5 ms·

I wish GDPR had some exemption for small companies or companies that are starting out. Maybe limitations on revenue, amount of users and scope of data, eg stric

I wish GDPR had some exemption for small companies or companies that are starting out. Maybe limitations on revenue, amount of users and scope of data, eg strict rules still apply (to a small company) when dealing with sensitive data such as health information, but email addresses are not as strictly governed. Perhaps require a plan of action to abide by the full rules by X future date even. Take for example some one person indie developer. A common way to monetize that is through ads and in app purchases that turn ads off. With the current rules it's difficult for a single person to know that they abide by all of that while still monetizing in such a way.

cnorthwood 7y ago
The problem is really that the indie developer doesn't really have any monetisation options other than those which break the law, but in theory it's not overly onerous to pick one that at least claims to be GDPR compliant. They should be able to trust that their suppliers aren't providing them illegal products tbh.
- criddell 7y ago
  You're forgetting the most legitimate monetization option: If you make something great, people will pay for it.
  - mrweasel 7y ago
    That seem like a lot work, go for VC funding and sell to Google, Facebook, Microsoft or Apple in two years.
  - Mirioron 7y ago
    That's not how it works at all though. The games on the app store that make a lot of money are those that mercilessly try to rip people off. Gacha games are essentially gambling, whereas proper games with a story and gameplay earn very little.
    - criddell 7y ago
      So if you are talking about games I assume you are talking about something like the Steam store? When I look at their top selling list, there are lots of pretty deep games listed.
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
ginko 7y ago
To me that sounds a bit like adding health and safety code exceptions for roadside food stalls.
- AnthonyMouse 7y ago
  It's more like not subjecting employees who bake cookies and share them with coworkers to the same inspection requirements as commercial kitchens whose entire business is selling food to the public. Even moreso because one person distributing bad food can give a dozen others food poisoning, but the concerns with data collection come from mass surveillance and aggregation, which implies a scale that large entities have and smaller ones don't.
  - inetknght 7y ago
    > not subjecting employees who bake cookies and share them with coworkers to the same inspection requirements as commercial kitchens whose entire business is selling food to the public. A coworker baking cookies and sharing them with coworkers isn't trying to make money off of those cookies. A startup is. The coworkers consuming those cookies are generally able to identify that the cookies were homemade, bakeshop, or industrial quality. Today we can barely even identify what is tracking us, let alone how, and definitely not why. You're not comparing apples to oranges. You're comparing apples to bushes. Homemade cookies and startup personal information aggregators aren't even in the same league of category.
    - Macha 7y ago
      Also it feels like a slippery slope. Let's say the cut off is $25m in revenue. So you have some business ideas based on violating user privacy that are profitable, until the company reaches the size where it has to comply, and all of a sudden its unprofitable. Clearly the next step is to lobby for raised limits, rather than companies planning in advance for what they'll do when they cross the threshold.
      - Mirioron 7y ago
lmkg 7y ago
As point of comparison: CCPA only applies to companies if they have either $25 million in revenue or data on 50,000 users (or derive half their revenue from sale of personal information, regardless of size). And to your point about sensitive data, neither CCPA nor GDPR prevent more specialized laws like HIPAA or GLBA.
belinder 7y ago
That would be way too easy to take advantage of by a big company making lots of small side companies
- ThomPete 7y ago
  How would that work out in practice? Sounds highly unlikely.
  - MiroF 7y ago
    Have you heard of contracting practices in the US? Rather than "highly unlikely", this is the norm for tech companies that want to skirt corporate responsibility.
    - AnthonyMouse 7y ago
      That's an unrelated issue. In this context that could be avoided simply by counting more than half time individual contractors as employees when measuring entity size.
  - IshKebab 7y ago
    Splitting large companies into smaller ones to get tax breaks and other incentives is extremely common. For example in the UK there are tax breaks for companies that spend more than a certain percentage of the revenue on research. Just below the threshold? Simple! Split out a research arm!
    - AnthonyMouse 7y ago
      This is common because splitting a large company into five or six smaller ones is feasible, since the overhead of doing so is much smaller than even the smaller entity size. Setting the threshold such that a company the size of Google would have to split their operations into thousands of individual corporations would be a lot less feasible. You could also avoid the issue by limiting the exemption to corporations not owned in any part by a corporation that wouldn't itself qualify for the exemption, since the point of the exemption is to help real small entities and not subsidiaries of huge publicly traded corporations.
Quarrelsome 7y ago
> A common way to monetize that is through ads and in app purchases that turn ads off. The point of GDPR is to stop this crap where advertisers demand way too much information. As long as you don't collect uniquely identifying information and personal data about the user then you don't fall under GDPR. Serve whatever ads you want, they just won't be tailored and that's fine (it might reduce your ad rates so its no-longer a viable business proposition but that's the point). Most people that cry foul about GDPR are the ones collecting uniquely identifiable information about their users. Just stop doing that, that's what the law is designed to prevent.
- guitarbill 7y ago
  Quite frankly, I'm sick of all the FUD or what-ifs, but it reliably happens in every GDPR thread, so thank you for jumping in and refuting this. There doesn't seem to be actual evidence that people with non-scummy business practices have been fined, or would be - like the hypothetical indie dev. I suspect the hardest part is actually finding an ad network that is GDPR compliant, and coming to terms with that you can't just embed every shitty tracking and "analytics" framework into your app. As a consumer, this still all seems like a win to me.
  - Mirioron 7y ago
