10 ms·

USA needs law 'a lot like GDPR' says Salesforce CEO Marc Benioff

114 points by LinuxBender 8y ago

neya 8y ago
I think this has been discussed before - The whole foundation of SalesForce is absolutely tracking every inch of a user, who you were what whitepaper you downloaded, where you're from, which stage of the funnel you're in, which industry you belong to, what's your company size, what's its revenue and the list goes on.. So, this is pretty ridiculous coming from a CEO of such a company, but hey, any publicity is good publicity, right?
- deleted 8y ago
  [deleted]
- tarr11 8y ago
  I don't think he's lying. But the reasons he wants GDPR are probably just as calculating as you would expect: 1. They already had to do most of this work for GDPR already so the cost will be lower 2. By saying this, he can be invited to meet with legislators who will shape the law. 3. Smaller competitors or startups will be discouraged from entering the market due to an increased regulatory environment (similar to PCI) it's still probably a good idea but skepticism (and even cynicism) is certainly warranted
  - 3pt14159 8y ago
    There are three reasons in addition: 1. Insulating himself from future lawsuits. Judges look very favourably towards corporations that try to work with regulators before a crisis. 2. Legislating a fix reduces market demand for a technical fix. Imagine a world where a competitive platform to the internet / the web arises. In such a case if the public feels safe because of legislation then they're less likely to abandon the previous web. 3. Realistically speaking any action that would be devastating for Salesforce would be devastating for the US economy / intelligence apparatus; so either way there is going to be some measure of tracking for some amount of time. The real issue that Saleforce needs to handle is to ensure that it's ahead of its competitors and to do that it needs to see where the regulatory environment is going and plan its strategy around that.
    - curun1r 8y ago
      > ...would be devastating for Salesforce would be devastating for the US ... intelligence apparatus GDPR exempts law enforcement and the court system so I'm not sure why we'd expect US legislation to be any different.
      - 3pt14159 8y ago
        Much of the data that our intelligence agencies collect is through collaboration with private industry. If Salesforce employs hundreds of people to clean up data then that (and other companies like them) going away would make a measurable difference to what the intelligence agencies are capable of doing.
- lukasLansky 8y ago
  It's consistent to both want to change the rules and also to play acording to the current ones. You can think that taxing property is better than taxing income, but you still pay what your state says, not more, not less.
- shadowtree 8y ago
  You need a lot of software to manage and track consent, plus the history of all interactions for audit purposes. GDRP forces usage of a CRM. Just like every complication of tax law benefits HR Block, TurboTax, etc.
  - DanBC 8y ago
    GDPR doesn't force consent. GDPR forces companies to think about the data they collect, and why they collect it, and what they do with it once they've got it. They should be doing that wherever they are, otherwise you end up with eg Equifax leaking details of 130million users.
wyldfire 8y ago
A consumer protection law like GDPR would probably be a good thing for US, but it's hard not to see this as SFDC saying, "As a multibillion-dollar SaaS vendor, we welcome regulation that might slow down or prevent a competitor from unseating us."
- TAForObvReasons 8y ago
  The hope is that in a new regulatory landscape we will see the emergence of new companies. Just because the tech unicorns of the last 10-15 years, like uber and facebook, were backed on odious behavior doesn't mean that a more palatable business model won't be discovered.
  - Mahn 8y ago
    Since when has more regulation translated in more entrepreneurship?
    - hannasanarion 8y ago
      How is an entrepeneur with a sense of ethics supposed to compete in the current environment? When there is no regulation, the people with less scuples are the winners, not the people with better product.
    - criddell 8y ago
      I was thinking about this the other day. Didn't the HIPAA regulations create a whole new industry around the handling of patient records?
    - woogle 8y ago
      I think the point was something like “constraint forces creativity”
    - deleted 8y ago
      [deleted]
    - ufo 8y ago
      Currently, honest companies that respect the user's data cannot compete with companies that try to profit as much as possible from our it. I see this as similar to regulating pollution. Forbidding companies from cutting costs by polluting the air and the rivers allows for innovation and entrepreneurship in cleaner alternatives.
greatamerican 8y ago
