7 ms·

Then look at GDPR, which is a mess imho, and article 13 too

by feketegy 8y ago

martin_a 8y ago
GDPR is quite good actually, we will just need to find a way to use its power for good.
- kypro 8y ago
  It's good for US tech because it is yet another cost and restriction EU startups have to face before they can grow to scale and profitability.
  - Dylan16807 8y ago
    It's a very small cost that all companies should already be able to handle if they're to be trusted with personal data.
    - pushpop 8y ago
      That's the crux of it. It's not asking companies to do anything they shouldn't have already been doing if they were conscious about security. The problem is it's been blown completely out of proportion to a point where by son's child minder sent out letters asking for our permission to contact us if our child is unwell (Of course she should - that isn't unsolicited contact. She was already covered!).
      - martin_a 8y ago
        > The problem is it's been blown completely out of proportion [...] Yeah, but blame that on the lawyers who wanted to cash in on this new regulation. I think only _very few_ people/business owners actually took the time to read the GDPR and think about whether all of that even applies to them. Most just became a victim of the fearmongering around all of that.
        pushpop 8y ago
        I've seen a lot of scaremongering but none of that was from lawyers. My observations was most of the negativity came from a combination of the press writing slanted articles criticising the EU (which is fairly typical for anything relating to the EU, it seems) and blogs from people who assumed the worst case and subsequently wrote a hysteria-driven knee-jerk opinion piece as a result. Those blogs, I've found, are the worst examples because they're more likely to spread like a virus where people say "if they're worried then I should be to!" Where as these days people can dismiss the press a little easier if it doesn't confirm their cognitive bias. That's just my opinion from what I've observed though. I'm not trying to claim anything as fact here.
        martin_a 8y ago
        I'm with you on that after a second thought. Our lawyers where rather calm, too, saying that not everything is eaten as hot as its being cooked. "Selfmade media" on the other hand went really wild and fantasized some absurd threats for everybody with a website, you're right on that.
      - Nasrudith 8y ago
        Not quite actually - sensible practice from a security standpoint alone (as opposed to transparency) would be to have a delete but not a download button as it would make exfiltrating data with a compromised account easier. That is the flipside of power to the user - more exploitability. I don't blame them for the goal (right to know is a valid interest for consumers) but we have to acknowledge consequences if we want to avoid future errors. The back up clearing involved would also be a pain in the ass and boost expenses of compliance (can't just use write only storage which nicely solves other problems) but it isn't insurmountable.
    - kypro 8y ago
      It's absolutely not a small cost. It cost the last startup I worked for around two weeks of development time, plus in many cases it prevents us (or adds massive restrictions) on collecting contact information from leads. It has certainly affected the bottom line of companies like Facebook and Google, but they can afford to take the hit, not all startups can. I'm not really disagree that companies "should" do it. But I'd argue one of the many reasons we have a shortage of big tech in the EU is excessive regulation restricting our ability to scale.
      - Dylan16807 8y ago
        I'm not sure how to react to you implying that it hurts small companies more than big companies, and that it's an impediment to scaling.
        Nasrudith 8y ago
        Those two aren't mutually exclusive or contradictory - oak trees sprout from acorns. If their growth is stunted then they won't scale.
        Dylan16807 8y ago
        Stopping something before it even tries to scale is different from making scaling itself hard, and the comment is implying the latter.
      - wlll 8y ago
        I'll take my data being protected over your ability to scale any day, and remember, if a US company wants to do business with EU citizens they still need to comply.
        kypro 8y ago
        But unlike EU startups, US startups have the advantage of only having to to comply with EU regulation when they're at scale and profitable. I actually like GDPR and would love it if it was made law worldwide, but right now that's not the case and with being EU only it comes at the cost of EU tech. And if the EU wishes to remain economically competitive with the US in the coming decades we're going to need tech and GDPR is yet another hurdle preventing us from achieve this. Again, I'm not really arguing what should be, but from a purely pragmatic perspective I'd argue tech regulation isn't good for the already struggling economy of the EU.
  - askmike 8y ago
    It applies to everyone who wants to serve EU customers. As for startups: depending on what kind of personal data you are collecting, being GDPR complicit shouldn't take more than a day. If it takes longer you are building a business around personal data, and I think you should know your stuff (not just GDPR, but also what kind of data you are collecting and why).
    - jfk13 8y ago
      > If it takes longer you are building a business around personal data, and I think you should know your stuff (not just GDPR, but also what kind of data you are collecting and why). And you should probably pause and ask whether your proposed business will provide a net benefit to the world, or if it's just an attempt to make money regardless of the consequences to society. Not to say there aren't any worthwhile businesses to be created around personal data, but experience suggests that some skepticism is in order.
      - CiaranMcNulty 8y ago
