5 ms·

From one of his responses in the link "I do appreciate the links. The gdpr documentation is quite long and I lack the domain expertise to read and comprehend th

by crysin 8y ago

From one of his responses in the link "I do appreciate the links. The gdpr documentation is quite long and I lack the domain expertise to read and comprehend the document in full. Perhaps this is cultural, since the United States is a very litigious society, but I would not feel comfortable accepting liability for gdpr compliance without consulting an attorney. It is also unclear how I am expected to respond to DPA execution requests (what the hell is a DPA request?), which I have already received, and what penalties I could face if I fail to provide a sufficient response. Overall, it just seems like outsourcing to StackOverflow or Google Groups makes more sense. This way I can focus my time on making Drone better, as opposed to becoming a legal expert"

jimnotgym 8y ago
I think you are right about one thing, the misreading of European law that comes from living in a litigious society. Just act in good faith and GDPR will not bite.
- mmanfrin 8y ago
  Just act in good faith and GDPR will not bite. Do you have $20million to make that gamble?
  - foepys 8y ago
    Nobody will fine an open-source project that amount of money. The goal of GDPR is not to bankrupt anybody but to nudge them into compliance. If you aren't maliciously handling user data, you are not a target of high fines.
    - malcolmgreaves 8y ago
      Then why does the law not have this an an exemption?
      - tambre 8y ago
        Have what as an exemption? Not applying GDPR to small-time open source projects? Being open source doesn't suddenly make it fine to mishandle users' information.
      - bigbugbag 8y ago
        GDPR has exemptions built in but being open source project is not one.
  - beberlei 8y ago
    20 million is the max penalty for repeat offenders. See article 83 about fines being proportinate to the offense: https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/ This is a european thing, if any law says $x is the max fine or alike, then for a first time offense you usually get much less.
    - tlrobinson 8y ago
      "usually" is the problem.
      - beberlei 8y ago
        how is interpretation of the law not a problem with any law that was in effect before GDPR. It didn't stop anybody from starting businesses before and will not after.
        kodablah 8y ago
        It's punishment amounts. Laws should strive for minimal maximums and reasonable ranges to apply that interpretation in. We don't say every crime is punishable up to a life sentence for a reason. The more leeway the law provides, the more room for abuse (for either side). It would not have been hard to define multiple reasonable ranges, but sadly they think these values are what gives the law "teeth" (instead of actual enforcement which is what should provide it).
        beberlei 8y ago
        The EU had competition law before that mentions 10% of global turnover as a maximum fee, along with very detailed notes of how to set them: https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:2006:210:0002:0005:EN:PDF https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:... The Sherman Act also mentions a ceiling of 10 million, 3 years of prison for private persons. And from history we know antitrust authorities broke up companies like AT&T or Standard Oil, which seems to me a much bigger punishment. Both laws only mention the maximum fine. Yet you don't see small companies sweating over competition law.
  - matwood 8y ago
    First, that is the maximum. Second, no one scare mongered about the old maximum fines of £500k (which BTW were never used). https://government.diginomica.com/2017/08/10/ico-maximum-fines-gdpr-will-last-resort/ https://government.diginomica.com/2017/08/10/ico-maximum-fin...
  - jimnotgym 8y ago
    Let's not talk theory. I am making that gamble. Business is about risk judgement, and I have judged the risk to be miniscule.
  - bigbugbag 8y ago
    Or 4% of your world revenue whichever is largest. Then again you can stop brandishing this FUD as this kind of fine is not gonna happen to small actors. If you act in good faith and are found doing something wrong you'll receive a notification asking you to fix the issue. Why do people think EU is dumb and will start distributing 20M fines right and left at the first offense ? Just look at how it's done up until now and what CNIL said about how GDPR will be applied.