Such a law will not survive a Constitutional challenge. Just rent seeking by an incumbent.
- dmoy 8y ago
  Could you elaborate? Most of us are not super well versed in constitutional law.
  - ocdtrekkie 8y ago
    The general claim people make suggesting things like Right To Be Forgotten or Right To Privacy is that it violates "free speech", and particularly, that via Citizens United, the US currently claims corporations have the right of free speech. Google believes, for instance, all limitations on how it provides search results as an infringement on Google's right to "say" whatever they want. Of course, we already have a variety of limitations on free speech, plenty of laws that restrict what companies and and cannot disclose about other entities, and GDPR would be no different.
    - kinsomo 8y ago
      > [a] Right To Privacy is that it violates "free speech" Copyright is settled law that definitely limits the kinds of speech people can engage in. Couldn't you construct a right to privacy by first saying an individual has an automatic ownership right to certain kinds of personal data [1], and that data can't be used without an appropriately constructed license [2]? [1] You might be able make this strong and compatible with the First Amendment, by treating machine-collected and person-collected data differently. A machine has no First Amendment right to speak about what it knows, while a person does. [2] The "appropriately constructed license" requirements could include GDPR-like definitions of consent.
      - ocdtrekkie 8y ago
        I, personally, do not believe there is any disagreement between the Constitution and GDPR. In fact, a right to privacy has long been inferred by combining traits of a few amendments: https://en.wikipedia.org/wiki/Right_to_privacy#United_States https://en.wikipedia.org/wiki/Right_to_privacy#United_States (Of course, that constructed right is a right to privacy specifically from government actions.) And generally, we've recognized that some rights such as speech, may need to have limits to avoid encroaching upon other rights, such as privacy.
ThomPete 8y ago
For big companies, this is a small problem to implement. For small companies, it's a big problem. I am all for protecting the consumer but GDPR is going too far with what I would call optics rather than actual consumer protection. I.e. things that look and sounds like they are protecting the user when they are really just adding more bureaucracy to the companies.
- throwaway2016a 8y ago
  While I agree with you I'll add another... For a new company that hasn't built the product yet this is a small(ish) problem to implement. New products can bake in privacy thinking directly from the first line of code. Who gets hit the hardest by this are small companies with legacy systems. Who don't necessarily have the budget to dive into the legacy stuff.
- realusername 8y ago
  > I am all for protecting the consumer but GDPR is going too far with what I would call optics rather than actual consumer protection Too far from what? Thanks to the GDPR, I received 100s of emails of services I never signed up for who scrapped my details from LinkedIn with bots. The industry went way too far with what would have been acceptable and that's why we need laws like this.
  - ThomPete 8y ago
    The law could simply punish those who do harm. All you are getting now is further boltering for those you end up being gamed to sign up for. I understand the pupose and intent of the law but it could have been done much more elegantly. Those who want to missuse your data will still do that they will just find another way to do it.
    - realusername 8y ago
      > The law could simply punish those who do harm That's exactly what the GDPR is doing I feel, you get punished for data misuse, it looks a good idea to reduce this kind of abuse. > All you are getting now is further boltering for those you end up being gamed to sign up for. I did not get gamed to sign up, they just scrapped my data and added me to their database, I did not do any action and they did not made me sign up with a trick (I also had a few of those yes but the majority are just data scrapping) > Those who want to missuse your data will still do that they will just find another way to do it. That's the argument you could make with every law basically. I also hear the same argument for car speeding "they could just drive faster at another place and not get caught". It's indeed true but it's not because there's still ways of misuse that we should abandon everything.
epicmellon 8y ago
Can we just take a step back and admit that treating an IP address as personal information is patently ridiculous?
- hsljekskfh 8y ago
  how about instead, we err on the side of privacy instead of billion dollar companies that don’t pay taxes for once.
- Karunamon 8y ago
  Doubly so when legal precedent exists that IP isn’t sufficient enough to identify a person.
