3 ms·

And then they spend their entire free-time playing administrator on a service that doesn't make them any money. Time they could've spent on improving the servic

And then they spend their entire free-time playing administrator on a service that doesn't make them any money. Time they could've spent on improving the service. The alternative is that if they're outside the EU they just block the EU and if they're inside the EU then they abandon the project.

ColinWright 8y ago
> And then they spend their entire free-time playing administrator on a service that doesn't make them any money. Do you really think this is going to be a constant, relentless attack on your time? Do you really think that users of a service will constantly be sending DSARs? I run a few closed services as side-projects totalling a few thousand users. I've received exactly three DSARs, and those are from people who wanted to see if I had processes in place. I'm very surprised that people think the administrative load will be significant. But these are the underlying assumptions that can, and perhaps should, be explored. Broadly speaking, how many users will send in DSARs? One in ten? One in 100? One in 1000? How long will it take to respond to a request?
- Mirioron 8y ago
  If the service gets enough users? Perhaps it will. If I annoy the wrong person on Twitter, then I'm fairly certain I will be handling those requests for a while. Just out of curiosity, how long did it take you to respond to those requests? >But these are the underlying assumptions that can, and perhaps should, be explored. Broadly speaking, how many users will send in DSARs? One in ten? One in 100? One in 1000? >How long will it take to respond to a request? I don't know, but I do know that there are plenty of developers out there that would probably have a lot of trouble adequately responding to these kinds of requests. Particularly the people who might have some trouble with English, especially the type of English in these requests. I have no idea how those people are going to handle these situations.
  - ColinWright 8y ago
    > If the service gets enough users? Perhaps it will. If I annoy the wrong person on Twitter, then I'm fairly certain I will be handling those requests for a while. Anyone to whom you are not providing a service should not have any data released to them, so they can get a simple "I'm sorry, you're not a customer, and I hold no data on you." response. Anyone who is a customer and is sending vexatious requests - I'd refund them if appropriate and terminate their service. Especially for side-projects, you don't need the aggravation. In my case people were genuinely asking about actual data, and I took the time for the first to respond "by hand" - it took about ten minutes. The second time I documented what had been done the first, and parametrised it. Total time was about 15 minutes. The third time I ran the script by hand and checked the output. Total time was under three minutes. I'm pretty sure that after another two or three I can just let it run automatically. Time taken for subsequent queries? Probably none. And I agree that for some people, especially those for whom English is not their first language, would have trouble responding in English. It's not clear that they have to. But speaking about time taken, I'm now going to bow out. I've made my position and understanding as clear as I can. GDPR is here, and everyone can make their choice about what they do to be seen to comply. I wish you all good luck. http://www.paulgraham.com/schlep.html http://www.paulgraham.com/schlep.html
- dwild 8y ago
  > How long will it take to respond to a request? We are talking about side projects. You do that as an hobby. Any minute spend on ANYTHING else than what you like to do is a minute lost for no meaningful reason.
  - jacquesm 8y ago
    (1) that you do it as a hobby has no bearing on your relationship with your users (2) hobbies already cost time, money and effort, this adds a bit more to the time and effort factor, need not cost any money (3) if you decide you can't operate your hobby and be legal then you always have the option to shut down or (4) you can shut off your service for Europe after removing all data on EU citizens that you have collected. This is no different than any other regulation.

ColinWright 8y ago

> And then they spend their entire free-time playing administrator on a service that doesn't make them any money. Do you really think this is going to be a constant, relentless attack on your time? Do you really think that users of a service will constantly be sending DSARs? I run a few closed services as side-projects totalling a few thousand users. I've received exactly three DSARs, and those are from people who wanted to see if I had processes in place. I'm very surprised that people think the administrative load will be significant. But these are the underlying assumptions that can, and perhaps should, be explored. Broadly speaking, how many users will send in DSARs? One in ten? One in 100? One in 1000? How long will it take to respond to a request?

Mirioron 8y ago
If the service gets enough users? Perhaps it will. If I annoy the wrong person on Twitter, then I'm fairly certain I will be handling those requests for a while. Just out of curiosity, how long did it take you to respond to those requests? >But these are the underlying assumptions that can, and perhaps should, be explored. Broadly speaking, how many users will send in DSARs? One in ten? One in 100? One in 1000? >How long will it take to respond to a request? I don't know, but I do know that there are plenty of developers out there that would probably have a lot of trouble adequately responding to these kinds of requests. Particularly the people who might have some trouble with English, especially the type of English in these requests. I have no idea how those people are going to handle these situations.
- ColinWright 8y ago
  > If the service gets enough users? Perhaps it will. If I annoy the wrong person on Twitter, then I'm fairly certain I will be handling those requests for a while. Anyone to whom you are not providing a service should not have any data released to them, so they can get a simple "I'm sorry, you're not a customer, and I hold no data on you." response. Anyone who is a customer and is sending vexatious requests - I'd refund them if appropriate and terminate their service. Especially for side-projects, you don't need the aggravation. In my case people were genuinely asking about actual data, and I took the time for the first to respond "by hand" - it took about ten minutes. The second time I documented what had been done the first, and parametrised it. Total time was about 15 minutes. The third time I ran the script by hand and checked the output. Total time was under three minutes. I'm pretty sure that after another two or three I can just let it run automatically. Time taken for subsequent queries? Probably none. And I agree that for some people, especially those for whom English is not their first language, would have trouble responding in English. It's not clear that they have to. But speaking about time taken, I'm now going to bow out. I've made my position and understanding as clear as I can. GDPR is here, and everyone can make their choice about what they do to be seen to comply. I wish you all good luck. http://www.paulgraham.com/schlep.html http://www.paulgraham.com/schlep.html
dwild 8y ago
> How long will it take to respond to a request? We are talking about side projects. You do that as an hobby. Any minute spend on ANYTHING else than what you like to do is a minute lost for no meaningful reason.
- jacquesm 8y ago
  (1) that you do it as a hobby has no bearing on your relationship with your users (2) hobbies already cost time, money and effort, this adds a bit more to the time and effort factor, need not cost any money (3) if you decide you can't operate your hobby and be legal then you always have the option to shut down or (4) you can shut off your service for Europe after removing all data on EU citizens that you have collected. This is no different than any other regulation.