4 ms·

I think of it like outlawing chemical pollution of rivers. Yes, a Corporation that manages not to dump toxic waste in rivers is going to have a moat against sm

I think of it like outlawing chemical pollution of rivers. Yes, a Corporation that manages not to dump toxic waste in rivers is going to have a moat against smaller companies that do dump toxic waste in rivers. But I'd rather it be illegal than have companies competing for who can externalize their costs more effectively by passing their problem of waste management to the state / local area.

echelon 8y ago
I'm not talking about corporations which have the means and the resources to engineer data pipelines that can be scrubbed and lawyers to deal with compliance. I'm speaking to the issue of you or I creating an MVP with a few months of dedicated hard work. How much extra time has to be spent on putting in place a process for data deletion? I'm working on GDPR right now at my company, and it's not a small effort.
- it_learnses 8y ago
  It sounds like you don't really care about customer privacy and where their data ends up as long as you are able to deliver your "MVP". Please let me know what your company is so I would know to avoid it.
- adventured 8y ago
  > I'm speaking to the issue of you or I creating an MVP with a few months of dedicated hard work. How much extra time has to be spent on putting in place a process for data deletion? None. Do not target the EU initially, start in the US market with your MVP. It's by far the most liberal major market to do an MVP in, in all regards. It's the world's largest economy and easily accessible; plus you essentially get Canada as a bonus: a combined $21.5 trillion in economy. Entirely disregard GDPR until you've scaled the business enough to afford whatever you've calculated GDPR compliance will cost you in terms of effort / resources, then push into the EU when it's convenient.
  - cheald 8y ago
    That'd be fine if the GDPR were constrained to business done inside the EU, but it purports to exercise authority over any entity which asks for any information from any EU citizen, inside or outside of its borders. Enforcement and jurisdiction have yet to be tested yet, of course, but it isn't as simple as "don't set up shop in the EU".
    - grigjd3 8y ago
      Yeah, there is going to be a wealth of problems in this regard.
    - adventured 8y ago
      It doesn't matter what the EU purports, that's nothing more than a comical fantasy on their part. I live in the US, my business operates in the US, I operate by US law. It also doesn't matter what China purports I should do with their citizen data, or South Africa, or Australia, or Brazil: their wishes don't overrule the supremacy of US law inside the US. If China wants me to delete everything on my service about Tiananmen Square, or an anti-China activist, guess what, that's not going to happen for the exact same reason. I'm also not subject to the UK government's enforced media blackout on the Tommy Robinson arrest: they too can piss off. If a EU citizen signs up with my US based service, their data will be governed by US law. It is that simple. It will remain that simple. The US isn't going to cede its sovereignty to the EU: it's drastically more powerful than the EU in every regard. There is no scenario where the US lays back and allows the EU to legislate how the domestic US economy operates in such large ways. The only likely outcome is that the US comes up with its own new privacy rules in the next few years, which will be different - more lenient - than GDPR. If you want to operate in the two markets, you'll have to comply with each approach accordingly.
      - cheald 8y ago
        I'd like to think that you're right, but I also don't want to be the guy that has to spend several hundred thousand dollars to defend that thesis in court.
- falcolas 8y ago
  > How much extra time has to be spent on putting in place a process for data deletion? Account for deletion when designing the product. When considered from the beginning, the cost is typically negligible. It's only when shoehorned on the end that it gets expensive. But... companies have had two years of notice about this. Any projects that have been running for fewer than two years have had plenty of notice. And it's not only the government who requires data deletion - it's your data sources (like Twitter) and your big customers who write it into their contracts. Just plan for being able to delete data. You are gonna need it.
hshehehjdjdjd 8y ago
The only difference is that dumping toxic waste in rivers does actual, concrete harm. Targeted advertising? The worst I’ve heard about it is that it makes some people feel a little icky. I suppose that’s a concrete harm in a sense but it seems a much less serious one, at least to me.
- Krasnol 8y ago
  > The worst I’ve heard about it is that it makes some people feel a little icky. Yeah sure, all that privacy, who needs it anyway? /s
  - conanbatt 8y ago
    Its interesting how one of the most frequent uses of the right to be forgotten is used by politicians cleaning up their search history. Who would have thought that legislators had something to gain from a proposal they push?
    - Angostura 8y ago
      Who would have thought that legislators would be aware of legislation.
  - hshehehjdjdjd 8y ago
    I’m sorry but this is not really a substantive objection to what I said. Yes, people have a vague preference for privacy. I never disputed that. No, failing to respect that preference has not caused material, externally visible harm.
    - Krasnol 8y ago
      We're not taking about some vague concept. For some of us it is part of the constitution. It's the RIGHT to privacy. Your attempts at downplaying it are the main vehicle of the advertisement industry and it's a disgrace at least. This ideology has educated those "people" to ignore that by hiding the means and downplaying the relevance. This law tries to at least regain some of the awareness that has been lost in the last decades and this is why the industry is crying so much.
JumpCrisscross 8y ago
> I think of it like outlawing chemical pollution of rivers Nobody disagrees with GDPR's intent. The qualm is with its administrative approach. If someone said "write a bailout for lawyers and lobbyists," it would look like GDPR. Taking your analogy, a good law would assess a fine for dumping. A bad law would (a) require continuous certification that one is not dumping and (b) allow anyone to prompt an expensive inspection (done via writing letter responses to a regulator, not on-site inspection by an expert) by reporting you to one of twenty-eight national regulators, each of which have jurisdiction over you. The former imposes a fixed costs, regardless of compliance. That benefits incumbents. The latter promotes venue shopping, a further advantage to size and incumbency.
- phicoh 8y ago
  Maybe it comes as a surprise, but there are places where if you generate industrial waste (even as a relatively small company) you have to be able to demonstrate that you get rid it in a responsible way. And if somebody complains with a local government that you are dumping waste in a particular way, they will send somebody over to investigate. Note that the European consumer protection laws already allow consumers to sue in their own country. So if you do business in all EU country, you can be sued in lots of places. Maybe if you are continuously worried about regulators, then it is better to not start a business. In the real world, regulators are busy enough. Regulators are not going to bother random companies in other countries just for the fun of it.
tomatotomato37 8y ago
It's not the technical aspect of not dumping into rivers that is the problem, its the administrative side of dealing with paperwork and inspectors verifying your business which is located 100 miles from the nearest river doesn't dump into a river In my opinion the GDPR should have tiered regulations based on global revenue. It's pretty hard to profit off of data and not have some sort of cash flow

