11 ms·

Being honest, some of the most egregious handling of PII is by small companies who don't have the resources to understand that it is PII, or how to store it, or

Being honest, some of the most egregious handling of PII is by small companies who don't have the resources to understand that it is PII, or how to store it, or how to be in compliance. I don't think it's failing in that case. A small company wouldn't google how to build a bridge then DIY it, but that's what's happening with storing PII. If I had a dollar for every article I read where a doctor's office had records on an un-restricted FTP server...

McDev 7y ago
I work at a lot of startups as a contractor. The disregard for privacy and user data everywhere I go is astounding. They're all in survival mode.
- DaiPlusPlus 7y ago
  My experience with startups lately is if it’s a greenfield project that started within the past 3 years then they’ll do everything by the book: sometimes even down to storing email addresses as hashes in the database, requiring a user to login first for the software system - and the company - to know their email address). Older systems which depend on having PII and even financial information as cleartext in the database are the problem - and its essentially technical debt with far-reaching consequences, so no-one will fix a system that uses tenants’ customers’ SSNs as a primary-key (yup).
  - baroffoos 7y ago
    I am aware of a legacy system powering a local business which runs on Rails 1 on a version of debian from 2012 and stores users passwords in plaintext, downcased. I have tried to explain so many times that this system needs to be replaced urgently not for security reasons but because no one actually knows how to use rails 1 anymore.
    - dwoozle 7y ago
      I have a Rails 1 product making $10K a year but I don’t have even the ability to log into the box anymore so if even the tiniest thing falls over that revenue is permanently gone for me.
      - mjfisher 7y ago
        I'm curious about the economics of this - is it big enough to not be worth redeveloping when you consider over the income over say, 3-5 years?
        dwoozle 7y ago
        I’m too busy with my kids and my job to deal with it.
- baroffoos 7y ago
  Its funny how we let this all slide when it comes to tech. Imagine if someone said "Food safety regulations only hurt the small businesses, they don't have the resources to wash a cutting board after cutting chicken while McDonalds serves unhealthy but legally safe food"
  - Mirioron 7y ago
    But that's exactly what happens in the world though. In some poorer countries like China, street vendors are literally using gutter oil to make food. If you want rules to be respected then you must be able to enforce them. Poorer places just can't afford to enforce those rules. If rules aren't enforced equally then people won't follow them, because if they have additional costs that their competition doesn't then they'll likely be outcompeted.
    - bjelkeman-again 7y ago
      But I don’t think McDev above was talking about a software startup in the poorest part of the world. I have implemented GDPR in a small non profit open source SaaS business. A funded startup should have no issue doing the same.
      - Mirioron 7y ago
        But I wasn't talking about poorest parts of the world either. China is richer than some EU countries, eg Bulgaria.
    - em-bee 7y ago
      they can and they do enforce it. street vendors are much less common in china than they used to be.
      - Jommi 7y ago
        Yes, in now richer cities. But they still thrive in lower gdp cities.
  - 7y ago
- beher 7y ago
  Do you consider it difficult to survive as a startup while protecting the privacy of users?
Mirioron 7y ago
You're right, but they probably can't afford to do it right. And since enforcement on this is lackluster it makes sense for the companies to just ignore it altogether, because if they get caught then it probably doesn't really matter if they took some steps to help privacy or none at all. I think there should be some exceptions to it for small companies based on the impact of the PII. Eg if the company handles email addresses or first names then that should be far less strict than if a company handles medical information, home addresses or credit card information. On the other side, we should have audits in companies to see how the personal data is handled. Particularly in ones that deal with sensitive information.
- phs318u 7y ago
  > they probably can't afford to do it right Two things occur to me here. 1) it's a cost of doing business. Costs of doing business change over time. Step changes as a result of regulation are typically introduced with windows to allow businesses time to respond. If you can't reasonably cover the cost of the change then...capitalism. You will fail and someone else will succeed. No one is guaranteed a profit. 2) Sounds like a business opportunity? GDPR/Privacy as a Service. e.g. https://privaon.com/ https://privaon.com/ (first search hit). > here should be some exceptions to it for small companies This would effectively become a get out of jail for companies that want to outsource their (lack of) privacy with sufficient arms-length plausible deniability.
  - Mirioron 7y ago
    >1) it's a cost of doing business. Costs of doing business change over time. Step changes as a result of regulation are typically introduced with windows to allow businesses time to respond. If you can't reasonably cover the cost of the change then...capitalism. You will fail and someone else will succeed. No one is guaranteed a profit. Except that foreign companies won't have this same limitation. The end result is that all of your online services will be provided by foreign companies, which ironically is already the case in the EU. A foreign company that's beyond the jurisdiction of the EU can abuse GDPR as much as they want. If they get caught then they'll just lose their business. The EU can't actually fine them, but that same company likely outcompeted EU companies for years. >This would effectively become a get out of jail for companies that want to outsource their (lack of) privacy with sufficient arms-length plausible deniability. They can do the same thing with foreign companies though. If you can set up a system where you would use your small companies to escape regulation, then the same can be done with companies run by foreigners. >2) Sounds like a business opportunity? GDPR/Privacy as a Service. e.g. https://privaon.com/ https://privaon.com/ (first search hit). And said business opportunity is additional inefficiency on businesses in the EU that their global competitors don't have to follow.

