9 ms·

A consumer protection law like GDPR would probably be a good thing for US, but it's hard not to see this as SFDC saying, "As a multibillion-dollar SaaS vendor,

A consumer protection law like GDPR would probably be a good thing for US, but it's hard not to see this as SFDC saying, "As a multibillion-dollar SaaS vendor, we welcome regulation that might slow down or prevent a competitor from unseating us."

TAForObvReasons 8y ago
The hope is that in a new regulatory landscape we will see the emergence of new companies. Just because the tech unicorns of the last 10-15 years, like uber and facebook, were backed on odious behavior doesn't mean that a more palatable business model won't be discovered.
- Mahn 8y ago
  Since when has more regulation translated in more entrepreneurship?
  - hannasanarion 8y ago
    How is an entrepeneur with a sense of ethics supposed to compete in the current environment? When there is no regulation, the people with less scuples are the winners, not the people with better product.
  - criddell 8y ago
    I was thinking about this the other day. Didn't the HIPAA regulations create a whole new industry around the handling of patient records?
  - woogle 8y ago
    I think the point was something like “constraint forces creativity”
  - deleted 8y ago
    [deleted]
  - ufo 8y ago
    Currently, honest companies that respect the user's data cannot compete with companies that try to profit as much as possible from our it. I see this as similar to regulating pollution. Forbidding companies from cutting costs by polluting the air and the rivers allows for innovation and entrepreneurship in cleaner alternatives.
    - donarb 8y ago
      What? Apple's stance on user data privacy is a selling point in the market. They're not really hurting against other companies.
      - chomp 8y ago
        I hate iOS and love Android, the only thing keeping me buying iPhones is my support for Apple's user privacy compared to Google.
      - ufo 8y ago
        Apple can only do that because they rule their hardware platform with an iron fist. They also position themselves as a premium product and do not / cannot compete with google in terms of price. While apple products (and iOS specially) are very popular in the US, here in Brazil you almost never see them.
  - jogjayr 8y ago
    Off the top of my head, Obamacare led to the founding of Zenefits and other companies in that industry. The EPA's exhaust regulations in the 1970s arguably birthed the catalytic converter industry. If the regulation is costly enough or introduces sufficient compliance risk, the rise of an industry to help companies comply with it is almost inevitable.
epicmellon 8y ago
That's exactly what this is. GDPR is untenable and creates magical rights where none exist. You don't own information about you. Data is data. The only reasonable thing I can see out of it is getting companies to clarify (simplify) their EULAs.
- deleted 8y ago
  [deleted]
- lawlessone 8y ago
  >You don't own information about you. What are your credit card numbers? :)
  - epicmellon 8y ago
    (see my window shade example above)
  - sandworm101 8y ago
    CC numbers are something that you definitely do not own. You do not own your credit cards. They are the property of the corporations who issued them to you. That's why they can cancel/alter/confiscate them without going through the courts. Same too for credit ratings. The right to view and alter them comes from various other common law rule (ie slander) but the credit rating itself belongs to the corporation that generates it.
  - putlake 8y ago
    A better analogy is - what is your credit score?
- Uberphallus 8y ago
  GDPR isn't that much about the data, than about what's done with it.
- xevb3k 8y ago
  I used to think more like this. Then when I thought about it I decided that essentially all “ownership” rights are like this. Intellectual property and physical property laws are artificial. There is no basic right, they are all rights created where “none exist”. They can be useful though, and part of how we decide what kind of society we want to create. Seems like Europe has decided that privacy and control of data personal data is something they want.
Frondo 8y ago
Like I said the last time this subject came up, fine. That's totally fine. I don't care which incumbents will be okay in a world with better laws around privacy. I want better laws around privacy. If your startup to unseat Salesforce requires doing tricky or infelicitous shit with my personal data, I don't want you to be able to operate, full stop. Your business shouldn't exist, if its existence requires schlepping or selling my data in a bad way. The rights to privacy that some new laws could give us is simply more important than that.
- wyldfire 8y ago