  - bulatb 8y ago
    Current guidance, although not definitive, is that IPs and similar identifiers are personal data iff the processor/controller can identify a natural person by combining them with other data it can legally access.
  - bhaak 8y ago
    There's also legal precedent that IPs can be sufficient enough to identify a person.
    - wooter 8y ago
      and its absurd, rejected, and overturned. if i use your laptop, am i you?
  - Dylan16807 8y ago
    Maybe not to a "reasonable doubt" threshold, but it's a pretty strong identifier.
  - hannasanarion 8y ago
    Not to conclusively for all time identify a person, but that's not what we're talking about. It's still PII: personally identifiable information. Things that can be used to identify a person. A first and last name is also insufficient to identify a person, are you going to argue that names aren't personal?
hsljekskfh 8y ago
He is right. This has been a long time coming. Your stupid hot take about how he’s not practicing what he preaches, or how this is bad for innovation, or how better ads are a good thing, doesn’t matter. this is the most important piece of tech legislation at least since the dmca and it’s a courageous jump forward with some kinks that will get worked out.
mychael 8y ago
The US needs a law that exempts American businesses from GDPR if they have no presence in Europe.
- Double_a_92 8y ago
  If you don't do business in the EU you don't really have to care?
  - castlecrasher2 8y ago
    We'll see how this pans out but I'm not confident the legal system will prove logical, especially with something as vague as the GDPR.
    - andrepd 8y ago
      What's vague about GDPR? What's vague about its scope? It's all clearly laid out.
- jkaplowitz 8y ago
  GDPR only applies to American companies if they either have a presence in Europe (through an establishment or through a vendor processing personal data) or sufficiently deal with a clientele in Europe. If the US tried to override the second part unilaterally, Europe would probably ban exempted companies from dealing with European customers unless they opted into GDPR or would otherwise fall out of scope without the exemption. They'd therefore have trouble dealing with European banks, shipping companies with a presence in Europe, etc. Not to mention, what if Europe tried to exempt their companies from dealing with the annoying US laws? It would become a messy war of exemptions and consequences. This game of "we're too special to have to follow your laws even if we want your customers en masse" is a dangerous game to play.
- grive 8y ago
  This is already the case...
- lightbyte 8y ago
jiggliemon 8y ago
Can’t all this GDPR stuff be abstracted away into a framework? Or at least some kind of pattern/generator tooling? It seems like there’s room for an enterprise framework that does all the compliance work for you (for US gov contacts, i18n, user info download etc). Maybe calling it enterprise is a misnomer. Maybe it’s a spec that framework’s can target or comply with?
- trjordan 8y ago
  Salesforce, roughly speaking.
- Kalium 8y ago
  > Can’t all this GDPR stuff be abstracted away into a framework? Or at least some kind of pattern/generator tooling? I understand why you think this way! It's an obvious approach, where there's a bunch of stuff that needs to be done and it's the same everywhere. Why not just have a framework that handles it all for you? It's so clear! It's perhaps possible that many of the requirements of GDPR are beyond the scope of what any kind of framework or code pattern or generator might be reasonably expected to handle. Code cannot readily become a Data Protection Officer or respond to inbound requests. Code cannot address the need to identify and inform users affected by any breach. Code will likely struggle to do the vendor assurance required of all your Data Processors. You're absolutely right! There's excellent reason to have the technical requirements handled for you by a framework so you can focus on the important parts of your business. It's just perhaps possible that this could be less than the whole of GDPR.
  - jiggliemon 8y ago
    I get the process parts, that make more sense to have a human interface, can’t be abstracted out. However, maybe they can? Compliance as a service? Sounds like just the kind of Bay Area centric idea that VC’s love to fund. But it seems like there’s some commen sense patterns that our tooling should take up. A framework can take up the transparency, and user control aspects. Framework might be too narrow, platform might be more like it. Things like Wordpress, Magento or Shopify can be “GDPR compliant”.
olivermarks 8y ago
comments on the register article are good IMO
wooter 8y ago
as an american, no thank you. compelled speech is not okay
- hannasanarion 8y ago
  wtf? How is requiring you to be responsible for other people's information that you collected "compelled speech"? If you don't want the law to affect you, don't spy on people, it's that simple.