- _csoz 8y ago
  There are litigious people even here, though. Someone who has an axe to grind for whatever reason can keep annoying the DPA until they do go after you.
  - cpncrunch 8y ago
    No, that simply doesnt happen. Ive annoyed the ico in the uk many times and they refuse to do anything for one complaint. I recently got a 500gbp out of court settlement in a spam lawsuit that the ico did fuck all about.
    - DanBC 8y ago
      > that the ico did fuck all about. I think this is the really important bit that Americans are missing. We've had decades of regulation from ICO, and we've seen them do fuck all about a lot of stuff. GDPR isn't going to change their approach.
- djsumdog 8y ago
  We've seen a number of lawsuits posted here on HN with EU companies, either going after other EU companies, or US companies, or other EU <-> US <-> AU lawsuits. Sure a lot of it involves the bigger shops like Microsoft/Google/Facebook, etc .. but don't go saying it's not a litigious society. Lawsuits are used in a lost of western and eastern countries to try and right wrongs. Many of them use lawsuits to troll and money grab as well. It's not unique to the US.
  - Quanttek 8y ago
    FYI, there are no lawsuits with GDPR: You file a complaint with the relevant data protection agency and they then decide whether to pursue this. Should they do that, the company can dispute the claim and only then elgal proceedings would follow (agency v company, no potential award for person filing complaint)
  - bigbugbag 8y ago
    IANAL but my understanding is that contrary to US, several EU countries have limitations to what on can claim in court. Claim can not exceed damage. If you burn yourself with a hot coffee in a mc donalds your medical expense will covered and you might get a couple hundreds or a thousand while in the US you can be awarded millions in punitive damage by a jury. This limitations means there's less frivolous litigation in the EU, unless it's a rich person or entity trying to silence someone, then they will waste money on frivolous litigation until the other party is unable to take it anymore (SLAPPs) a well known example of this is what happened to journalist Denis Robert who went through 10 years of multiple litigations in several countries for daring to expose the money laundering scheme happening in the European banking system in Luxembourg.
lucb1e 8y ago
> The gdpr documentation is quite long and I lack the domain expertise to read and comprehend the document in full. As if he read all laws of his own country that apply to him. Raise your hand if you actually read and comprehend all laws that apply to you. I'm willing to bet there's not a single person on this planet who really reads and comprehends all laws completely. Usually you just go with common sense and reading a blog post or two when it seems relevant: that usually makes compliant and in the worst case it will get you a warning from the regulator (they give warnings for unintentional first-time violations, so they'll tell you if you're doing wrong and it bothers them enough (usually you're too small anyway), and you get a chance to improve).
- closeparen 8y ago
  >As if he read all laws of his own country that apply to him. Drone.ci is treating GDPR like any other law by steering well clear of the territory it regulates. The US also has stringent rules about online gambling, payment processing, pornography, copyrighted material, etc. Normal website operators don't become familiar with these rules or how to thread a business through them. They simply don't engage in regulated activity at all, unless making a deliberate and well-capitalized entrance with the help of lawyers and compliance professionals. (Obviously there are some high-profile counterexamples, but those are, well, high-profile). If the GDPR were a law about data brokerage or advertising, then forum operators would be similarly far away from it. But it's a law about the handling and storage of data related to people, which you definitely do if you're running a forum. Ordinary websites have never been that close to the boundaries of legality before, so people are scared.

