9 ms·

Isn't the unspoken rule to just ignore GDPR until you're big enough and EU starts bitching at you, at which point you just pay them off and spend some resources

Isn't the unspoken rule to just ignore GDPR until you're big enough and EU starts bitching at you, at which point you just pay them off and spend some resources on compliance?

qwerty456127 8y ago
How is GDPR a problem at all? Is it so hard to avoid personalized tracking of unregistered users, ask users for their consent at sign-up time and implement a button for them to export and delete their data?
- jcranmer 8y ago
  The problem with GDPR is that the actual scope of it applies to is rather unclear, and the regulatory guidance hasn't been reassuring as to what the actual extent will be in practice. For example, do email addresses on the comments on a blog site fall under that protection? If so, there are some agencies in charge of enforcing GDPR that are violating GDPR on their sites...
  - TheCoelacanth 8y ago
    > For example, do email addresses on the comments on a blog site fall under that protection? That is not unclear at all. They absolutely do. That doesn't mean you can't have them, but it means you need consent, you need to be clear about how you will use them and you need to let people withdraw consent.
    - perl4ever 8y ago
      You can't win an argument about whether something is unclear by proving (let alone merely asserting) it is so. This is something a lot of people seem unclear on.
      - majewsky 8y ago
        Why though? Email addresses are quite obviously "something that identifies a person".
        perl4ever 8y ago
        I'm not debating what's clear or not to me. My point is that it's subjective and if someone says a thing is unclear, you can not necessarily make it clear to them or force them to admit they are lying about their perception. Arguing with confusion is like debating whether someone is in pain when they act like they are. It could be they are lying. It could be they are not. It could be they are particularly stupid. I want to emphasize - you can be right or wrong about the GDPR, but that's not the same thing as being right or wrong about whether people are confused by it. I think it should be obvious that debating feelings or perceptions or emotions of other people tends to lead to unproductive interpersonal interactions, but perhaps others have not noticed this phenomenon. I can't imagine winning a debate with someone over whether they are trolling or not. Even if it's really obvious, nobody can see inner motivations for sure.
        eitland 8y ago
        > It could be they are lying. It could be they are not. It could be they are particularly stupid. At the point where one can prove that one part is too (trollish || stupid) I think it is reasonable to limit how much we care about their opinions.
      - TheCoelacanth 8y ago
        The only people unclear on this point are people who have failed to do even the most basic research into what GDPR says. It is blindingly obvious that an email is information that can be used to identify a person.
        perl4ever 8y ago
        I'm not arguing with you. If it is clear, then it suggests people saying it is not clear are basically trolls. Surely you can see that telling an apparent troll to admit being a troll is unproductive. You might be right, or you might be wrong, but you can't win that debate because it's about inner motivations and perceptions and not verifiable facts.
  - zaarn 8y ago
    EMail Addresses are protected by the GDPR. Passwords are too. THat doesn't mean you can't use email addresses without asking; ie if the comment system uses emails to notify people of replies or moderative actions, then it's totally legit to collect it for exactly this purpose. You only need consent if the personal data collected isn't strictly necessary for the operation of your site, ie if you use tracking cookies and sell emails to advertisers.
  - pluma 8y ago
    You seem to be making the same mistake a lot of people (especially those from countries with no regard for consumer protection or privacy) do with regard to the GDPR: It's not about e-mail addresses. It's about personal information. It's not about what data you can have. It's about how you can use data. You don't own my personal information, I do. If I give my information to you, you can only use it in whichever ways I consented to when I gave it to you. If you want to use it for something else, you need to ask me again. And you can't just give me a blanket CYA contract to sign just so you can decide later. This is precisely how it would work in normal everyday social interactions. If I go to a Mom & Pop shop and give them my number so they can call me when my favorite brand of soup is back in stock that doesn't mean they can call me to tell me about random new stuff they carry or give my number away to someone else. Personal information is owned by the person it is about. It gets murky with aggregates (but the GDPR helps you figure out which ones are still considered personally identifiable) but it's blindingly obvious for things like "enter your e-mail address". Do you have an e-mail input in a contact form? I'm going to assume that'll be used so you can respond to me although it'd nice of you if you say that explicitly right there on the form. If it's a comment form, why do you need my address? Who will it be shown to? What are you going to do with it? Where will it be stored and how can I tell you to delete it later? That's why you now need to think up a Privacy Policy: these are questions you always had to answer for yourself but now you're legally required to make conscious decisions about this. Is this too much of a hassle? That likely means you didn't have any good reason to collect that information in the first place. Great! Personal information is a liability and it's better to collect less of it than more. Although that may disappoint future Zuckerbergs, collecting people's private information (even if they give it away voluntarily) imbues a lot of responsibility on you if you don't want to be completely careless. And the GDPR is an example for a policy that gives that responsibility teeth and punishes companies who are careless. You don't want to store passwords in plaintext. You don't want to hoard credit card details or medical data. Personally identifiable information is no different. The GDPR just provides ways for you to store and use that information legally, in addition to reiterating that privacy and control of your personal information is a human right.