    Of course the indie dev wouldn't be fined. These regulations are meant to be used selectively. Essentially, you're encouraged to break the law because everyone else on your level is doing the same. Then you just hope you're not the one that's made an example of. >As a consumer, this still all seems like a win to me. Of course, because you won't notice that Europeans can't compete. You'll just use the Chinese/American apps instead, because those can afford to compete.
- labawi 7y ago
  Note that almost anything can form uniquely identifying information, so technically, it's not easy to fully exempt yourself from GDPR. Not that anyone would care about minor unwitting infractions. So far, enforcement is way on the other side of spectrum, it's hard to get yourself in trouble even when blatantly and purposefully breaking GDPR.
gizmo 7y ago
GDPR compliance for indie developers is a little painful, but completely doable. The core principles are that you collect as little personal data as possible, have an expiration policy for all data, and don't share personal data with 3rd parties that don't themselves abide by GDPR. If you do these three things you should be OK, assuming you don't collect the most sensitive data. GDPR isn't meant to bully people who make a good-faith effort to deal with customer data responsibly, and GDPR isn't enforced to destroy those who don't comply perfectly. In the US prosecutors will mercilessly enforce the letter of the law for a few unlucky nobodies to set an example for the rest. In the EU it doesn't work like this.
- Mirioron 7y ago
  >In the EU it doesn't work like this. Yep, it's much more selective in the EU. As long as you are in the good graces of those in power everything will be fine. If you aren't...
  - ahartmetz 7y ago
    The level of corruption is fairly low around here, thankyouverymuch.
- tzs 7y ago
  For indie developers not in the EU but with users in the EU, what's a good way to deal with Article 27's requirements [1]? [1] https://gdpr-info.eu/art-27-gdpr/ https://gdpr-info.eu/art-27-gdpr/
  - latk 7y ago
    1. Many indie developers will not actually be subject to the GDPR. The GDPR effectively only applies to non-EU controllers if they are actively targeting and expecting EU users, or if they are monitoring/tracking users in the EU. The canonical reference to when that's the case is the EDPB Guideline 3/2018 on the territorial scope of the GDPR [1]. These guidelines are more narrow than widely perceived, e.g. that regional US news websites started blocking EU visitors is totally silly and unnecessary. Mere accessibility of a service, without offering the service to persons in the EU, does not trigger the GDPR. 2. If the developer does expect to be subject to the GDPR, they can hire a representative. There are many lawyers offering this service. It's not a terribly involved job, but it affects which member state's data protection agency is responsible. E.g. if you think Austrian GDPR interpretations are nuts, go look for someone in Ireland instead. [1]: https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32018-territorial-scope-gdpr-article-3-version_en https://edpb.europa.eu/our-work-tools/our-documents/guidelin...
oneplane 7y ago
Unless you implement data collection in your indie code (as an indie developer) you have no 'extra' work or burden. The GDPR scales with the size of the data collection, meaning: it doesn't matter how large the staff/company is, it matters if you collect data, and as an indie developer you'd be in an excellent position to quickly scope out anything you don't need. If anything, it's easier to not build collection than build it if you don't need it.
- Mirioron 7y ago
  You might need minimal data yourself, but the tools you use (eg Unity) or the way you monetize (AdSense) do data collection.
  - JackRabbitSlim 7y ago
    That's a failure of the tools, not the regulations.
  - zentiggr 7y ago
    And again, time to swap out third parties that don't/can't/won't comply... and maybe have to roll your own a little bit if you can't find any compliant tools. (Throwing Unity in there is a pretty pointless strawman, unless you know that there is something in there that DOES collect user data.)
mrweasel 7y ago
If you operate a small company, why not be GDPR complaint to begin with? It seems easier to start out complaint, rather than trying to "fix" the issue once you reach a certain size. The upfront cost seems much lower than retrofitting GDPR into your systems.
- kuzimoto 7y ago
  Unless I'm a lawyer, I wouldn't trust myself to ensure I'm compliant with all laws. Would probably have to hire lawyers/do an audit which if you're just starting out might not have much money for. Money that could be better spent improving your product so you can provide a service and also make money. Doesn't mean you can't try your best to be compliant, I still think no matter what you wont know for sure until you hire a third party.
- Mirioron 7y ago
  How is the upfront cost lower? If you know software development you could make a simple game quickly. You can add ads to it and release it, except that now you need to essentially be a lawyer to know that the ad network usage you have does not violate GDPR in some way.
iamaelephant 7y ago
If you can't handle data reasonably then you can't handle data. I don't see why the company size is relevant.
- ahartmetz 7y ago
  It seems like many small companies are also not run by people who have read in some business magazine or have been told by some consultants that they need to be doing big data. Unless they do advertising, they likely don't need the data in the first place and so the path of least resistance is to do the right thing. No data, no problems.
  - Mirioron 7y ago
    And if you don't do advertising how do you monetize? Do you follow all the other apps that implement gambling as their monetization strategy?
    - ahartmetz 7y ago
      You do it while complying with GDPR, of course.
    - inetknght 7y ago
      > if you don't do advertising how do you monetize? Try making sales instead of providing a "free" product?
      - K0SM0S 7y ago
        You might need data to increase your sales, though. But that parts needs not be unethical, nor leave your company.
      - Mirioron 7y ago
        Have you looked at how apps on the app stores are monetized? The only ones with a lot of success that charge upfront are big existing names or rare exceptions. Everything else that has success tends to be free. You can't compete with that, because somebody will just clone your app and release a free version of it with ads.
kaffeemitsahne 7y ago
The point of GDPR is to protect users' privacy. Clearly it is not in line with the goals of GDPR to allow small companies invade privacy anyway, just because they're small. Privacy is privacy.
jacquesm 7y ago
It does have an exemption that works for everybody: don't track your users, and don't keep data you don't need. Problem solved.

