5 ms·

The problem is you have to do all that or face fines and lawsuits which is outside the risk envelope of most people's side projects.

Radle 8y ago
Try to build a treehouse without following legal guidelines and see what happens to your side project. I frankyl don't understand why web site owners are entitled to a wild west, now-law zone?
- donatj 8y ago
  Treehouse is an odd yet apt choice as the laws vary highly by municipality. None of the treehouses I played in as a child were inspected or up to code. I think the argument to be made here anyway is the level of danger. You could die falling out of a treehouse, whereas the actual damages from mishandling a single users data is several magnitudes less.
  - freeflight 8y ago
    > You could die falling out of a treehouse, whereas the actual damages from mishandling a single users data is several magnitudes less. That's a very dangerous sentiment to have. Identity theft is a very real thing. You can do pretty horrible things impersonating other people, things that will lead to people ending up in jail, things that can ruin whole families and drive people into poverty, desperation, and suicide. It opens people up to blackmail, manipulation and a whole list of other, rather nasty, tactics. On the extreme end, there's also the fact that not everybody lives in a "free country". In many places saying the wrong things, even online, can have very final consequences. In such cases, you not taking proper care of your user's data, sharing or leaking it all over the place, can result in people vanishing in some torture dungeon never to be seen again.
    - tetromino_ 8y ago
      My entire, multi-year record of personal and financial information has been leaked and stolen at least 3 times, most recently from Equifax. In addition, certain of my passwords and financial and personal details were leaked at least a dozen times that I know about by various stores, restaurants, apps, and online forums. The consequences to me, personally? Not much. I haven't been blackmailed, I haven't been impersonated, jailed, or driven to suicide. And in this, I am not unique, not unusual. Probably at least half of the adult US population has had all their information leaked just like mine was. The overwhelming majority of them suffered few to no consequences.
      - aleksei 8y ago
        So your argument is that the unlucky minority can just get fucked?
        tetromino_ 8y ago
        My argument is that freeflight's apocalyptic image of the dangers of PII leakage and identity theft don't seem to match the actual experience of living in a country where PII leakage and identity theft are a norm.
        aleksei 8y ago
        The examples given were hardly "apocalyptic". And since there are accounts of all of them happening, it does seem to match the experience for some. Which leads me back to my initial interpretation of your comment.
      - tin4iii 8y ago
        Big lurker, just created this to throw in my anecdote. I know of a person that was targeted with identity theft. They are current fighting it in court. It is weird how they have to prove to the system that it wasn't them who registered some vehicle somewhere and were involved in a hit-and-run(while they were even outside of the country through that period of time). That person owns a transportation company and could possibly get their license suspended. They were paid a visit by the sheriff because the debt collectors were not seeing their money (thankfully the sheriff was understanding enough, because it did look like they were going to be arrested until the court date). The name was not even written correctly! But since it is a SIMILAR name and at your address, it is you! Sorry for the rant, I just don't think the people that are going through this have the time or will to sit and describe their crappy situation. Is everyone who got their identity stolen supposed to run to the press? Run to Equifax's office asking for their reimbursement? If so, I wish they can spell it out more clearly to those who do end