- boznz 8y ago
  The irony is most sites use cookies to click on the "this site uses cookies" and as I block them I get the same message ad-infinitum on every fucking site... and I'm in NZ NOT the EU
  - umichguy 8y ago
    Kia ora! The "issue" here is that most sites which want to cater to worldwide audiences pretty much try to comply with influential legislation to stay on the good side. And GDPR/EU regs wield a big enough stick and come from a large enough region that you can't ignore them unless you want to block your site out completely to traffic coming from the EU. So they try and just do a worldwide rollout, irrespective of where you live. Of course, you can always implement this selectively but maybe more tricky to small and medium businesses, so they play and safe. Probably. I am speculating here.
    - q12we34rt5 8y ago
      The "EU" as a market is only important to the largest players or as an after thought once you have a solid footing in e.g. the US for one simple reason. The EU has too many languages so you can't just target the entire population in one shot like you can in single language even larger economy in America. Even if you wanted to target the entire EU, in my personal experience I can tell you that some web services work well in a place like Germany yet fail hard in France so most small to mid-level players are only going to go in places where they make the most money and it may be years before they ever end up in say Italy or the Netherlands. All that adds up to the EU regulations having a much smaller impact on most startups than you seem to believe. And that impact will be zero on the ones who look at the regulatory landscape as it exists now and just decide to stay out. Edit: I see somebody chose to express disagreement via mouse rather than keyboard. Interesting.
      - qwerty456127 8y ago
        As a European who has never been to an English-speaking country yet has always preferred English versions of everything (and all my friends are bi- or tri- (or more) lingual, reading something in English or in our mother tongues is a near-zero difference for us) I wonder what is the actual proportion of Europeans who can not be targeted by a service in English... I've heard learning English is not particularly popular among e.g. Italians but in Scandinavia and in France almost every "millennial" is more or less fluent in English and comfortable with it. PS: I didn't downvote, I never do - I'm a downvote-hater :-)
- im3w1l 8y ago
  > How is GDPR a problem at all? I'm sure there will be a significant price tag just for training people to be compliant with it.
  - raverbashing 8y ago
    Here's your one line compliance GDPR course: don't treat customer data like it's something to be sold to anyone that asks for it. PII is not yours.
- sacado2 8y ago
  Avoiding personalized tracking of unregistered users means you can't use Google Analytics or something equivalent. Not that it's impossible per se, but these tools have a strong added value, so...
  - elliekelly 8y ago
    > but these tools have a strong added value, so... Strong added value to who? If Google Analytics disappeared tomorrow do you think the average internet user would be at all impacted? Remember, GDPR is about protecting the user.
  - CWuestefeld 8y ago
    I'm not a fan of GDPR, but no, it doesn't mean that. It only means that GA can't be used in a way that allows you to correlate the data back to a particular individual. You can still use it in aggregate, and you can even follow individual threads through the system; you just can't know who the user was.
  - qwerty456127 8y ago
    I admit this is a very amateurish view but I don't really understand why do people need Google Analytics or anything like that at all. As a webmaster you can log every request a depersonalized way recording the fact of a request to a particular HTTP resource from a particular country originating from a particular website as a referrer at particular time. You don't need any 3-rd party service for this and this doesn't mean tracking any particular user.
- CWuestefeld 8y ago
  Is it so hard to ... implement a button for them to export and delete their data? Yes, it is. Although we're constantly updating the code, my team's responsible for a web site for which the data model is nearly a decade old. And the overall business process that it feeds is about 25 years old. We don't know everywhere that the user's data goes in order to export it. Building the support to do so is pretty big. And being able to expunge their data on request is huge, given that data models were constructed without thought to a requirement that the user data be purgeable. It turns out that the requirement isn't quite that broad, but then the legal advice to help determine where it does need to be done isn't cheap.
- anonytrary 8y ago
  I don't disagree. My comment was mostly tongue in cheek, but I guess a /s was needed. I'm glad it spurred some discussion, though.
pluma 8y ago
If you escalate things to the point where you need to "pay them off" you're entering serious monetary fines territory.