by crysin 8y ago

jimnotgym 8y ago

I think you are right about one thing, the misreading of European law that comes from living in a litigious society. Just act in good faith and GDPR will not bite.

mmanfrin 8y ago
Just act in good faith and GDPR will not bite. Do you have $20million to make that gamble?
- foepys 8y ago
  Nobody will fine an open-source project that amount of money. The goal of GDPR is not to bankrupt anybody but to nudge them into compliance. If you aren't maliciously handling user data, you are not a target of high fines.
  - malcolmgreaves 8y ago
    Then why does the law not have this an an exemption?
    - tambre 8y ago
      Have what as an exemption? Not applying GDPR to small-time open source projects? Being open source doesn't suddenly make it fine to mishandle users' information.
    - bigbugbag 8y ago
      GDPR has exemptions built in but being open source project is not one.
- beberlei 8y ago
  20 million is the max penalty for repeat offenders. See article 83 about fines being proportinate to the offense: https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/ This is a european thing, if any law says $x is the max fine or alike, then for a first time offense you usually get much less.
  - tlrobinson 8y ago
    "usually" is the problem.
    - beberlei 8y ago
      how is interpretation of the law not a problem with any law that was in effect before GDPR. It didn't stop anybody from starting businesses before and will not after.
      - kodablah 8y ago
        It's punishment amounts. Laws should strive for minimal maximums and reasonable ranges to apply that interpretation in. We don't say every crime is punishable up to a life sentence for a reason. The more leeway the law provides, the more room for abuse (for either side). It would not have been hard to define multiple reasonable ranges, but sadly they think these values are what gives the law "teeth" (instead of actual enforcement which is what should provide it).
        beberlei 8y ago
        The EU had competition law before that mentions 10% of global turnover as a maximum fee, along with very detailed notes of how to set them: https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:2006:210:0002:0005:EN:PDF https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:... The Sherman Act also mentions a ceiling of 10 million, 3 years of prison for private persons. And from history we know antitrust authorities broke up companies like AT&T or Standard Oil, which seems to me a much bigger punishment. Both laws only mention the maximum fine. Yet you don't see small companies sweating over competition law.
- matwood 8y ago
  First, that is the maximum. Second, no one scare mongered about the old maximum fines of £500k (which BTW were never used). https://government.diginomica.com/2017/08/10/ico-maximum-fines-gdpr-will-last-resort/ https://government.diginomica.com/2017/08/10/ico-maximum-fin...
- jimnotgym 8y ago
  Let's not talk theory. I am making that gamble. Business is about risk judgement, and I have judged the risk to be miniscule.
- bigbugbag 8y ago
  Or 4% of your world revenue whichever is largest. Then again you can stop brandishing this FUD as this kind of fine is not gonna happen to small actors. If you act in good faith and are found doing something wrong you'll receive a notification asking you to fix the issue. Why do people think EU is dumb and will start distributing 20M fines right and left at the first offense ? Just look at how it's done up until now and what CNIL said about how GDPR will be applied.
_csoz 8y ago
There are litigious people even here, though. Someone who has an axe to grind for whatever reason can keep annoying the DPA until they do go after you.
- cpncrunch 8y ago
  No, that simply doesnt happen. Ive annoyed the ico in the uk many times and they refuse to do anything for one complaint. I recently got a 500gbp out of court settlement in a spam lawsuit that the ico did fuck all about.
  - DanBC 8y ago
    > that the ico did fuck all about. I think this is the really important bit that Americans are missing. We've had decades of regulation from ICO, and we've seen them do fuck all about a lot of stuff. GDPR isn't going to change their approach.
djsumdog 8y ago
We've seen a number of lawsuits posted here on HN with EU companies, either going after other EU companies, or US companies, or other EU <-> US <-> AU lawsuits. Sure a lot of it involves the bigger shops like Microsoft/Google/Facebook, etc .. but don't go saying it's not a litigious society. Lawsuits are used in a lost of western and eastern countries to try and right wrongs. Many of them use lawsuits to troll and money grab as well. It's not unique to the US.
- Quanttek 8y ago
  FYI, there are no lawsuits with GDPR: You file a complaint with the relevant data protection agency and they then decide whether to pursue this. Should they do that, the company can dispute the claim and only then elgal proceedings would follow (agency v company, no potential award for person filing complaint)
- bigbugbag 8y ago
  IANAL but my understanding is that contrary to US, several EU countries have limitations to what on can claim in court. Claim can not exceed damage. If you burn yourself with a hot coffee in a mc donalds your medical expense will covered and you might get a couple hundreds or a thousand while in the US you can be awarded millions in punitive damage by a jury. This limitations means there's less frivolous litigation in the EU, unless it's a rich person or entity trying to silence someone, then they will waste money on frivolous litigation until the other party is unable to take it anymore (SLAPPs) a well known example of this is what happened to journalist Denis Robert who went through 10 years of multiple litigations in several countries for daring to expose the money laundering scheme happening in the European banking system in Luxembourg.

lucb1e 8y ago

> The gdpr documentation is quite long and I lack the domain expertise to read and comprehend the document in full. As if he read all laws of his own country that apply to him. Raise your hand if you actually read and comprehend all laws that apply to you. I'm willing to bet there's not a single person on this planet who really reads and comprehends all laws completely. Usually you just go with common sense and reading a blog post or two when it seems relevant: that usually makes compliant and in the worst case it will get you a warning from the regulator (they give warnings for unintentional first-time violations, so they'll tell you if you're doing wrong and it bothers them enough (usually you're too small anyway), and you get a chance to improve).

closeparen 8y ago
>As if he read all laws of his own country that apply to him. Drone.ci is treating GDPR like any other law by steering well clear of the territory it regulates. The US also has stringent rules about online gambling, payment processing, pornography, copyrighted material, etc. Normal website operators don't become familiar with these rules or how to thread a business through them. They simply don't engage in regulated activity at all, unless making a deliberate and well-capitalized entrance with the help of lawyers and compliance professionals. (Obviously there are some high-profile counterexamples, but those are, well, high-profile). If the GDPR were a law about data brokerage or advertising, then forum operators would be similarly far away from it. But it's a law about the handling and storage of data related to people, which you definitely do if you're running a forum. Ordinary websites have never been that close to the boundaries of legality before, so people are scared.