4 ms·

GDPR doesn't apply to companies still in the "Move fast, break things" phase.

Benjamin_Dobell 7y ago
It does if said companies plan on being acquired, which is precisely what happened here: > It is believed the vulnerability began when the systems of the Starwood hotels group were compromised in 2014. Marriott subsequently acquired Starwood in 2016
- diminoten 7y ago
  Starwood is by far big enough to have the GDPR apply to it independently. Starwood was well beyond the "move fast and break things" phase of companies. Many companies aren't, and if you're trying to say all startups have to comply with GDPR on day 1, you are wrong.
  - supermatt 7y ago
    Yes they do, from day 1. Maybe you are confused between this and the recent copyright stuff
    - diminoten 7y ago
      https://www.internetlegalattorney.com/are-there-gdpr-exemptions-for-u-s-small-businesses/ https://www.internetlegalattorney.com/are-there-gdpr-exempti... > U.S. based businesses may actually be exempt based upon some interpretation of Article 3.2(a):
      - supermatt 7y ago
        OK - so basically, if you don't knowingly provide (or envisage providing) goods or services to EU customers. This is a very different situation from your original statements based on size and maturity of a company - but I'll concede that the EU reach clearly only applies to EU interests .
gcthomas 7y ago
GDPR doesn't have a lower limit on company size or age - it applies to any organisation that handles personal data.
- diminoten 7y ago
  > But, there is an important limitation. Article 30 requires people/businesses processing personal data to keep records of their processing activities and categories and to make those records available upon request. If your business employs fewer than 250 people, you do not have to create these records unless there could be a risk to the ‘rights and freedoms of data subjects (including trade secrets or intellectual property rights), the processing is not occasional, or your business processes any ‘special categories’ of data as referred to in Article 9(1) (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation, or personal data relating to criminal convictions and offences referred to in Article 10.) https://www.internetlegalattorney.com/are-there-gdpr-exemptions-for-u-s-small-businesses/ https://www.internetlegalattorney.com/are-there-gdpr-exempti... It's not a blanket immunity, but it's not universal as you say.
  - hedders 7y ago
    The way art 30(5) is drafted though means that the exception applies to basically nobody. What business can, honestly, say that it only occasionally processes personal data? Does it have no employees? Does it only occasionally communicate with people? That hardly seems likely. Yes, it's probably a drafting defect, but I think one would be very brave indeed to try to rely on it, especially given that establishing an art 30 record is, practically speaking, a prerequisite for being in a position to comply with the rest of GDPR.
    - diminoten 7y ago
      Then I guess we're back to letting big companies, who have the resources to do this shit, have Europe, and the small companies, who are too busy building new things, will just grow in other areas before expanding to the EU.

It does if said companies plan on being acquired, which is precisely what happened here: > It is believed the vulnerability began when the systems of the Starwood hotels group were compromised in 2014. Marriott subsequently acquired Starwood in 2016

diminoten 7y ago
Starwood is by far big enough to have the GDPR apply to it independently. Starwood was well beyond the "move fast and break things" phase of companies. Many companies aren't, and if you're trying to say all startups have to comply with GDPR on day 1, you are wrong.
- supermatt 7y ago
  Yes they do, from day 1. Maybe you are confused between this and the recent copyright stuff
  - diminoten 7y ago
    https://www.internetlegalattorney.com/are-there-gdpr-exemptions-for-u-s-small-businesses/ https://www.internetlegalattorney.com/are-there-gdpr-exempti... > U.S. based businesses may actually be exempt based upon some interpretation of Article 3.2(a):
    - supermatt 7y ago
      OK - so basically, if you don't knowingly provide (or envisage providing) goods or services to EU customers. This is a very different situation from your original statements based on size and maturity of a company - but I'll concede that the EU reach clearly only applies to EU interests .

gcthomas 7y ago

GDPR doesn't have a lower limit on company size or age - it applies to any organisation that handles personal data.

diminoten 7y ago
> But, there is an important limitation. Article 30 requires people/businesses processing personal data to keep records of their processing activities and categories and to make those records available upon request. If your business employs fewer than 250 people, you do not have to create these records unless there could be a risk to the ‘rights and freedoms of data subjects (including trade secrets or intellectual property rights), the processing is not occasional, or your business processes any ‘special categories’ of data as referred to in Article 9(1) (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation, or personal data relating to criminal convictions and offences referred to in Article 10.) https://www.internetlegalattorney.com/are-there-gdpr-exemptions-for-u-s-small-businesses/ https://www.internetlegalattorney.com/are-there-gdpr-exempti... It's not a blanket immunity, but it's not universal as you say.
- hedders 7y ago
  The way art 30(5) is drafted though means that the exception applies to basically nobody. What business can, honestly, say that it only occasionally processes personal data? Does it have no employees? Does it only occasionally communicate with people? That hardly seems likely. Yes, it's probably a drafting defect, but I think one would be very brave indeed to try to rely on it, especially given that establishing an art 30 record is, practically speaking, a prerequisite for being in a position to comply with the rest of GDPR.
  - diminoten 7y ago
    Then I guess we're back to letting big companies, who have the resources to do this shit, have Europe, and the small companies, who are too busy building new things, will just grow in other areas before expanding to the EU.