  > If your startup to unseat Salesforce requires doing tricky or infelicitous shit with my personal data, I don't want you to be able to operate, full stop. Yeah, I'm onboard (like I said, I think the intent of the law is good) -- but regulatory compliance is expensive and in general creating a SaaS business is not. Compliance is more than just doing the right thing, BTW, it's creating processes, audits, attorneys, etc to prove that you're doing the right thing. One of SFDC's risks is that today a competitor could probably arrive and eat up their business by emulating their business model and undercutting their costs. They're very well placed to establish or enhance their existing regulatory compliance team(s).
  - Kalium 8y ago
    There's a tendency to think of well-intentioned regulations that serve whatever purpose someone wishes to advance as cheaply and easily complied with by an honest actor. This tends to not be maximally congruent with reality.
- Mahn 8y ago
  What if my startup does not require tricky or infelicitous shit with your personal data, but due to strict regulation I now require to hire a full time lawyer just to redact the company terms and keep up with regulations, and since my company does not yet make any revenue and I have no investors that means a lot more risk on my side, which in turns leads me to not start or not go on with that company at all? And what if this decrease in garage startups leads to less competition and more concentration of power for the big companies, which then can happily lobby and influence laws to their own interests with no one to contest them? Is that the deal that we want in exchange for mildly inconveniencing Facebook and Google?
dnomad 8y ago
What you don't realize is that the lawlessness around user data hurts big corporations too. If you're a big corporation collecting significant data than you've taken on a significant liability but the nature of this liability is amorphous. How much will it cost you if your data gets hacked? What will be the impact if you share the data with a partner and the partner gets hacked? How much can you share in your api? What if you sell the data to a foreign firm and that firm turns out to be the Russian government? What happens when a client sues you and claims you caused harm to her because you have the wrong data about her? Every corporation has to answer these questions but right now they have to do it with no real guidance from the government. This makes the data a ticking time bomb. It's not clear what can be done with it or even how much it's worth. It's not clear what best practices exist in terms of technologies and ethical guidelines. That said nobody expects something like the GDPR too happen in America. Pretty much every other country will adopt similar laws though. If Americans are lucky they'll get some benefit from that.
- whatshisface 8y ago
  >How much will it cost you if your data gets hacked? What will be the impact if you share the data with a partner and the partner gets hacked? Historically, these numbers have been $0.0+/-0. Executives aren't exactly bumbling around with hazardous materials.
  - hannasanarion 8y ago
    Tell that to Equifax.
    - criddell 8y ago
      Elizabeth Warren thinks it may end up making money for Equifax: https://www.marketplace.org/2018/02/28/tech/sen-elizabeth-warren-equifax-may-actually-make-money-breach https://www.marketplace.org/2018/02/28/tech/sen-elizabeth-wa...
  - atomic77 8y ago
    Interesting you should use the hazardous materials analogy - Bruce Schneier made a pretty convincing case two years ago that data should be considered a toxic asset. https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...
mbesto 8y ago
This is exactly why he's saying it. Anyone who follows Benioff and the Oracle ilk knows this. Which is why GDPR needs to be scaled appropriately so that it fosters innovation while still protecting customers interests. Having a lower bound of €10M in penalties with no respect to how much data the company holds is what makes this taxing for startups.
- icebraining 8y ago
  €10M is not the lower bound in penalties. It's the upper bound for breaches of data protection obligations (except for very large companies, with turnover >€500M/y).
  - _jn 8y ago
    I've got a gut feeling that judges will be pretty reasonable here, but I guess only time will tell.
  - mbesto 8y ago
    This is what I don't understand...how do you present two cases of "up to" and then say "whichever is higher"?! https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/ "Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:"
    - detaro 8y ago
      What's the problem with that? The "whichever is higher" doesn't refer to the fine, but to the limit it can be "up to". Something a bit more verbose could have been easier to understand, true, but there's no doubt about what it means.
      - mbesto 8y ago
        > but to the limit it can be "up to". So then why not just set it to a percent of revenue? If you're just going to slap a small company with minimal turnover with €1k fines anyway, then why the need for the "up to €10M" amount?
deleted 8y ago
[deleted]

TAForObvReasons 8y ago

The hope is that in a new regulatory landscape we will see the emergence of new companies. Just because the tech unicorns of the last 10-15 years, like uber and facebook, were backed on odious behavior doesn't mean that a more palatable business model won't be discovered.

