5 ms·

Or perhaps they've been advised that because they have an email subscription, they'd need to hire a full time DPO, and their outside counsel quoted them several

Or perhaps they've been advised that because they have an email subscription, they'd need to hire a full time DPO, and their outside counsel quoted them several thousand dollars a year. It's simple arithmetic to decide it's cheaper to block all EU visitors.

nextlevelwizard 8y ago
Nothing of value was lost. Good riddance!
oblio 8y ago
> they'd need to hire a full time DPO They don't. They need to designate someone as the DPO, it doesn't have to be full time.
- repolfx 8y ago
  That's technically true but practically untrue. The DPO is a major imposition and simply being required to comply with the DPO parts alone is sufficient to make the EU not worthwhile for many businesses. 1. Whilst a DPO can theoretically be part time, a DPO is not allowed to have other roles in the firm that could create a "conflict of interest". This is so vague that in a company that works with data, almost any other role could be argued to create such a conflict of interest. 2. The DPO position has a list of mandatory responsibilities and even qualifications that will be accepted. For example the EU has advised DPOs need "expertise in EU data protection law". Where will foreign websites find such a person? 3. The DPO works for the firm but cannot be told how to do their job. They also cannot be fired or penalised for anything related to their job responsibilities. In practice these rules mean it's very likely everyone will outsource the DPO role to third parties.
seszett 8y ago
> they've been advised that because they have an email subscription, they'd need to hire a full time DPO, and their outside counsel quoted them several thousand dollars a year. I think a large part of the scare that can be observed among American companies is due to legal advisers jumping on the opportunity to make big money by misleading their customers into thinking there are enormous, complicated and unlikely requirements for compliance, and huge risks to making any mistake.
- repolfx 8y ago
  There are in fact enormous, complicated and unlikely requirements for compliance and huge risks to making any mistake. The risk to making mistakes: fines of up to 4% of your turnover, in the worst case. As many companies have margins below this, it means losing all your profit for a year or more. As for the rest, the vastness and vagueness of the GDPR has been extensively documented elsewhere. Bear in mind the EU Commission itself was immediately found in repeated violation of the GDPR just via their own website once the law activated. Their answer was that they themselves didn't have to comply with it.
pimterry 8y ago
You need a DPO if one of the following apply: * you are a public authority or body (except for courts acting in their judicial capacity) * your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking) * your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences. That's from https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/ https://ico.org.uk/for-organisations/guide-to-the-general-da..., which is a pretty good summary generally, from the UK Information Commissioner's Office. If you're running an ad network building profiles of millions of users, then yes, you need a DPO. If you're storing extremely personal medical data, then yes, you need a DPO. If you're running an email newsletter, you 100% do not.

nextlevelwizard 8y ago

Nothing of value was lost. Good riddance!

oblio 8y ago

> they'd need to hire a full time DPO They don't. They need to designate someone as the DPO, it doesn't have to be full time.

repolfx 8y ago
That's technically true but practically untrue. The DPO is a major imposition and simply being required to comply with the DPO parts alone is sufficient to make the EU not worthwhile for many businesses. 1. Whilst a DPO can theoretically be part time, a DPO is not allowed to have other roles in the firm that could create a "conflict of interest". This is so vague that in a company that works with data, almost any other role could be argued to create such a conflict of interest. 2. The DPO position has a list of mandatory responsibilities and even qualifications that will be accepted. For example the EU has advised DPOs need "expertise in EU data protection law". Where will foreign websites find such a person? 3. The DPO works for the firm but cannot be told how to do their job. They also cannot be fired or penalised for anything related to their job responsibilities. In practice these rules mean it's very likely everyone will outsource the DPO role to third parties.

seszett 8y ago

> they've been advised that because they have an email subscription, they'd need to hire a full time DPO, and their outside counsel quoted them several thousand dollars a year. I think a large part of the scare that can be observed among American companies is due to legal advisers jumping on the opportunity to make big money by misleading their customers into thinking there are enormous, complicated and unlikely requirements for compliance, and huge risks to making any mistake.

repolfx 8y ago
There are in fact enormous, complicated and unlikely requirements for compliance and huge risks to making any mistake. The risk to making mistakes: fines of up to 4% of your turnover, in the worst case. As many companies have margins below this, it means losing all your profit for a year or more. As for the rest, the vastness and vagueness of the GDPR has been extensively documented elsewhere. Bear in mind the EU Commission itself was immediately found in repeated violation of the GDPR just via their own website once the law activated. Their answer was that they themselves didn't have to comply with it.

pimterry 8y ago

You need a DPO if one of the following apply: * you are a public authority or body (except for courts acting in their judicial capacity) * your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking) * your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences. That's from https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/ https://ico.org.uk/for-organisations/guide-to-the-general-da..., which is a pretty good summary generally, from the UK Information Commissioner's Office. If you're running an ad network building profiles of millions of users, then yes, you need a DPO. If you're storing extremely personal medical data, then yes, you need a DPO. If you're running an email newsletter, you 100% do not.