hurt startups" to "proving compliance isn't a burdensome cost to completely innocent companies" to "if you can't do it, you shouldn't exist anyways [even-though no one is forcing anyone to use anything]" to "it is vague to give our benevolent regulators ability to enforce it selectively [and somehow always perfectly]" ironically, this very blogger made all the same arguments here: https://jacquesmattheij.com/gdpr-hysteria https://jacquesmattheij.com/gdpr-hysteria his response to his current concern is: "then automate it" as if this is trivial. and "my blog is compliant" as if this means anything for even the most basic business model.
  - Maarten88 8y ago
    > the true cost and negative consequences of this law is extremely unsettling I think the cost of not having this law is much higher. Also, lots companies had few problems automating the dissemination of users personal information to dozens of interested parties, building completely automated markets for this information with derivatives trading etc, all without users (and regulators) knowing or understanding anything about these practices. It is long overdue to put a stop to the excesses, and as a EU citizen I am extremely happy with GDPR. There will be new opportunities for startups, hopefully GDPR can help make sure these opportunities are less detrimental to society than before.
    - deleted 8y ago
      [deleted]
    - wooter 8y ago
      > I think the cost of not having this law is much higher. There is no way you could know this and every indication to the contrary. Many EU countries are struggling with jobs and claiming to want a tech sector. This just made it much less likely. > There will be new opportunities for startups, The barrier to entry was raised. That means that startups which cannot afford proof of compliance will not exist - whether or not they meet your subjective definition of "detrimental to society."
      - samdoidge 8y ago
        Why are we down-voting this post? The argument seems logical. Respond with counter-points instead, please..
        Maarten88 8y ago
        >> There is no way you could know this and every indication to the contrary. > Why are we down-voting this post? Responding to that will certainly not lead to new insights or good discussion. I did respond to the other point.
- Faark 8y ago
  I wonder if there would have been a better middle ground by allowing to charge a fee for such requests, like some freedom of information law does. We wouldn't want to make it a strong deterrent against sending such requests to large companies, though, that should have automated the process anyway.
  - JumpCrisscross 8y ago
    Or just reserve the bulk of the law’s teeth to projects crossing a low global revenue boundary. Somewhere around €1 million per year, on average.
  - jacquesm 8y ago
    > I wonder if there would have been a better middle ground by allowing to charge a fee for such requests In some cases you can, but most GDPR DSARs are going to be free of charge.
eadmund 8y ago
> It's not the requester's fault that you can't handle compliance with a law efficiently. No, it's not: it's the government's fault for passing an over-large law.
- lykr0n 8y ago
  You're right. Why should I have to spend my money to make sure I'm not polluting the environment? Make my products conform to safety regulations? Provide safe working conditions? Pay my taxes? It's all the governments fault for passing regulations that help consumers. Those fuckers.
  - wooter 8y ago
    many people disagree with preemptive, guilty until proven innocent regulation. many people also disagree with taxation in-so-far as they are not proportionate usage fees. And yes, certain regulations are definitely harmful. "But other regulations exist" isn't a valid excuse for any and all ever-increasing regulation.
    - lykr0n 8y ago
      Are you saying that there is no reason for GDPR to exist? None at all? It has nothing to do with all the data leaks that have happened, Facebook and Cambridge Analytica collecting information, invasive targeted ads?
      - Godel_unicode 8y ago
        I didn't read their comment to be that black and white, but rather to say that the law is overly vague and hard to comply with. Surely not the first such complaint you've heard.
  - cm2012 8y ago
    If GDPR was an environment law, it would say, "Hurting the environment means you can be subject to a $20,000,000 fine." Which sounds great! Except the biggest thing most people can do to hurt the environment, by far, is international flights. And everyone is wondering if the law meant to cover flights. And lots of people are saying, "You shouldn't be flying far anyway." And one expert is saying, obviously flights are excluded, and another is saying, fines are very likely. Etc etc.
mrlatinos 8y ago
> It's not the requester's fault that you can't handle compliance with a law efficiently. You're right, it's the EU's.