Mahn 8y ago
Since when has more regulation translated in more entrepreneurship?
- hannasanarion 8y ago
  How is an entrepeneur with a sense of ethics supposed to compete in the current environment? When there is no regulation, the people with less scuples are the winners, not the people with better product.
- criddell 8y ago
  I was thinking about this the other day. Didn't the HIPAA regulations create a whole new industry around the handling of patient records?
- woogle 8y ago
  I think the point was something like “constraint forces creativity”
- deleted 8y ago
  [deleted]
- ufo 8y ago
  Currently, honest companies that respect the user's data cannot compete with companies that try to profit as much as possible from our it. I see this as similar to regulating pollution. Forbidding companies from cutting costs by polluting the air and the rivers allows for innovation and entrepreneurship in cleaner alternatives.
  - donarb 8y ago
    What? Apple's stance on user data privacy is a selling point in the market. They're not really hurting against other companies.
    - chomp 8y ago
      I hate iOS and love Android, the only thing keeping me buying iPhones is my support for Apple's user privacy compared to Google.
    - ufo 8y ago
      Apple can only do that because they rule their hardware platform with an iron fist. They also position themselves as a premium product and do not / cannot compete with google in terms of price. While apple products (and iOS specially) are very popular in the US, here in Brazil you almost never see them.
- jogjayr 8y ago
  Off the top of my head, Obamacare led to the founding of Zenefits and other companies in that industry. The EPA's exhaust regulations in the 1970s arguably birthed the catalytic converter industry. If the regulation is costly enough or introduces sufficient compliance risk, the rise of an industry to help companies comply with it is almost inevitable.

epicmellon 8y ago

That's exactly what this is. GDPR is untenable and creates magical rights where none exist. You don't own information about you. Data is data. The only reasonable thing I can see out of it is getting companies to clarify (simplify) their EULAs.

deleted 8y ago
[deleted]
lawlessone 8y ago
>You don't own information about you. What are your credit card numbers? :)
- epicmellon 8y ago
  (see my window shade example above)
- sandworm101 8y ago
  CC numbers are something that you definitely do not own. You do not own your credit cards. They are the property of the corporations who issued them to you. That's why they can cancel/alter/confiscate them without going through the courts. Same too for credit ratings. The right to view and alter them comes from various other common law rule (ie slander) but the credit rating itself belongs to the corporation that generates it.
- putlake 8y ago
  A better analogy is - what is your credit score?
Uberphallus 8y ago
GDPR isn't that much about the data, than about what's done with it.
xevb3k 8y ago
I used to think more like this. Then when I thought about it I decided that essentially all “ownership” rights are like this. Intellectual property and physical property laws are artificial. There is no basic right, they are all rights created where “none exist”. They can be useful though, and part of how we decide what kind of society we want to create. Seems like Europe has decided that privacy and control of data personal data is something they want.

Frondo 8y ago

Like I said the last time this subject came up, fine. That's totally fine. I don't care which incumbents will be okay in a world with better laws around privacy. I want better laws around privacy. If your startup to unseat Salesforce requires doing tricky or infelicitous shit with my personal data, I don't want you to be able to operate, full stop. Your business shouldn't exist, if its existence requires schlepping or selling my data in a bad way. The rights to privacy that some new laws could give us is simply more important than that.