  - wooter 8y ago
    if you don't want to agree to my terms of service, don't use my service. don't force me to implement features and increase costs on other voluntary users. don't use products you don't want to use, its that simple.
- aoeusnth1 8y ago
  Is the HIPAA[1]'s privacy rule compelled speech? Do you believe corporations have a right to unlimited surveillance derived from their right to free speech? [1] See https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act#Privacy_Rule https://en.wikipedia.org/wiki/Health_Insurance_Portability_a... "The Privacy Rule gives individuals the right to request a covered entity to correct any inaccurate PHI." "The Privacy Rule requires covered entities to notify individuals of uses of their PHI. Covered entities must also keep track of disclosures of PHI and document privacy policies and procedures."
  - wooter 8y ago
    HIPAA does a lot of damage to innovation in healthcare research and industry. Still, I don't know why you assumes every law that exists is perfect justification for the a more expansive law. This is exactly why slippery slope is not a fallacy. The state always wants more power under the guise of providing safety.
kodablah 8y ago
Let's try something different. How about a smaller law requiring transparency first (not even the ability to delete or how to handle the data or that you have to have a certain appointed position or any other nonsense). Just transparency at first. The transparency requirements can be detailed, as food labeling is, but it doesn't need to require companies to provide users their data (just yet). Then, begin PSAs and public education awareness campaigns that show some of the harms of over collection of data, overuse of social media, lax approaches to information protection, acceptability of ad blocking solutions, etc (EDIT: rethinking this, I would no longer recommend this, at least at first). Then work on a law defining culpability of data breaches (i.e. data escaping its now-more-transparently defined intention). Also, consider grants to companies providing healthy privacy practices in the social media space (these should be small, measured, and for non-profits only of course). But I would just consider it, I wouldn't actually give them out just yet. All in all, this can be done w/ steps that don't rock companies. Also, what we're going to find out is that people are happy with the tradeoff that currently exists and you can't legislate that away from them without pissing them off.
pojkofd00m 8y ago
Ajit Pai disagree
fhrow4484 8y ago
There has already been a lot of discussion about GDPR in the recent weeks, but one thing that shocked me is that the regulation is seriously described like this: From https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/ https://ico.org.uk/for-organisations/guide-to-the-general-da... : > The GDPR does not specify how to make a valid request. Therefore, an individual can make a subject access request to you verbally or in writing. It can also be made to any part of your organisation (including by social media) and does not have to be to a specific person or contact point. > A request does not have to include the phrase 'subject access request' or Article 15 of the GDPR, as long as it is clear that the individual is asking for their own personal data. > This presents a challenge as any of your employees could receive a valid request. However, you have a legal responsibility to identify that an individual has made a request to you and handle it accordingly. In a normal world, I think only officers or registered agents can be addressed legal requests, how here any government though it was a good idea that "any of your employees could receive a valid request" and that it's a legal responsibility to handle it correctly. This is just mind blowing to me.
- marten-de-vries 8y ago
  Your customer service should know how to deal with product warranty. Or should be able to handle a request to cancel an online purchase for 14 days after the order ([1]). How is making a request to access your personal data different? [1]: https://europa.eu/youreurope/citizens/consumers/shopping/guarantees-returns/index_en.htm https://europa.eu/youreurope/citizens/consumers/shopping/gua...
- tokai 8y ago
  I suppose this is blowback from most of the large tech giants making it almost impossible to contact them as a user.
rhapsodic 8y ago
I would like to see the US enact a law that says US companies must grant their users in the US all of the benefits that they grant their non-US users under non-US laws. So small US companies would still be able to avoid onerous non-US laws by not doing business in those countries, but the big ones, who can't afford to forgo the market in the rest of the world but who can afford to comply with the laws there, will. And their US users will reap the benefits.