cnorthwood 7y ago

The problem is really that the indie developer doesn't really have any monetisation options other than those which break the law, but in theory it's not overly onerous to pick one that at least claims to be GDPR compliant. They should be able to trust that their suppliers aren't providing them illegal products tbh.

criddell 7y ago
You're forgetting the most legitimate monetization option: If you make something great, people will pay for it.
- mrweasel 7y ago
  That seem like a lot work, go for VC funding and sell to Google, Facebook, Microsoft or Apple in two years.
- Mirioron 7y ago
  That's not how it works at all though. The games on the app store that make a lot of money are those that mercilessly try to rip people off. Gacha games are essentially gambling, whereas proper games with a story and gameplay earn very little.
  - criddell 7y ago
    So if you are talking about games I assume you are talking about something like the Steam store? When I look at their top selling list, there are lots of pretty deep games listed.
deleted 7y ago
[deleted]
deleted 7y ago
[deleted]

ginko 7y ago

To me that sounds a bit like adding health and safety code exceptions for roadside food stalls.

AnthonyMouse 7y ago
It's more like not subjecting employees who bake cookies and share them with coworkers to the same inspection requirements as commercial kitchens whose entire business is selling food to the public. Even moreso because one person distributing bad food can give a dozen others food poisoning, but the concerns with data collection come from mass surveillance and aggregation, which implies a scale that large entities have and smaller ones don't.
- inetknght 7y ago
  > not subjecting employees who bake cookies and share them with coworkers to the same inspection requirements as commercial kitchens whose entire business is selling food to the public. A coworker baking cookies and sharing them with coworkers isn't trying to make money off of those cookies. A startup is. The coworkers consuming those cookies are generally able to identify that the cookies were homemade, bakeshop, or industrial quality. Today we can barely even identify what is tracking us, let alone how, and definitely not why. You're not comparing apples to oranges. You're comparing apples to bushes. Homemade cookies and startup personal information aggregators aren't even in the same league of category.
  - Macha 7y ago
    Also it feels like a slippery slope. Let's say the cut off is $25m in revenue. So you have some business ideas based on violating user privacy that are profitable, until the company reaches the size where it has to comply, and all of a sudden its unprofitable. Clearly the next step is to lobby for raised limits, rather than companies planning in advance for what they'll do when they cross the threshold.
    - Mirioron 7y ago