        Delete * from user_data doesn't take that long
    - chii 8y ago
      > being GDPR complicit shouldn't take more than a day. either you're overly optimistic, or you have some 100x rock star doing the impl. because it took over 1 year to implement all of the GDPR required features for me, and we don't even store that much private data!
      - Semaphor 8y ago
        > it took over 1 year to implement all of the GDPR required features for me > we don't even store that much private data! What do you store? Because I can't imagine what would take that long.
      - askmike 8y ago
        It took me half a day: Had to download a GDPR pivacy policy template, read through the thing. Double check all the sections applied to what I was doing (cookies, etc) and fill in my details. What have you spend 1 year doing if I may ask? Did you previously store passwords in plain text and you had to update that?
  - Cthulhu_ 8y ago
    Protecting your customer's privacy is already a "cost and restriction" regardless of where you live; is this how you feel about all the regulation you have to conform to if you're processing payments?
    - Nasrudith 8y ago
      Really I would prefer the payment system was robust enough that it would do no more harm than publishing your past shopping lists but that is a separate topic. That has always frustrated me - we have cryptographic signatures. An order should involve only an invoice signed by the end user, the merchant checking it vs your public key and then submission to the credit card processor. Even if done with "black box calculator functions" to the end user it should be layman usable.
  - defertoreptar 8y ago
    The US saw this with banking regulation after the great recession. Big banks could afford to make it work, and small local banks got the worst of it.
  - Hamuko 8y ago
    It's bad for US tech because apparently US tech companies do not understand what privacy is and why people deserve to have it.
- kerng 8y ago
  Agreed. I think it's one of the biggest privacy achievements ever. We have been seeing a tremendous normalization of defiance with how user data is frequently unknowingly misused and it's time for correcting this. GDPR is a good start, hopefully US soon follows.
wlll 8y ago
Why is GDPR a mess? As an EU citizen (for the time being at least) with personal data I want to protect I'm quite happy with it. As someone starting a startup there's compliance I need to do, and it's work for sure, but I still (again, for now) live in the EU as a citizen, and I still have personal data that I don't want to lose control of so on balance I'll take it. article 13 is bad for sure. They don't get everything right by a long shot, but on balance I think the changes have been positive.
- _Codemonkeyism 8y ago
  As a EU citizen I like my personal data protected. I left facebook and all other networks except Twitter and usually do not give data for any coupons in shops. GDPR is a mess not from the goal but the implementation. Currently no one knows how to implement GDPR correctly - e.g. how to exchange business cards, how to store information from sales leads etc. Compare this with PCI compliance (which is about CC data protection) and it's very clear if you're compliant and if you are not and what to do. For now this has no effect because data protection agencies - at least in Germany - are overloaded, but will lead to a lot of fines for companies that want to do everything the right way. Article 13 is the same mess. Good in intention of making YT pay for the content they use and which is copyright protected, but _impossible_ to implement in it's current form.
  - wlll 8y ago
    > Currently no one knows how to implement GDPR correctly - e.g. how to exchange business cards, how to store information from sales leads etc. The only time I've seen it be a problem for people is when they are playing fast and loose with people's data. I mean, exchanging business cards is (I would suggest) in invitation to start a conversation. I'm not personally worried about that. It's definitely not an invitation to store my data in a leads database indefinitely though. Does not being able to indefintely store people's data in your database without getting permission first make your life harder? Good, that's the point. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- From: _Codemonkeyism@ycombinator.com To: Bob@from.accounting Subject: Great chat! Hey Bob, thanks for handing me your business card the other day, can I add you to our sales database? We will contact you whenver we think we have some suitable widgets. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- From: Bob@from.accounting To: _Codemonkeyism@ycombinator.com Subject: Re: Great chat! Take a hike _Codemonkeyism! / Sure, go ahead! -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > Compare this with PCI compliance I've done PCI compliance, it's largely bullshit IMO. It does certify compliance with something, but it's not a particularly useful way of working out wether a company is storing peoples data securely. > but will lead to a lot of fines for companies that want to do everything the right way. Well, we will have to see, but I doubt it. Sure, there will be companies that want to protect people's data, but can't for whatever reason (developer time etc.), but the solution there is "don't do it". If you can't secure people's data, don't store it. "It's a bit beyond our capabilities" isn't an excuse. > Article 13 is the same mess. Good in intention of making YT pay for the content they use and which is copyright protected, but _impossible_ to implement in it's current form. Yep, totally agree.
black_puppydog 8y ago
If the GDPR looks like a mess to you, it is because it makes it blatantly obvious and very visible how strongly the entire internet industry rejects the mere idea of privacy respecting services.
sctb 8y ago
We detached this subthread from https://news.ycombinator.com/item?id=19440981 https://news.ycombinator.com/item?id=19440981.