McDev 7y ago

I work at a lot of startups as a contractor. The disregard for privacy and user data everywhere I go is astounding. They're all in survival mode.

DaiPlusPlus 7y ago
My experience with startups lately is if it’s a greenfield project that started within the past 3 years then they’ll do everything by the book: sometimes even down to storing email addresses as hashes in the database, requiring a user to login first for the software system - and the company - to know their email address). Older systems which depend on having PII and even financial information as cleartext in the database are the problem - and its essentially technical debt with far-reaching consequences, so no-one will fix a system that uses tenants’ customers’ SSNs as a primary-key (yup).
- baroffoos 7y ago
  I am aware of a legacy system powering a local business which runs on Rails 1 on a version of debian from 2012 and stores users passwords in plaintext, downcased. I have tried to explain so many times that this system needs to be replaced urgently not for security reasons but because no one actually knows how to use rails 1 anymore.
  - dwoozle 7y ago
    I have a Rails 1 product making $10K a year but I don’t have even the ability to log into the box anymore so if even the tiniest thing falls over that revenue is permanently gone for me.
    - mjfisher 7y ago
      I'm curious about the economics of this - is it big enough to not be worth redeveloping when you consider over the income over say, 3-5 years?
      - dwoozle 7y ago
        I’m too busy with my kids and my job to deal with it.
baroffoos 7y ago
Its funny how we let this all slide when it comes to tech. Imagine if someone said "Food safety regulations only hurt the small businesses, they don't have the resources to wash a cutting board after cutting chicken while McDonalds serves unhealthy but legally safe food"
- Mirioron 7y ago
  But that's exactly what happens in the world though. In some poorer countries like China, street vendors are literally using gutter oil to make food. If you want rules to be respected then you must be able to enforce them. Poorer places just can't afford to enforce those rules. If rules aren't enforced equally then people won't follow them, because if they have additional costs that their competition doesn't then they'll likely be outcompeted.
  - bjelkeman-again 7y ago
    But I don’t think McDev above was talking about a software startup in the poorest part of the world. I have implemented GDPR in a small non profit open source SaaS business. A funded startup should have no issue doing the same.
    - Mirioron 7y ago
      But I wasn't talking about poorest parts of the world either. China is richer than some EU countries, eg Bulgaria.
  - em-bee 7y ago
    they can and they do enforce it. street vendors are much less common in china than they used to be.
    - Jommi 7y ago
      Yes, in now richer cities. But they still thrive in lower gdp cities.
- 7y ago
beher 7y ago
Do you consider it difficult to survive as a startup while protecting the privacy of users?

Mirioron 7y ago

You're right, but they probably can't afford to do it right. And since enforcement on this is lackluster it makes sense for the companies to just ignore it altogether, because if they get caught then it probably doesn't really matter if they took some steps to help privacy or none at all. I think there should be some exceptions to it for small companies based on the impact of the PII. Eg if the company handles email addresses or first names then that should be far less strict than if a company handles medical information, home addresses or credit card information. On the other side, we should have audits in companies to see how the personal data is handled. Particularly in ones that deal with sensitive information.

phs318u 7y ago
> they probably can't afford to do it right Two things occur to me here. 1) it's a cost of doing business. Costs of doing business change over time. Step changes as a result of regulation are typically introduced with windows to allow businesses time to respond. If you can't reasonably cover the cost of the change then...capitalism. You will fail and someone else will succeed. No one is guaranteed a profit. 2) Sounds like a business opportunity? GDPR/Privacy as a Service. e.g. https://privaon.com/ https://privaon.com/ (first search hit). > here should be some exceptions to it for small companies This would effectively become a get out of jail for companies that want to outsource their (lack of) privacy with sufficient arms-length plausible deniability.
- Mirioron 7y ago
  >1) it's a cost of doing business. Costs of doing business change over time. Step changes as a result of regulation are typically introduced with windows to allow businesses time to respond. If you can't reasonably cover the cost of the change then...capitalism. You will fail and someone else will succeed. No one is guaranteed a profit. Except that foreign companies won't have this same limitation. The end result is that all of your online services will be provided by foreign companies, which ironically is already the case in the EU. A foreign company that's beyond the jurisdiction of the EU can abuse GDPR as much as they want. If they get caught then they'll just lose their business. The EU can't actually fine them, but that same company likely outcompeted EU companies for years. >This would effectively become a get out of jail for companies that want to outsource their (lack of) privacy with sufficient arms-length plausible deniability. They can do the same thing with foreign companies though. If you can set up a system where you would use your small companies to escape regulation, then the same can be done with companies run by foreigners. >2) Sounds like a business opportunity? GDPR/Privacy as a Service. e.g. https://privaon.com/ https://privaon.com/ (first search hit). And said business opportunity is additional inefficiency on businesses in the EU that their global competitors don't have to follow.