5 ms·

It makes it extremely difficult to legally be a tech firm unless you're already a tech giant, just like the FDAs procedures make it impossible to invent a new d

by tylerl 7y ago

It makes it extremely difficult to legally be a tech firm unless you're already a tech giant, just like the FDAs procedures make it impossible to invent a new drug unless you're already an established, giant pharma company. None of the big names in tech will have any trouble at all complying with this; I'd be very surprised if any at all are not already compliant today. At the same time, the percentage of tech startups that are already compliant with this law is likely around zero, and few will ever become so. Unless this is precisely what your startup is about, small firms, especially with venture funding, can't afford to invest anything at all into privacy beyond the surface. If your startup fails because it gets sued into oblivion, that's no worse (and way less likely) than it failing because nobody actually wanted a chat app for dogs.

drusepth 7y ago
This law's implementation is bad for the same reason GDPR's implementation is bad: the people it's meant to target are easily capable of complying (and likely already do) and it's good for "the people" on paper, but disproportionately affects (hurts) small businesses that don't have the means to comply (or even know if they're properly complying to the extent of avoiding a lawsuit).
- Renaud 7y ago
  Most of these requirements are perfectly reasonable and i don’t see any that are technologically difficult to implement unless you underlying business model relies on selling user data without regards, in which case, good riddance.
  - drusepth 7y ago
    I feel like the "GDPR doesn't affect you unless you sell data" line is the new version of "surveillance doesn't affect you unless you've got something to hide". Every time GDPR is mentioned in a HN thread you see dozens+ of comments asking for clarifications on how to "get around" GDPR issues for legitimate uses. The point is you don't have to be a bad guy to be affected by GDPR and need to spend time+money on not only complying (auditing and implementing systems), but also verifying you're actually compliant with an expert, and the smaller you are the more relative time you have to spend on this work yourself (instead of e.g. hiring lawyers+developers to just do it for you).
- digitalengineer 7y ago
  The GDPR requirements are not that hard to follow. Yes, it takes time to audit your tech stack and website, but small companies can certainly get it to work without paying thousands of dollars. Tools like this one (It was just $49 bucks) help you get started. https://appsumo.com/gdpr-tracker/ https://appsumo.com/gdpr-tracker/
hackerbabz 7y ago
If a company (small or giant) can't afford to protect my data and preserve my rights to it, then I don't want that company to exist. Just like I don't want startups making unsafe medicine, or losing my medical secrets.
raxxorrax 7y ago
I doubt this to be true honestly, because having user data worth selling already implies you to have a certain size. The request are reasonable and the dismissal with reference to difficulties startups might face is probably not applicable. But if that is really a problem, just apply the requirements to companies with a minimum amount of users. Venture capital funded companies don't need to cut corners and shouldn't be allowed to when it comes to privacy.
bmistree 7y ago
I just wanted to piggy-back onto the parent’s comment with a concrete example. I’ve always been told that it’s good practice to take periodic backups. In the absolute worst cases, you can simply restore directly from these. If a customer requests that their data are deleted, in addition to my production instance, does that mean that I have to remove their data from my backups? If so, I’m uncertain of the best way to do this. I’m uncertain if many managed services will allow me to mutate backups. And even if I were managing my database and backups directly, it seems painful to load each backed up database, remove the data, and rewrite the backup. Note: I’m not saying that any of this is impossible. However, it does require a lot of ancillary engineering work difficult for a small company that’s just trying to get to product market fit.
- hvidgaard 7y ago
  For GDPR it's sufficient to inform about the backups and when they are expected to be deleted. If you restore them you must have procedures in place to delete the requested data. I don't think this is any different.
- alxlaz 7y ago
  Not sure about the legal framework in the US but over here across the pond, it's enough if you remove the data when restoring the backups (reasonably easy to do; took me about a day to implement that on an old codebase that I wrote more than ten years ago, and I haven't touched either PHP or that codebase since then...). IANAL but the guy who told us how it's done was, and in addition to all the legal stuff, of which I have absolutely no recollection because I don't really understand it, he pointed us to this as a useful resource for people who are also not lawyers: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/#ib5 https://ico.org.uk/for-organisations/guide-to-data-protectio... . Turns out it's acceptable for data to remain backed up for a while (as long as you inform your users), as long as you have systems in place that guarantees it's not used anymore. Just sayin, it's not rocket science. Reading Internet forums you'd think the GDPR was like Apocalypse Lite, but in my experience, it took very little effort to implement it for companies that weren't engaging in shady practices.
alxlaz 7y ago
> It makes it extremely difficult to legally be a tech firm unless you're already a tech giant Why? There are plenty of tech companies that collect very little data, and don't sell any of it. I fondly remember one of my customers telling me how much effort it took to come up with a wordy enough privacy policy page for one of their products so that it wouldn't look suspicious. The first draft was barely two paragraphs long and contained just a couple of items, most of them ephemeral (e.g. IP addresses, which were collected only for logging purposes and were only stored for 30 days). If a company is unable to even articulate what data it collects and cannot do basic operations on it (e.g. remove a piece of it), then it shouldn't be in the business of handling personal information. The same way a clinic that can't even keep track of blood samples shouldn't be in business. And if a company's earnings depend strictly on being able to collect and sell personal data, what they need is a better business plan, not having everyone turn a blind eye.
Despegar 7y ago
>just like the FDAs procedures make it impossible to invent a new drug unless you're already an established, giant pharma company. This is complete nonsense. The biotech industry is very large and vibrant and are most certainly not Big Pharma.

by tylerl 7y ago

drusepth 7y ago

This law's implementation is bad for the same reason GDPR's implementation is bad: the people it's meant to target are easily capable of complying (and likely already do) and it's good for "the people" on paper, but disproportionately affects (hurts) small businesses that don't have the means to comply (or even know if they're properly complying to the extent of avoiding a lawsuit).