Then look at GDPR, which is a mess imho, and article 13 too

martin_a 8y ago

GDPR is quite good actually, we will just need to find a way to use its power for good.

kypro 8y ago
It's good for US tech because it is yet another cost and restriction EU startups have to face before they can grow to scale and profitability.
- Dylan16807 8y ago
  It's a very small cost that all companies should already be able to handle if they're to be trusted with personal data.
  - pushpop 8y ago
    That's the crux of it. It's not asking companies to do anything they shouldn't have already been doing if they were conscious about security. The problem is it's been blown completely out of proportion to a point where by son's child minder sent out letters asking for our permission to contact us if our child is unwell (Of course she should - that isn't unsolicited contact. She was already covered!).
    - martin_a 8y ago
      > The problem is it's been blown completely out of proportion [...] Yeah, but blame that on the lawyers who wanted to cash in on this new regulation. I think only _very few_ people/business owners actually took the time to read the GDPR and think about whether all of that even applies to them. Most just became a victim of the fearmongering around all of that.
      - pushpop 8y ago
        I've seen a lot of scaremongering but none of that was from lawyers. My observations was most of the negativity came from a combination of the press writing slanted articles criticising the EU (which is fairly typical for anything relating to the EU, it seems) and blogs from people who assumed the worst case and subsequently wrote a hysteria-driven knee-jerk opinion piece as a result. Those blogs, I've found, are the worst examples because they're more likely to spread like a virus where people say "if they're worried then I should be to!" Where as these days people can dismiss the press a little easier if it doesn't confirm their cognitive bias. That's just my opinion from what I've observed though. I'm not trying to claim anything as fact here.
        martin_a 8y ago
        I'm with you on that after a second thought. Our lawyers where rather calm, too, saying that not everything is eaten as hot as its being cooked. "Selfmade media" on the other hand went really wild and fantasized some absurd threats for everybody with a website, you're right on that.
    - Nasrudith 8y ago
      Not quite actually - sensible practice from a security standpoint alone (as opposed to transparency) would be to have a delete but not a download button as it would make exfiltrating data with a compromised account easier. That is the flipside of power to the user - more exploitability. I don't blame them for the goal (right to know is a valid interest for consumers) but we have to acknowledge consequences if we want to avoid future errors. The back up clearing involved would also be a pain in the ass and boost expenses of compliance (can't just use write only storage which nicely solves other problems) but it isn't insurmountable.
  - kypro 8y ago
    It's absolutely not a small cost. It cost the last startup I worked for around two weeks of development time, plus in many cases it prevents us (or adds massive restrictions) on collecting contact information from leads. It has certainly affected the bottom line of companies like Facebook and Google, but they can afford to take the hit, not all startups can. I'm not really disagree that companies "should" do it. But I'd argue one of the many reasons we have a shortage of big tech in the EU is excessive regulation restricting our ability to scale.
    - Dylan16807 8y ago
      I'm not sure how to react to you implying that it hurts small companies more than big companies, and that it's an impediment to scaling.
      - Nasrudith 8y ago
        Those two aren't mutually exclusive or contradictory - oak trees sprout from acorns. If their growth is stunted then they won't scale.
        Dylan16807 8y ago
        Stopping something before it even tries to scale is different from making scaling itself hard, and the comment is implying the latter.
    - wlll 8y ago
      I'll take my data being protected over your ability to scale any day, and remember, if a US company wants to do business with EU citizens they still need to comply.
      - kypro 8y ago
        But unlike EU startups, US startups have the advantage of only having to to comply with EU regulation when they're at scale and profitable. I actually like GDPR and would love it if it was made law worldwide, but right now that's not the case and with being EU only it comes at the cost of EU tech. And if the EU wishes to remain economically competitive with the US in the coming decades we're going to need tech and GDPR is yet another hurdle preventing us from achieve this. Again, I'm not really arguing what should be, but from a purely pragmatic perspective I'd argue tech regulation isn't good for the already struggling economy of the EU.
- askmike 8y ago
  It applies to everyone who wants to serve EU customers. As for startups: depending on what kind of personal data you are collecting, being GDPR complicit shouldn't take more than a day. If it takes longer you are building a business around personal data, and I think you should know your stuff (not just GDPR, but also what kind of data you are collecting and why).
  - jfk13 8y ago
    > If it takes longer you are building a business around personal data, and I think you should know your stuff (not just GDPR, but also what kind of data you are collecting and why). And you should probably pause and ask whether your proposed business will provide a net benefit to the world, or if it's just an attempt to make money regardless of the consequences to society. Not to say there aren't any worthwhile businesses to be created around personal data, but experience suggests that some skepticism is in order.
    - CiaranMcNulty 8y ago
      Delete * from user_data doesn't take that long
  - chii 8y ago
    > being GDPR complicit shouldn't take more than a day. either you're overly optimistic, or you have some 100x rock star doing the impl. because it took over 1 year to implement all of the GDPR required features for me, and we don't even store that much private data!
    - Semaphor 8y ago
      > it took over 1 year to implement all of the GDPR required features for me > we don't even store that much private data! What do you store? Because I can't imagine what would take that long.
    - askmike 8y ago
      It took me half a day: Had to download a GDPR pivacy policy template, read through the thing. Double check all the sections applied to what I was doing (cookies, etc) and fill in my details. What have you spend 1 year doing if I may ask? Did you previously store passwords in plain text and you had to update that?
- Cthulhu_ 8y ago
  Protecting your customer's privacy is already a "cost and restriction" regardless of where you live; is this how you feel about all the regulation you have to conform to if you're processing payments?
  - Nasrudith 8y ago
    Really I would prefer the payment system was robust enough that it would do no more harm than publishing your past shopping lists but that is a separate topic. That has always frustrated me - we have cryptographic signatures. An order should involve only an invoice signed by the end user, the merchant checking it vs your public key and then submission to the credit card processor. Even if done with "black box calculator functions" to the end user it should be layman usable.
- defertoreptar 8y ago
  The US saw this with banking regulation after the great recession. Big banks could afford to make it work, and small local banks got the worst of it.
- Hamuko 8y ago
  It's bad for US tech because apparently US tech companies do not understand what privacy is and why people deserve to have it.
kerng 8y ago
Agreed. I think it's one of the biggest privacy achievements ever. We have been seeing a tremendous normalization of defiance with how user data is frequently unknowingly misused and it's time for correcting this. GDPR is a good start, hopefully US soon follows.

