4 ms·

The article you're commenting on mentions reasonably large firms being held accountable. What's your basis for the "smallest and weakest" claims?

manigandham 7y ago
Fines for larger companies are either too small to matter or will be negotiated down. Larger companies also have a much easier time gaining consent (like Google and Facebook) that clears their usage while smaller companies struggle. This can be seen by the constant consent popups on every website. Users click yes on the major sites, then deny the rest.
- tsimionescu 7y ago
  > Larger companies also have a much easier time gaining consent (like Google and Facebook) that clears their usage while smaller companies struggle. I feel the opposite may be true. When the law came to pass, I took some time to review my privacy options on Google and Facebook, since they are a big impact for me. On the other hand, when I click on a link on HN to some random news paper, and get presented with a five-step process to start to see my options, I don't usually bother and dismiss it as soon as I can, probably with some 'opt-in' consent. Since I'm not planning on viewing the site again, I consider it a minor annoyance.
  - deleted 7y ago
    [deleted]
barry-cotter 7y ago
The GPDR is a large compliance burden. The bigger your company is the less this hurts you because it’s very approximately a fixed cost. So the GPDR kneecaps small companies while being a painful but bearable expense for large ones. On net it helps the internet giants by reducing competition.
- jacobolus 7y ago
  This is no different than anything else. All sorts of unethical and exploitative arrangements are helpful for small firms’ bottom line, but easier to handle properly with larger scale. Dumping toxic byproducts in the river. Forcing employees to work unpaid overtime. Keeping fraudulent books and evading taxes. Selling illegally dangerous products. Not following local building codes. Facilitating third-party fraud or money laundering... Being a small business should not be license to do whatever you want, irrespective of the harm to customers, business partners, or others in the society. In the case of data protection specifically, companies (perhaps especially small companies) are very cavalier with all sorts of data including personally identifiable information, financial information, communications, ...., and this causes serious harms when that data is misused directly or stolen by/leaked to/sold to someone who misuses it. If a company cannot afford to stay in business while treating data carefully, then perhaps they should not be in business.
  - deleted 7y ago
    [deleted]
  - AnthonyMouse 7y ago
    You're assuming that treating data carefully and complying with the law are the same thing. You can easily do the former and not the latter. More to the point, you can easily have already been treating data carefully and still have the compliance burden of paying lawyers to verify that fact put you out of business. So what you're really saying is, if a company cannot afford to stay in business while navigating a legal framework designed for companies the size of Google, then perhaps they should not be in business. The result of which would be to have only companies the size of Google.
    - jacobolus 7y ago
      The same goes for any other kind of regulatory compliance. No small company has to pay lawyers to validate that they are complying with GDPR. It’s just that if it turns out they weren’t, the fines for violations can be quite steep, so a risk-averse company is going to be proactive about it. There are many types of regulations which are much stricter with more up-front costs than GDPR, which companies of every size manage to cope with (or sometimes don’t, and go out of business). The technology industry has just gotten used to not being held accountable when it harms people, so now that some sensible consumer protection regulation comes down (some) people are freaking out.

manigandham 7y ago

Fines for larger companies are either too small to matter or will be negotiated down. Larger companies also have a much easier time gaining consent (like Google and Facebook) that clears their usage while smaller companies struggle. This can be seen by the constant consent popups on every website. Users click yes on the major sites, then deny the rest.

tsimionescu 7y ago
> Larger companies also have a much easier time gaining consent (like Google and Facebook) that clears their usage while smaller companies struggle. I feel the opposite may be true. When the law came to pass, I took some time to review my privacy options on Google and Facebook, since they are a big impact for me. On the other hand, when I click on a link on HN to some random news paper, and get presented with a five-step process to start to see my options, I don't usually bother and dismiss it as soon as I can, probably with some 'opt-in' consent. Since I'm not planning on viewing the site again, I consider it a minor annoyance.
- deleted 7y ago
  [deleted]

barry-cotter 7y ago

The GPDR is a large compliance burden. The bigger your company is the less this hurts you because it’s very approximately a fixed cost. So the GPDR kneecaps small companies while being a painful but bearable expense for large ones. On net it helps the internet giants by reducing competition.

jacobolus 7y ago
This is no different than anything else. All sorts of unethical and exploitative arrangements are helpful for small firms’ bottom line, but easier to handle properly with larger scale. Dumping toxic byproducts in the river. Forcing employees to work unpaid overtime. Keeping fraudulent books and evading taxes. Selling illegally dangerous products. Not following local building codes. Facilitating third-party fraud or money laundering... Being a small business should not be license to do whatever you want, irrespective of the harm to customers, business partners, or others in the society. In the case of data protection specifically, companies (perhaps especially small companies) are very cavalier with all sorts of data including personally identifiable information, financial information, communications, ...., and this causes serious harms when that data is misused directly or stolen by/leaked to/sold to someone who misuses it. If a company cannot afford to stay in business while treating data carefully, then perhaps they should not be in business.
- deleted 7y ago
  [deleted]
- AnthonyMouse 7y ago
  You're assuming that treating data carefully and complying with the law are the same thing. You can easily do the former and not the latter. More to the point, you can easily have already been treating data carefully and still have the compliance burden of paying lawyers to verify that fact put you out of business. So what you're really saying is, if a company cannot afford to stay in business while navigating a legal framework designed for companies the size of Google, then perhaps they should not be in business. The result of which would be to have only companies the size of Google.
  - jacobolus 7y ago
    The same goes for any other kind of regulatory compliance. No small company has to pay lawyers to validate that they are complying with GDPR. It’s just that if it turns out they weren’t, the fines for violations can be quite steep, so a risk-averse company is going to be proactive about it. There are many types of regulations which are much stricter with more up-front costs than GDPR, which companies of every size manage to cope with (or sometimes don’t, and go out of business). The technology industry has just gotten used to not being held accountable when it harms people, so now that some sensible consumer protection regulation comes down (some) people are freaking out.