lmkg 7y ago

As point of comparison: CCPA only applies to companies if they have either $25 million in revenue or data on 50,000 users (or derive half their revenue from sale of personal information, regardless of size). And to your point about sensitive data, neither CCPA nor GDPR prevent more specialized laws like HIPAA or GLBA.

belinder 7y ago

That would be way too easy to take advantage of by a big company making lots of small side companies

ThomPete 7y ago
How would that work out in practice? Sounds highly unlikely.
- MiroF 7y ago
  Have you heard of contracting practices in the US? Rather than "highly unlikely", this is the norm for tech companies that want to skirt corporate responsibility.
  - AnthonyMouse 7y ago
    That's an unrelated issue. In this context that could be avoided simply by counting more than half time individual contractors as employees when measuring entity size.
- IshKebab 7y ago
  Splitting large companies into smaller ones to get tax breaks and other incentives is extremely common. For example in the UK there are tax breaks for companies that spend more than a certain percentage of the revenue on research. Just below the threshold? Simple! Split out a research arm!
  - AnthonyMouse 7y ago
    This is common because splitting a large company into five or six smaller ones is feasible, since the overhead of doing so is much smaller than even the smaller entity size. Setting the threshold such that a company the size of Google would have to split their operations into thousands of individual corporations would be a lot less feasible. You could also avoid the issue by limiting the exemption to corporations not owned in any part by a corporation that wouldn't itself qualify for the exemption, since the point of the exemption is to help real small entities and not subsidiaries of huge publicly traded corporations.

Quarrelsome 7y ago

> A common way to monetize that is through ads and in app purchases that turn ads off. The point of GDPR is to stop this crap where advertisers demand way too much information. As long as you don't collect uniquely identifying information and personal data about the user then you don't fall under GDPR. Serve whatever ads you want, they just won't be tailored and that's fine (it might reduce your ad rates so its no-longer a viable business proposition but that's the point). Most people that cry foul about GDPR are the ones collecting uniquely identifiable information about their users. Just stop doing that, that's what the law is designed to prevent.

guitarbill 7y ago
Quite frankly, I'm sick of all the FUD or what-ifs, but it reliably happens in every GDPR thread, so thank you for jumping in and refuting this. There doesn't seem to be actual evidence that people with non-scummy business practices have been fined, or would be - like the hypothetical indie dev. I suspect the hardest part is actually finding an ad network that is GDPR compliant, and coming to terms with that you can't just embed every shitty tracking and "analytics" framework into your app. As a consumer, this still all seems like a win to me.
- Mirioron 7y ago
  Of course the indie dev wouldn't be fined. These regulations are meant to be used selectively. Essentially, you're encouraged to break the law because everyone else on your level is doing the same. Then you just hope you're not the one that's made an example of. >As a consumer, this still all seems like a win to me. Of course, because you won't notice that Europeans can't compete. You'll just use the Chinese/American apps instead, because those can afford to compete.
labawi 7y ago
Note that almost anything can form uniquely identifying information, so technically, it's not easy to fully exempt yourself from GDPR. Not that anyone would care about minor unwitting infractions. So far, enforcement is way on the other side of spectrum, it's hard to get yourself in trouble even when blatantly and purposefully breaking GDPR.

gizmo 7y ago

GDPR compliance for indie developers is a little painful, but completely doable. The core principles are that you collect as little personal data as possible, have an expiration policy for all data, and don't share personal data with 3rd parties that don't themselves abide by GDPR. If you do these three things you should be OK, assuming you don't collect the most sensitive data. GDPR isn't meant to bully people who make a good-faith effort to deal with customer data responsibly, and GDPR isn't enforced to destroy those who don't comply perfectly. In the US prosecutors will mercilessly enforce the letter of the law for a few unlucky nobodies to set an example for the rest. In the EU it doesn't work like this.