114 points by LinuxBender 8y ago

neya 8y ago

I think this has been discussed before - The whole foundation of SalesForce is absolutely tracking every inch of a user, who you were what whitepaper you downloaded, where you're from, which stage of the funnel you're in, which industry you belong to, what's your company size, what's its revenue and the list goes on.. So, this is pretty ridiculous coming from a CEO of such a company, but hey, any publicity is good publicity, right?

deleted 8y ago
[deleted]
tarr11 8y ago
I don't think he's lying. But the reasons he wants GDPR are probably just as calculating as you would expect: 1. They already had to do most of this work for GDPR already so the cost will be lower 2. By saying this, he can be invited to meet with legislators who will shape the law. 3. Smaller competitors or startups will be discouraged from entering the market due to an increased regulatory environment (similar to PCI) it's still probably a good idea but skepticism (and even cynicism) is certainly warranted
- 3pt14159 8y ago
  There are three reasons in addition: 1. Insulating himself from future lawsuits. Judges look very favourably towards corporations that try to work with regulators before a crisis. 2. Legislating a fix reduces market demand for a technical fix. Imagine a world where a competitive platform to the internet / the web arises. In such a case if the public feels safe because of legislation then they're less likely to abandon the previous web. 3. Realistically speaking any action that would be devastating for Salesforce would be devastating for the US economy / intelligence apparatus; so either way there is going to be some measure of tracking for some amount of time. The real issue that Saleforce needs to handle is to ensure that it's ahead of its competitors and to do that it needs to see where the regulatory environment is going and plan its strategy around that.
  - curun1r 8y ago
    > ...would be devastating for Salesforce would be devastating for the US ... intelligence apparatus GDPR exempts law enforcement and the court system so I'm not sure why we'd expect US legislation to be any different.
    - 3pt14159 8y ago
      Much of the data that our intelligence agencies collect is through collaboration with private industry. If Salesforce employs hundreds of people to clean up data then that (and other companies like them) going away would make a measurable difference to what the intelligence agencies are capable of doing.
lukasLansky 8y ago
It's consistent to both want to change the rules and also to play acording to the current ones. You can think that taxing property is better than taxing income, but you still pay what your state says, not more, not less.
shadowtree 8y ago
You need a lot of software to manage and track consent, plus the history of all interactions for audit purposes. GDRP forces usage of a CRM. Just like every complication of tax law benefits HR Block, TurboTax, etc.
- DanBC 8y ago
  GDPR doesn't force consent. GDPR forces companies to think about the data they collect, and why they collect it, and what they do with it once they've got it. They should be doing that wherever they are, otherwise you end up with eg Equifax leaking details of 130million users.

wyldfire 8y ago

A consumer protection law like GDPR would probably be a good thing for US, but it's hard not to see this as SFDC saying, "As a multibillion-dollar SaaS vendor, we welcome regulation that might slow down or prevent a competitor from unseating us."

TAForObvReasons 8y ago
The hope is that in a new regulatory landscape we will see the emergence of new companies. Just because the tech unicorns of the last 10-15 years, like uber and facebook, were backed on odious behavior doesn't mean that a more palatable business model won't be discovered.
- Mahn 8y ago
  Since when has more regulation translated in more entrepreneurship?
  - hannasanarion 8y ago
    How is an entrepeneur with a sense of ethics supposed to compete in the current environment? When there is no regulation, the people with less scuples are the winners, not the people with better product.
  - criddell 8y ago
    I was thinking about this the other day. Didn't the HIPAA regulations create a whole new industry around the handling of patient records?
  - woogle 8y ago
    I think the point was something like “constraint forces creativity”
  - deleted 8y ago
    [deleted]
  - ufo 8y ago
    Currently, honest companies that respect the user's data cannot compete with companies that try to profit as much as possible from our it. I see this as similar to regulating pollution. Forbidding companies from cutting costs by polluting the air and the rivers allows for innovation and entrepreneurship in cleaner alternatives.