Isn't the unspoken rule to just ignore GDPR until you're big enough and EU starts bitching at you, at which point you just pay them off and spend some resources on compliance?

qwerty456127 8y ago

How is GDPR a problem at all? Is it so hard to avoid personalized tracking of unregistered users, ask users for their consent at sign-up time and implement a button for them to export and delete their data?

jcranmer 8y ago
The problem with GDPR is that the actual scope of it applies to is rather unclear, and the regulatory guidance hasn't been reassuring as to what the actual extent will be in practice. For example, do email addresses on the comments on a blog site fall under that protection? If so, there are some agencies in charge of enforcing GDPR that are violating GDPR on their sites...
- TheCoelacanth 8y ago
  > For example, do email addresses on the comments on a blog site fall under that protection? That is not unclear at all. They absolutely do. That doesn't mean you can't have them, but it means you need consent, you need to be clear about how you will use them and you need to let people withdraw consent.
  - perl4ever 8y ago
    You can't win an argument about whether something is unclear by proving (let alone merely asserting) it is so. This is something a lot of people seem unclear on.
    - majewsky 8y ago
      Why though? Email addresses are quite obviously "something that identifies a person".
      - perl4ever 8y ago
        I'm not debating what's clear or not to me. My point is that it's subjective and if someone says a thing is unclear, you can not necessarily make it clear to them or force them to admit they are lying about their perception. Arguing with confusion is like debating whether someone is in pain when they act like they are. It could be they are lying. It could be they are not. It could be they are particularly stupid. I want to emphasize - you can be right or wrong about the GDPR, but that's not the same thing as being right or wrong about whether people are confused by it. I think it should be obvious that debating feelings or perceptions or emotions of other people tends to lead to unproductive interpersonal interactions, but perhaps others have not noticed this phenomenon. I can't imagine winning a debate with someone over whether they are trolling or not. Even if it's really obvious, nobody can see inner motivations for sure.
        eitland 8y ago
        > It could be they are lying. It could be they are not. It could be they are particularly stupid. At the point where one can prove that one part is too (trollish || stupid) I think it is reasonable to limit how much we care about their opinions.
    - TheCoelacanth 8y ago
      The only people unclear on this point are people who have failed to do even the most basic research into what GDPR says. It is blindingly obvious that an email is information that can be used to identify a person.
      - perl4ever 8y ago
        I'm not arguing with you. If it is clear, then it suggests people saying it is not clear are basically trolls. Surely you can see that telling an apparent troll to admit being a troll is unproductive. You might be right, or you might be wrong, but you can't win that debate because it's about inner motivations and perceptions and not verifiable facts.
- zaarn 8y ago
  EMail Addresses are protected by the GDPR. Passwords are too. THat doesn't mean you can't use email addresses without asking; ie if the comment system uses emails to notify people of replies or moderative actions, then it's totally legit to collect it for exactly this purpose. You only need consent if the personal data collected isn't strictly necessary for the operation of your site, ie if you use tracking cookies and sell emails to advertisers.
- pluma 8y ago
  You seem to be making the same mistake a lot of people (especially those from countries with no regard for consumer protection or privacy) do with regard to the GDPR: It's not about e-mail addresses. It's about personal information. It's not about what data you can have. It's about how you can use data. You don't own my personal information, I do. If I give my information to you, you can only use it in whichever ways I consented to when I gave it to you. If you want to use it for something else, you need to ask me again. And you can't just give me a blanket CYA contract to sign just so you can decide later. This is precisely how it would work in normal everyday social interactions. If I go to a Mom & Pop shop and give them my number so they can call me when my favorite brand of soup is back in stock that doesn't mean they can call me to tell me about random new stuff they carry or give my number away to someone else. Personal information is owned by the person it is about. It gets murky with aggregates (but the GDPR helps you figure out which ones are still considered personally identifiable) but it's blindingly obvious for things like "enter your e-mail address". Do you have an e-mail input in a contact form? I'm going to assume that'll be used so you can respond to me although it'd nice of you if you say that explicitly right there on the form. If it's a comment form, why do you need my address? Who will it be shown to? What are you going to do with it? Where will it be stored and how can I tell you to delete it later? That's why you now need to think up a Privacy Policy: these are questions you always had to answer for yourself but now you're legally required to make conscious decisions about this. Is this too much of a hassle? That likely means you didn't have any good reason to collect that information in the first place. Great! Personal information is a liability and it's better to collect less of it than more. Although that may disappoint future Zuckerbergs, collecting people's private information (even if they give it away voluntarily) imbues a lot of responsibility on you if you don't want to be completely careless. And the GDPR is an example for a policy that gives that responsibility teeth and punishes companies who are careless. You don't want to store passwords in plaintext. You don't want to hoard credit card details or medical data. Personally identifiable information is no different. The GDPR just provides ways for you to store and use that information legally, in addition to reiterating that privacy and control of your personal information is a human right.