Mirioron 7y ago
>In the EU it doesn't work like this. Yep, it's much more selective in the EU. As long as you are in the good graces of those in power everything will be fine. If you aren't...
- ahartmetz 7y ago
  The level of corruption is fairly low around here, thankyouverymuch.
tzs 7y ago
For indie developers not in the EU but with users in the EU, what's a good way to deal with Article 27's requirements [1]? [1] https://gdpr-info.eu/art-27-gdpr/ https://gdpr-info.eu/art-27-gdpr/
- latk 7y ago
  1. Many indie developers will not actually be subject to the GDPR. The GDPR effectively only applies to non-EU controllers if they are actively targeting and expecting EU users, or if they are monitoring/tracking users in the EU. The canonical reference to when that's the case is the EDPB Guideline 3/2018 on the territorial scope of the GDPR [1]. These guidelines are more narrow than widely perceived, e.g. that regional US news websites started blocking EU visitors is totally silly and unnecessary. Mere accessibility of a service, without offering the service to persons in the EU, does not trigger the GDPR. 2. If the developer does expect to be subject to the GDPR, they can hire a representative. There are many lawyers offering this service. It's not a terribly involved job, but it affects which member state's data protection agency is responsible. E.g. if you think Austrian GDPR interpretations are nuts, go look for someone in Ireland instead. [1]: https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32018-territorial-scope-gdpr-article-3-version_en https://edpb.europa.eu/our-work-tools/our-documents/guidelin...

oneplane 7y ago

Unless you implement data collection in your indie code (as an indie developer) you have no 'extra' work or burden. The GDPR scales with the size of the data collection, meaning: it doesn't matter how large the staff/company is, it matters if you collect data, and as an indie developer you'd be in an excellent position to quickly scope out anything you don't need. If anything, it's easier to not build collection than build it if you don't need it.

Mirioron 7y ago
You might need minimal data yourself, but the tools you use (eg Unity) or the way you monetize (AdSense) do data collection.
- JackRabbitSlim 7y ago
  That's a failure of the tools, not the regulations.
- zentiggr 7y ago
  And again, time to swap out third parties that don't/can't/won't comply... and maybe have to roll your own a little bit if you can't find any compliant tools. (Throwing Unity in there is a pretty pointless strawman, unless you know that there is something in there that DOES collect user data.)

mrweasel 7y ago

If you operate a small company, why not be GDPR complaint to begin with? It seems easier to start out complaint, rather than trying to "fix" the issue once you reach a certain size. The upfront cost seems much lower than retrofitting GDPR into your systems.

kuzimoto 7y ago
Unless I'm a lawyer, I wouldn't trust myself to ensure I'm compliant with all laws. Would probably have to hire lawyers/do an audit which if you're just starting out might not have much money for. Money that could be better spent improving your product so you can provide a service and also make money. Doesn't mean you can't try your best to be compliant, I still think no matter what you wont know for sure until you hire a third party.
Mirioron 7y ago
How is the upfront cost lower? If you know software development you could make a simple game quickly. You can add ads to it and release it, except that now you need to essentially be a lawyer to know that the ad network usage you have does not violate GDPR in some way.

iamaelephant 7y ago

If you can't handle data reasonably then you can't handle data. I don't see why the company size is relevant.

ahartmetz 7y ago
It seems like many small companies are also not run by people who have read in some business magazine or have been told by some consultants that they need to be doing big data. Unless they do advertising, they likely don't need the data in the first place and so the path of least resistance is to do the right thing. No data, no problems.
- Mirioron 7y ago
  And if you don't do advertising how do you monetize? Do you follow all the other apps that implement gambling as their monetization strategy?
  - ahartmetz 7y ago
    You do it while complying with GDPR, of course.
  - inetknght 7y ago
    > if you don't do advertising how do you monetize? Try making sales instead of providing a "free" product?
    - K0SM0S 7y ago
      You might need data to increase your sales, though. But that parts needs not be unethical, nor leave your company.
    - Mirioron 7y ago
      Have you looked at how apps on the app stores are monetized? The only ones with a lot of success that charge upfront are big existing names or rare exceptions. Everything else that has success tends to be free. You can't compete with that, because somebody will just clone your app and release a free version of it with ads.

kaffeemitsahne 7y ago

The point of GDPR is to protect users' privacy. Clearly it is not in line with the goals of GDPR to allow small companies invade privacy anyway, just because they're small. Privacy is privacy.

jacquesm 7y ago

It does have an exemption that works for everybody: don't track your users, and don't keep data you don't need. Problem solved.