greatamerican 8y ago

Such a law will not survive a Constitutional challenge. Just rent seeking by an incumbent.

dmoy 8y ago
Could you elaborate? Most of us are not super well versed in constitutional law.
- ocdtrekkie 8y ago
  The general claim people make suggesting things like Right To Be Forgotten or Right To Privacy is that it violates "free speech", and particularly, that via Citizens United, the US currently claims corporations have the right of free speech. Google believes, for instance, all limitations on how it provides search results as an infringement on Google's right to "say" whatever they want. Of course, we already have a variety of limitations on free speech, plenty of laws that restrict what companies and and cannot disclose about other entities, and GDPR would be no different.
  - kinsomo 8y ago
    > [a] Right To Privacy is that it violates "free speech" Copyright is settled law that definitely limits the kinds of speech people can engage in. Couldn't you construct a right to privacy by first saying an individual has an automatic ownership right to certain kinds of personal data [1], and that data can't be used without an appropriately constructed license [2]? [1] You might be able make this strong and compatible with the First Amendment, by treating machine-collected and person-collected data differently. A machine has no First Amendment right to speak about what it knows, while a person does. [2] The "appropriately constructed license" requirements could include GDPR-like definitions of consent.
    - ocdtrekkie 8y ago
      I, personally, do not believe there is any disagreement between the Constitution and GDPR. In fact, a right to privacy has long been inferred by combining traits of a few amendments: https://en.wikipedia.org/wiki/Right_to_privacy#United_States https://en.wikipedia.org/wiki/Right_to_privacy#United_States (Of course, that constructed right is a right to privacy specifically from government actions.) And generally, we've recognized that some rights such as speech, may need to have limits to avoid encroaching upon other rights, such as privacy.

ThomPete 8y ago

For big companies, this is a small problem to implement. For small companies, it's a big problem. I am all for protecting the consumer but GDPR is going too far with what I would call optics rather than actual consumer protection. I.e. things that look and sounds like they are protecting the user when they are really just adding more bureaucracy to the companies.

throwaway2016a 8y ago
While I agree with you I'll add another... For a new company that hasn't built the product yet this is a small(ish) problem to implement. New products can bake in privacy thinking directly from the first line of code. Who gets hit the hardest by this are small companies with legacy systems. Who don't necessarily have the budget to dive into the legacy stuff.
realusername 8y ago
> I am all for protecting the consumer but GDPR is going too far with what I would call optics rather than actual consumer protection Too far from what? Thanks to the GDPR, I received 100s of emails of services I never signed up for who scrapped my details from LinkedIn with bots. The industry went way too far with what would have been acceptable and that's why we need laws like this.
- ThomPete 8y ago
  The law could simply punish those who do harm. All you are getting now is further boltering for those you end up being gamed to sign up for. I understand the pupose and intent of the law but it could have been done much more elegantly. Those who want to missuse your data will still do that they will just find another way to do it.
  - realusername 8y ago
    > The law could simply punish those who do harm That's exactly what the GDPR is doing I feel, you get punished for data misuse, it looks a good idea to reduce this kind of abuse. > All you are getting now is further boltering for those you end up being gamed to sign up for. I did not get gamed to sign up, they just scrapped my data and added me to their database, I did not do any action and they did not made me sign up with a trick (I also had a few of those yes but the majority are just data scrapping) > Those who want to missuse your data will still do that they will just find another way to do it. That's the argument you could make with every law basically. I also hear the same argument for car speeding "they could just drive faster at another place and not get caught". It's indeed true but it's not because there's still ways of misuse that we should abandon everything.

epicmellon 8y ago

Can we just take a step back and admit that treating an IP address as personal information is patently ridiculous?

