3 ms·

I don’t know whether you’re naive or flippant, but the reality of transacting on the Internet requires companies to handle their customers’ personal information

I don’t know whether you’re naive or flippant, but the reality of transacting on the Internet requires companies to handle their customers’ personal information. “Explicit consent” (and the intricacies of how it can later be revoked) is only part of the voluminous surface area of the regulations. GDPR certainly will have a chilling effect on tech startups. The jury is out on whether it’s a net benefit to society.

flohofwoe 7y ago
I do hope the GDPR has an extremely chilling effect on tech startups that are built around the idea of sucking up as much personal information as possible in order to monetize that data. E.g. "chilling" as in: either go bust or don't get funding in the first place. That's the entire point of GDPR. If you just have a user login, that's quite trivial to implement in a GDPR conforming way.
- hackeraccount 7y ago
  How about if you don't save state it's easy to implement the GDPR. My blog is covered but beyond that ...
- drusepth 7y ago
  There's a HUGE middle ground between "just having a login" and "sucking up as much personal information as possible in order to monetize that data". Unfortunately, that's where most of the chilling effect will be.
- thu2111 7y ago
  As far as I can tell, everyone who supports GDPR knows nothing about it. GDPR is vastly more complex than "if you just have a user login it's easy". To pick just one non-login related problem that has cropped up for me in the past month, a job candidate got upset after a rejection and asked us to "erase him from our database" - probably meaning our recruitment mailing lists. But the recruiters decided this was a GDPR "right to be forgotten" request and proceeded to erase all mention of him from our applicant tracking database. I was then quite confused when he approached me and said he'd been interviewed, because as far as I could tell we'd never talked to him about it. Of course, the whole idea that job candidates can simply make a company "forget" that they interviewed them is absurd to start with but it's the sort of thing that happens due to GDPR. And then there's the perenially enjoyable question of whether backups are now illegal, or to what extent they're illegal. Oh, and please don't give me any lectures about how GDPR doesn't require this. GDPR is such a badly written piece of law that it's impossible to say what it does or doesn't require. Anyone who thinks they know just doesn't understand how the regulation works.
chrismeller 7y ago
Already has, in fact. I was considering taking a personal project I’d been working on public and offering it to others. Whether paid or free, I fall under the requirements of GDPR. I spent quite literally hours reading through everything I could find about what exactly a company of my size (1) needed to do. Even after I wrote the code to handle DSARs for me, I decided it just wasn’t worth it. In order to be comfortable I would need to hire a lawyer to review things (and continue to pay him to keep on top of changes as things make it through court cases), put together things like an official TOS, worry about whether I could include any analytics services in my product to see if customers were getting frustrated with a particular page... all to launch a free service with no clear path to recurring revenue. And that was on top of the existing worries of having customer data that I want to make sure is secure. Europe (and increasingly the US) sees corporations as all being huge tax avoiding monoliths of evil. Well, legislation like this will eventually prove them right because only the Googles of the world will still be able to afford compliance.

flohofwoe 7y ago

I do hope the GDPR has an extremely chilling effect on tech startups that are built around the idea of sucking up as much personal information as possible in order to monetize that data. E.g. "chilling" as in: either go bust or don't get funding in the first place. That's the entire point of GDPR. If you just have a user login, that's quite trivial to implement in a GDPR conforming way.

hackeraccount 7y ago
How about if you don't save state it's easy to implement the GDPR. My blog is covered but beyond that ...
drusepth 7y ago
There's a HUGE middle ground between "just having a login" and "sucking up as much personal information as possible in order to monetize that data". Unfortunately, that's where most of the chilling effect will be.
thu2111 7y ago
As far as I can tell, everyone who supports GDPR knows nothing about it. GDPR is vastly more complex than "if you just have a user login it's easy". To pick just one non-login related problem that has cropped up for me in the past month, a job candidate got upset after a rejection and asked us to "erase him from our database" - probably meaning our recruitment mailing lists. But the recruiters decided this was a GDPR "right to be forgotten" request and proceeded to erase all mention of him from our applicant tracking database. I was then quite confused when he approached me and said he'd been interviewed, because as far as I could tell we'd never talked to him about it. Of course, the whole idea that job candidates can simply make a company "forget" that they interviewed them is absurd to start with but it's the sort of thing that happens due to GDPR. And then there's the perenially enjoyable question of whether backups are now illegal, or to what extent they're illegal. Oh, and please don't give me any lectures about how GDPR doesn't require this. GDPR is such a badly written piece of law that it's impossible to say what it does or doesn't require. Anyone who thinks they know just doesn't understand how the regulation works.

chrismeller 7y ago

Already has, in fact. I was considering taking a personal project I’d been working on public and offering it to others. Whether paid or free, I fall under the requirements of GDPR. I spent quite literally hours reading through everything I could find about what exactly a company of my size (1) needed to do. Even after I wrote the code to handle DSARs for me, I decided it just wasn’t worth it. In order to be comfortable I would need to hire a lawyer to review things (and continue to pay him to keep on top of changes as things make it through court cases), put together things like an official TOS, worry about whether I could include any analytics services in my product to see if customers were getting frustrated with a particular page... all to launch a free service with no clear path to recurring revenue. And that was on top of the existing worries of having customer data that I want to make sure is secure. Europe (and increasingly the US) sees corporations as all being huge tax avoiding monoliths of evil. Well, legislation like this will eventually prove them right because only the Googles of the world will still be able to afford compliance.