up affected. I think we will hear more about these stories eventually, after everyone who got burned clears their names of whatever they were burned for and have the patience to sit and explain how crap hit the fan, because they took out a loan somewhere and didn't understand the consequences. Even if GDPR isn't perfect right now, it is a step in the right direction. It sounds to me like the whole industry has been mishandling data until this point, that it makes it okay for people to complain that new players wont be able to come in and continue the same ways. Sorry if this is not the proper reply format, I hope it is ok to reply to anecdotes with anecdotes.
- mrep 8y ago
  Why shouldn't they have that option? You chose to visit that website and input your data. You are completely free to not go there. Adding legal costs like this de-incentivizes website owners which is now causing websites to shutdown EU access which I don't like. I don't get why the EU thinks there are entitled to get content from the web while not abiding by the business model for targeted advertising companies.
- Mirioron 8y ago
  Is this why nobody actually builds treehouses for their kids anymore?
  - avip 8y ago
    We still build just tell your kids not to let any EU kids in
ColinWright 8y ago
Even if you're running a small side-project, you really should (a) not do things people don't expect, (b) be able to provide people with a copy of their data that you hold, and (c) delete their data if you're asked to (and you have no legitimate reason to keep it). That all seems completely reasonable to me. It's certainly reasonable that a new start-up or side-project should use these considerations as part of their design, and I should think that an existing start-up or side-project that does not comply should look hard at why not. If you think these demands are unreasonable, I'd genuinely be interested in knowing which, and why.
- Mirioron 8y ago
  Does it seem reasonable to you? Let me propose a scenario to you. Let's suppose that you commenting on Hacker News would mean that you must adequately respond to certain messages sent to you. If you don't do that then you can be fined. Does this sound like an environment that would encourage you to share your thoughts on Hacker News? Or does it sound more like an environment, where you would just not say anything and perhaps go elsewhere? It's unreasonable, because it imposes an administrative cost on anyone that tries to do things on the side regardless whether they have good data handling practices or whether they have any intention of abusing the data. I would bet money on the fact, that JUST the fact that they must respond to a letter is enough to make some people go do something else. And who knows, maybe the side project could've been the next google.
  - wooter 8y ago
    not to mention that, historically and intrinsically, visiting a site or using someones application is a voluntary activity. no one is forcing the user to do anything and the user shouldn't be able to force the developers to do anything.
  - ColinWright 8y ago
    My understanding is that if someone is not a customer, and I hold no data on them, then I can safely ignore any requests. At worst I can automate a response saying "I hold no data on you". For customers, how many requests would you expect? One in 100? One in 1000? If I store the data securely, and I only use it for the purpose it was intended, I can automate a response that (a) Sends them a copy of their data, (b) points them at the privacy policy saying I don't do anything unexpected with their data, and (c) offer a link to delete their data. Once set up, these should not place a significant burden on the provider of a service. I suspect we are arguing about how much work will be required. I'm saying that once set up, the administrative overhead is negligible, you are saying it isn't. Certainly the services I run have seen no increase in administrative load, I'd be interested to know who has seen a significant increase (once already set up) and why.