hsljekskfh 8y ago
how about instead, we err on the side of privacy instead of billion dollar companies that don’t pay taxes for once.
Karunamon 8y ago
Doubly so when legal precedent exists that IP isn’t sufficient enough to identify a person.
- bulatb 8y ago
  Current guidance, although not definitive, is that IPs and similar identifiers are personal data iff the processor/controller can identify a natural person by combining them with other data it can legally access.
- bhaak 8y ago
  There's also legal precedent that IPs can be sufficient enough to identify a person.
  - wooter 8y ago
    and its absurd, rejected, and overturned. if i use your laptop, am i you?
- Dylan16807 8y ago
  Maybe not to a "reasonable doubt" threshold, but it's a pretty strong identifier.
- hannasanarion 8y ago
  Not to conclusively for all time identify a person, but that's not what we're talking about. It's still PII: personally identifiable information. Things that can be used to identify a person. A first and last name is also insufficient to identify a person, are you going to argue that names aren't personal?

hsljekskfh 8y ago

He is right. This has been a long time coming. Your stupid hot take about how he’s not practicing what he preaches, or how this is bad for innovation, or how better ads are a good thing, doesn’t matter. this is the most important piece of tech legislation at least since the dmca and it’s a courageous jump forward with some kinks that will get worked out.

mychael 8y ago

The US needs a law that exempts American businesses from GDPR if they have no presence in Europe.

Double_a_92 8y ago
If you don't do business in the EU you don't really have to care?
- castlecrasher2 8y ago
  We'll see how this pans out but I'm not confident the legal system will prove logical, especially with something as vague as the GDPR.
  - andrepd 8y ago
    What's vague about GDPR? What's vague about its scope? It's all clearly laid out.
jkaplowitz 8y ago
GDPR only applies to American companies if they either have a presence in Europe (through an establishment or through a vendor processing personal data) or sufficiently deal with a clientele in Europe. If the US tried to override the second part unilaterally, Europe would probably ban exempted companies from dealing with European customers unless they opted into GDPR or would otherwise fall out of scope without the exemption. They'd therefore have trouble dealing with European banks, shipping companies with a presence in Europe, etc. Not to mention, what if Europe tried to exempt their companies from dealing with the annoying US laws? It would become a messy war of exemptions and consequences. This game of "we're too special to have to follow your laws even if we want your customers en masse" is a dangerous game to play.
grive 8y ago
This is already the case...
lightbyte 8y ago

jiggliemon 8y ago

Can’t all this GDPR stuff be abstracted away into a framework? Or at least some kind of pattern/generator tooling? It seems like there’s room for an enterprise framework that does all the compliance work for you (for US gov contacts, i18n, user info download etc). Maybe calling it enterprise is a misnomer. Maybe it’s a spec that framework’s can target or comply with?

trjordan 8y ago
Salesforce, roughly speaking.
Kalium 8y ago
> Can’t all this GDPR stuff be abstracted away into a framework? Or at least some kind of pattern/generator tooling? I understand why you think this way! It's an obvious approach, where there's a bunch of stuff that needs to be done and it's the same everywhere. Why not just have a framework that handles it all for you? It's so clear! It's perhaps possible that many of the requirements of GDPR are beyond the scope of what any kind of framework or code pattern or generator might be reasonably expected to handle. Code cannot readily become a Data Protection Officer or respond to inbound requests. Code cannot address the need to identify and inform users affected by any breach. Code will likely struggle to do the vendor assurance required of all your Data Processors. You're absolutely right! There's excellent reason to have the technical requirements handled for you by a framework so you can focus on the important parts of your business. It's just perhaps possible that this could be less than the whole of GDPR.
- jiggliemon 8y ago
  I get the process parts, that make more sense to have a human interface, can’t be abstracted out. However, maybe they can? Compliance as a service? Sounds like just the kind of Bay Area centric idea that VC’s love to fund. But it seems like there’s some commen sense patterns that our tooling should take up. A framework can take up the transparency, and user control aspects. Framework might be too narrow, platform might be more like it. Things like Wordpress, Magento or Shopify can be “GDPR compliant”.