echelon 8y ago

I'm not talking about corporations which have the means and the resources to engineer data pipelines that can be scrubbed and lawyers to deal with compliance. I'm speaking to the issue of you or I creating an MVP with a few months of dedicated hard work. How much extra time has to be spent on putting in place a process for data deletion? I'm working on GDPR right now at my company, and it's not a small effort.

it_learnses 8y ago
It sounds like you don't really care about customer privacy and where their data ends up as long as you are able to deliver your "MVP". Please let me know what your company is so I would know to avoid it.
adventured 8y ago
> I'm speaking to the issue of you or I creating an MVP with a few months of dedicated hard work. How much extra time has to be spent on putting in place a process for data deletion? None. Do not target the EU initially, start in the US market with your MVP. It's by far the most liberal major market to do an MVP in, in all regards. It's the world's largest economy and easily accessible; plus you essentially get Canada as a bonus: a combined $21.5 trillion in economy. Entirely disregard GDPR until you've scaled the business enough to afford whatever you've calculated GDPR compliance will cost you in terms of effort / resources, then push into the EU when it's convenient.
- cheald 8y ago
  That'd be fine if the GDPR were constrained to business done inside the EU, but it purports to exercise authority over any entity which asks for any information from any EU citizen, inside or outside of its borders. Enforcement and jurisdiction have yet to be tested yet, of course, but it isn't as simple as "don't set up shop in the EU".
  - grigjd3 8y ago
    Yeah, there is going to be a wealth of problems in this regard.
  - adventured 8y ago
    It doesn't matter what the EU purports, that's nothing more than a comical fantasy on their part. I live in the US, my business operates in the US, I operate by US law. It also doesn't matter what China purports I should do with their citizen data, or South Africa, or Australia, or Brazil: their wishes don't overrule the supremacy of US law inside the US. If China wants me to delete everything on my service about Tiananmen Square, or an anti-China activist, guess what, that's not going to happen for the exact same reason. I'm also not subject to the UK government's enforced media blackout on the Tommy Robinson arrest: they too can piss off. If a EU citizen signs up with my US based service, their data will be governed by US law. It is that simple. It will remain that simple. The US isn't going to cede its sovereignty to the EU: it's drastically more powerful than the EU in every regard. There is no scenario where the US lays back and allows the EU to legislate how the domestic US economy operates in such large ways. The only likely outcome is that the US comes up with its own new privacy rules in the next few years, which will be different - more lenient - than GDPR. If you want to operate in the two markets, you'll have to comply with each approach accordingly.
    - cheald 8y ago
      I'd like to think that you're right, but I also don't want to be the guy that has to spend several hundred thousand dollars to defend that thesis in court.
falcolas 8y ago
> How much extra time has to be spent on putting in place a process for data deletion? Account for deletion when designing the product. When considered from the beginning, the cost is typically negligible. It's only when shoehorned on the end that it gets expensive. But... companies have had two years of notice about this. Any projects that have been running for fewer than two years have had plenty of notice. And it's not only the government who requires data deletion - it's your data sources (like Twitter) and your big customers who write it into their contracts. Just plan for being able to delete data. You are gonna need it.