Renaud 7y ago
Most of these requirements are perfectly reasonable and i don’t see any that are technologically difficult to implement unless you underlying business model relies on selling user data without regards, in which case, good riddance.
- drusepth 7y ago
  I feel like the "GDPR doesn't affect you unless you sell data" line is the new version of "surveillance doesn't affect you unless you've got something to hide". Every time GDPR is mentioned in a HN thread you see dozens+ of comments asking for clarifications on how to "get around" GDPR issues for legitimate uses. The point is you don't have to be a bad guy to be affected by GDPR and need to spend time+money on not only complying (auditing and implementing systems), but also verifying you're actually compliant with an expert, and the smaller you are the more relative time you have to spend on this work yourself (instead of e.g. hiring lawyers+developers to just do it for you).
digitalengineer 7y ago
The GDPR requirements are not that hard to follow. Yes, it takes time to audit your tech stack and website, but small companies can certainly get it to work without paying thousands of dollars. Tools like this one (It was just $49 bucks) help you get started. https://appsumo.com/gdpr-tracker/ https://appsumo.com/gdpr-tracker/

hackerbabz 7y ago

If a company (small or giant) can't afford to protect my data and preserve my rights to it, then I don't want that company to exist. Just like I don't want startups making unsafe medicine, or losing my medical secrets.

raxxorrax 7y ago

I doubt this to be true honestly, because having user data worth selling already implies you to have a certain size. The request are reasonable and the dismissal with reference to difficulties startups might face is probably not applicable. But if that is really a problem, just apply the requirements to companies with a minimum amount of users. Venture capital funded companies don't need to cut corners and shouldn't be allowed to when it comes to privacy.

bmistree 7y ago

I just wanted to piggy-back onto the parent’s comment with a concrete example. I’ve always been told that it’s good practice to take periodic backups. In the absolute worst cases, you can simply restore directly from these. If a customer requests that their data are deleted, in addition to my production instance, does that mean that I have to remove their data from my backups? If so, I’m uncertain of the best way to do this. I’m uncertain if many managed services will allow me to mutate backups. And even if I were managing my database and backups directly, it seems painful to load each backed up database, remove the data, and rewrite the backup. Note: I’m not saying that any of this is impossible. However, it does require a lot of ancillary engineering work difficult for a small company that’s just trying to get to product market fit.

hvidgaard 7y ago
For GDPR it's sufficient to inform about the backups and when they are expected to be deleted. If you restore them you must have procedures in place to delete the requested data. I don't think this is any different.
alxlaz 7y ago
Not sure about the legal framework in the US but over here across the pond, it's enough if you remove the data when restoring the backups (reasonably easy to do; took me about a day to implement that on an old codebase that I wrote more than ten years ago, and I haven't touched either PHP or that codebase since then...). IANAL but the guy who told us how it's done was, and in addition to all the legal stuff, of which I have absolutely no recollection because I don't really understand it, he pointed us to this as a useful resource for people who are also not lawyers: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/#ib5 https://ico.org.uk/for-organisations/guide-to-data-protectio... . Turns out it's acceptable for data to remain backed up for a while (as long as you inform your users), as long as you have systems in place that guarantees it's not used anymore. Just sayin, it's not rocket science. Reading Internet forums you'd think the GDPR was like Apocalypse Lite, but in my experience, it took very little effort to implement it for companies that weren't engaging in shady practices.

alxlaz 7y ago

> It makes it extremely difficult to legally be a tech firm unless you're already a tech giant Why? There are plenty of tech companies that collect very little data, and don't sell any of it. I fondly remember one of my customers telling me how much effort it took to come up with a wordy enough privacy policy page for one of their products so that it wouldn't look suspicious. The first draft was barely two paragraphs long and contained just a couple of items, most of them ephemeral (e.g. IP addresses, which were collected only for logging purposes and were only stored for 30 days). If a company is unable to even articulate what data it collects and cannot do basic operations on it (e.g. remove a piece of it), then it shouldn't be in the business of handling personal information. The same way a clinic that can't even keep track of blood samples shouldn't be in business. And if a company's earnings depend strictly on being able to collect and sell personal data, what they need is a better business plan, not having everyone turn a blind eye.

Despegar 7y ago

>just like the FDAs procedures make it impossible to invent a new drug unless you're already an established, giant pharma company. This is complete nonsense. The biotech industry is very large and vibrant and are most certainly not Big Pharma.