wyldfire 8y ago
> If your startup to unseat Salesforce requires doing tricky or infelicitous shit with my personal data, I don't want you to be able to operate, full stop. Yeah, I'm onboard (like I said, I think the intent of the law is good) -- but regulatory compliance is expensive and in general creating a SaaS business is not. Compliance is more than just doing the right thing, BTW, it's creating processes, audits, attorneys, etc to prove that you're doing the right thing. One of SFDC's risks is that today a competitor could probably arrive and eat up their business by emulating their business model and undercutting their costs. They're very well placed to establish or enhance their existing regulatory compliance team(s).
- Kalium 8y ago
  There's a tendency to think of well-intentioned regulations that serve whatever purpose someone wishes to advance as cheaply and easily complied with by an honest actor. This tends to not be maximally congruent with reality.
Mahn 8y ago
What if my startup does not require tricky or infelicitous shit with your personal data, but due to strict regulation I now require to hire a full time lawyer just to redact the company terms and keep up with regulations, and since my company does not yet make any revenue and I have no investors that means a lot more risk on my side, which in turns leads me to not start or not go on with that company at all? And what if this decrease in garage startups leads to less competition and more concentration of power for the big companies, which then can happily lobby and influence laws to their own interests with no one to contest them? Is that the deal that we want in exchange for mildly inconveniencing Facebook and Google?

dnomad 8y ago

What you don't realize is that the lawlessness around user data hurts big corporations too. If you're a big corporation collecting significant data than you've taken on a significant liability but the nature of this liability is amorphous. How much will it cost you if your data gets hacked? What will be the impact if you share the data with a partner and the partner gets hacked? How much can you share in your api? What if you sell the data to a foreign firm and that firm turns out to be the Russian government? What happens when a client sues you and claims you caused harm to her because you have the wrong data about her? Every corporation has to answer these questions but right now they have to do it with no real guidance from the government. This makes the data a ticking time bomb. It's not clear what can be done with it or even how much it's worth. It's not clear what best practices exist in terms of technologies and ethical guidelines. That said nobody expects something like the GDPR too happen in America. Pretty much every other country will adopt similar laws though. If Americans are lucky they'll get some benefit from that.

whatshisface 8y ago
>How much will it cost you if your data gets hacked? What will be the impact if you share the data with a partner and the partner gets hacked? Historically, these numbers have been $0.0+/-0. Executives aren't exactly bumbling around with hazardous materials.
- hannasanarion 8y ago
  Tell that to Equifax.
  - criddell 8y ago
    Elizabeth Warren thinks it may end up making money for Equifax: https://www.marketplace.org/2018/02/28/tech/sen-elizabeth-warren-equifax-may-actually-make-money-breach https://www.marketplace.org/2018/02/28/tech/sen-elizabeth-wa...
- atomic77 8y ago
  Interesting you should use the hazardous materials analogy - Bruce Schneier made a pretty convincing case two years ago that data should be considered a toxic asset. https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...

mbesto 8y ago

This is exactly why he's saying it. Anyone who follows Benioff and the Oracle ilk knows this. Which is why GDPR needs to be scaled appropriately so that it fosters innovation while still protecting customers interests. Having a lower bound of €10M in penalties with no respect to how much data the company holds is what makes this taxing for startups.

icebraining 8y ago
€10M is not the lower bound in penalties. It's the upper bound for breaches of data protection obligations (except for very large companies, with turnover >€500M/y).
- _jn 8y ago
  I've got a gut feeling that judges will be pretty reasonable here, but I guess only time will tell.
- mbesto 8y ago
  This is what I don't understand...how do you present two cases of "up to" and then say "whichever is higher"?! https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/ "Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:"
  - detaro 8y ago
    What's the problem with that? The "whichever is higher" doesn't refer to the fine, but to the limit it can be "up to". Something a bit more verbose could have been easier to understand, true, but there's no doubt about what it means.
    - mbesto 8y ago
      > but to the limit it can be "up to". So then why not just set it to a percent of revenue? If you're just going to slap a small company with minimal turnover with €1k fines anyway, then why the need for the "up to €10M" amount?

deleted 8y ago

[deleted]