hshehehjdjdjd 8y ago

The only difference is that dumping toxic waste in rivers does actual, concrete harm. Targeted advertising? The worst I’ve heard about it is that it makes some people feel a little icky. I suppose that’s a concrete harm in a sense but it seems a much less serious one, at least to me.

Krasnol 8y ago
> The worst I’ve heard about it is that it makes some people feel a little icky. Yeah sure, all that privacy, who needs it anyway? /s
- conanbatt 8y ago
  Its interesting how one of the most frequent uses of the right to be forgotten is used by politicians cleaning up their search history. Who would have thought that legislators had something to gain from a proposal they push?
  - Angostura 8y ago
    Who would have thought that legislators would be aware of legislation.
- hshehehjdjdjd 8y ago
  I’m sorry but this is not really a substantive objection to what I said. Yes, people have a vague preference for privacy. I never disputed that. No, failing to respect that preference has not caused material, externally visible harm.
  - Krasnol 8y ago
    We're not taking about some vague concept. For some of us it is part of the constitution. It's the RIGHT to privacy. Your attempts at downplaying it are the main vehicle of the advertisement industry and it's a disgrace at least. This ideology has educated those "people" to ignore that by hiding the means and downplaying the relevance. This law tries to at least regain some of the awareness that has been lost in the last decades and this is why the industry is crying so much.

JumpCrisscross 8y ago

> I think of it like outlawing chemical pollution of rivers Nobody disagrees with GDPR's intent. The qualm is with its administrative approach. If someone said "write a bailout for lawyers and lobbyists," it would look like GDPR. Taking your analogy, a good law would assess a fine for dumping. A bad law would (a) require continuous certification that one is not dumping and (b) allow anyone to prompt an expensive inspection (done via writing letter responses to a regulator, not on-site inspection by an expert) by reporting you to one of twenty-eight national regulators, each of which have jurisdiction over you. The former imposes a fixed costs, regardless of compliance. That benefits incumbents. The latter promotes venue shopping, a further advantage to size and incumbency.

phicoh 8y ago
Maybe it comes as a surprise, but there are places where if you generate industrial waste (even as a relatively small company) you have to be able to demonstrate that you get rid it in a responsible way. And if somebody complains with a local government that you are dumping waste in a particular way, they will send somebody over to investigate. Note that the European consumer protection laws already allow consumers to sue in their own country. So if you do business in all EU country, you can be sued in lots of places. Maybe if you are continuously worried about regulators, then it is better to not start a business. In the real world, regulators are busy enough. Regulators are not going to bother random companies in other countries just for the fun of it.

tomatotomato37 8y ago

It's not the technical aspect of not dumping into rivers that is the problem, its the administrative side of dealing with paperwork and inspectors verifying your business which is located 100 miles from the nearest river doesn't dump into a river In my opinion the GDPR should have tiered regulations based on global revenue. It's pretty hard to profit off of data and not have some sort of cash flow