wlll 8y ago

Why is GDPR a mess? As an EU citizen (for the time being at least) with personal data I want to protect I'm quite happy with it. As someone starting a startup there's compliance I need to do, and it's work for sure, but I still (again, for now) live in the EU as a citizen, and I still have personal data that I don't want to lose control of so on balance I'll take it. article 13 is bad for sure. They don't get everything right by a long shot, but on balance I think the changes have been positive.

_Codemonkeyism 8y ago
As a EU citizen I like my personal data protected. I left facebook and all other networks except Twitter and usually do not give data for any coupons in shops. GDPR is a mess not from the goal but the implementation. Currently no one knows how to implement GDPR correctly - e.g. how to exchange business cards, how to store information from sales leads etc. Compare this with PCI compliance (which is about CC data protection) and it's very clear if you're compliant and if you are not and what to do. For now this has no effect because data protection agencies - at least in Germany - are overloaded, but will lead to a lot of fines for companies that want to do everything the right way. Article 13 is the same mess. Good in intention of making YT pay for the content they use and which is copyright protected, but _impossible_ to implement in it's current form.
- wlll 8y ago
  > Currently no one knows how to implement GDPR correctly - e.g. how to exchange business cards, how to store information from sales leads etc. The only time I've seen it be a problem for people is when they are playing fast and loose with people's data. I mean, exchanging business cards is (I would suggest) in invitation to start a conversation. I'm not personally worried about that. It's definitely not an invitation to store my data in a leads database indefinitely though. Does not being able to indefintely store people's data in your database without getting permission first make your life harder? Good, that's the point. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- From: _Codemonkeyism@ycombinator.com To: Bob@from.accounting Subject: Great chat! Hey Bob, thanks for handing me your business card the other day, can I add you to our sales database? We will contact you whenver we think we have some suitable widgets. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- From: Bob@from.accounting To: _Codemonkeyism@ycombinator.com Subject: Re: Great chat! Take a hike _Codemonkeyism! / Sure, go ahead! -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > Compare this with PCI compliance I've done PCI compliance, it's largely bullshit IMO. It does certify compliance with something, but it's not a particularly useful way of working out wether a company is storing peoples data securely. > but will lead to a lot of fines for companies that want to do everything the right way. Well, we will have to see, but I doubt it. Sure, there will be companies that want to protect people's data, but can't for whatever reason (developer time etc.), but the solution there is "don't do it". If you can't secure people's data, don't store it. "It's a bit beyond our capabilities" isn't an excuse. > Article 13 is the same mess. Good in intention of making YT pay for the content they use and which is copyright protected, but _impossible_ to implement in it's current form. Yep, totally agree.

black_puppydog 8y ago

If the GDPR looks like a mess to you, it is because it makes it blatantly obvious and very visible how strongly the entire internet industry rejects the mere idea of privacy respecting services.

sctb 8y ago

We detached this subthread from https://news.ycombinator.com/item?id=19440981 https://news.ycombinator.com/item?id=19440981.