Radle 8y ago

Try to build a treehouse without following legal guidelines and see what happens to your side project. I frankyl don't understand why web site owners are entitled to a wild west, now-law zone?

donatj 8y ago
Treehouse is an odd yet apt choice as the laws vary highly by municipality. None of the treehouses I played in as a child were inspected or up to code. I think the argument to be made here anyway is the level of danger. You could die falling out of a treehouse, whereas the actual damages from mishandling a single users data is several magnitudes less.
- freeflight 8y ago
  > You could die falling out of a treehouse, whereas the actual damages from mishandling a single users data is several magnitudes less. That's a very dangerous sentiment to have. Identity theft is a very real thing. You can do pretty horrible things impersonating other people, things that will lead to people ending up in jail, things that can ruin whole families and drive people into poverty, desperation, and suicide. It opens people up to blackmail, manipulation and a whole list of other, rather nasty, tactics. On the extreme end, there's also the fact that not everybody lives in a "free country". In many places saying the wrong things, even online, can have very final consequences. In such cases, you not taking proper care of your user's data, sharing or leaking it all over the place, can result in people vanishing in some torture dungeon never to be seen again.
  - tetromino_ 8y ago
    My entire, multi-year record of personal and financial information has been leaked and stolen at least 3 times, most recently from Equifax. In addition, certain of my passwords and financial and personal details were leaked at least a dozen times that I know about by various stores, restaurants, apps, and online forums. The consequences to me, personally? Not much. I haven't been blackmailed, I haven't been impersonated, jailed, or driven to suicide. And in this, I am not unique, not unusual. Probably at least half of the adult US population has had all their information leaked just like mine was. The overwhelming majority of them suffered few to no consequences.
    - aleksei 8y ago
      So your argument is that the unlucky minority can just get fucked?
      - tetromino_ 8y ago
        My argument is that freeflight's apocalyptic image of the dangers of PII leakage and identity theft don't seem to match the actual experience of living in a country where PII leakage and identity theft are a norm.
        aleksei 8y ago
        The examples given were hardly "apocalyptic". And since there are accounts of all of them happening, it does seem to match the experience for some. Which leads me back to my initial interpretation of your comment.
    - tin4iii 8y ago
      Big lurker, just created this to throw in my anecdote. I know of a person that was targeted with identity theft. They are current fighting it in court. It is weird how they have to prove to the system that it wasn't them who registered some vehicle somewhere and were involved in a hit-and-run(while they were even outside of the country through that period of time). That person owns a transportation company and could possibly get their license suspended. They were paid a visit by the sheriff because the debt collectors were not seeing their money (thankfully the sheriff was understanding enough, because it did look like they were going to be arrested until the court date). The name was not even written correctly! But since it is a SIMILAR name and at your address, it is you! Sorry for the rant, I just don't think the people that are going through this have the time or will to sit and describe their crappy situation. Is everyone who got their identity stolen supposed to run to the press? Run to Equifax's office asking for their reimbursement? If so, I wish they can spell it out more clearly to those who do end up affected. I think we will hear more about these stories eventually, after everyone who got burned clears their names of whatever they were burned for and have the patience to sit and explain how crap hit the fan, because they took out a loan somewhere and didn't understand the consequences. Even if GDPR isn't perfect right now, it is a step in the right direction. It sounds to me like the whole industry has been mishandling data until this point, that it makes it okay for people to complain that new players wont be able to come in and continue the same ways. Sorry if this is not the proper reply format, I hope it is ok to reply to anecdotes with anecdotes.
mrep 8y ago
Why shouldn't they have that option? You chose to visit that website and input your data. You are completely free to not go there. Adding legal costs like this de-incentivizes website owners which is now causing websites to shutdown EU access which I don't like. I don't get why the EU thinks there are entitled to get content from the web while not abiding by the business model for targeted advertising companies.
Mirioron 8y ago
Is this why nobody actually builds treehouses for their kids anymore?
- avip 8y ago
  We still build just tell your kids not to let any EU kids in

ColinWright 8y ago

Even if you're running a small side-project, you really should (a) not do things people don't expect, (b) be able to provide people with a copy of their data that you hold, and (c) delete their data if you're asked to (and you have no legitimate reason to keep it). That all seems completely reasonable to me. It's certainly reasonable that a new start-up or side-project should use these considerations as part of their design, and I should think that an existing start-up or side-project that does not comply should look hard at why not. If you think these demands are unreasonable, I'd genuinely be interested in knowing which, and why.

Mirioron 8y ago
Does it seem reasonable to you? Let me propose a scenario to you. Let's suppose that you commenting on Hacker News would mean that you must adequately respond to certain messages sent to you. If you don't do that then you can be fined. Does this sound like an environment that would encourage you to share your thoughts on Hacker News? Or does it sound more like an environment, where you would just not say anything and perhaps go elsewhere? It's unreasonable, because it imposes an administrative cost on anyone that tries to do things on the side regardless whether they have good data handling practices or whether they have any intention of abusing the data. I would bet money on the fact, that JUST the fact that they must respond to a letter is enough to make some people go do something else. And who knows, maybe the side project could've been the next google.
- wooter 8y ago
  not to mention that, historically and intrinsically, visiting a site or using someones application is a voluntary activity. no one is forcing the user to do anything and the user shouldn't be able to force the developers to do anything.
- ColinWright 8y ago
  My understanding is that if someone is not a customer, and I hold no data on them, then I can safely ignore any requests. At worst I can automate a response saying "I hold no data on you". For customers, how many requests would you expect? One in 100? One in 1000? If I store the data securely, and I only use it for the purpose it was intended, I can automate a response that (a) Sends them a copy of their data, (b) points them at the privacy policy saying I don't do anything unexpected with their data, and (c) offer a link to delete their data. Once set up, these should not place a significant burden on the provider of a service. I suspect we are arguing about how much work will be required. I'm saying that once set up, the administrative overhead is negligible, you are saying it isn't. Certainly the services I run have seen no increase in administrative load, I'd be interested to know who has seen a significant increase (once already set up) and why.