boznz 8y ago
The irony is most sites use cookies to click on the "this site uses cookies" and as I block them I get the same message ad-infinitum on every fucking site... and I'm in NZ NOT the EU
- umichguy 8y ago
  Kia ora! The "issue" here is that most sites which want to cater to worldwide audiences pretty much try to comply with influential legislation to stay on the good side. And GDPR/EU regs wield a big enough stick and come from a large enough region that you can't ignore them unless you want to block your site out completely to traffic coming from the EU. So they try and just do a worldwide rollout, irrespective of where you live. Of course, you can always implement this selectively but maybe more tricky to small and medium businesses, so they play and safe. Probably. I am speculating here.
  - q12we34rt5 8y ago
    The "EU" as a market is only important to the largest players or as an after thought once you have a solid footing in e.g. the US for one simple reason. The EU has too many languages so you can't just target the entire population in one shot like you can in single language even larger economy in America. Even if you wanted to target the entire EU, in my personal experience I can tell you that some web services work well in a place like Germany yet fail hard in France so most small to mid-level players are only going to go in places where they make the most money and it may be years before they ever end up in say Italy or the Netherlands. All that adds up to the EU regulations having a much smaller impact on most startups than you seem to believe. And that impact will be zero on the ones who look at the regulatory landscape as it exists now and just decide to stay out. Edit: I see somebody chose to express disagreement via mouse rather than keyboard. Interesting.
    - qwerty456127 8y ago
      As a European who has never been to an English-speaking country yet has always preferred English versions of everything (and all my friends are bi- or tri- (or more) lingual, reading something in English or in our mother tongues is a near-zero difference for us) I wonder what is the actual proportion of Europeans who can not be targeted by a service in English... I've heard learning English is not particularly popular among e.g. Italians but in Scandinavia and in France almost every "millennial" is more or less fluent in English and comfortable with it. PS: I didn't downvote, I never do - I'm a downvote-hater :-)
im3w1l 8y ago
> How is GDPR a problem at all? I'm sure there will be a significant price tag just for training people to be compliant with it.
- raverbashing 8y ago
  Here's your one line compliance GDPR course: don't treat customer data like it's something to be sold to anyone that asks for it. PII is not yours.
sacado2 8y ago
Avoiding personalized tracking of unregistered users means you can't use Google Analytics or something equivalent. Not that it's impossible per se, but these tools have a strong added value, so...
- elliekelly 8y ago
  > but these tools have a strong added value, so... Strong added value to who? If Google Analytics disappeared tomorrow do you think the average internet user would be at all impacted? Remember, GDPR is about protecting the user.
- CWuestefeld 8y ago
  I'm not a fan of GDPR, but no, it doesn't mean that. It only means that GA can't be used in a way that allows you to correlate the data back to a particular individual. You can still use it in aggregate, and you can even follow individual threads through the system; you just can't know who the user was.
- qwerty456127 8y ago
  I admit this is a very amateurish view but I don't really understand why do people need Google Analytics or anything like that at all. As a webmaster you can log every request a depersonalized way recording the fact of a request to a particular HTTP resource from a particular country originating from a particular website as a referrer at particular time. You don't need any 3-rd party service for this and this doesn't mean tracking any particular user.
CWuestefeld 8y ago
Is it so hard to ... implement a button for them to export and delete their data? Yes, it is. Although we're constantly updating the code, my team's responsible for a web site for which the data model is nearly a decade old. And the overall business process that it feeds is about 25 years old. We don't know everywhere that the user's data goes in order to export it. Building the support to do so is pretty big. And being able to expunge their data on request is huge, given that data models were constructed without thought to a requirement that the user data be purgeable. It turns out that the requirement isn't quite that broad, but then the legal advice to help determine where it does need to be done isn't cheap.
anonytrary 8y ago
I don't disagree. My comment was mostly tongue in cheek, but I guess a /s was needed. I'm glad it spurred some discussion, though.

pluma 8y ago

If you escalate things to the point where you need to "pay them off" you're entering serious monetary fines territory.