ainiriand 8y ago

The letters are FUD. Take a look at the process: https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-role-edpb_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d...

jacquesm 8y ago
Please stop spreading incorrect (and identical) advice all over this thread. https://news.ycombinator.com/item?id=17178562 https://news.ycombinator.com/item?id=17178562
- ainiriand 8y ago
  I only want to help users and creators. They should not be afraid of the GDPR. There is a lot of FUD around this topic and I guess that most of the people didn't even read the law. But I'm gonna take your advice anyways. There is plenty of information already for anyone concerned.
  - JumpCrisscross 8y ago
    You’re spreading patently false information. After being corrected in one thread, you repeat it in another. I’ve read the law, myself and with a lawyer. This is complicated stuff. Ignoring letters is a bad idea.
dnomad 8y ago
The letters aren't even smart FUD. This sort of stuff gets made up by dumb people to validate the fears of other dumb people. It's a kind of self-propaganda. The idea that rando customers can ask for arbitrary information like backup policies and safe-guards or the location of your servers is just silly. The SARs have clear, well-defined limits [1] and the response can and should be automated (once identity has been verified). [1] https://ico.org.uk/media/for-organisations/documents/2014223.. https://ico.org.uk/media/for-organisations/documents/2014223....
- 8y ago

galieos_ghost 8y ago

Wouldn't be surprised to see some blackhat services come out that offer to drown competitors with these requests.

ggg9990 8y ago
I’ve already had my sister send one to the chief competitor of my side project.
- deleted 8y ago
  [deleted]
- specializeded 8y ago
  Cant see a reason not to honestly, especially if it’s valid. Swings and roundabouts innit
  - relics443 8y ago
    I think you mean "can't see a reason not to honestly, ONLY if it's valid". And even that's morally ambiguous.

Matticus_Rex 8y ago

Woke up to my second one today from a user who literally only had their name and email address in one entry in our system. And now, they still have their name and email in one entry in our system, but it's the record that we deleted the first entry at their request. Thanks for wasting half an hour of my day checking our systems, jerk.

gcthomas 8y ago
You had two years to sort out a quick procedure for doing this process, and it still took an hour and a half. Didn't you have a script to do that semi-automatically?
- Matticus_Rex 8y ago
  Half an hour*. And I got hired when my US company figured out the GDPR was important about seven months ago. We're in a bunch of verticals with a lot of different systems that can't all be made to talk to one another. Some of it is semi-automatic, some can't be, and some could be but would require a ton of developer time.
  - gcthomas 8y ago
    Oh, only seven months to look at it? What were the lawyers doing all that time before then? IT techs here have been training for GDPR for the four years since the law was first designed.
    - wooter 8y ago
      > What were the lawyers doing all that time before then? IT techs here have been training for GDPR for the four years since the law was first designed. wow, and people claim this won't just destroy totally innocent startups.
      - gcthomas 8y ago
        Any business trading internationally has to have a care over the regulatory environment of the target country. Why is internet trading any different? What I meant by the 'four years' comment was not that it takes that long to train, but that GDPR has been included in the training for that long. A four year run-up is plenty long enough for even start-ups to get themselves up to speed and design their systems for privacy by design.

DmenshunlAnlsis 8y ago

It’s the most self-inflicted wound in history, as an industry. Abusive practices, constant leaks, intrusive marketing, have all been building to a hefty backlash. It’s a shame that you’ve been caught up in the riptide, through no particular fault of your own, but this was inevitable. A whole industry can’t dick over the world’s population without blowback. The time for reasonable negotiations and slow change was probably a decade ago, not twenty years of abuse in. At this point nobody outside of the industry cares if people in the industry are hurting, they just want some privacy back.

relics443 8y ago
Really? Most of what I've seen from outside the industry is akin to "GET THIS ING DIALOG OFF MY SCREEN I HATE IT WHEN THE FIRST THING AN APP DOES IS SHOW A ING POINTLESS DIALOG WHEN I JUST WANT TO USE THE APP"