olivermarks 8y ago

comments on the register article are good IMO

wooter 8y ago

as an american, no thank you. compelled speech is not okay

hannasanarion 8y ago
wtf? How is requiring you to be responsible for other people's information that you collected "compelled speech"? If you don't want the law to affect you, don't spy on people, it's that simple.
- wooter 8y ago
  if you don't want to agree to my terms of service, don't use my service. don't force me to implement features and increase costs on other voluntary users. don't use products you don't want to use, its that simple.
aoeusnth1 8y ago
Is the HIPAA[1]'s privacy rule compelled speech? Do you believe corporations have a right to unlimited surveillance derived from their right to free speech? [1] See https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act#Privacy_Rule https://en.wikipedia.org/wiki/Health_Insurance_Portability_a... "The Privacy Rule gives individuals the right to request a covered entity to correct any inaccurate PHI." "The Privacy Rule requires covered entities to notify individuals of uses of their PHI. Covered entities must also keep track of disclosures of PHI and document privacy policies and procedures."
- wooter 8y ago
  HIPAA does a lot of damage to innovation in healthcare research and industry. Still, I don't know why you assumes every law that exists is perfect justification for the a more expansive law. This is exactly why slippery slope is not a fallacy. The state always wants more power under the guise of providing safety.

kodablah 8y ago

Let's try something different. How about a smaller law requiring transparency first (not even the ability to delete or how to handle the data or that you have to have a certain appointed position or any other nonsense). Just transparency at first. The transparency requirements can be detailed, as food labeling is, but it doesn't need to require companies to provide users their data (just yet). Then, begin PSAs and public education awareness campaigns that show some of the harms of over collection of data, overuse of social media, lax approaches to information protection, acceptability of ad blocking solutions, etc (EDIT: rethinking this, I would no longer recommend this, at least at first). Then work on a law defining culpability of data breaches (i.e. data escaping its now-more-transparently defined intention). Also, consider grants to companies providing healthy privacy practices in the social media space (these should be small, measured, and for non-profits only of course). But I would just consider it, I wouldn't actually give them out just yet. All in all, this can be done w/ steps that don't rock companies. Also, what we're going to find out is that people are happy with the tradeoff that currently exists and you can't legislate that away from them without pissing them off.

pojkofd00m 8y ago

Ajit Pai disagree

fhrow4484 8y ago

There has already been a lot of discussion about GDPR in the recent weeks, but one thing that shocked me is that the regulation is seriously described like this: From https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/ https://ico.org.uk/for-organisations/guide-to-the-general-da... : > The GDPR does not specify how to make a valid request. Therefore, an individual can make a subject access request to you verbally or in writing. It can also be made to any part of your organisation (including by social media) and does not have to be to a specific person or contact point. > A request does not have to include the phrase 'subject access request' or Article 15 of the GDPR, as long as it is clear that the individual is asking for their own personal data. > This presents a challenge as any of your employees could receive a valid request. However, you have a legal responsibility to identify that an individual has made a request to you and handle it accordingly. In a normal world, I think only officers or registered agents can be addressed legal requests, how here any government though it was a good idea that "any of your employees could receive a valid request" and that it's a legal responsibility to handle it correctly. This is just mind blowing to me.

marten-de-vries 8y ago
Your customer service should know how to deal with product warranty. Or should be able to handle a request to cancel an online purchase for 14 days after the order ([1]). How is making a request to access your personal data different? [1]: https://europa.eu/youreurope/citizens/consumers/shopping/guarantees-returns/index_en.htm https://europa.eu/youreurope/citizens/consumers/shopping/gua...
tokai 8y ago
I suppose this is blowback from most of the large tech giants making it almost impossible to contact them as a user.

rhapsodic 8y ago

I would like to see the US enact a law that says US companies must grant their users in the US all of the benefits that they grant their non-US users under non-US laws. So small US companies would still be able to avoid onerous non-US laws by not doing business in those countries, but the big ones, who can't afford to forgo the market in the rest of the world but who can afford to comply with the laws there, will. And their US users will reap the benefits.